What personal data we collect, why we collect it, how long we keep it, who else processes it, and the rights you have over it.
BREVORA LTD, a private limited company registered in England and Wales under number 17370266, with registered office at 2 Frederick Street, Kings Cross, London, WC1X 0ND, United Kingdom, is the data controller for personal data collected through https://brevora.com. The company's director is Ihab Aarab.
We are not required to appoint a statutory Data Protection Officer. All data protection matters are handled directly by the company and can be raised at support@brevora.com.
We do not collect special category data (health, ethnicity, religion, political opinions, biometrics, sexual orientation). Please do not send such information to us. We do not collect or store full payment card numbers — see section 4.
| Purpose | Data used | Legal basis (UK GDPR Art. 6) |
|---|---|---|
| Create and maintain your account | Account data | Performance of a contract |
| Take payment and issue receipts or invoices | Order data | Performance of a contract |
| Deliver access to purchased courses | Account, order data | Performance of a contract |
| Track progress and issue certificates | Learning data | Performance of a contract |
| Provide support and answer messages | Correspondence, account data | Performance of a contract; legitimate interests |
| Keep accounting and tax records | Order data | Legal obligation |
| Prevent fraud and credential sharing | Technical, learning data | Legitimate interests (protecting the service) |
| Maintain security and diagnose faults | Technical data | Legitimate interests (securing the service) |
| Improve courses using aggregate progress data | Learning data, aggregated | Legitimate interests (improving the product) |
| Send optional marketing emails | Account data | Consent (withdrawable at any time) |
| Non-essential analytics cookies | Cookie data | Consent (PECR) |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and we limit processing to what is necessary for the stated purpose. You may object to processing based on legitimate interests — see section 11.
Card payments are processed by a third-party payment provider. Your card details are entered on the provider's secure, encrypted page and are transmitted directly to them. BREVORA LTD never receives, sees or stores your full card number, expiry date or security code.
What we do receive and retain from the payment provider is limited to what we need to identify and service the order: the order reference, the amount and currency, the date, the payment status, the last four digits and brand of the card, and the email address used. The payment provider acts as an independent controller for the payment transaction and applies its own privacy policy.
| Category | Retention period | Reason |
|---|---|---|
| Account data | While your account is active; deleted within 30 days of a deletion request | Delivering lifetime access you have paid for |
| Order and invoice records | 7 years from the end of the relevant accounting period | UK company and tax law |
| Learning data and certificates | While your account is active | Certificate re-issue and progress |
| Support correspondence | 3 years from last contact | Handling follow-up questions and disputes |
| Server and security logs | 12 months | Security and fault diagnosis |
| Marketing consent records | Until withdrawn, then 3 years | Evidence of consent under PECR |
Note that if you ask us to delete your account, we must still retain order and invoice records for the statutory period. In that case we retain only the transaction record and remove the rest.
We do not sell personal data, and we do not share it for third-party advertising. We share the minimum necessary with the following categories of processor, each under a written agreement requiring them to act only on our instructions and to protect the data:
We may also disclose personal data where required by law, court order or a regulator; where necessary to establish, exercise or defend legal claims; or in connection with a sale or reorganisation of the business, in which case the recipient is bound by this policy.
Some of our processors operate outside the United Kingdom. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place — either a UK adequacy decision for the country in question, or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. You may request details of the safeguard applied by writing to support@brevora.com.
We use strictly necessary cookies to keep you signed in, to remember your cart or plan selection, and to protect forms against cross-site request forgery. These do not require consent because the service cannot function without them.
Any analytics or non-essential cookies are set only after you consent, and you may withdraw that consent at any time. The full list of cookies, their purposes and their durations is in our Cookie Policy.
We send transactional emails — order confirmations, access details, receipts, password resets and important service notices — on the basis of our contract with you. These are not marketing and cannot be opted out of while you hold an account, because they are how the service is delivered.
We send marketing emails, such as notice of a new course, only where you have opted in. Every marketing email contains a one-click unsubscribe link, and you may also withdraw consent at any time by writing to support@brevora.com. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
We apply technical and organisational measures appropriate to the risk, including: encryption in transit using HTTPS across the whole site; passwords stored only as salted cryptographic hashes; access to administrative systems restricted to the director and protected by strong, unique credentials; regular software and dependency updates; and regular backups.
No system can be guaranteed absolutely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, and will notify affected individuals without undue delay where the risk is high.
Under the UK GDPR you have the right to:
Write to support@brevora.com from the email address associated with your account, stating which right you wish to exercise. We may ask for additional information to confirm your identity where the request is not made from the registered address.
We respond within one calendar month. Where a request is complex or you have made several requests, we may extend this by up to two further months and will tell you why within the first month. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse — and we will explain our reasoning.
If you are unhappy with how we have handled your personal data, please tell us first at support@brevora.com so we can try to put it right. You also have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom — ico.org.uk. If you are resident in the European Union, you may instead complain to the supervisory authority in your country of residence.
Our service is intended for adults in professional life. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, contact support@brevora.com and we will delete it.
We do not carry out automated decision-making producing legal or similarly significant effects, and we do not profile you for advertising purposes. Automated checks may be applied by our payment provider for fraud prevention, in accordance with that provider's own privacy policy.
We may update this policy to reflect changes in the service or in law. The current version is always published on this page with its "last updated" date. Where a change materially affects how we use your data, we will notify you by email before it takes effect.