Privacy policy.

This policy explains how OnlineUni collects, uses, shares and protects your personal data when you browse onlineuni.org, make an enquiry, purchase a programme, or study with us. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We keep this policy in plain English deliberately. If anything is unclear, ask us at [email protected].

The data controller is London School of Business and Research Limited, trading as OnlineUni, registered in England and Wales under company number 10684693, with its registered office at 622 Crown House, North Circular Road, Park Royal, London, NW10 7PN, United Kingdom.

For any matter relating to your personal data, contact [email protected] with the subject line "Data request".

Data you give us

• Identity and contact data — your name, email address, phone or WhatsApp number, and postal address where a printed certificate is ordered.
• Enrolment data — the programmes you purchase, your study plan, add-ons and membership status.
• Communications — emails, chat conversations, support requests and feedback you send us.

Data collected automatically

• Learning data — module progress, assessment attempts and completion records on the learning platform.
• Technical data — IP address, browser type, device information and pages visited, collected through server logs and cookies (section 6).

Payment data

Payments are handled by our payment providers through our group checkout. We receive confirmation of payment, the amount and a transaction reference. We never see or store your full card number.

We only process personal data where we have a lawful basis to do so:

• To perform our contract with you — enrolling you, delivering your programme, providing professor support, issuing certificates, and handling refunds.
• Legitimate interests — responding to enquiries, improving our courses and website, keeping the platform secure, and preventing fraud and abuse.
• Consent — sending marketing emails (section 7) and any other processing where we ask you first. Consent can be withdrawn at any time.
• Legal obligation — keeping tax and accounting records, and responding to lawful requests from authorities.

When you use the chat on our website, we ask for your name, email address and, optionally, a WhatsApp number so an admissions adviser can follow up on your enquiry. The conversation itself is stored with your enquiry.

• Chat conversations are used to answer your questions, recommend suitable programmes, and follow up with you about your enquiry.
• Our chat service uses automated assistance to help respond quickly. Conversations may be processed by our technology providers for that purpose only.
• Chat data is never sold and is retained in line with section 10.

• Essential cookies and storage keep the website working — for example, remembering your chat session so a conversation can continue where you left off.
• Analytics help us understand how the website is used, in aggregate, so we can improve it.
• You can control cookies through your browser settings. Blocking essential cookies may stop parts of the website from working.

• We only send marketing emails where you have opted in, or where you are an existing customer and the message concerns similar programmes (with an opt-out in every message, as UK law allows).
• Every marketing email contains an unsubscribe link that works immediately.
• Service messages — receipts, access instructions, certificate notifications, policy changes — are not marketing and are sent to all learners.

We never sell personal data. We share it only with:

• Our group companies and platforms — including the TilGlobal learning and checkout platform that delivers your programme and processes your order.
• Payment providers — to process payments and refunds.
• Service providers — hosting, email delivery, analytics and technology providers who process data on our instructions under contract.
• Delivery partners — name and address only, where you order a printed certificate.
• Authorities — where required by law or to protect our legal rights.

Our systems are primarily operated from the United Kingdom. Where a service provider processes data outside the UK, we ensure an adequate level of protection through UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement or standard contractual clauses.

• Learner records and certificates — kept indefinitely so we can verify your certificate for employers and reissue it if you lose it.
• Financial records — kept for 6 years after the tax year they relate to, as required by UK law.
• Enquiries and chat conversations that do not lead to enrolment — kept for up to 24 months, then deleted.
• Technical logs — kept for up to 12 months for security purposes.

You can ask us to delete data earlier at any time (section 12); we will do so unless the law requires us to keep it.

• All traffic to and from the website is encrypted with TLS (HTTPS).
• Personal data is stored on access-controlled systems, limited to staff who need it to do their jobs.
• Card payments are handled by PCI-DSS-compliant payment providers; card numbers never touch our systems.
• In the unlikely event of a breach that risks your rights, we will notify you and the Information Commissioner's Office as UK GDPR requires.

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have your data deleted where no legal ground requires us to keep it.
• Restriction and objection — limit or object to certain processing, including all direct marketing.
• Portability — receive the data you provided in a machine-readable format.
• Withdraw consent — at any time, where processing is based on consent.

To exercise any right, email [email protected] with the subject line "Data request". We respond within one calendar month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, though we would welcome the chance to resolve any concern with you first.

Our programmes are designed for adults and learners aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy from time to time to reflect changes in our services or the law. Material changes are highlighted on this page and, where appropriate, notified to enrolled learners by email. The "last updated" date at the top of the page shows when the current version took effect.