01Who is responsible for your data
1.1. For ordinary Website, Account, payment administration, consumer service and Course operations, the data controller is DAREVON TRADING LTD (company number 17470852), registered office Suite 34, Cariocca Business Park 2 Sawley Road Manchester M40 8BB England, United Kingdom.
1.2. Email privacy enquiries, requests to exercise your rights or concerns about processing to info@eduashy.com. Use the subject “Privacy Request” to help us route your message.
1.3. Some technology providers act as our processors when handling data on our instructions; other parties, such as card issuers or certain payment processors, may be independent controllers for their own activities. Their separate notices may also apply.
1.4. If we process personal data strictly on another organisation's documented instructions in a genuinely business-to-business arrangement, the roles and applicable data-processing terms must be agreed separately. Ordinary personalised consumer Course Orders are not automatically treated as a processor-only service.
02Scope
2.1. This Policy covers the Website, registration and login, Customer Materials submitted for Courses, AI-assisted processing, human preparation of Mentor-Crafted Courses, Balance management, card transactions, delivery, support and related administrative records.
2.2. It does not govern independently operated websites, financial institutions or services reached through external links. Their own privacy notices apply to their independent activities.
03Categories of personal data
3.1. Identity and contact information: name or chosen account name, email address, country, language preferences and any optional profile information you provide.
3.2. Account and authentication information: login identifiers, password credentials in their protected technical form where applicable, account state, access controls, preferences and account recovery records.
3.3. Order and learning information: selected subject, specialisation, level, module count, pace, language, learning objective, statements of prior knowledge, optional briefs, Course files, delivery status and revision or complaint correspondence.
3.4. Payment and transaction information: top-up amount, currency, payment status, payment processor references, limited card information returned by the processor (such as brand and masked details where provided), Balance movements, refunds, chargebacks and associated billing or tax details. Full card details entered into a payment provider's secure payment flow are processed by that provider rather than requested in Course briefs.
3.5. Device and usage data: IP address, approximate location derived from technical signals, device and browser characteristics, timestamps, page events, login records, diagnostic information and security logs, subject to any required cookie consent.
3.6. Communications and verification: support emails, messages, review requests, reported problems and information reasonably required to verify identity or payment ownership when handling an Account or refund issue.
3.7. Third-party information: a Course brief may incidentally mention other people. You should not provide identifiable information about others unless you have a lawful basis to do so and the information is genuinely necessary.
3.8. We do not require special-category information (such as health, religion or biometric data) or criminal-offence data for ordinary Course generation. Please do not include it in briefs. If such data is nevertheless supplied, its processing must have an appropriate lawful basis and, where required, an additional legal condition; otherwise we may reject or remove it.
04Where data comes from
4.1. We collect information directly when you register, configure a Course, top up Balance, place an Order, seek help or exercise privacy rights.
4.2. We also receive transaction status and limited payment or fraud-prevention data from relevant processors and financial service providers, and automatically collect essential technical information needed for operation and security.
4.3. Non-essential analytics or advertising data is collected only to the extent a relevant technology is actually implemented and any required consent has been obtained. See the Cookie Policy.
05Purposes and legal grounds
5.1. Performance of a contract / steps before a contract: registering and authenticating users, preparing Orders, processing Customer Materials to generate Courses, obtaining human input for Mentor-Crafted Courses, deducting purchases from Balance, delivering PDFs and handling contractual support.
5.2. Compliance with a legal obligation: maintaining records necessary for accounting and taxes, dealing with legally required refund and consumer-rights processes, responding to lawful authority requests and complying with applicable sanctions or other binding rules.
5.3. Legitimate interests, subject to balancing: ensuring Website functionality, securing accounts, preventing abuse and fraud, maintaining proportionate operational logs, resolving disputes, preventing repeated technical failure and improving reliability using data limited to what is necessary. You may object to processing based on legitimate interests in accordance with your rights.
5.4. Consent where required: setting or reading non-essential cookies or similar technologies and sending certain optional direct marketing communications, where used. Consent can be withdrawn without affecting the lawfulness of earlier processing.
5.5. We will identify an additional lawful basis or condition before processing special-category or criminal-offence data, if relevant; a standard Course Order does not by itself authorise unrestricted processing of such data.
5.6. We do not use Course selections or generated text to make automated decisions that determine legal rights or have similarly significant effects on individuals in the ordinary service. Automated Course generation produces learning content; it does not determine eligibility for credit, employment or official credentials.
06AI-assisted Course processing
6.1. When you order AI Course Builder, the brief and relevant configuration information are processed by AI systems to develop the curriculum and PDF content. Some information may be transmitted to contracted AI model or infrastructure providers where necessary to complete the Order.
6.2. Mentor-Crafted Courses involve human authors or specialists. Depending on the workflow, they may use AI or other software tools to help with research, structuring, editing or formatting. People assigned to an Order may see those Customer Materials reasonably necessary for their work.
6.3. We aim to limit shared information to what is needed for the requested Course and to apply appropriate contractual controls with relevant service providers. Users should not assume that third-party AI providers have zero retention or zero access unless the specific provider arrangements confirm this. Provider processing, potential abuse-monitoring retention and model-training restrictions must follow the contracts and settings actually in force.
6.4. We do not ask you to include passwords, complete payment-card numbers or unrelated highly sensitive data in prompts. Information submitted in a brief may be reflected in the generated Course, so review what you choose to provide.
6.5. We will not describe Customer Materials as used or not used for general AI training in a way that exceeds the actual contractual commitments and technical settings of our AI suppliers. Our handling of input and output is governed by the purposes in this Policy and our supplier arrangements.
07Disclosure to other parties
7.1. Personal data may be shared, to the extent necessary and appropriate, with: payment processing and card-service partners; Website, hosting, database, storage and infrastructure providers; AI model and generation providers; assigned human Course authors or reviewers; email delivery, communication and customer-support providers; and professional advisers or security service providers.
7.2. Providers acting on our behalf should receive data only for defined services under appropriate confidentiality, privacy and security arrangements. We assess whether they act as processors, independent controllers or, where applicable, joint controllers.
7.3. We may disclose information to authorities, courts or regulators where there is a lawful requirement; to protect rights or investigate suspected unlawful conduct where legally justified; or as part of a genuine corporate restructuring or sale subject to lawful safeguards.
7.4. We do not disclose private Course briefs publicly by default or give other customers access to an individual's private Account. Any public-sharing feature, if introduced, must have its own clearly explained controls.
08International transfers
8.1. Our company is based in the United Kingdom, but hosting, AI infrastructure, payment partners, support providers or Course authors may operate in other countries. We do not guarantee that all information remains in the UK or European Economic Area.
8.2. Where UK GDPR or EU GDPR applies to a restricted international transfer, we use a permitted transfer route appropriate to the circumstances, such as an applicable adequacy decision, recognised standard contractual clauses, a UK addendum or the UK International Data Transfer Agreement, together with supplementary safeguards where required.
8.3. Information about relevant transfer arrangements may be requested at info@eduashy.com, subject to lawful confidentiality limitations. Actual destinations and safeguards depend on the service providers in use and must be kept under review.
09Retention and deletion
9.1. We retain personal information only for as long as reasonably needed for the relevant purpose, subject to statutory recordkeeping, fraud prevention, resolution of disputes and the establishment or defence of legal claims. Retention is not indefinite merely because an Account exists.
9.2. Account and identity data: generally held while an Account remains active and thereafter only for a reasonable closure, security, legal or dispute period. A valid deletion request will be assessed against any information we must still retain.
9.3. Course briefs and Deliverables: held for as long as necessary to create and deliver the Course and support the account-based access or retrieval actually offered; removed or de-identified when the purpose ends, a valid deletion request is fulfilled, or the relevant service retention criterion is reached, unless a specific lawful basis requires further retention. Account access to a PDF does not mean all associated raw prompts must be retained for the same period.
9.4. Transaction, refund, billing and accounting records: retained for the applicable statutory recordkeeping period and, where necessary, for handling disputes or tax enquiries. In the UK, relevant business records may commonly need to be maintained for six years or longer depending on the applicable rule and circumstances.
9.5. Support and security records: held for periods proportionate to service, security and complaint purposes, with longer retention only where a continuing investigation, claim or legal obligation reasonably requires it.
9.6. Cookies and similar identifiers: retained for the lifetimes disclosed in the live Cookie Settings inventory, or as technically applicable to session-based storage, subject to the Cookie Policy.
9.7. Deletion from active systems may not immediately remove copies in secure backups or records independently retained by service providers under their own legal obligations. Such copies are subject to defined backup schedules and access limits and are removed or overwritten according to the applicable cycle.
9.8. We review the retention criteria and technical deletion arrangements against the live system. Users may request further information about applicable periods by contacting us.
10Data security
10.1. We use organisational and technical measures appropriate to the risks of the processing, including access management, service-provider oversight and measures designed to reduce accidental loss, unauthorised disclosure or misuse.
10.2. Access to Customer Materials is restricted on a need-to-know basis. Where human specialists work on Courses, their access should be limited to the material needed for the relevant Order and governed by appropriate commitments.
10.3. No internet transmission or storage system is entirely risk-free. This statement does not reduce our statutory duties to safeguard personal data and respond to reportable breaches.
11Your rights
11.1. Depending on your location and the circumstances, you may have the right to: receive information about processing; access your personal data; request correction; request erasure; restrict processing; object to certain processing; obtain portable data in an applicable format; withdraw consent; and challenge certain solely automated decisions with legal or similarly significant effects.
11.2. These rights are not absolute. We may need to verify identity, preserve information required by law or apply a lawful exception. We will explain material restrictions when responding.
11.3. Send requests to info@eduashy.com. We will respond within the deadline set by applicable law, ordinarily one month under UK GDPR, subject to legally permitted extensions and verification requirements.
11.4. If you believe we have mishandled your personal data, you may complain to the UK Information Commissioner's Office (ICO) at https://ico.org.uk. If EU GDPR applies to your situation, you may also have the right to complain to a competent data-protection authority in the EEA.
12Marketing choices and cookies
12.1. Essential service messages, such as purchase confirmations, delivery notifications, security alerts and refund correspondence, are not treated as optional promotional marketing.
12.2. If we send promotional emails, we will do so only with the lawful basis and marketing permissions required in the recipient's jurisdiction. Where applicable, marketing messages will include an effective unsubscribe method.
12.3. Non-essential cookies and similar technologies must not be enabled before any legally required consent is obtained. Cookie preferences must remain changeable. See the Cookie Policy.
13Children and sensitive content
13.1. The platform is intended for users aged 18 or over, and we do not knowingly invite children to establish Accounts or make payments.
13.2. If we discover that personal data has been collected from a minor contrary to applicable law and our eligibility rules, we will take appropriate steps, including verification and deletion where required.
13.3. Users must not disclose sensitive information about other people in briefs without a proper legal reason and authority. We may refuse or redact a request that creates an unjustified privacy risk.
14International operations and representation
14.1. We make the platform available to eligible users in multiple countries. Privacy rights and operational obligations may differ depending on where users live and whether UK GDPR, EU GDPR or another local privacy law applies.
14.2. Where the circumstances trigger an obligation to appoint a representative under Article 27 of the EU GDPR, we will make that representative's contact details available in the relevant notice. This Policy does not imply an appointment has already been made.
15Changes and contact
15.1. We may update this Policy when processing practices, suppliers, services or laws change. Material privacy changes will be communicated where appropriate and reflected in the updated notice.
15.2. Controller: DAREVON TRADING LTD, company number 17470852, Suite 34, Cariocca Business Park 2 Sawley Road Manchester M40 8BB England, United Kingdom.
Privacy contact: info@eduashy.com.
Website: https://eduashy.com.