PRIVACY POLICY

Last updated: 13 August 2026

This policy explains how Academy94 uses personal information across academy94.co.uk, the Academy94 online platform, accounts, shop, courses, lessons, coaching, studio hire, events, memberships, recordings, communications and related services.

1. Who is responsible for your information?

Academy94 Ltd, trading as Academy94 (“Academy94”, “we”, “us” or “our”), is the controller of the personal information described in this policy unless we specifically say that another organisation is the controller.

Academy94 Ltd is registered in England and Wales under company number 17252681. Its registered office and principal trading address are Crown House, 94 Armley Road, Leeds, England, LS12 2EJ, United Kingdom.

For privacy questions, rights requests or complaints, contact:

• Email: team@academy94.co.uk
• Telephone: 0113 460 4323
• Post: Privacy, Academy94 Ltd, Crown House, 94 Armley Road, Leeds, England, LS12 2EJ, United Kingdom

2. Scope

This policy applies when you:

• visit our website or use cookies or similar technology;
• create or use an Academy94 account or artist dashboard;
• buy merchandise, digital products, courses, memberships or other services;
• book or attend a lesson, coaching session, studio, workshop or event;
• upload music, audio, images, video, documents or creative material;
• receive feedback, assessment, scoring, recommendations or progress records;
• appear in an authorised lesson recording, event image, livestream, studio recording or CCTV footage;
• join a community or use messaging, comments or other platform features;
• contact us, subscribe to marketing, enter a promotion or interact with support; or
• act for a Business Customer, supplier, tutor, contractor or partner.

It does not govern a third party’s own website, app or service merely because we link to it. Those organisations provide their own privacy information.

3. The information we collect

Depending on how you use Academy94, we may collect the following categories.

3.1 Identity, account and contact information

This includes your name, username, artist or DJ name, email address, telephone number, age or date of birth information, account identifiers, encrypted password or authentication information, role, profile image, social media handle, billing address, delivery address and postcode.

For younger students, it may include the name and contact details of a parent or guardian and records of permissions or consent.

3.2 Verification and safety information

This may include age confirmation, limited photo ID information for studio access, fraud or account verification results, accessibility or reasonable adjustment requests, emergency contact details, incident reports and information reasonably needed for safeguarding, health and safety or site security.

We do not need a copy of your ID for every service. Where a studio booking requires ID, we aim to verify it without keeping a copy where practical. If a copy is needed, it is restricted access and deleted under the retention schedule below unless a legal or safety reason requires longer retention.

3.3 Order, transaction and payment information

This includes products and services ordered, prices, VAT or tax information, coupons, gift purchases, payment status, provider references, instalment status, refunds, disputes, chargebacks, invoices and delivery information.

Academy94 does not normally receive or store complete payment card numbers. Payment providers process card, bank, credit or buy now, pay later information under their own security standards and privacy notices. We receive limited tokens, status and transaction references needed to administer the order.

3.4 Booking, lesson and studio information

This includes lesson packages and credits, activation and expiry dates, bookings, requested and assigned tutors, connected availability, reschedules, cancellations, attendance, late arrivals, missed appointments, studio rooms, hire times, attendee details, equipment issues, cleaning or damage records and access logs.

We keep an audit history of material manual changes to lesson credits and of legacy credits migrated from earlier systems.

3.5 Education, development and progress information

This may include course enrolment, learning level, lesson history, course progress, quiz or assignment results, completion, certificates, goals, Artist Focus Map information, Artist Mark or other developmental scores, assessments, recommendations, milestones, tutor notes, homework, action points and feedback.

Development scores and recommendations are coaching tools. They are not formal qualifications or decisions about employment, finance or legal rights.

3.6 Creative content and uploads

This includes tracks, mixes, stems, samples, project files, video, photography, artwork, logos, press releases, EPK material, social posts, marketing plans, documents, links, comments and other content submitted for hosting, feedback, mastering, assessment, content review, platform use or creative services.

Files may contain metadata such as author, device, creation time or location. Remove metadata you do not want to share before upload where the service does not need it.

3.7 Lesson recordings, transcripts and AI assisted notes

Where a student agrees to lesson recording, we may process voices, names, lesson or coaching discussion, music and project discussion, the original audio, a transcript, summary, action points, homework, tutor or student feedback and meeting metadata such as date, time and participants.

This is explained in detail in section 8.

3.8 Communications

This includes contact forms, emails, telephone notes, support enquiries, booking messages, complaints, rights requests, chat or WhatsApp messages sent to Academy94, survey responses and records of service or marketing preferences.

3.9 Remote session and integration information

For Zoom or other remote sessions, this may include meeting identifiers, attendance, display name, chat, connection information and any recording or transcript that has been separately notified.

Booking integrations may process limited calendar information, such as busy/free status, availability, event identifiers and tutor appointment information. We do not need the full private contents of a tutor’s external calendar merely to prevent duplicate booking.

3.10 Images, video and audio at our premises and events

This may include event photography, performance video, livestream footage, studio deliverables, testimonials and general images of Academy94 activities. If CCTV operates at a premises, it may capture images, time, date and location for security, safety and incident investigation. CCTV audio will be disabled unless there is an exceptional, documented and lawful need.

3.11 Technical, usage and security information

This includes IP address, browser, device type, operating system, language, approximate location derived from IP, referring page, pages or features used, cart and session information, login activity, security events, errors, performance information and cookie or consent preferences.

3.12 Marketing and profile information

This includes newsletter subscription, campaign interaction, areas of interest, purchase or course history used to select relevant Academy94 messages, audience segments, competition entries, testimonial permissions and suppression list information.

4. Where information comes from

We collect information:

• directly from you, a parent or guardian, an authorised Business Customer contact or another person booking for you;
• from your use of the website, platform, dashboard, booking system and connected device;
• from Academy94 tutors, staff and contractors who deliver services or record progress;
• from payment, ecommerce, membership, booking, calendar, video conference, hosting, analytics and security providers;
• from social networks or music platforms when you give us a profile or track link or use an integration;
• from public professional sources where appropriate for genuine business contact or artist research; and
• from fraud prevention, identity verification, delivery or professional adviser services where necessary.

If you give us information about another person, tell them about this policy and make sure you are authorised to provide it.

5. Why we use information and our lawful bases

UK data protection law requires a lawful basis for each purpose. More than one basis may apply to the same information in different circumstances.

5.1 Contract

We use information where necessary to take steps at your request before a contract or to perform a contract, including to:

• create and manage an account;
• process orders, payments, refunds and deliveries;
• allocate, display and redeem lesson credits;
• arrange lessons, tutors, studios, events and remote sessions;
• provide courses, digital content, memberships and dashboard features;
• host and review creative uploads;
• provide feedback, assessments, project deliverables and support; and
• send essential service, order, booking, security and access communications.

If you do not provide information needed for the contract, we may be unable to create an account, accept an order, verify eligibility or deliver the service.

5.2 Legal obligation

We use information where necessary to comply with law, including tax and accounting records, consumer rights obligations, product safety, court orders, regulatory requests, data protection rights, safeguarding duties that apply in the circumstances and lawful fraud or crime prevention requirements.

5.3 Legitimate interests

We use information where necessary for our or another person’s legitimate interests and where those interests are not overridden by your rights. These interests include:

• operating, securing, debugging and improving Academy94 services;
• preventing fraud, chargebacks, account abuse and unauthorised access;
• maintaining accurate credit, attendance and service records;
• planning tutor availability, capacity, courses and facilities;
• providing proportionate, reviewed by a person learning recommendations;
• handling enquiries, complaints, legal claims and business administration;
• protecting students, staff, visitors, equipment and premises;
• taking proportionate general event images after clear notice;
• understanding service use and measuring performance; and
• marketing Academy94’s own similar services to eligible existing customers where electronic marketing law permits and an opt out was offered.

Where we rely on legitimate interests, you can object. We will consider your circumstances and stop unless we have compelling legitimate grounds or need the information for legal claims. The right to object to direct marketing is absolute.

5.4 Consent

We rely on consent where appropriate, including for:

• optional lesson audio recording and AI transcription;
• optional marketing where consent is required;
• optional cookies and tracking that do not qualify for a legal exception;
• prominent marketing use of an identifiable student’s image, performance, testimonial or case study;
• processing sensitive information where explicit consent is the appropriate condition; and
• any optional use of Academy94 customer content for AI model training or an unrelated purpose.

You may withdraw consent at any time. Withdrawal does not make earlier lawful processing unlawful. If information is also needed for another lawful purpose, we will explain what must be retained.

5.5 Vital interests

In a genuine emergency, we may use or share limited information where necessary to protect someone’s life or physical safety.

6. Sensitive or special category information

Information about health, disability, race or ethnicity, religion, sexual orientation, political opinions, trade union membership, genetics or biometrics used for unique identification is subject to additional protection.

Academy94 does not ask students to provide unnecessary sensitive information. We may need limited health, disability, accessibility, safeguarding or incident information to make a reasonable adjustment, protect safety or respond to an emergency. We identify an Article 6 lawful basis and an appropriate special category condition before deliberately retaining or using it.

A lesson discussion or creative upload could incidentally reveal sensitive information. Students should avoid unnecessary disclosure. If a transcript contains sensitive information that is not needed, we will redact or delete it where practical. If we need to keep or use it, we will identify an appropriate legal condition, which may be explicit consent in an optional recording context.

We do not use lesson recordings to infer emotion, health, ethnicity or other sensitive traits.

7. The Academy94 online platform

The online platform may combine account information, purchases, lesson credits, bookings, progress, assessments, track feedback, uploads, community participation, memberships and recommendations in one dashboard.

Relevant Academy94 staff and authorised tutors can access only the information reasonably needed for their role. A tutor may see a student’s name, contact or booking details, goals, relevant uploads, prior feedback and progress information needed to deliver the service. Tutors must not keep student files indefinitely in personal folders, export them for unrelated use or contact students for an unrelated personal or marketing purpose.

Administrators may correct credits, bookings and progress records. Material manual credit changes are logged to protect both students and Academy94.

We may use rules or AI assisted tools to organise content, highlight learning options, summarise feedback, analyse submitted material or support development scoring. Staff retain oversight. Students may ask for important factual information to be reviewed.

We do not intend to use Artist Mark, Artist Focus Map, course progress, AI analysis or similar tools to make a solely automated decision that has a legal or similarly significant effect. If this changes, we will provide specific information about the logic, significance, consequences and available human review before the processing begins.

7.1 Connected music and social platforms

Connected-platform features are optional. If you choose to connect a SoundCloud or other supported music or social account, you authorise that platform to provide Academy94 with the limited information needed for the feature you request. Academy94 does not receive or store your platform password.

For a connected SoundCloud account, the information may include the SoundCloud account identifier, profile name and profile fields, avatar, follower and following counts, public or otherwise authorised tracks and playlists, track and release metadata, and performance counters made available by SoundCloud, such as plays, likes, reposts, comments and downloads. We also process encrypted access and refresh tokens, connection status, last-sync information and dated analytics snapshots so Social Studio can display current statistics and changes over time.

We use this information to provide the connected analytics feature you request, maintain and secure the connection, refresh authorised information, diagnose errors and show your own artist-development signals. Where applicable, Academy94 may also use permitted public catalogue metadata to improve text-based track identification in DJ Intelligence. We do not use SoundCloud audio for fingerprinting, download or copy SoundCloud audio, train or supply SoundCloud content to an AI model, or use the connection to obtain private listening history.

Our usual lawful basis is performance of our contract with you where the connection is needed to deliver a feature you request. We may also rely on legitimate interests for proportionate security, service administration and improvement. We will rely on consent where applicable law specifically requires it. Authorising a platform connection is separate from any consent used for electronic marketing.

SoundCloud and each other connected platform remain responsible for their own processing and provide their own privacy information. Information sent to or received from SoundCloud is also governed by the SoundCloud Privacy Policy and the permissions shown during SoundCloud authorisation.

You can disconnect SoundCloud at any time from My Account > Settings > Integrations and may also revoke access in your SoundCloud settings. When disconnected, Academy94 stops requesting SoundCloud information and removes the stored SoundCloud tokens, connected-account record, imported snapshots and Academy94 trend history without undue delay and in any event within seven days, unless limited information must be retained for security, legal claims or another legal obligation. Disconnecting does not delete information held independently by SoundCloud.

We limit access to authorised staff and service providers, protect connection credentials using encryption and access controls, request no more platform information than the feature needs, and do not sell connected-platform personal information.

7.2 Meta, Facebook and Instagram Platform Data

Connecting a Facebook Page or Instagram professional account is optional and is initiated by the account holder through Meta’s authorisation flow. Depending on the permissions approved by Meta and selected by you, Academy94 may receive limited Meta Platform Data such as account, Page and professional profile identifiers, names, usernames, profile images, follower or audience counts, authorised media and content metadata, and permitted reach, views, engagement and other insight metrics. We also process encrypted access tokens, granted scopes, connection status, last-sync information and dated analytics snapshots needed to operate Social Studio.

We use Meta Platform Data only to provide, secure and support the connected feature requested by the account holder, display the account holder’s own artist and content analytics, maintain the connection, diagnose errors and create permitted aggregated or derived career-development signals. We do not use the connection to manage advertising, access unrelated business assets, obtain private listener activity, sell Platform Data or train an unrelated AI model. Academy94 requests only the permissions needed for enabled features and follows applicable Meta Platform Terms, Developer Policies and permission-specific requirements.

You can disconnect a Meta connection through Academy94 account settings and can also remove Academy94 through the relevant Facebook or Instagram settings. After disconnection we stop requesting new Meta Platform Data and remove stored Meta access tokens, connected-account records, imported snapshots and Academy94 trend history without undue delay and in any event within seven days, unless a limited record must be retained for security, legal claims or another legal obligation. Information retained independently by Meta is governed by Meta’s own policies.

7.3 Multi-platform artist analytics and DJ Intelligence

Where a feature is available and the relevant platform permits it, Academy94 may support SoundCloud, Meta services including Facebook and Instagram, Spotify, Beatport, Apple Music, Amazon Music, Discogs and other disclosed music or social platforms. A connection may use OAuth or another platform-approved authorisation method, an artist or release URL or identifier supplied by you, or public catalogue and professional-profile data made available under the platform’s rules. We do not ask for or store a platform password.

To provide a coherent Social Studio and DJ Intelligence service, we may normalise and correlate permitted identifiers, artist names, track and release titles, versions, labels, catalogue identifiers, dates, genres, artwork references, follower or audience counts, authorised performance metrics and source links across supported platforms. This can be used to reduce duplicate records, match tracks from uploaded playlist text, improve track identification, show source-specific analytics together and calculate transparent trends or recommendations. We retain the source platform and retrieval time so users can understand where a result came from. We do not present inferred matches as certain where confidence is insufficient, and material platform-specific restrictions take priority over this general description.

Each integration remains subject to the permissions you grant, the data actually made available, the platform’s current developer terms and any approval, rate, display, caching, attribution, deletion or use restrictions. We do not bypass access controls, scrape information where prohibited, copy protected audio merely to build a fingerprinting library, combine private listener histories, or use connected-platform data for unrelated advertising. Removing one connection stops future collection from that platform without automatically deleting information held independently by another platform. Academy94 applies the shortest applicable platform rule where different requirements overlap.

8. Optional Plaud lesson recording and AI transcription

8.1 Student facing summary

Some lessons may be audio recorded and AI transcribed to produce personalised feedback, learning notes, action points, homework and progress records.

8.2 Recording is optional

Academy94 relies on consent for this optional recording. The tutor must tell the student before recording begins and must verbally confirm at the beginning of the recorded lesson that audio recording and transcription are active.

You may say no or ask the tutor to stop. You will still receive the lesson and the tutor will use a not recorded alternative, normally manual notes. Refusing recording does not reduce your course access or lesson time.

For a younger student, Academy94 will obtain appropriate parent or guardian permission and will also explain recording to the student in suitable for their age language. Recording will not be used where the required permission has not been obtained.

8.3 What is captured

The recording may contain voices, names, lesson and coaching discussion, music or project discussion, tutor and student feedback, and meeting metadata. Plaud may generate a transcript, summary, action points, homework and other structured notes.

Avoid discussing unnecessary highly sensitive personal information. Tell the tutor if a discussion should pause or a section should not be recorded.

8.4 Why we record

The purposes are to help the student remember teaching and feedback, produce sufficiently accurate learning notes, record agreed actions, support continuity between sessions and help the tutor review progress. We do not use recordings for staff surveillance, public content, marketing, advertising or unrelated profiling.

8.5 Plaud and third party AI processing

Academy94 uses Plaud recording devices and services. To create transcription and summaries, audio or text may be securely sent to Plaud and its AI service providers. Plaud states that its AI processing may use enterprise services from OpenAI, Google and Microsoft for transcription and summarisation.

Plaud states, as at the date of this policy, that these AI providers process the content to return the requested output under no retention enterprise arrangements and do not use customer recordings, transcripts, prompts or summaries to train, fine tune, test, evaluate or improve their models. Plaud also states that it does not use customer content for AI model training unless the user gives an explicit, informed opt in.

Academy94 will not opt lesson content into AI training and will not allow recording, transcript or summary content to be used to train an unrelated AI system without separate, explicit permission and updated privacy information.

Providers, models and regional processing arrangements can change. We will review the service and update this policy before making a material change to the purpose or privacy impact.

8.6 AI accuracy and human review

Transcription and summarisation are AI assisted and may mishear words, equipment names, technical instructions, tracks or speakers, and may omit context. A transcript is a supporting note, not necessarily a word for word or authoritative record of the lesson.

Tutors should review important feedback, actions and technical instructions before treating them as final. Students should check important information and tell us about a material error. Where appropriate, we will correct the summary or mark a disputed point rather than preserving a known inaccuracy.

8.7 Storage, access and delivery

During processing, Academy94 may keep both the original audio and the generated transcript or summary in an authorised Academy94 or Plaud account.

• Original audio: deleted from active Academy94 and Plaud storage within 30 days after the lesson, once the summary has been checked, unless it is temporarily needed to correct a disputed transcript, investigate a safeguarding or security incident, or establish or defend a legal claim. If an exception applies, access is restricted and the audio is deleted when that need ends.
• Raw transcript: deleted within 90 days after the lesson once useful notes have been checked and transferred, unless a student requests continued access or it is needed for a documented dispute.
• Reviewed summary, action points and learning notes: retained for 24 months after the relevant lesson or until the student’s account is closed, whichever is later where the record remains needed to provide an active course. A limited relevant extract may be retained for up to six years where necessary for a legal claim or contractual record.

Reviewed summaries may be placed in the artist dashboard or sent to the email address on the student’s account. Raw audio is not routinely placed in the dashboard. Raw transcripts are not routinely shared more widely than the student and relevant tutor or staff.

Only relevant Academy94 staff, the tutor delivering or supervising the service and authorised technical providers may access recording content. Tutors must use approved Academy94 or Plaud systems and must delete any temporary export from a personal device or folder as soon as it has been transferred or is no longer needed.

8.8 Access, correction, deletion and objection

You can ask for access to your recording related information, correction of a transcript or summary, or deletion where the law applies. You may withdraw recording consent for future sessions at any time. You may also ask us to delete an existing optional recording; we will do so unless a lawful, documented reason requires limited retention.

A recording can include another person’s information. We may need to redact, summarise or withhold parts to protect their rights.

8.9 International processing and security

Plaud states that it uses regional data centres, including European infrastructure, and regional enterprise AI endpoints where available. The processing chain may still involve organisations or support access outside the United Kingdom. Section 15 explains international transfer safeguards.

Recording data must be encrypted in transit and at rest where supported, protected by access according to roles access, and kept only in authorised Academy94 and Plaud systems. Recording consent and the privacy notice version in use are logged where practical.

9. Payments, ecommerce and fraud prevention

Payment providers such as Stripe, PayPal, Klarna, Clearpay, banks or WooCommerce supported gateways process information needed to authorise and settle a transaction. They may act as independent controllers for legal compliance, credit, fraud and account functions. Their terms and privacy notices apply to those activities.

Academy94 uses transaction references, payment status, account, IP, device, delivery and order information to prevent fraud, investigate suspicious activity, resolve payment failures and manage refunds or chargebacks. We do not make an adverse decision merely because an automated tool flags a transaction; proportionate human review is used where practical and significant.

10. Bookings, tutors and connected calendars

Our booking system processes requested times, tutor assignment, credits, attendance and contact details to arrange services. Connected Google, Microsoft or Apple calendars may exchange limited availability or event information to prevent duplicate booking. Tutors should configure external events as busy where appropriate and avoid exposing private event descriptions when free/busy status is sufficient.

Calendar and booking providers may experience sync errors. We retain the booking audit and communications needed to resolve conflicts and protect the contractual record.

11. Creative files, track feedback and content services

Academy94 processes uploaded creative content only for the service requested, platform security, support and any separately authorised use. Relevant tutors, engineers, reviewers or content staff may access it.

When you replace a file, the previous active version may be deleted or archived briefly to preserve feedback continuity. Unless the product states otherwise:

• an unreviewed abandoned upload is deleted after 90 days;
• a superseded file is deleted from active storage within 30 days;
• a file and feedback record linked to an active course are kept for up to 24 months after the review; and
• mastering, editing or content project source files are kept for the archive period in the quotation, or 12 months after final delivery if no period is stated.

We may retain a smaller feedback record after deleting the original file. Backups age out under our backup cycle. Users should keep their own master copies; Academy94 is not a permanent archive service.

We do not publish, market or train AI on a student’s creative content without separate permission. If a student asks us to distribute, livestream or publicly review content, that public use is treated as a separate purpose.

12. Images, video, testimonials and CCTV

For prominent marketing uses, such as a named student case study, testimonial, close up campaign image, performance feature or promotional reel, we will seek a separate release or rely on another clearly explained lawful basis. Permission can be withdrawn for future use, although it may not be possible to recall printed material already distributed.

At events, we may take general crowd or atmosphere images where attendees receive advance or on site notice and our legitimate interests are not overridden. We will provide a reasonable way to raise a concern or avoid prominent capture where practical. Additional safeguards apply to children.

If CCTV operates, signs will identify the purpose and controller. CCTV is used for premises security, safety and incident investigation, not routine monitoring of lessons. Footage is normally overwritten within 30 days unless preserved for an incident, insurance claim or legal request. CCTV audio is disabled unless an exceptional lawful need has been documented and additional notice is given.

13. Marketing and service communications

Order confirmations, booking reminders, security alerts, course access messages and important policy or service changes are service communications, not optional marketing. We may need to send them to perform the contract or operate the service.

Promotional email, text, WhatsApp or similar electronic marketing is sent with consent or, where permitted, to an existing customer about Academy94’s own similar products or services after a clear opt out was offered when details were collected and in each message. Sole traders and some partnerships are treated like individuals for electronic marketing rules. Corporate Business Customers may be contacted about relevant business services, but we respect objections.

You can unsubscribe using the link in a message or by contacting us. We keep minimal suppression information so we do not accidentally contact you again.

We do not sell personal information. We do not add a contact to marketing merely because they received a service email, attended an event or appeared in someone else’s address book.

14. Cookies and similar technologies

The website and online platform use cookies, local storage, pixels or similar technologies for functions such as login, account security, WooCommerce cart and checkout, session continuity, preferences, consent records, analytics, embedded media and marketing.

Strictly necessary technologies may operate without consent because they are needed to provide a service you request or secure it. Under current UK law, limited technologies used solely for statistical service improvement or to adapt appearance or functionality may also operate without prior consent where the detailed legal conditions are met, clear information is provided and there is a simple, free way to object.

Other analytics, advertising, behavioural tracking and optional third party technologies require consent before they are used. Rejecting them must be as easy as accepting them. You can change preferences through the site’s cookie controls.

Third party embeds, including video, maps, social media or chat, may set their own technologies. We should prevent optional embedded tracking from loading until the relevant choice has been made.

Typical categories are:

• Essential: security, login, load balancing, cart, checkout, account and consent preferences;
• Functional: optional personalisation, media, maps, chat and enhanced features;
• Analytics: understanding service use and performance; and
• Marketing: measuring campaigns, advertising audiences and cross site behaviour.

The cookie banner or cookie details panel provides current provider, purpose and duration information. As a general rule, consent choices are refreshed at appropriate intervals and analytics or marketing identifiers should not be kept longer than reasonably necessary, normally no more than 13 months without a documented reason.

15. Who we share information with

We share the minimum information reasonably necessary with:

• Academy94 directors, employees, authorised tutors, coaches, engineers and contractors;
• website, hosting, cloud, content delivery, backup, security and technical support providers;
• WordPress, WooCommerce and connected ecommerce services;
• learning, membership and account platforms such as LearnDash, ProfilePress or MemberDash where used;
• booking and scheduling providers such as Amelia and connected calendar providers;
• Zoom or other notified remote session providers;
• Plaud and the AI service providers used through Plaud, including OpenAI, Google and Microsoft for transcription or summarisation;
• payment, bank, buy now, pay later, fraud prevention, accounting and tax providers;
• email, messaging, customer support, analytics and consent management providers;
• couriers, merchandise manufacturers and fulfilment providers;
• venues, event partners, insurers and safety or security providers where necessary;
• professional advisers such as lawyers, accountants and auditors;
• a buyer, investor or successor involved in a genuine sale, restructuring or transfer, subject to confidentiality and data protection safeguards; and
• courts, regulators, law enforcement or public authorities where disclosure is required or lawfully necessary.

Some payment, social, map, video and platform providers act as independent controllers for their own purposes. Other suppliers act as our processors and must follow documented instructions, confidentiality, security and deletion obligations.

We do not share lesson recordings, student uploads or progress information for another organisation’s advertising or unrelated AI training.

15.1 Hosting, Meta Platform Data and public-authority requests

Academy94 currently uses Hostinger for website and application hosting, cloud processing, technical support and backups. The Academy94 site is hosted on infrastructure located in the United Kingdom and backups may be processed in Germany. Hostinger and any authorised subprocessors must process personal information under contractual data-protection, confidentiality, security and deletion obligations. We review material changes to providers and update this policy where appropriate.

Before disclosing personal information, including Meta Platform Data, to a public authority, Academy94 requires a review of the legal basis and scope of the request. We challenge a request where it is considered unlawful or disproportionate, disclose only the minimum information legally necessary, and document the request, response, legal reasoning and people involved. These safeguards do not prevent us from acting where disclosure is lawfully required. As at 13 August 2026, Academy94 had not provided Meta-derived personal information to public authorities in response to national-security requests during the preceding 12 months.

16. International transfers

Some providers operate in the European Economic Area, United States and other countries. Information may therefore be processed outside the United Kingdom.

Before making a restricted transfer, we use an available lawful mechanism, which may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved EU Standard Contractual Clauses;
• another approved Article 46 safeguard; or
• a narrow legal exception where appropriate.

Where required, we assess the destination, provider, contractual protections and practical security measures and add supplementary safeguards. You may contact us for information about the safeguard relevant to a particular transfer, subject to commercial confidentiality.

For Plaud specifically, see section 8. Plaud states that European users are routed to regional infrastructure and that enterprise AI providers operate under no retention and not used for training commitments, but Academy94 still treats the processing chain as potentially international and reviews the available transfer safeguards.

17. How long we keep information

We keep personal information only for as long as needed for the stated purpose, legal obligations, security and proportionate legal claims. The following is our standard schedule; a shorter or longer period may apply where a specific legal hold, safeguarding issue, dispute, product term or recorded justification requires it.

• Account profile and authentication: while the account is active; inactive accounts reviewed after 24 months and deleted or anonymised unless linked to an active product or required record. After an accepted closure request, active profile data is normally removed within 30 days and backups within 90 days.
• Orders, invoices, refunds and tax records: six years after the end of the relevant financial year, or longer if tax law or an active enquiry requires.
• Payment tokens and provider references: while needed for recurring payment, refund, dispute, fraud prevention or accounting; complete card details are not normally held by Academy94.
• Bookings, attendance, cancellations, missed appointments and credit audit: six years after the service or package ends where needed for contract, accounting and dispute records; routine calendar detail may be deleted sooner.
• Course progress, assessments and tutor feedback: while the course or account is active and normally 24 months after the last learning activity, then deleted or anonymised except for a limited completion or certificate record and legal claims.
• Plaud original audio: normally 30 days after the lesson.
• Plaud raw transcripts: normally 90 days after the lesson.
• Reviewed lesson summaries and action points: normally 24 months after the lesson or while needed for an active course, with limited extracts retained up to six years for claims where necessary.
• Creative uploads and project files: according to section 11, normally 90 days for abandoned uploads, 30 days for superseded active versions, 24 months after course feedback, or 12 months after a completed creative project if no other archive period is agreed.
• Photo ID copies for studio access: verify without copying where possible; otherwise normally deleted within 30 days after the booking, unless an incident, fraud concern or law requires longer.
• Support messages and ordinary enquiries: three years after closure; complaints, incidents or legal claims up to six years after resolution, or longer for an active claim.
• Marketing contacts: until unsubscribe, withdrawal, sustained inactivity or our review shows they are no longer appropriate; minimal suppression records retained as needed to honour an opt out.
• Cookie and device identifiers: as stated in the cookie panel; normally session only to 13 months, subject to purpose and current law.
• CCTV: normally 30 days, longer only for an identified incident, claim or lawful request.
• General event images: reviewed at least every three years and deleted when no longer relevant; release records may be kept while the image is in use and for a reasonable claims period.
• Security and login logs: normally 12 months, longer for an active incident or repeated abuse.
• Backups: overwritten on a rolling cycle, normally within 90 days; restored data remains subject to the original deletion rule.

We periodically review retention and securely delete or anonymise information that is no longer needed.

• Connected-platform tokens and imported analytics: retained while the connection is active and needed for the requested feature. After disconnection, tokens, connected-account records, imported snapshots and Academy94 trend history are normally removed within seven days unless a shorter platform rule applies or a limited record is needed for security, legal claims or another legal obligation. Residual backup copies are overwritten on the normal backup cycle, normally within 90 days, and are not restored for ordinary use.

18. Security

We use measures proportionate to the information and risk, which may include encrypted connections, access controls, authentication using multiple factors authentication for privileged accounts, password hashing, access limited to what is needed tutor access, provider due diligence, backups, logging, patching, malware protection, staff confidentiality, incident procedures and secure deletion.

Recordings, transcripts, uploads and student records must be stored in authorised Academy94 or approved provider systems. Tutors and contractors must not keep them indefinitely in personal email, desktop folders, consumer cloud drives or messaging apps.

No online service is completely without risk. If a personal data breach is likely to create a risk to people, we will assess it, contain it, keep required records and notify the relevant regulator and affected people where the law requires.

You also have a role: use a unique password, protect meeting links, sign out on shared devices and tell us promptly about suspicious account activity.

Connected-platform credentials and tokens are encrypted or otherwise protected at rest and in transit, kept separate from public-facing content, restricted to authorised systems and personnel, and used with least-privilege permissions. We monitor access and integration errors, rotate or revoke credentials where appropriate, and require processors handling Platform Data to follow documented security and deletion instructions.

19. Children and younger students

Academy94 services are not intended for an unsupervised child under 16. A younger student may participate only in an agreed arrangement involving a parent or guardian.

We use suitable for their age explanations, collect only what is needed, apply higher privacy defaults, restrict tutor access and avoid profiling or solely automated significant decisions about children. Marketing to children is not based on behavioural profiling.

Parents or guardians may exercise rights on behalf of a child where legally appropriate, but a young person may have their own privacy rights depending on age, understanding and circumstances. We consider the child’s best interests and confidentiality when responding.

Optional lesson recording of a younger student requires appropriate permission and a clear explanation to the student. A not recorded alternative remains available.

If you believe a child has created an account or provided information without an appropriate arrangement, contact us.

20. Your rights

Depending on the purpose and lawful basis, you may have the right to:

• be informed about how your information is used;
• obtain a copy of your personal information;
• correct inaccurate information and complete incomplete information;
• ask for deletion in certain circumstances;
• ask us to restrict use in certain circumstances;
• receive information you provided in a portable format where the right applies;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• withdraw consent at any time; and
• receive safeguards concerning a solely automated significant decision, including human intervention and a way to challenge it, if we ever use such processing.

Rights are not absolute. For example, we may need to retain an invoice for tax, protect another person’s information, preserve a legal claim or keep a suppression record to honour an opt out.

Send a request to team@academy94.co.uk. Tell us which right you wish to use and provide enough information to locate the relevant record. We may request proportionate identification. We normally respond without undue delay and within one month, subject to a lawful extension for a complex or numerous request. There is normally no fee, although the law permits a reasonable fee or refusal for a manifestly unfounded or excessive request.

For a recording or transcript, another participant’s rights may require redaction or a summary rather than an unedited copy.

21. Privacy complaints

Please contact us first at team@academy94.co.uk so we can investigate. State what processing concerns you, when it happened and the outcome you seek. We will acknowledge the complaint within 30 days, investigate without undue delay, keep you informed where more time is needed and explain the outcome and any right to escalate.

You can also complain to the United Kingdom’s data protection regulator:

Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Telephone: 0303 123 1113 Website: ico.org.uk

You may have the right to complain to a regulator or court in another country where you live, work or believe an infringement occurred.

22. Changes to this policy

We review this policy when services, providers or law change. The latest version is posted on the website with its update date. If a change is material, we will take reasonable steps to notify affected account holders, for example through the dashboard or email, before the new use begins where required.

We will not use an existing lesson recording, student upload or other personal information for a materially incompatible new purpose without giving appropriate information and identifying a lawful basis. Where consent is required, we will ask for it.

23. Contact

For any privacy question, request or complaint, email team@academy94.co.uk or write to Privacy, Academy94 Ltd, Crown House, 94 Armley Road, Leeds, England, LS12 2EJ, United Kingdom.