Courses are now open for booking.
Some key points at a glance
Who we are
Scope of this notice
Information we collect about you
How we use your information and our legal basis for doing so
Recordings of tutorials, classes, and lectures
Marketing communications
Automated decision-making and AI-enabled features
Who we share your information with
International transfers of your information
Cookies and similar technologies
How we keep your information secure
How long we keep your information
Your rights
How to complain
Children
Changes to this notice
How to contact us
Last updated: 22 September 2026 | Version: 1.2
This is a plain-English summary to help you understand this notice before you read it in full. It is not part of your contract with us, and does not replace or override the full notice below, which applies in all cases. If anything in this summary appears to conflict with the full notice, the full notice applies.
We collect information you give us directly (such as your name, contact details, and payment confirmation), information collected automatically through our website and learning platforms, and information we receive from Stripe, Google, and anyone booking on your behalf (Section 3).
We use your information mainly to deliver your course, tuition, or product. Most of this relies on it being necessary to perform our contract with you, though some uses — such as marketing — rely instead on your consent or our legitimate interests (Section 4).
Live sessions may be recorded; how a recording is used differs by session type, and you have options if you have concerns about appearing in one (Section 5).
We only send marketing emails with your consent, or under the "soft opt-in" if you are an existing customer, and you can opt out at any time (Section 6).
We share your information only with those who need it — our staff and tutors, Stripe, Google, professional advisers, and regulators where required — and we never sell it (Section 8).
Some of our providers (Google and Stripe) may process your information outside the UK, but with appropriate legal safeguards in place (Section 9).
You have rights over your information, including access, correction, deletion, and the right to object to certain uses — see Section 13 for the full list and how to exercise them.
If you are unhappy with how we have handled your information, you can complain (Section 14).
This notice is issued by Woodroffe Legal Education ("Woodroffe", "we", "us", "our").
Woodroffe is the data controller for the personal information described in this notice.
If you have any questions about this notice or how we handle your personal information, please contact us using the details in Section 17.
This notice explains how we collect, use, share, and protect personal information about:
visitors to our website at woodroffe.education;
prospective customers who make enquiries about our products and services;
students and customers who enrol on, purchase, or use our products and services; and
other individuals whose personal information we process in connection with delivering our services (for example, a parent or employer who pays for a course on a student's behalf).
This notice applies whether you interact with us through our website, by email, by telephone, or through the third-party platforms we use to deliver teaching (including but not necessarily limited to Google Classroom, Google Meet, and Google Calendar).
Our products and services are intended for customers based in the United Kingdom, and this notice is written on that basis. We do not knowingly direct our services at, or process personal information on the basis of, consumers resident outside the United Kingdom.
This notice does not cover our recruitment, employment, or engagement of staff and tutors, which is addressed separately.
This notice should be read alongside our Website Terms of Use ("Website Terms") and our Terms and Conditions (Products and Services) ("Terms and Conditions"), which govern your use of our website and your contract with us respectively.
Identity and contact information: name, email address, postal address, telephone number, and your confirmation that you are aged 18 or over, given by you at the point of Booking.
Account and enrolment information: username, course or tutorial selections, booking preferences, correspondence with us (whether by phone, email, or through our website), and any information you provide in enquiry or contact forms.
Payment-related information: billing name and address, and confirmation of payment status. We do not collect or store full card details ourselves — these are collected and processed directly by Stripe, our payment processor (see Section 8).
Communications and coursework: messages sent through our platforms, submissions, assessments, and feedback you provide to us.
Special category data (health/disability information): where you tell us that you require reasonable adjustments to access our teaching or assessments — for example, under the Equality Act 2010 — we will ask for enough information about your condition or need to put appropriate adjustments in place. You control whether you disclose this information to us.
Technical information about your device and browsing activity when you visit our website, collected through cookies and similar technologies (see Section 10), including IP address, browser type, pages visited, and referral source.
Usage information generated when you use our online learning platforms, such as log-in times, session duration, and engagement with learning materials and resources.
Any live session you attend with us may be recorded, although whether to record a session is at our discretion; we are under no obligation to do so. See Section 5 for how recordings are made, used, and, in some cases, shared or published.
Stripe, our payment processor, provides us with confirmation of successful payment, payment status, and limited billing information — never full card numbers.
Google, through the Google services we use to run our website and deliver our courses (listed in Section 8), provides us with information generated through your use of those services.
If someone else books or pays for a product or service on your behalf (for example, an employer or a parent/guardian, where relevant), we may receive your contact and enrolment information from that person.
If you provide us with someone else's personal information — for example, because you are booking or paying on their behalf — you must have their agreement to do so, and you must make sure they are aware of this notice.
Under UK data protection law, we must have a "lawful basis" for each use we make of your personal information. The list below sets out our main purposes, examples of what this involves, and the basis we rely on for each.
Setting up your account, processing payment, and delivering your course, tuition, or product. This includes creating your student record; scheduling tutorials via Google Calendar; providing access to Classroom; confirming payment via Stripe and issuing invoices or receipts; and running live sessions, providing course materials, and marking and giving feedback. We do this because it is necessary to perform our contract with you.
Providing reasonable adjustments. This includes arranging teaching adjustments under the Equality Act 2010. We rely on your explicit consent to process this special category data, alongside our legal obligations under equality law.
Quality assurance, staff training, and dispute resolution. This includes reviewing recorded sessions to check teaching standards, train tutors, or resolve a complaint or dispute. We do this on the basis of our legitimate interests in maintaining and improving the quality of our services and defending our legal position.
Sharing lecture recordings with other students. This includes making a recorded lecture available to other enrolled students on the same course, as described in Section 5. We do this because it is necessary to perform our contract with you.
Using a recording of a Tutorial, Class, or Lecture for promotional purposes or in publicly-facing training content. We do not do this as a matter of course. It only happens in the rare case where the relevant student has separately given express consent to that specific use, as described in Section 5. We rely on your consent as the legal basis for this processing, which you may withdraw at any time
Responding to enquiries and providing customer service. This includes answering questions by email or through our website. We do this on the basis of our legitimate interests in responding to people who contact us, or because it is necessary to perform our contract with you.
Sending marketing communications. This includes newsletters, course updates, and promotional offers. We rely on your consent if you are a prospective customer, or the "soft opt-in" for existing customers under the Privacy and Electronic Communications Regulations 2003 (see Section 6).
Website analytics. This means understanding how visitors use our website via Google Analytics. We rely on your consent, captured through the cookie banner presented on our website (see Section 10).
Maintaining the security of our systems and platforms. This includes monitoring for fraud, unauthorised access, or misuse. We do this on the basis of our legitimate interests in keeping our services and your data secure.
Enforcing our Terms and Conditions, including rules of student conduct. This includes investigating and acting on suspected misconduct. Depending on the circumstances, we rely on our legitimate interests, the performance of our contract with you, or a legal obligation.
Complying with our legal and regulatory obligations. This includes keeping financial records for tax purposes and responding to lawful requests from regulators or law enforcement. We do this because it is necessary to comply with a legal obligation.
Business transfer. This includes disclosing information to a prospective buyer, or transferring it to a new owner (whether an individual or an organisation), in the event of a sale, merger, or reorganisation of Woodroffe's business. We do this on the basis of our legitimate interests in the continuity of our business and services, subject to appropriate safeguards.
We do not sell your personal information to third parties.
Because Woodroffe delivers teaching and tuition online, recording is an integral part of how we operate. We offer three types of live session:
one-to-one tutorials — personalised sessions, tailored to your individual requirements;
classes — group sessions delivered in an interactive format, typically involving structured discussion, exercises, or two-way engagement between the tutor and students throughout the session; and
lectures — group sessions delivered in a primarily one-to-many format, in which student participation is generally limited to questions or comments raised by voice or in the on-screen chat, rather than sustained two-way interaction.
These correspond to the definitions of "Tutorial", "Class", and "Lecture" in Section 3 of our Terms and Conditions. Classes and lectures are typically delivered using the same underlying platform (Google Meet), so the same kinds of content — video, audio, screen shares, and on-screen chat — can be captured in a recording of either. Any of the three session types may be recorded, although whether to record a session is at our discretion; we are under no obligation to record any particular session, and we are under no obligation to make a recording available to you or anyone else except where the law requires it (for example, under your data protection rights described in Section 13, or an order of a court, regulator, or other body with the power to require disclosure), and then only to the extent the law requires.
The contractual rights described in this section are granted by you to us under Section 14.4 (Recording and use of sessions) of our Terms and Conditions when you enrol on a Course that includes a Lecture, Class, or Tutorial; this notice explains how recordings are made, retained, and used in practice, our legal basis for doing so, and your options if you have concerns.
This section covers recordings of live teaching sessions only. Our separate practice of recording customer service calls and retaining service correspondence is described in Sections 3.1, 3.3, and 4 above.
Where a session is recorded, it is retained and used to deliver teaching and training, for quality assurance of our tutors, as evidence in the event of a dispute, and for internal staff training. Beyond this common baseline, the three session types are treated differently:
One-to-one tutorials. Recordings are not published, shared with other students, or used for promotional purposes or in publicly-facing training content, except in the rare case where a student's express consent has been obtained beforehand.
Classes. Because a class is interactive, a class recording may capture not only the tutor but discussion, questions, and comments from other students taking part — whether spoken, on camera, or posted in the on-screen chat. If you switch on your microphone or camera, or post in the chat, that contribution — and any name attached to it — will be captured; if you keep your camera and microphone off and do not use the chat, you will not appear directly in the recording, although you may still be referred to by the tutor or another student during the discussion. Whether and how to take part is entirely your choice. Because of this interactive content, our preference is to make a class recording available only to the other students enrolled in that same class, rather than to the wider course cohort. However, this may not always be achievable — for example, depending on the type of teaching activity, how a particular course has been structured, or how classes and courses have been set up in Google Classroom — and in those circumstances a class recording may instead be made available to other students enrolled on the same course more broadly. Class recordings are not used for promotional purposes or in publicly-facing training content, except in the rare case where a student's express consent has been obtained beforehand.
Lectures. A lecture recording captures the tutor's presentation and any shared screen or materials, together with any part you choose to take in the session. If you switch on your microphone to speak, or post a message in the on-screen chat, that audio or chat contribution — and any name attached to it — will be captured in the recording; if you keep your camera and microphone off and do not use the chat, you will not appear in it. Whether and how to take part is entirely your choice. A lecture recording may also be made available to other students enrolled on the same course (necessary to perform our contract with you). Lecture recordings are not used for promotional purposes or in publicly-facing training content, except in the rare case where a student's express consent has been obtained beforehand. If you have concerns about appearing in a recorded lecture, please contact us before enrolling so we can discuss the options available — for example, taking part without using your camera, microphone, or the chat, or sending questions to your tutor by email instead of raising them live.
Where you have given express consent to a recording of a Tutorial, Class, or Lecture being used for promotional purposes or in publicly-facing training content, you may withdraw that consent at any time by contacting us, including after that recording has already been used for that purpose; we will stop that use from the point you withdraw. Withdrawing your consent does not affect the lawfulness of anything we did on the basis of your consent before you withdrew it.
In all cases, recordings, learning materials, and any other resources we make available are protected by copyright and confidentiality obligations, set out in full in our Terms and Conditions. Sharing, downloading, or redistributing recordings or materials without our permission is prohibited.
We will only send you marketing communications (such as newsletters, course announcements, or promotional offers) in the following circumstances:
If you are a prospective customer (you have not yet purchased anything from us), we will only send marketing emails if you have given us your opt-in consent, for example by ticking a box or actively signing up to our mailing list.
If you are an existing customer (you have previously purchased a product or service from us), we may send you marketing about similar products and services on the basis of the "soft opt-in" permitted under the Privacy and Electronic Communications Regulations 2003. This applies where we obtained your details in the course of that purchase, we only market products and services similar to what you bought, and we give you a simple way to opt out both at that time and in every message since.
You can withdraw your consent or opt out of marketing at any time by using the unsubscribe link in any marketing email, or by contacting us using the details in Section 17. Opting out of marketing will not affect service-related communications we need to send you (for example, information about a course you have booked).
We do not carry out any solely automated decision-making about you that has a legal or similarly significant effect on you.
Some of the Google platforms we use to deliver courses (in particular Google Classroom) may have built-in AI features, including Gemini, made available by Google as part of its platform functionality. Where these features are available to students, Woodroffe does not itself use Gemini to process or analyse your personally identifiable information, and we do not use it to make decisions about you. Any use of such features is governed by Google's own terms and privacy disclosures, which we encourage you to review.
If this changes — for example, if we begin using an automated tool to make decisions that affect you — we will update this notice and, where required by law, provide you with further information about the safeguards in place, including your right to obtain human review of, and to contest, any such decision.
We share personal information with the following categories of recipient, only to the extent necessary for the purposes described in this notice:
Our staff and tutors — those who need to see your information in order to deliver your course, tuition, or product to you.
Stripe — our payment processor, which handles all payment card and transaction data. "Stripe" refers to the Stripe corporate group, comprising Stripe, Inc. (incorporated in the United States) and its UK and Ireland affiliates, including Stripe Payments UK Limited and Stripe Technology Europe Limited, together with other Stripe group entities involved in processing payments on our behalf, regardless of which Stripe entity we contract with directly. Stripe acts as an independent controller of the payment data it processes; please refer to Stripe's own privacy policy for details of how it handles your information. We do not take or request payment from consumers by any means outside Stripe.
Google — we use a suite of Google services to run our website (Google Sites, Google Forms), to deliver our courses and tuition (Google Classroom, Google Meet, Google Calendar), and to understand how our website is used (Google Analytics). Where you access our courses, you may need to sign up using a Google account or Google email address; this is a practical requirement of accessing our teaching and materials through these platforms. Google acts as our data processor for most of these services under our contract with Google, and in some respects as an independent controller of information relating to your own Google account. We encourage you to review Google's privacy policy and the relevant Google Workspace terms for further detail.
Professional advisers — such as our accountants, auditors, or lawyers, where necessary for the operation of our business.
Regulators, law enforcement, and courts — where we are required to disclose information by law, or to establish, exercise, or defend legal claims.
A prospective buyer or successor of our business — if Woodroffe is sold, merged, or reorganised (in whole or in part) to another person, whether an individual or an organisation, personal information may be transferred to the new owner or successor, subject to that person or organisation using it for materially the same purposes and providing at least equivalent protection to that described in this notice. We will notify you if this happens and if it will materially change how your information is used.
Third parties offering discounts — where a third party (for example, a publisher offering a discount on books) needs limited information from us to verify your eligibility for an advertised discount, we will only share what is strictly necessary for that purpose, and only with your knowledge.
We do not currently use any other third-party data processors beyond those named above.
Some of the organisations we work with — in particular Google and Stripe — may store or process your personal information outside the United Kingdom, including in the United States and other countries. In Stripe's case, this applies regardless of which Stripe group entity (see Section 8) we contract with directly, since payment data may still be processed by other Stripe group entities, including its US parent, as part of Stripe's global processing infrastructure.
Where we (or our service providers) transfer personal information outside the UK, we ensure this is done in accordance with UK data protection law — which requires that protection in the destination country is not materially lower than the equivalent standard under UK law — using one or more of the following safeguards:
transferring to a country that is subject to UK adequacy regulations (which includes the European Economic Area and a number of other countries recognised by the UK government as providing an adequate standard of protection);
relying on the UK–US Data Bridge, an extension to the UK adequacy regime that allows transfers to US organisations self-certified under the relevant framework; or
putting in place the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where required.
Both Google and Stripe currently satisfy these requirements: each is self-certified under the UK–US Data Bridge described above, with the IDTA/UK Addendum in place as a fallback. For further detail, please see Google's and Stripe's own data processing and privacy terms, or contact us using the details in Section 17.
Our website is built and hosted on Google Sites. We do not operate a separate or custom cookie consent tool of our own — cookie and similar tracking technologies on our website are managed through the standard consent banner that Google presents to visitors of Google Sites-hosted websites, together with the controls Google makes available through that banner and through your own browser settings. We can choose whether certain features, such as Google Analytics, are linked to our website at all, but we do not control the design or mechanics of the consent banner itself.
Where you make a payment with us, this is processed by Stripe. If this takes place on a page hosted directly by Stripe, rather than within our Google Sites pages, Stripe may set its own cookies there for security and fraud-prevention purposes; these are governed by Stripe's own cookie and privacy policies, not by the Google Sites banner described above.
Aside from any cookies Stripe may set during checkout, as described above, the cookies and similar technologies used on our website are those set by Google in connection with running the site and, where enabled, Google Analytics. Google groups the purposes of its cookies into the following broad categories, each described in full in Google's own cookie policy at https://policies.google.com/technologies/cookies:
Functionality cookies, which allow you to access features fundamental to the website, such as remembering your preferences and maintaining your session.
Security cookies, which help authenticate users and protect against fraud, abuse, and attacks.
Analytics cookies, which help us understand how visitors use our website — this is the category that includes Google Analytics, where enabled on our website.
Your consent choices are captured and managed through the Google Sites banner described above. You can also manage cookies generally through your browser settings, which allow you to block or delete cookies, though doing so may affect how our website functions.
UK cookie rules are set out in the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025. Recent changes to PECR introduced limited new exemptions from consent for certain low-risk, first-party purposes — for example, cookies used solely to compile aggregate website statistics with no sharing of data with third parties. A standard Google Analytics configuration shares data with Google for Google's own purposes and does not qualify for this narrow exemption, which is why consent continues to be sought for analytics cookies through the cookie banner described above.
We take appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. This includes relying on the security measures built into the reputable third-party platforms we use (including Google's and Stripe's own security infrastructure), restricting access to personal information to those who need it to perform their role, and reviewing our practices from time to time. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we are committed to protecting your information to a high standard.
If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commission (see Section 14) and, where required by law, notify you directly.
We only keep your personal information for as long as necessary for the purposes described in this notice, and to comply with our legal obligations. The retention periods that apply to each category of information are set out below.
Financial records (invoices, payment confirmations, tax records) are kept for 6 years (or for any period that is required by law, whichever is the greater) from the end of the relevant tax/financial year, in line with HMRC record-keeping requirements.
Student/enrolment records (course history, correspondence, assessment results) are kept for a maximum of 6 years from the end of your last course or tuition with us, to allow us to respond to queries, disputes, or requests for references/transcripts.
Special category data (health/disability information provided for reasonable adjustments) is retained only for as long as needed to deliver the relevant adjustment and to evidence compliance with equality law, then securely deleted; it is kept separately and accessed on a need-to-know basis.
One-to-one tutorial, class, and lecture recordings are kept for a maximum of 12 months from the date of the session, unless needed for longer to resolve an ongoing dispute or complaint. Where a recording is used for promotional purposes or in publicly-facing training content under a student's express consent, it is retained for as long as it remains in active use for that purpose, subject to periodic review.
Marketing preference records (consent/opt-out records) are kept for as long as you remain subscribed, and for a reasonable period afterwards to evidence compliance with PECR.
Website analytics data (Google Analytics) is retained in accordance with Google Analytics' standard retention settings, as configured on our account.
Records of data protection complaints are kept for a maximum of 6 years (or for any period that is required by law, whichever is the greater) from resolution, to demonstrate compliance with our complaints-handling obligations.
Where you exercise your right to erasure (see Section 13), we will delete or anonymise your information unless we are legally required or entitled to retain it.
Under UK data protection law, you have the following rights in relation to your personal information, subject to certain exemptions and conditions:
Right of access — to obtain a copy of the personal information we hold about you.
Right to rectification — to have inaccurate or incomplete information corrected.
Right to erasure — to ask us to delete your personal information in certain circumstances.
Right to restrict processing — to ask us to limit how we use your information in certain circumstances.
Right to data portability — to receive certain information you have provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another organisation, where technically feasible.
Right to object — to object to our processing of your information where we rely on legitimate interests (for example, our use of a lecture recording for promotional purposes, as described in Section 5), or to direct marketing at any time.
Right to withdraw consent — where we rely on your consent (for example, for marketing or certain cookies), you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
Rights relating to automated decision-making — as explained in Section 7, we do not currently carry out solely automated decision-making with legal or similarly significant effects on you; if this changes, you will have rights to obtain information about the decision, to express your point of view, to request human review, and to contest the decision.
To exercise any of these rights, please contact us using the details in Section 17. We may need to verify your identity before responding, and we may ask you to clarify your request if it is broad or unclear. We will respond within one month of receiving a valid request, extendable by a further two months for complex or numerous requests, in which case we will explain the reason for the delay. We do not normally charge a fee, but may charge a reasonable fee or decline to act where a request is manifestly unfounded or excessive.
We hope we can resolve any concern you have about how we handle your personal information. If you have a concern, please contact us first using the details in Section 17, including as much detail as possible. We will acknowledge your complaint without undue delay (usually within seven business days) and aim to provide a full response within 30 days. If your complaint is complex, we will let you know and keep you updated on progress.
If you remain dissatisfied with our response, or wish to raise your concern directly with the UK's independent data protection regulator, you can contact:
The Information Commission (before 30 September 2026, the Information Commissioner's Office (ICO); the two names refer to the same UK data protection regulator, which transitioned to its current structure under the Data (Use and Access) Act 2025):
Website: https://ico.org.uk
Telephone: 0303 123 1113
Our services are intended for adults only. To purchase or enrol in any product or service from Woodroffe, you must be at least 18 years old. We do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently collected personal information from someone under 18, we will take steps to delete it promptly.
We may update this notice from time to time, for example to reflect changes in our practices or in the law. Where we make material changes, we will take reasonable steps to notify current customers (for example, by email or a notice on our website) and will update the "last updated" date at the top of this notice. Updating this notice does not itself vary any licence or right already granted to us under an existing Contract, for example, such as under our Terms and Conditions; any change to those contractual rights would need to be made in accordance with our Terms and Conditions instead.
If you have any questions about this notice, or wish to exercise any of your rights, please contact us at:
Woodroffe Legal Education
Email: privacy@woodroffe.education
This notice is governed by the law of England and Wales.