Legal

Cookie & Privacy Policy

Protecting your personal data with transparency and care.

Document Version 2.0 · Effective 31 August 2026 · Reviewed 31 August 2026

This policy applies to London School of Applied Excellence (LSAE). If you have any data protection questions, contact us at support@lsae.co.uk.

This Cookie & Privacy Policy applies to the London School of Applied Excellence ('LSAE', 'we', 'our', or 'us'), operating in England and Wales. This policy explains how we collect, use, store, share, and protect your personal data when you visit our website (lsae.co.uk), create an account, enrol on any of our Degree Pathway or Professional Qualification courses, use our Certificate Verification tool, join our Refer & Earn referral programme, or contact us via WhatsApp, whether accessed online or via a mobile application.

We are committed to protecting your privacy and handling your personal data with transparency and care, in full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). We encourage you to read this policy carefully before using our services.

1. Who We Are

Data Controller: London School of Applied Excellence (LSAE), registered in England and Wales (Company No. 17186021, UKPRN 10101145). LSAE is an accredited online learning institution offering Degree Pathway and Professional Qualification courses to learners in the UK and internationally.

For all data protection enquiries, subject access requests, complaints, or general privacy questions, please contact our Data Protection team:

  • Email: support@lsae.co.uk (general enquiries: info@lsae.co.uk)
  • Website: lsae.co.uk
  • Post: Data Protection Officer, London School of Applied Excellence (Company No. 17186021, UKPRN 10101145), England and Wales

We aim to respond to all data protection enquiries within 30 calendar days of receipt. In complex cases, we may extend this period by a further two months, in which case we will notify you of the extension and the reasons for it, as required by UK GDPR Article 12(3).

2. What Personal Data We Collect

We collect and process personal data that you provide to us directly, data generated through your use of our services, and in some cases data obtained from third-party sources. The categories of personal data we may collect and process are set out below.

2.1 Identity Data

Full name, date of birth, username, or similar identifier. Where required for accreditation or regulatory purposes, we may also request proof of identity documentation, such as a copy of a passport or driving licence.

2.2 Contact Data

Email address, telephone number (including mobile and WhatsApp number), and postal address, including both personal and, where applicable, professional contact details.

2.3 Account & Enrolment Data

Login credentials (stored in hashed, encrypted form), course enrolment history, learning progress records, assessment submissions and grades, attendance and engagement records, and any certificates of completion issued by us or our accreditation partners, including the unique verification code checked through our Certificate Verification tool.

2.4 Payment Data

Billing name and address, and payment card or bank transfer details. We display and accept payment in multiple currencies, including GBP, USD, EUR, NGN, and GHS. Please note that we do not store full payment card numbers ourselves. All card payment data is processed securely by our authorised, PCI-DSS compliant payment service providers. We retain only the last four digits of a card number and the billing postcode for your records.

2.5 Technical Data

IP address, browser type and version, operating system, device type and identifiers, time zone setting, approximate location data (country or region level), referral source, session duration, and a record of pages visited on our website.

2.6 Usage & Behavioural Data

Information about how you interact with our website and learning platform, including click behaviour, search queries made through our course search tool (powered by Algolia), time spent on individual lessons or modules, video playback data, and quiz or assessment interactions.

2.7 Communication Data

Records of communications between you and LSAE, including emails, support tickets, WhatsApp messages, live chat transcripts, and any feedback or survey responses you provide. These records are retained to maintain the quality of our support services and to assist in resolving any disputes.

2.8 Marketing Preferences

Your stated preferences regarding receipt of marketing communications from us, including newsletter sign-ups made through our website footer, your preferred channel (email, SMS, WhatsApp, or post), and subject areas of interest. You may update or withdraw these preferences at any time through your account settings or by contacting us.

2.9 Referral Programme Data

If you take part in our Refer & Earn programme, we collect your name and contact details as the referring Member, and the name and contact details of the person you refer, in order to track the referral, verify eligibility, and pay any reward due. We also collect the referred person's confirmation that they consent to being contacted about the course they were referred to.

2.10 Special Category Data

In limited circumstances, and only where strictly necessary, we may process special category data as defined under UK GDPR Article 9, such as information about a disability or health condition that you share with us in order for us to make reasonable adjustments to your learning experience or to assess an exceptional-circumstances refund request. We will always seek your explicit consent before processing any such data and will explain the specific purpose at the point of collection. This data is processed only by authorised personnel who are subject to strict confidentiality obligations.

2.11 Data Collected from Third-Party Sources

In certain circumstances, we may receive personal data about you from third-party sources, such as corporate clients who sponsor your enrolment, Refer & Earn referral partners, our partnerships team's introducers, or publicly available directories. Where this occurs, we will inform you of the source and the data received within a reasonable period of obtaining it, as required by UK GDPR.

3. How We Use Your Personal Data

We use your personal data only for specified, explicit, and legitimate purposes. We do not process your data in a manner that is incompatible with those purposes. The primary purposes for which we process your data are as follows.

3.1 Course Delivery and Account Management

To process your enrolment, create and manage your student account, track your learning progress, administer assessments, issue certificates of completion, and communicate with you about your course. This is the core purpose for which your data is collected and is necessary for the performance of our contract with you.

3.2 Payment Processing and Financial Administration

To process course fees in your chosen currency, manage invoicing, handle refund requests in accordance with Section 6 (Refund Policy) of our Terms and Conditions, and maintain financial and accounting records as required by UK tax law and HMRC regulations.

3.3 Student Support Services

To provide you with academic and technical support, respond to your enquiries and complaints across email, live chat, and WhatsApp, escalate issues where necessary, and ensure you have access to the resources and assistance you need throughout your studies.

3.4 Service Communications

To send you important notices relating to your course, account, or enrolment, such as schedule changes, policy updates, system maintenance notifications, or amendments to our Terms and Conditions. These communications are not marketing and cannot be opted out of while your account is active, as they are necessary for the performance of our contract with you.

3.5 Marketing Communications

Where you have given your consent, or where we have a legitimate interest and you have not objected, to send you our newsletter and information about new courses, promotions, events, and educational content that may be of interest to you. You can withdraw consent or object to this processing at any time by clicking 'unsubscribe' in any marketing email, contacting us at support@lsae.co.uk, or updating your preferences in your account settings.

3.6 Referral Programme Administration

To operate our Refer & Earn programme: to verify that a referral is genuine and eligible, to track a referred person through to enrolment, to calculate and pay any reward due to the referring Member, and to prevent fraudulent or abusive use of the programme.

3.7 Service Improvement and Research

To analyse how students use our platform — including our course search tool — in order to improve course content, website functionality, and the overall student experience. Where possible, this analysis is carried out on aggregated and anonymised data that cannot be used to identify individual students.

3.8 Safety, Security, and Fraud Prevention

To protect the security and integrity of our platform and users, detect and prevent fraudulent or unauthorised activity (including misuse of the Refer & Earn programme), enforce our Terms and Conditions, and investigate suspected breaches of our policies.

3.9 Legal and Regulatory Compliance

To comply with applicable laws and regulations, respond to lawful requests from public authorities (including HMRC, the ICO, or law enforcement), and to defend or prosecute legal claims.

3.10 Accreditation and Qualification Verification

Where your course leads to a qualification recognised or awarded by a third-party accreditation body, we may share relevant personal data with that body for the purposes of registration, verification, and certification, as described in Section 6.2. We also use your enrolment and certification data to power our public Certificate Verification tool, which displays limited, non-sensitive confirmation details to anyone who enters a valid certificate code.

Under UK GDPR, we are required to identify a lawful basis for each processing activity. The legal bases we rely on are described below.

  • Contract (Article 6(1)(b)): Processing that is necessary to deliver your course, manage your account, and fulfil our obligations under our agreement with you.
  • Legal Obligation (Article 6(1)(c)): Processing required to comply with UK tax law, employment law, health and safety legislation, or other legal obligations applicable to us.
  • Legitimate Interests (Article 6(1)(f)): Processing for purposes such as fraud prevention, improving our services, maintaining platform security, administering our Refer & Earn programme, and sending marketing to existing students. We always carry out a balancing test to ensure our interests do not override your rights and freedoms.
  • Consent (Article 6(1)(a)): For non-essential cookies, direct marketing communications to prospective students, WhatsApp messaging where you initiate or opt in to contact, and the processing of any special category data. You have the right to withdraw consent at any time.

Where we process special category data (Section 2.10), we rely on your explicit consent (UK GDPR Article 9(2)(a)) as the additional legal basis. We may also rely on Article 9(2)(b) where processing is necessary for compliance with employment or social protection law.

5. Cookies and Tracking Technologies

Our website (lsae.co.uk) and learning platform use cookies and similar tracking technologies, including pixels and local storage objects, to operate core functions, improve your experience, and help us understand how our services are used.

5.1 What Are Cookies?

Cookies are small text files placed on your device by our website when you visit. They store information about your visit, such as your preferences, session state, or browsing behaviour. Some cookies are set directly by LSAE; others are set by third-party providers whose services we integrate into our platform, such as our course search provider (Algolia) and analytics tools.

5.2 Categories of Cookies We Use

Strictly Necessary Cookies

Essential for the website and learning platform to function correctly. These include session cookies that keep you logged in, cookies that remember items in your enrolment basket, and security cookies that protect against cross-site request forgery. These cookies cannot be disabled through our cookie preferences tool, as the website cannot function without them.

Performance & Analytics Cookies

Help us understand how visitors interact with our website by collecting anonymised information such as pages visited, time on site, search terms entered in our course search, error messages encountered, and traffic sources. We use tools such as Google Analytics for this purpose. These cookies require your consent and are only set if you choose to accept them.

Functional Cookies

Allow our website to remember choices you make, such as language preference, currency preference, login details, or whether you have dismissed a notification, in order to provide a more personalised and convenient experience. These may be set by us or by embedded third-party tools.

Marketing & Targeting Cookies

Used to show you relevant advertising on third-party websites after you have visited ours, and to measure the effectiveness of our advertising campaigns. These require your explicit consent and are only set if you actively opt in through our cookie consent banner.

5.3 Managing Your Cookie Preferences

When you first visit our website, you will be shown a cookie consent banner through which you can accept or decline non-essential cookies by category. You can review and change your preferences at any time by clicking the 'Cookie Settings' link in the footer of our website at lsae.co.uk.

You can also control cookies through your browser settings. Most modern browsers allow you to block, restrict, or delete cookies. However, doing so may affect the functionality of our website and learning platform, including our course search tool. Please refer to your browser's help documentation for guidance on managing cookies.

Withdrawing or declining consent to cookies does not affect the lawfulness of any processing that took place before withdrawal.

5.4 Third-Party Cookies

Some cookies on our platform are placed by third parties whose content or tools are integrated into our services, such as our course search tool (Algolia), embedded video players, payment processors, the WhatsApp chat widget, and social media sharing buttons. These third parties have their own privacy and cookie policies, which we recommend you review. LSAE does not control third-party cookies and is not responsible for the practices of third-party cookie providers.

5.5 Cookie Retention Periods

The retention period for cookies varies depending on their type. Session cookies expire when you close your browser. Persistent cookies remain on your device for a set period, typically between 30 days and 24 months, depending on their purpose. You can view the specific retention periods for each cookie category in our Cookie Settings panel.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your data only in the following limited circumstances.

6.1 Service Providers and Sub-Processors

We engage trusted third-party companies to provide services on our behalf. These include:

  • Payment processors, for secure card and direct debit processing in GBP, USD, EUR, NGN, and GHS;
  • Email service providers, for transactional and marketing communications, including our newsletter;
  • WhatsApp Business and live chat platforms, for real-time student support and enquiries (messages sent via WhatsApp are also subject to WhatsApp's own privacy policy, published by Meta);
  • Cloud hosting and infrastructure providers, for secure data storage and platform operation;
  • Learning management system (LMS) providers;
  • Algolia, for our course search functionality, which may process the search terms you enter;
  • Analytics providers, such as Google Analytics;
  • Cybersecurity and fraud detection providers, including for the prevention of Refer & Earn programme abuse.

All third-party processors are contractually required, through data processing agreements, to process your data only on our written instructions, to implement appropriate technical and organisational security measures, and to comply with UK GDPR. We carry out due diligence assessments of all new processors and review existing arrangements regularly.

6.2 Accreditation and Awarding Bodies

Where your course leads to a certificate that is independently accredited or awarded by a third-party body, we may share relevant personal data — such as your full name, enrolment details, and assessment results — with that body for the purposes of registration, verification, and certification. We will inform you of any such sharing at the point of enrolment.

6.3 Legal and Regulatory Authorities

We may disclose your personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of LSAE, our students, or others. Where permitted by law, we will endeavour to notify you of any such disclosure.

6.4 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of all or part of our business, your personal data may be transferred to the relevant third party as part of that transaction. We will provide advance notice of any such transfer and ensure that your data continues to be protected in accordance with this policy.

6.5 Professional Advisers

We may share personal data with our legal advisers, auditors, and insurers where necessary for the exercise or defence of legal claims, regulatory compliance, or the management of our business.

7. International Data Transfers

As LSAE serves students internationally, including in markets where we accept payment in NGN and GHS, your personal data may be transferred to, and processed in, countries outside the UK, including countries that may not have data protection laws equivalent to the UK GDPR.

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Agreement (IDTA), an adequacy decision made by the UK Government, or the UK Addendum to the EU Standard Contractual Clauses. You may request details of the specific safeguards in place for any international transfer of your data by contacting us at support@lsae.co.uk.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or for as long as required by applicable law. Our key retention periods are as follows:

  • Account and enrolment data: Retained for six years following the end of your enrolment, in accordance with UK tax law and the Limitation Act 1980.
  • Financial and payment records: Retained for seven years following the relevant financial year, as required by HMRC.
  • Certificate and qualification records: Retained indefinitely, to allow verification of qualifications awarded through our Certificate Verification tool.
  • Referral programme records: Retained for two years following payment of any reward, or two years from the referral date where no reward was paid, to allow us to resolve queries and prevent abuse.
  • Marketing communications data: Retained until you withdraw consent or object, plus a reasonable suppression period to prevent inadvertent re-contact.
  • Support and communications records: Retained for three years following the close of the relevant enquiry or complaint, including WhatsApp and live chat transcripts.
  • Technical and usage data: Typically retained in identifiable form for up to 13 months, in line with analytics best practice, after which it is aggregated or anonymised.
  • Special category data: Retained only for as long as strictly necessary for the purpose for which it was collected, and deleted securely upon request or when it is no longer required.

When personal data is no longer required, we securely delete or anonymise it in accordance with our internal Data Retention and Deletion Procedure, which is reviewed annually.

9. Your Rights Under UK GDPR

As a data subject, you have the following rights under UK GDPR. We will respond to all valid requests within one calendar month, extendable by up to two further months in complex cases. We will not charge a fee for responding to rights requests unless they are manifestly unfounded or excessive.

9.1 Right of Access (Subject Access Request)

You have the right to request a copy of the personal data we hold about you. We will provide this in a structured, commonly used, machine-readable format. To submit a Subject Access Request (SAR), please contact us at support@lsae.co.uk with sufficient information to verify your identity.

9.2 Right to Rectification

You have the right to request correction of any inaccurate or incomplete personal data we hold about you. Many basic account details can be updated directly through your account settings on our platform.

9.3 Right to Erasure ('Right to be Forgotten')

You have the right to request that we delete your personal data in certain circumstances, such as where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other lawful basis for continued processing. This right is not absolute and may be subject to our legal retention obligations.

9.4 Right to Restrict Processing

You have the right to request that we restrict our processing of your data in certain circumstances, such as while we investigate a challenge to the accuracy of your data or a complaint about our processing activities.

9.5 Right to Data Portability

Where processing is based on your consent or on the performance of a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to request that we transmit it directly to another controller where technically feasible.

9.6 Right to Object

You have the right to object to our processing of your personal data where that processing is based on legitimate interests. You also have an absolute right to object to processing for direct marketing purposes at any time, without needing to give reasons.

9.7 Rights in Relation to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects on you. We do not currently make any decisions about students or prospective students through solely automated means.

9.8 Right to Withdraw Consent

Where our processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at support@lsae.co.uk. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection, at ico.org.uk or by calling 0303 123 1113.

10. Data Security

We take the security of your personal data seriously and have implemented a comprehensive range of technical and organisational measures to protect it against unauthorised access, accidental loss, alteration, unlawful disclosure, or destruction.

  • Encryption: All data transmitted between your browser and our servers is protected using SSL/TLS encryption (minimum TLS 1.2). Sensitive data at rest, including passwords and payment information, is encrypted using industry-standard algorithms.
  • Access Controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data are required to complete mandatory data protection training and are bound by confidentiality obligations under their contracts of employment.
  • Secure Infrastructure: Our platform is hosted on reputable cloud infrastructure providers that maintain internationally recognised security certifications, including ISO 27001.
  • Regular Security Reviews: We conduct periodic reviews of our security practices, including vulnerability assessments and penetration testing, to identify and address potential risks proactively.
  • Incident Response: We maintain a formal Personal Data Breach Response Procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly without undue delay.
  • Supplier Security: We require all third-party processors — including our search, payment, and messaging providers — to maintain appropriate technical and organisational security measures and to notify us promptly of any security incidents affecting your data.

While we take all reasonable steps to protect your data, no method of electronic transmission or storage is entirely secure. We encourage you to use a strong, unique password for your LSAE account and to contact us immediately at support@lsae.co.uk if you suspect any unauthorised activity.

11. Children's Privacy

Our courses and services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you are a parent or guardian and believe that your child has provided us with personal data without appropriate consent, please contact us promptly at support@lsae.co.uk and we will take steps to delete the relevant data without undue delay.

Our website and course materials may contain links to third-party websites, tools, or services that are not operated by LSAE — including our social media pages on Facebook, LinkedIn, and Instagram, our WhatsApp chat channel, and our '3Ci Consulting' partner site. This policy does not apply to those third-party sites or services. LSAE has no control over and accepts no responsibility for the content, privacy policies, data practices, or security of any third-party site or service. We encourage you to review the privacy policy of every website or app you use to contact us.

13. Changes to This Policy

We may update this Cookie & Privacy Policy from time to time to reflect changes in our practices, applicable law, regulatory guidance from the ICO, or developments in technology, including the addition of new features such as our course search tool, Certificate Verification tool, or Refer & Earn programme. When we make material changes, we will notify you by email (using the address associated with your account) or by posting a prominent notice on our website (lsae.co.uk) at least 14 days prior to the change taking effect.

We encourage you to review this policy periodically. Your continued use of our services following notification of material changes constitutes your acknowledgement of the updated policy. If you do not agree with any changes, you must cease using our services and may request closure of your account.

For previous versions of this policy, or to request a copy of any historical version, please contact us at support@lsae.co.uk.

London School of Applied Excellence (Company No. 17186021, UKPRN 10101145) is registered in England and Wales. This Cookie & Privacy Policy was last updated on 31 August 2026 and supersedes all previous versions.

For data protection enquiries: support@lsae.co.uk | Website: lsae.co.uk | Supervisory Authority: ico.org.uk