Privacy Policy

1.Who we are

Digital Delivery Academy Ltd ("DDA", "we", "us", "our") is a training provider and approved ILM Centre delivering the ILM Level 5 Certificate in Operational Leadership & Management Skills. We are the data controller responsible for personal data we collect from applicants, learners, employer partners, and website visitors.

This policy explains what we collect, why, how we keep it safe, and the rights you have over your data. If anything here is unclear, contact us using the details above.

2.Data we collect

When you apply

To process an application to the programme, we collect:

• Your name, date of birth, and gender (required by the Institute of Leadership & Management for learner registration)
• Your email address and phone number
• Your current role and employer (where applicable)
• Your years of professional experience
• Your preferred cohort, funding route, and payment plan
• Whether you are a service leaver or ex-military (optional)
• Your goals and how you heard about us (optional)

When you become a learner

If your application is accepted and you enrol, we additionally process:

• Payment details (handled by our payment processor — we do not store card numbers)
• Learning records, assessments, and assignment submissions
• Attendance and participation records from live Decision Lab sessions
• Communications you exchange with us via Microsoft Teams, email, or our learning platform

When you visit our website

Our website uses cookie-free, server-side analytics (Netlify Analytics) to understand how the site is used. We do not use tracking cookies or third-party advertising pixels. No personal data is collected from casual website visits.

3.Why we process your data

We rely on the following lawful bases under UK GDPR:

• Contract: to process your application, deliver the programme you enrol on, issue your qualification, and manage payment
• Legal obligation: to meet the regulatory requirements of the Institute of Leadership & Management (ILM) and its awarding framework, and to keep records required by HMRC and company law
• Legitimate interests: to communicate with applicants about cohort availability, to improve our programme, and to keep records of unsuccessful applications for a limited period
• Consent: for any optional marketing communications — you can withdraw consent at any time

4.How we share your data

We share only what is necessary, and only with the following parties:

• The Institute of Leadership & Management (ILM) and City & Guilds: your name, date of birth, gender, and assessment records are submitted via the Walled Garden platform for qualification registration, quality assurance, and certification. This is a regulatory requirement of the qualification
• Kajabi: our learning platform provider, acting as a data processor on our behalf to host course content, administer enrolment, and process payments
• Netlify: our website host, which handles server-side analytics and domain delivery
• Microsoft: Teams and SharePoint are used for live sessions and secure document storage under a business agreement
• Our payment processor: Stripe (via Kajabi Payments), which handles card transactions under PCI DSS compliance — we never see or store full card details
• HMRC and our professional advisors: where required by law or for legitimate accounting purposes

We do not sell your data, rent it to marketers, or share it with any party for advertising.

5.How long we keep your data

• Unsuccessful applications: retained for 6 months from the decision date, then deleted
• Learner records: retained for the duration of your programme and for 7 years afterwards, in line with ILM record-keeping requirements and UK tax law
• Assessment evidence and ILM audit records: retained for 3 years after certification as required by ILM quality assurance
• Financial records: retained for 7 years to meet statutory accounting requirements
• Marketing consent records: retained until you withdraw consent, then deleted within 30 days

6.Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you (right of access)
• Have inaccurate data corrected (right to rectification)
• Request deletion of your data where we no longer have a lawful basis to hold it (right to erasure)
• Restrict how we process your data, or object to processing based on legitimate interests
• Receive a copy of your data in a portable format (right to data portability)
• Withdraw consent at any time, where consent is the basis for processing
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113

Some rights are subject to limits — for example, we must retain certain records to meet ILM and HMRC obligations even if you request deletion. We will explain clearly if this applies to your request.

7.How we protect your data

We take your data seriously. We use:

• Encrypted transmission (HTTPS) for all data moving between you and our systems
• Access controls limiting who within DDA can see your records — in practice, only Chris Lord (Director) and Lisa (Operations)
• Multi-factor authentication on all administrative accounts
• Secure, encrypted storage via Microsoft SharePoint and Kajabi
• Documented procedures for responding to data breaches within 72 hours as required by UK GDPR

8.International transfers

Some of our processors (including Kajabi and Microsoft) may process data outside the UK. Where this happens, we rely on appropriate safeguards — International Data Transfer Agreements or equivalent mechanisms recognised by the UK government — to ensure your data is protected to UK GDPR standards.

9.Changes to this policy

We may update this policy from time to time to reflect changes in our practices, the services we offer, or the law. The "Last updated" date at the top of this page will show when changes were made. For material changes affecting current learners, we will notify you directly by email.

10.Contact us