Policies & Safeguarding

Data Controller

PremPR Academy is the data controller responsible for your personal data. We are committed to protecting your privacy and your right to data protection in accordance with UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

Personal Data We Collect

We collect and process the following categories of personal data:

• Identity data: full name, date of birth, username.
• Contact data: email address, phone number, postal address.
• Account data: username, password, account preferences.
• Payment data: processed securely via Stripe; we do not store full card details.
• Profile data: bio, photographs, social media handles, portfolio links.
• Usage data: IP address, browser type, pages visited, course progress.
• Marketing data: preferences for receiving newsletters and communications.

Lawful Basis for Processing

We process your personal data under the following lawful bases under UK GDPR Article 6:

• Consent (Article 6(1)(a)) — for marketing communications and optional profile data.
• Contract (Article 6(1)(b)) — for enrolment, purchases, and course access.
• Legal obligation (Article 6(1)(c)) — for tax records and safeguarding obligations.
• Legitimate interests (Article 6(1)(f)) — for platform security and service improvement.

How We Use Your Data

We use your personal data to:

• Provide and manage your account, course enrolments and progress tracking.
• Process payments and issue certificates of completion.
• Operate the PremPR Network, referral programme and creator opportunities.
• Publish approved press releases and news content submitted by network members.
• Send service updates, course communications and (with consent) marketing materials.
• Maintain platform security, prevent fraud and comply with legal obligations.

Data Sharing

We do not sell your personal data. We may share data with:

• Stripe — our payment processor, for secure transaction handling.
• Cloud infrastructure providers — for hosting and data storage within the UK/EEA where possible.
• Brand partners and agencies — only for creator opportunities you have explicitly applied for.
• Regulatory or law enforcement bodies — where legally required or to safeguard individuals.

International Transfers

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements or reliance on adequacy regulations, in compliance with UK GDPR Chapter 5.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting or reporting requirements. Course completion records and certificates are retained indefinitely; marketing data is retained until consent is withdrawn.

Your Rights

Under UK GDPR you have the right to:

• Be informed about how we use your data (this policy).
• Access your personal data (Subject Access Request).
• Rectify inaccurate or incomplete data.
• Erase your data (right to be forgotten), subject to legal exceptions.
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time.
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Contact

To exercise any of these rights or for any privacy-related enquiry, contact our Data Protection Officer at admin@prempracademy.org. We will respond within one month of receipt.