Privacy Policy
June 19, 2020 2026-05-22 11:01Privacy Policy
Privacy Policy
Last updated: 22/05/2026
Digital Business School Ltd (“we”, “our”, “us”) operates the website at dbschool.co.uk, the courses portal at courses.dbschool.co.uk, and the DBS Launchpad subscription service at app.dbschool.co.uk (together, “our services”). This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the rights you have under UK data protection law.
We are the data controller for the personal data described in this notice. If you have questions about anything in this policy, or you want to exercise any of your rights, contact us at info@dbschool.co.uk.
1. What this policy covers
This policy covers personal data we collect through:
- Our main website (dbschool.co.uk) — contact forms, newsletter signups, general enquiries
- Our courses portal (courses.dbschool.co.uk) — course enrolments, student accounts, course delivery
- DBS Launchpad (app.dbschool.co.uk) — our subscription-based job application support service, including CV submissions
Where a section applies only to one of these services, we have labelled it clearly.
2. Information we collect
2.1 Information you give us directly
When you sign up, enquire, or use our services, we collect:
Across all services:
- Name
- Email address
- Phone number (where you provide it)
- Any other information you choose to include in messages, enquiries, or support requests
Courses (courses.dbschool.co.uk):
- Course enrolment details
- Progress, submissions, and assessment data
- Payment information (handled by our payment processors — see Section 4)
DBS Launchpad (app.dbschool.co.uk):
- Account details (name, email, phone)
- Your CV (uploaded as a PDF document) — note that CVs typically contain sensitive information such as employment history, educational background, and contact details
- Subscription and billing information (handled by our payment processor Stripe — we do not see or store your card details)
- Communications with our team about your job applications
2.2 Information collected automatically
When you use our services, we automatically collect:
- Log data: IP address, browser type and version, operating system, pages visited, time and date of visit, time spent on pages, and other diagnostic data
- Cookies and similar technologies — see Section 10 (Cookies Policy) below
3. How we use your information, and our lawful basis
UK data protection law requires us to have a lawful basis for processing your personal data. The table below sets out what we do with your data and why we are allowed to do so.
What we use it for | Lawful basis (UK GDPR Article 6) |
Delivering courses you have enrolled in | Performance of a contract |
Delivering the Launchpad service (including reviewing and submitting your CV) | Performance of a contract |
Processing payments and managing subscriptions | Performance of a contract |
Sending you service-related communications (e.g. password resets, trial expiry notices, billing receipts) | Performance of a contract |
Sending you marketing emails about other DBS services | Your consent — you can withdraw consent at any time |
Responding to enquiries and providing customer support | Legitimate interests (responding to people who contact us) |
Keeping financial and contractual records | Legal obligation (HMRC, Companies Act) |
Improving our services and understanding how people use them | Legitimate interests (improving our offering) |
Detecting and preventing fraud or misuse | Legitimate interests (protecting our business and users) |
We do not make any decisions about you that are based solely on automated processing or profiling.
4. Who we share your information with
We share your personal data with the following categories of third parties, only to the extent necessary to operate our services. Each of these has data protection obligations in place to protect your information.
Payment processors
- Stripe, Inc. — processes subscription payments for DBS Launchpad and course payments. Stripe receives your name, email, and card details (which you enter directly into Stripe — we never see them).
- PayPal Holdings, Inc. — processes course payments where this option is selected.
Infrastructure and platform providers (Launchpad)
- Supabase, Inc. — provides the database and authentication service that stores your Launchpad account information and CV.
- Lovable AB — provides the application hosting platform (Lovable Cloud, which is certified to SOC 2 Type II and ISO 27001).
- Resend, Inc. — sends transactional emails (such as account confirmation and password resets) on our behalf.
- Airtable, Inc. — used by our operations team to track Launchpad job application activity. Stores name, email, subscription status, and CV submission status.
Other service providers
- Google LLC (Google Analytics) — provides website analytics. Where used, IP addresses are anonymised.
Our team and contractors
- DBS staff and VAs (virtual assistants) who deliver Launchpad and course services may access your information solely to provide those services. All are bound by confidentiality obligations.
Legal disclosures
- We may share your data where we are required to do so by law, regulation, or court order, or where it is necessary to defend our legal rights.
We do not sell your personal data, ever. We do not share it for third-party marketing purposes.
5. International transfers
Some of our service providers (including Stripe, Supabase, Lovable, Resend, Airtable, and Google) are based in the United States or process data outside the UK. Where this happens, we rely on UK-approved transfer mechanisms — typically the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider participates in it.
If you would like more information about these transfer mechanisms, contact us at info@dbschool.co.uk.
6. How long we keep your information
We only keep your personal data for as long as we need it. The table below sets out our retention periods.
Data | How long we keep it |
Account data (name, email, phone) | For the duration of your subscription or course enrolment, plus 6 years afterwards (to allow for contractual claims under the UK Limitation Act 1980) |
Launchpad CV and application data | 3 months after your subscription is cancelled, then permanently deleted |
Course progress and assessment data | For the duration of your enrolment, plus 6 years afterwards |
Payment and subscription records | 7 years (HMRC requirement for financial records) |
Marketing consent records | Until consent is withdrawn, then 2 years afterwards (to demonstrate the lawful basis we relied on) |
Customer support correspondence | 3 years |
Server logs (IP addresses, access logs) | 90 days |
Analytics cookies | 13 months maximum |
Authentication cookies | The duration of your session, plus up to 30 days for “keep me signed in” |
After the retention period ends, your data is either deleted or anonymised so it can no longer be linked to you.
7. How we protect your information
We take the security of your personal data seriously. The measures we use include:
- Encryption in transit — all data sent between you and our services uses TLS/HTTPS encryption
- Encryption at rest — data stored in our database and CV storage is encrypted
- Access controls — only DBS staff and contractors who need access to your data have it, and access is logged
- Vetted infrastructure — our hosting and infrastructure providers maintain SOC 2 Type II and ISO 27001 certifications
- Regular reviews — we review our security practices and update them as risks evolve
No system is ever 100% secure. While we use industry-standard practices, we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner’s Office (ICO) within 72 hours, as required by UK GDPR.
8. Your rights
Under UK data protection law, you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — ask us to correct inaccurate or incomplete data
- Right to erasure (“right to be forgotten”) — ask us to delete your personal data, subject to certain exceptions (for example, we may need to keep some data to meet legal obligations)
- Right to restrict processing — ask us to limit how we use your data
- Right to data portability — receive your data in a structured, machine-readable format, or have it transmitted to another controller
- Right to object — object to processing based on legitimate interests, or to direct marketing
- Right to withdraw consent — where we rely on your consent, you can withdraw it at any time
To exercise any of these rights, email us at info@dbschool.co.uk. We will respond within one month. There is no fee, unless your request is manifestly unfounded or excessive.
If you are unhappy with how we handle your personal data, you have the right to complain to the Information Commissioner’s Office (ICO):
- Website: org.uk
- Phone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
We would appreciate the chance to address your concerns first, but you can complain to the ICO directly without contacting us.
9. Children
Our services are not directed at people under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us at info@dbschool.co.uk and we will delete it.
10. Cookies Policy
Last updated: [DATE OF PUBLICATION]
We use cookies and similar technologies on our websites. This section explains what they are, how we use them, and the choices you have.
What are cookies?
Cookies are small text files that a website places on your device when you visit. They allow the website to recognise you on your next visit and to remember things like your preferences and login state.
Cookies can be “session” cookies (deleted when you close your browser) or “persistent” cookies (stored on your device for a set period).
How we use cookies
We use the following types of cookies:
- Strictly necessary cookies — required for the website to function. These include authentication cookies that keep you signed in to your account, and security cookies that prevent fraudulent use. You cannot opt out of these because the service will not work without them.
- Analytics cookies — help us understand how visitors use our websites so we can improve them. Where we use these (e.g. Google Analytics), IP addresses are anonymised.
- Preference cookies — remember choices you make, such as language or display preferences.
We do not use cookies for behavioural advertising or to track you across other websites.
Third-party cookies
Some of the cookies on our websites are set by third parties. The main third parties are:
- Google Analytics (analytics)
- Stripe (payment processing — only set when you go through checkout)
- Supabase (authentication — only on app.dbschool.co.uk)
Your choices
You can control cookies through your browser settings. Most browsers let you block or delete cookies, either entirely or from specific sites. If you block strictly necessary cookies, parts of our services (especially signing in to Launchpad or the courses portal) will not work.
You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top, and where the changes are significant, we will notify you by email or through a notice on our website. We encourage you to review this policy periodically.
12. Contact us
For any questions about this Privacy Policy, or to exercise your rights, contact us at:
Digital Business School Ltd
Email: info@dbschool.co.uk
Phone: 0208 003 0190
