Last updated: 22 September 2026 | Version 2.1
This Privacy Policy explains how TOP92 Ltd (‘we’, ‘us’, ‘our’) collects, uses, stores, discloses and protects your Personal Data when you access or use the ILS101 educational platform at ils101.com (‘the Platform’).
We are committed to processing your data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and other applicable data protection legislation.
Please read this Privacy Policy carefully. By registering for or using the Platform, you acknowledge that you have read and understood this policy. This policy should be read alongside, and in addition to, our Terms and Conditions.
The data controller responsible for your Personal Data is:
TOP92 Ltd
Company No. 16605980
167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom
Data Protection Contact: contact@ils101.com
For all data protection enquiries, please mark your email ‘Data Protection’.
We collect and process the following categories of Personal Data:
| Category | Data Elements | Source |
|---|---|---|
| Identity | Full name, title, professional designation | You (at registration) |
| Contact | Email address, country | You (at registration) |
| Professional | Employer, job title, industry sector | You (optional, at registration) |
| Technical | IP address, browser type and version, device type, operating system, referring URL, session identifiers | Automated collection |
| Usage | Pages visited, lectures viewed, quiz attempts and scores, time spent per page, downloads, session duration | Automated collection via analytics |
| Payment | Transaction ID, amount, currency, payment status. Full card details are processed by Stripe and are never stored on our servers. | Stripe (payment processor) |
We process your Personal Data only where we have a lawful basis to do so under Article 6 of the UK GDPR. The table below sets out each processing purpose and the corresponding lawful basis:
| Purpose | Data Used | Lawful Basis (Art. 6) |
|---|---|---|
| Account creation and authentication | Identity, Contact | Performance of contract (Art. 6(1)(b)) |
| Delivering Course content, tracking progress, issuing certificates | Identity, Contact, Usage | Performance of contract (Art. 6(1)(b)) |
| Processing payments and refunds | Identity, Contact, Payment | Performance of contract (Art. 6(1)(b)) |
| Platform analytics and improvement | Technical, Usage | Legitimate interests (Art. 6(1)(f)) — improving our educational services |
| Platform security and fraud prevention | Technical, Identity | Legitimate interests (Art. 6(1)(f)) — protecting our Platform and users |
| Tax, accounting and legal compliance | Identity, Contact, Payment | Legal obligation (Art. 6(1)(c)) |
| Marketing communications | Identity, Contact | Consent (Art. 6(1)(a)) — withdrawable at any time |
Where we rely on legitimate interests, we have carried out a balancing assessment to ensure that our interests do not override your fundamental rights and freedoms. You may request a copy of this assessment by contacting us.
We do not sell, rent or trade your Personal Data. We share your data only with the following categories of third-party service providers, each of which processes data on our behalf under a data processing agreement (DPA) that complies with Article 28 of the UK GDPR:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Platform hosting and infrastructure | All data stored on Platform | EU (Stockholm) |
| Stripe, Inc. | Payment processing | Identity, Contact, Payment | US (UK-US Data Bridge) |
| Supabase, Inc. | Platform analytics and session tracking | Usage, Technical (anonymised session IDs) | US (UK-US Data Bridge) |
| Google LLC (Google Analytics 4) | Website analytics | Technical, Usage (anonymised) | US (UK-US Data Bridge) |
| Amazon Cognito (AWS) | User authentication | Identity, Contact | EU (Stockholm) |
We may also share your data with: (a) professional advisers (solicitors, accountants, auditors) under professional duties of confidentiality; (b) HM Revenue & Customs, regulators and other authorities where required by law; and (c) law enforcement agencies where we are under a legal obligation to do so.
Some of our third-party processors are based in the United States. Where Personal Data is transferred outside the UK, we ensure that appropriate safeguards are in place as required by Article 46 of the UK GDPR:
You may request a copy of the relevant transfer safeguards by contacting us at contact@ils101.com.
We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, in accordance with the principle of storage limitation (Article 5(1)(e) UK GDPR):
| Data Category | Retention Period | Basis |
|---|---|---|
| Account and Identity data | Duration of account + 6 years | Limitation Act 1980 (contractual claims) |
| Payment and transaction records | 6 years from transaction date | HMRC record-keeping requirements |
| Usage and analytics data | Anonymised after 24 months | Data minimisation principle |
| Marketing consent records | Until consent is withdrawn + 12 months | Demonstrating lawful consent (accountability) |
After the applicable retention period, Personal Data is securely deleted or irreversibly anonymised.
We have implemented appropriate technical and organisational measures to protect your Personal Data against unauthorised or unlawful processing, accidental loss, destruction or damage, in accordance with Article 32 of the UK GDPR. These measures include:
Whilst we take all reasonable precautions, no method of electronic transmission or storage is 100% secure. In the event of a Personal Data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours (Article 33 UK GDPR) and, where required, notify affected individuals without undue delay (Article 34 UK GDPR).
We use cookies and similar technologies on the Platform. Under the Privacy and Electronic Communications Regulations 2003 (PECR), we are required to obtain your consent before placing non-essential cookies on your device.
Categories of cookies we use:
| Type | Purpose | Consent Required |
|---|---|---|
| Strictly Necessary | Authentication, session management, security. The Platform cannot function without these. | No (PECR exempt) |
| Analytics / Performance | Google Analytics 4 and Supabase analytics to understand how the Platform is used and to improve user experience. | Yes |
| Functionality | Remembering your preferences (e.g. theme, progress). | Yes |
You may manage, block or delete cookies at any time through your browser settings. Please note that disabling certain cookies may affect Platform functionality.
For more information about cookies generally, visit www.allaboutcookies.org.
Under the UK GDPR, you have the following rights in relation to your Personal Data. These rights are not absolute and may be subject to exemptions:
| Right | Description | UK GDPR Article |
|---|---|---|
| Access | Request a copy of the Personal Data we hold about you (a ‘subject access request’). | Art. 15 |
| Rectification | Request correction of inaccurate or incomplete Personal Data. | Art. 16 |
| Erasure | Request deletion of your Personal Data (‘right to be forgotten’) where the data is no longer necessary or you withdraw consent. | Art. 17 |
| Restriction | Request limitation of processing where you contest accuracy or object to processing. | Art. 18 |
| Data Portability | Receive your Personal Data in a structured, commonly used, machine-readable format and transmit it to another controller. | Art. 20 |
| Objection | Object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds. | Art. 21 |
| Withdraw Consent | Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing. | Art. 7(3) |
| Automated Decisions | Not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects. We do not currently carry out any solely automated decision-making. | Art. 22 |
How to exercise your rights
To exercise any of the above rights, please email us at contact@ils101.com with the subject line ‘Data Subject Request’. We may ask you to verify your identity before processing your request. We will respond to your request within one calendar month of receipt. If your request is complex or we receive a large number of requests, we may extend this period by a further two months, in which case we will inform you within the initial one-month period and explain the reason for the extension (Article 12(3) UK GDPR).
There is no fee for exercising your rights unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request (Article 12(5) UK GDPR).
The Platform is not directed at individuals under the age of 18. We do not knowingly collect Personal Data from children. If we become aware that we have inadvertently collected data from a child under 18, we will take steps to delete it as soon as practicable. If you believe we hold data relating to a child, please contact us at contact@ils101.com.
If you are unhappy with how we have handled your Personal Data or wish to make a complaint, we encourage you to contact us first at contact@ils101.com so that we can try to resolve the matter.
You also have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. For minor changes, we will update the ‘Last updated’ date at the top of this policy. For material changes that affect how we process your Personal Data, we will: (a) notify you by email at least 30 days before the change takes effect; and (b) where the change affects processing based on consent, seek fresh consent before implementing the change. The latest version of this policy is always available on the Platform.