Privacy Policy

1. Data Controller Information

Webcross Limited ("we", "us", or "our") is committed to protecting and respecting your privacy. Webcross Limited operates as the Data Controller responsible for personal data collected across webcross.co.uk and our educational platform Webcross Academy (academy.webcross.co.uk).

Company Registered Address: York, North Yorkshire, United Kingdom.
Data Privacy Inquiries: [email protected]
Telephone: +44 73 855 42850

2. The 7 Core Data Processing Principles

In accordance with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, all personal data is processed under the seven core principles:

• Lawfulness, Fairness & Transparency: Processed legally with complete operational disclosure.
• Purpose Limitation: Collected only for specified, explicit, and legitimate commercial or educational purposes.
• Data Minimisation: Adequate, relevant, and strictly limited to what is necessary.
• Accuracy: Maintained accurately and kept up to date where required.
• Storage Limitation: Kept in identifiable form no longer than necessary.
• Integrity & Confidentiality (Security): Protected against unauthorized processing, loss, or destruction.
• Accountability: The Data Controller takes full responsibility for demonstrable compliance.

3. Categories of Personal Data We Collect

• Identity & Contact Data: Name, professional email address, telephone number, and company name when submitting inquiry forms or booking consultations.
• Academy Student Data: Account credentials, course progress, quiz completion records, and digital certification verification logs on Webcross Academy.
• Technical & Log Data: Internet protocol (IP) address, browser user-agent, operating system, referral URL, and timestamps.
• Usage & Behavioral Data: Aggregate page interaction metrics, tool simulator parameters, and reading session durations via privacy-conscious analytics.

4. Lawful Bases for Data Processing

We process your data under the following lawful bases defined in UK GDPR Article 6:

• Contractual Necessity: To deliver services requested by you, manage client engagements, and provide Webcross Academy course delivery.
• Legitimate Interests: To protect digital security, prevent automated spam attacks, monitor brand abuse, and optimize platform usability.
• Consent: For non-essential analytics tracking or marketing communications (which you may withdraw at any time).
• Legal Obligation: To maintain accounting records and comply with statutory statutory reporting obligations in the UK.

5. International Data Transfers & Security

We implement industry-standard encryption protocols (TLS 1.3 in transit, AES-256 at rest) and strict access controls. Where third-party cloud infrastructure (e.g. Supabase, Vercel, Google Cloud) processes data outside the UK/EEA, transfers are secured via UK International Data Transfer Agreements (IDTA) or European Commission Standard Contractual Clauses (SCCs).

6. Your Statutory Rights Under UK GDPR

You have the right to request from us:

• Right of Access (DSAR): Confirmation of processing and copies of your personal data.
• Right to Rectification: Immediate correction of inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): Deletion of your data where no overriding legal requirement exists.
• Right to Restrict or Object to Processing: Stop processing based on legitimate interest or direct marketing.
• Right to Data Portability: Receive your data in a structured, machine-readable format.

To exercise any statutory right, contact [email protected]. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).