LNAT Academy Customer Privacy Notice

Last updated: June 2026

This privacy notice tells you what to expect us to do with your personal information.

What information we collect, use, and why

To provide and improve products and services for clients:

  • Names and contact details
  • Transaction data (including details about payments to and from you and details of products and services you have purchased)
  • Usage data (including information about how you interact with and use our website, products and services)

For the operation of client or customer accounts:

  • Names and contact details
  • Purchase or service history
  • Account information, including registration details
  • Information used for security purposes

For dealing with queries, complaints or claims:

  • Names and contact details

Lawful bases and data protection rights

Under UK data protection law, we must have a lawful basis for collecting and using your personal information. Our lawful basis for all processing activities is contract — we have to collect or use the information so we can enter into or carry out a contract with you.


Your data protection rights:

  • Right of access: you have the right to ask us for copies of your personal information.
  • Right to rectification: you have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
  • Right to erasure: you have the right to ask us to delete your personal information.
  • Right to restriction of processing: you have the right to ask us to limit how we can use your personal information.
  • Right to object to processing: you have the right to object to the processing of your personal data.
  • Right to data portability: you have the right to ask that we transfer your personal information to another organisation, or to you.

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, contact [email protected].

Where we get personal information from

Directly from you.

How long we keep information

Personal data is retained for as long as your account remains active. Upon account deletion, all personal data is permanently erased. Passwords are stored in hashed form and are never accessible in plain text.

Who we share information with

Data processors:

  • Stripe: payment processing — stripe.com/privacy
  • Supabase: database hosting, stores user account data, progress and essay records — supabase.com/privacy
  • Resend: transactional email delivery (account confirmation, password reset) — resend.com/privacy

Sharing information outside the UK

Where necessary, we transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place. All three processors (Stripe, Supabase and Resend) are based in the United States. These transfers comply with UK data protection law under the UK-US data bridge (Adequacy Regulations).

Age

This platform is not intended for children under the age of 13. Users under the age of 18 should ensure a parent or guardian is aware of their use of the platform. LNAT Academy does not knowingly collect personal data from children under 13.

How to complain

If you have any concerns about our use of your personal information, please contact us at [email protected].


If you remain unhappy after raising a complaint with us, you can complain to the Information Commissioner's Office (ICO):


Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint