Privacy Notice

1 Who is responsible for your information

Set-Piece Academy Ltd is the controller responsible for the personal information described in this notice. Our contact address is 12 Dott Road, Bangour Village, EH52 1AN, United Kingdom. For privacy questions or to exercise your rights, email hello@set-pieceacademy.com.

2 Information we collect and where it comes from

We collect information you provide through our interest-registration, enquiry, enrolment and account forms, course sessions, assignments and correspondence. The information depends on the form or service: name, email address, role, club or team, coaching level, country where requested, selected interests or course, and optional learning goals or enquiry details.

For purchases and accounts, we hold your selected course or Bundle, price and price tier, order and payment-provider references, payment or refund status, registration confirmations, terms-acceptance records, account identifiers and authentication records. We also process course access, progress, submissions, feedback, assessment and certificate information when relevant to your course.

Revolut collects payment-card information through its own checkout and provides us with order and payment-confirmation information. Our course-enrolment system does not store your full card number or card security code. Password authentication is handled through Supabase; do not send us your password in an email or assignment.

Our service providers process technical information needed to operate and protect the services, such as IP addresses, browser and device details, request logs, login events and email delivery or failure information. Sessions and submissions may include information about other people, as explained in sections 8 and 9.

3 Why we use information and our lawful bases

Contract and steps you request before a contract: to process enrolment and payment, create and secure your account, provide purchased course access, deliver teaching and assessment, issue a certificate where earned, administer refunds and respond to course-related requests.

Legal obligation: to meet applicable accounting, tax and other legal record-keeping requirements.

Legitimate interests: to answer ordinary enquiries, protect accounts, prevent fraud and misuse, investigate faults, maintain reliable services, resolve complaints or claims, and review teaching quality through the restricted session recordings described in section 9. These interests are delivering effective teaching and running a secure, reliable Academy. We limit the information used and consider the effect on your rights.

Consent: for interest-list processing where the form asks for your permission, optional promotional emails where consent is required, and identifiable social-media publicity under section 9. Permission for one purpose does not give permission for another. You can withdraw consent at any time without affecting earlier lawful use or purchased course access.

4 Required information and communications

Required fields on an enrolment or account form are needed to process your purchase, provide access or confirm course requirements. Without them, we may be unable to complete that step. Optional responses and optional publicity or marketing choices are not conditions of buying a course.

We send necessary payment, account, security and course messages to administer your purchase. Promotional emails are separate. You can unsubscribe from marketing using the email link or by emailing hello@set-pieceacademy.com. You may object to direct marketing at any time.

5 Who receives information

Authorised Academy personnel use the information needed for administration, teaching, assessment and support. Student administration includes name, email, club or team, role, verified payment status and purchased course. Submissions and feedback are used for teaching and assessment. Full session recordings are restricted to the course leader for private review, as explained in section 9.

We use Supabase for authentication, accounts, database records and course or assessment storage; Vercel for website hosting and server functions; Revolut for checkout, payment confirmation and refunds; Resend for account and transactional email delivery; HubSpot for interest registrations, enquiries and relevant email communications; and Microsoft Teams for live sessions and recordings. These services may use authorised subprocessors to deliver and secure their services.

The website currently loads Google Fonts to display its typefaces, so your browser makes requests to Google. Links to Teams, Revolut and social-media sites take you to services with their own privacy information and settings. We do not sell student information. Revolut and other providers may act as independent controllers for their own payment, regulatory, account or security activities.

We may share necessary information with professional advisers, authorities or other parties where required by law or needed to handle a claim. We do not make student details or submissions public as part of ordinary course delivery. Public use of identifiable student work, images or testimonials requires separate permission.

6 International processing and safeguards

Our Supabase project database is hosted in Frankfurt, Germany. This does not mean all processing stays in Germany: our providers and their support, security and infrastructure partners may process information in other countries.

International processing includes the United States for Resend and Vercel, US and other international operations for HubSpot, and Singapore-based Supabase contracting and international support or subprocessors. Microsoft and Google operate international infrastructure, including in the United States. Payment processing can also involve international Revolut entities and service partners. The destination depends on the service and its published provider and subprocessor information.

For transfers subject to UK data-protection restrictions, the applicable protections include UK adequacy regulations where the recipient is covered, or approved contractual safeguards. Supabase, Resend and HubSpot publish standard contractual clauses incorporating the UK International Data Transfer Addendum. Vercel publishes UK contractual transfer provisions. Microsoft publishes contractual protections and participation in the UK Extension to the EU-US Data Privacy Framework for transfers covered by that framework. Provider safeguards do not imply that every country offers identical legal protection.

You can request information about the safeguards applicable to your data, or a copy with confidential information removed where necessary, by emailing hello@set-pieceacademy.com. Details of providers’ processing and onward transfers are available in their data-processing and privacy information: Supabase customer legal resources; Resend Data Processing Addendum; Vercel Data Processing Addendum; HubSpot Data Processing Agreement; Microsoft Privacy Statement; Google Privacy Policy; and Revolut Business Customer Privacy Notice. The website version links to these documents.

7 Access and how long we keep information

Platform access ends one week after the final module of your purchased course. For a Bundle, this means one week after the final module of the later-finishing course. Downloadable module slides may be kept as PDFs for your personal learning, subject to the course terms and content-sharing restrictions. Course video footage is not supplied for download. Ending platform access is different from deleting every record about you.

Student profiles, progress, submissions, feedback, assessment and certificate records: during platform access and for 12 months after access ends, to handle course support and assessment queries. Interest registrations that do not become purchases: up to 12 months after the relevant course launch. Routine enquiries: up to 12 months after the enquiry is resolved, unless they become part of a purchase, complaint or another record with a different retention period.

Full session recordings: deleted within 90 days after the course finishes. Separately consented social-media extracts: kept while relevant to the agreed publicity purpose, reviewed for continued need and subject to consent withdrawal under section 9.

Optional marketing contact information: until you withdraw consent or object, with a review after 24 months of inactivity to decide whether continued retention remains necessary. We keep minimal suppression information where needed to respect an unsubscribe.

Payment and accounting records: normally six years from the end of the company financial year to which they relate, or longer where legally required. We may retain specific necessary records longer for an unresolved complaint, dispute, fraud investigation or legal obligation. We restrict such retention to the information needed and review the exception.

We delete or anonymise information when it is no longer needed. Technical logs, email-delivery records and backups have provider-specific retention and deletion cycles; limited copies may remain until those cycles complete. A refund or account closure does not require deletion of records we must retain by law.

8 Assignments and information about other people

Assignments may contain information about players, coaches or other people. Submit only what is necessary for assessment and make sure you have the rights and a lawful basis to share it. Remove unnecessary names, identifying details and sensitive information, and take particular care with footage or information about children. Do not include health details, identification documents or other sensitive personal information unless specifically agreed with us and appropriate safeguards are in place.

We use submissions for course delivery, assessment, feedback and related administration. We do not use them in public marketing without separate permission. People shown or described in a submission can contact us about its use. Where required, we provide privacy information to those people or assess an applicable legal exception. A student’s permission alone does not remove the rights of other people shown.

9 Live session recordings and optional social media publicity

Live teaching sessions on Microsoft Teams will be recorded for the course leader’s private review of teaching and delivery. Our lawful basis for this restricted review is legitimate interests in improving the clarity, pacing and effectiveness of teaching, including how explanations and questions are handled. Full recordings are not provided to students or made public, and only the course leader is authorised to watch them for this purpose. They are deleted within 90 days after the course finishes. Microsoft and its authorised providers process recording files as necessary to operate the service.

Recordings may include your camera image, Teams profile picture or avatar, displayed name, voice and contributions, and any screen or chat captured by the recording. Participants are told when recording starts. You may keep your camera off; this does not automatically remove your name, profile picture, voice or contributions. Contact us before a session if you object to being recorded or need an alternative way to participate. We will consider your circumstances, minimise capture where practical and arrange a suitable alternative where needed. Do not share sensitive personal information during a recorded discussion.

Screenshots or short extracts may be selected for public posts on Set-Piece Academy’s social-media accounts to promote the Academy and its courses. Before using an identifiable image, Teams profile picture, displayed name, voice or contribution, we obtain separate, optional consent identifying the relevant social-media platform or platforms. Enrolment, acceptance of the course terms and attendance do not give that consent. Declining it does not affect course access, assessment or certification. We omit, crop, blur or mute non-consenting participants as appropriate.

Withdraw publicity consent by emailing hello@set-pieceacademy.com. We will stop new use and remove the relevant material from posts we control where consent is the basis for its use. Withdrawal does not make earlier lawful use unlawful. Public posts may be viewed, downloaded or reshared by others; we cannot guarantee removal of copies outside our control. The social-media platform also processes information under its own privacy notice.

10 Cookies and similar browser storage

The account system uses local storage or session storage to maintain authentication. The login page also stores your Remember me preference and, when selected, your email address to prefill a later login. Checkout uses session storage for a request identifier and the selected course and email combination to help avoid duplicate checkout requests.

Our current website code does not load Google Analytics, advertising pixels, HubSpot’s website-tracking script or embedded YouTube or Vimeo players. HubSpot forms submit directly to its form-submission service. Google Fonts requests and necessary hosting or security requests still occur. A Vercel preview may also load Vercel’s development-feedback tools.

Read the Cookie Notice at /cookies/ for the current storage, purposes and controls. You can clear cookies and site data through your browser, but doing so may sign you out or interrupt checkout. Revolut checkout, Teams and external sites have their own storage and privacy choices. We will update the notice and obtain consent where required before adding non-essential tracking.

11 Your rights and complaints

Depending on the circumstances and lawful basis, you may request access, correction, erasure, restriction or portability of your information, and object to processing based on legitimate interests. You may withdraw consent at any time where we rely on it. Direct-marketing objections must be respected. Other rights are subject to applicable legal conditions; for example, an erasure request may not cover accounting records we must retain.

Email hello@set-pieceacademy.com to make a request. We may ask for proportionate information to verify your identity. We normally respond within one month; if the law permits an extension for a complex request, we will explain it within that period.

You may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/. You do not have to contact us first, but we welcome the opportunity to resolve your concern.

12 Account automation and changes to this notice

The enrolment system uses verified payment information to send account invitations and grant access to the purchased course or courses. Returning from checkout alone does not confirm payment. This automation does not mark assignments or decide whether you have earned a certificate. Contact hello@set-pieceacademy.com if access is missing or incorrect, so we can review it.

We update this notice when our use of information changes and communicate material changes as appropriate. The date at the start identifies the current version.