Privacy policy
Your privacy matters, and we take it very seriously. Below, you can find out how your data is used, stored and protected.
Last updated: 5 November 2026
This policy explains what personal data we collect, why we collect it, who helps us process it, and the rights you have over it.
Who we are
Vant Academy is a trading name of Vant Enterprises Limited, a company registered in England and Wales (company number 13411198). Our registered office is Suite A, 82 James Carter Road, Mildenhall, Bury St Edmunds, Suffolk, IP28 7DE.
For the personal data described here, we are the data controller. That means we decide how and why it’s used, and we’re responsible for protecting it.
We are registered with the Information Commissioner’s Office (ICO). Our registration number is ZB732761.
Contact: privacy@vant-academy.co.uk
What we collect and why
We only collect what we need.
When you join our mailing list or register interest
- What: your email address, your consent (with the date and time you gave it) and which page you signed up on, so we know whether you’re waiting for a particular course or a course in a new area. If you ask for a course near you, we also ask for your town or area. You can also choose to add your first name, your area (if we haven’t already asked) and what’s prompting your interest.
- Why: to send you course dates, news and occasional updates, and to work out where and when to run courses.
- Lawful basis: your consent. You can withdraw it at any time using the unsubscribe link in every email, or by emailing us.
If you book and pay for a course yourself, we’ll also email you about similar courses and related news, unless you tell us not to by ticking the box on the booking form. You can unsubscribe at any time using the link in every email. For these emails, our lawful basis is our legitimate interests in telling our customers about similar courses, as UK electronic marketing law allows. If someone else booked your place, we only add you to our mailing list if you sign up yourself.
When you contact us
- What: your name, your contact details (such as your email address) and whatever you choose to tell us in your message. This applies whether you email us or message us through social media.
- Why: to reply to you and deal with your enquiry.
- Lawful basis: our legitimate interests in answering people who get in touch. If your enquiry is about booking a course, the basis is taking steps towards a contract with you.
When you book a course
Bookings are made through Eventbrite. If someone else books a place for you, such as your employer, they give us your name and email address so we can contact you about the course.
- What: your name, email address, mobile number, any answers you give to booking questions (for example, accessibility needs or dietary requirements), and a record of what you booked and paid. We never see your full card details. Eventbrite and its payment providers handle those.
- Why: to deliver the course, contact you about it, and keep the records the law requires.
- Lawful basis: contract, so we can deliver what you booked, and legal obligation, for tax and accounting records.
We use your mobile number only to contact you about your course, for example if we have to cancel at short notice. We never use it for marketing.
If you tell us about access needs
When you book, or when you contact us, you can tell us about access needs, dietary requirements or anything else that would help. This can include health information, which the law treats as special category data.
- Why: only to make the course work for you.
- Lawful basis: your explicit consent, which you give by choosing to tell us. You can ask us to delete it at any time.
We never put this information into AI tools, and we delete it after your course (see below).
Photos and videos at our courses
We never photograph or film you without asking first. If you agree, we may use photos or videos of you on our website and social media to show what our courses are like.
- Lawful basis: your consent. You can withdraw it at any time by emailing us. We’ll then stop using the images and remove them from our website and social media.
Social media
We have pages on Facebook and LinkedIn. If you message us there, we treat it like any other enquiry (see “When you contact us” above). Meta (which runs Facebook) and LinkedIn are separate controllers of the data on their platforms, and their own privacy policies apply.
These platforms give us anonymous statistics about how people use our pages, such as how many people saw a post. For those statistics, we and the platform are joint controllers. The platform takes the main responsibility and handles requests about them, under Meta’s Page Insights Controller Addendum and LinkedIn’s Page Insights Joint Controller Addendum. Our lawful basis is our legitimate interests in understanding what’s useful to our audience.
When you visit this website
- Security: our forms use Cloudflare Turnstile to check that a real person, not a bot, is submitting them. To do this, Turnstile briefly processes technical information such as your IP address and browser details. Our lawful basis is our legitimate interests in keeping the site and our mailing list free of spam and abuse.
- Hosting: Cloudflare hosts and protects this site. Like any web host, it processes technical data such as IP addresses so it can deliver pages and block attacks. Our lawful basis is our legitimate interests in running a secure website.
See our cookie policy for what, if anything, is stored on your device.
Who processes your data for us
We use a small number of trusted providers, known as processors. They only act on our instructions and must keep your data secure. We don’t sell your data, and we never share it for anyone else’s marketing.
| Provider | What they do for us | Where data is held |
|---|---|---|
| MailerLite | Mailing list and email newsletters | EU; may be transferred to the USA under standard contractual clauses |
| Eventbrite | Course bookings and payments | USA, under the UK–US Data Bridge and the UK Addendum to standard contractual clauses |
| Cloudflare | Website hosting, security and spam protection (Turnstile) | Global network run by a USA-based company, under the UK–US Data Bridge and the UK Addendum to standard contractual clauses |
| Zoho Mail | Our business email | EU; limited access from India for technical support, under standard contractual clauses |
| Anthropic (Claude) | AI tools we use to draft replies and content, and to handle admin — see our AI usage policy | USA, under the UK Addendum to standard contractual clauses |
Eventbrite also handles some booking data for its own purposes, such as fraud prevention and its own account services. For that data it is a separate controller, and its own privacy policy applies. Read Eventbrite’s privacy policy.
AI and your data
We use AI tools throughout the business. A person checks anything an AI tool produces before it reaches you, and a person makes every significant decision. Some of those tasks involve personal data. Drafting a reply to your email, for example, means the AI tool sees your name and email address. We give AI tools only the personal information a task genuinely needs, we never put sensitive (special category) information into them, and we choose business-grade settings that stop providers training on our data where that option exists. The AI providers we use are processors, bound by the same rules as our other providers, and are listed in the table above.
We never make decisions about you using automated processing alone, AI or otherwise. Our AI usage policy explains how we use AI in more detail.
Transfers outside the UK
Some of our providers store or access data outside the UK. When they do, we make sure your data stays protected by one of these routes:
- the destination is covered by UK “adequacy” regulations (as the EU and EEA are)
- the provider is certified under the UK–US Data Bridge
- we have the UK’s approved contract clauses in place (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses)
How long we keep it
| Data | How long |
|---|---|
| Mailing list | Until you unsubscribe. We also remove contacts who haven’t opened an email in 12 months. |
| Enquiries | 12 months after we last hear from you, unless the enquiry leads to a booking. This includes messages through social media. |
| Booking and payment records | 6 years after the end of the financial year, as tax law requires. |
| Accessibility and dietary information | Deleted within 30 days of the course. |
| Mobile numbers | Deleted within 30 days of your course. |
| Photos and videos | Until you withdraw your consent, or we no longer have a use for them, whichever is sooner. |
When we no longer need data, we delete it securely. Eventbrite keeps its own copy of booking data under its own privacy policy.
How we keep it safe
Access is limited to the people who need it. Our accounts use strong, unique passwords and two-factor authentication. This website is served over an encrypted connection (HTTPS), and we choose providers that meet recognised security standards.
Your rights
Under UK data protection law, you have the right to:
- access the personal data we hold about you
- correct anything that’s wrong or incomplete
- delete your data, when we have no good reason to keep it
- restrict how we use your data
- object to us using your data based on our legitimate interests, and to direct marketing at any time
- take your data with you (data portability), where the right applies
- withdraw consent at any time, where we rely on consent. This doesn’t affect anything we did before you withdrew.
To use any of these rights, email privacy@vant-academy.co.uk. It’s free, and we’ll respond within one month.
Complaints
If you’re unhappy with how we’ve handled your data, please tell us first at privacy@vant-academy.co.uk. We’ll acknowledge your complaint within 30 days and aim to put things right quickly.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Children
Our courses and mailing list are for adults running or working in businesses. We don’t knowingly collect data from anyone under 18.
Changes to this policy
We’ll update this policy when our services or the law change. The date at the top shows the latest version. If a change significantly affects how we use your data, we’ll tell mailing list subscribers by email.