Privacy Policy

Last updated: July 2026

Who we are

YOUbuntu CIC is a Community Interest Company providing anti-racism education, racial-literacy training and related services. We are the "data controller" for the personal information described in this policy. You can reach us through our contact form. [Registered office and CIC company number to be added here.]

The information we collect

  • Account details — your name, email address and (for schools/organisations) your organisation name.
  • Bookings & enquiries — the details you give us when you book a session or send a message.
  • Learning data — your course enrolments, progress and any certificates you earn.
  • Purchases — order and invoice details when you buy from us. Card payments are handled by our payment providers; we never see or store your full card number.
  • Technical data — a session cookie to keep you logged in and protect forms, plus, only if you agree, privacy-respecting analytics.

How and why we use it

We use your information to provide your account and courses, fulfil bookings and orders, send you service messages (for example booking confirmations), keep the site secure, meet our legal and accounting obligations, and — only with your consent — send you our newsletter. Our lawful bases are performing our contract with you, our legitimate interest in running the service safely, your consent (for marketing), and compliance with the law (for accounting records).

Payments

We take payments through Stripe (cards) and GoCardless (Direct Debit). They process your payment details under their own privacy policies. We store only a payment reference, never your card details.

Who we share it with

We share data only with the providers who help us run the service — our hosting, email, payment and accounting (Xero) providers — and only as needed. We do not sell your personal data. We may disclose information if the law requires it.

Working with schools

When we deliver programmes for a school or organisation, that organisation is usually the data controller and we act as a data processor under a separate agreement. We collect the minimum needed and keep it only as long as necessary.

How long we keep it

We keep account and learning data while your account is active. Order and invoice records are kept for as long as accounting and tax law requires; if you ask us to delete your account, we anonymise those financial records rather than removing them entirely.

Your rights

You can access, download or delete your data at any time from your account's Data & Privacy page, or by contacting us. You also have the right to correct inaccurate data, object to certain processing, and withdraw consent (you can unsubscribe from the newsletter via the link in any email). If you have a concern you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. [ICO registration number to be added here, if applicable.]

Changes

We may update this policy from time to time. The "last updated" date above shows when it last changed.