01Introduction
Cortexa Limited (“Cortexa”, “we”, “us”, or “our”) respects your privacy and is committed to protecting personal data.
This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when individuals access or use:
- Cortexa learning management systems;
- learning experience platforms;
- e-learning portals;
- websites;
- mobile applications;
- assessments;
- certification services;
- AI-powered learning tools;
- customer support services;
- and related services (collectively, the “Services”).
This Privacy Policy applies to:
- learners;
- employees;
- contractors;
- instructors;
- administrators;
- customers;
- website visitors;
- prospective customers;
- and all other users of our Services.
02Data controller
For the purposes of applicable data protection laws, the data controller is:
Cortexa Limited
Timsons Business Centre
Bath Road
Kettering
Northamptonshire
NN16 8NQ
Email: privacy@cortexa.co.uk
Website: https://www.cortexa.co.uk
Where Cortexa provides hosted learning services to organisations, those organisations may also act as data controllers for information uploaded into the Services.
03Personal data we collect
The personal data we collect depends upon how you interact with the Services.
3.1 Identity information
We may collect:
- name;
- username;
- employee ID;
- learner ID;
- job title;
- organisation name;
- department;
- professional qualifications.
3.2 Contact information
We may collect:
- email address;
- telephone number;
- postal address;
- business contact information.
3.3 Account information
We may collect:
- login credentials;
- account settings;
- authentication details;
- single sign-on identifiers.
Passwords are encrypted and are not visible to our staff.
3.4 Learning information
We may collect:
- enrolment records;
- course participation data;
- completion records;
- learning progress;
- assessment results;
- examination outcomes;
- certificates issued;
- competency records;
- learning preferences.
3.5 Technical information
We may collect:
- IP address;
- browser type;
- device information;
- operating system;
- language settings;
- network information;
- usage analytics.
3.6 Support information
We may collect:
- support requests;
- correspondence;
- feedback;
- survey responses;
- complaint information.
05How we collect personal data
We collect personal data:
Directly from you
When you:
- register;
- complete courses;
- submit assessments;
- contact support;
- complete forms;
- interact with AI Features.
From your organisation
Your employer, educational institution, training provider, or other organisation may provide information required to create your account.
Automatically
Through:
- cookies;
- analytics tools;
- log files;
- security monitoring systems.
From third parties
Including:
- identity providers;
- single sign-on providers;
- CRM systems;
- HR systems;
- training providers;
- integration partners.
06Purposes of processing
We process personal data for the following purposes.
Service delivery
To:
- provide access to Services;
- authenticate users;
- deliver learning content;
- administer assessments;
- issue certificates.
Customer support
To:
- resolve issues;
- provide assistance;
- communicate with users.
Security
To:
- prevent fraud;
- investigate misuse;
- protect systems;
- monitor compliance.
AI services
To:
- generate responses;
- provide learning assistance;
- personalise learning experiences.
Analytics
To:
- improve Services;
- understand usage patterns;
- enhance performance.
Legal compliance
To:
- comply with legal obligations;
- respond to regulatory requests;
- establish or defend legal claims.
07Legal bases for processing
Depending upon the circumstances, we process personal data under one or more of the following legal bases:
Contract
Processing necessary to provide Services.
Legitimate interests
Including:
- service improvement;
- fraud prevention;
- security;
- customer support;
- business operations.
Legal obligations
Compliance with legal and regulatory requirements.
Consent
Where required by law, including certain marketing activities.
09International transfers
Personal data may be transferred outside the United Kingdom.
9.1 Safeguards
Where transfers occur, appropriate safeguards will be implemented including:
- UK Addendum to Standard Contractual Clauses;
- adequacy decisions;
- other approved safeguards.
9.2 Use of third-party AI providers
Certain AI Features may be provided by third-party artificial intelligence service providers located in the United Kingdom, European Economic Area, United States, or other jurisdictions.
Where a user submits prompts, documents, learning content, assessment content, personal data, or other information to an AI Feature, such information may be processed by those providers for the purpose of generating AI Outputs and providing the requested functionality.
The location of processing may vary depending upon the AI provider, infrastructure architecture, service availability, and operational requirements.
Where personal data is transferred outside the United Kingdom or European Economic Area, Cortexa will implement appropriate safeguards in accordance with applicable data protection legislation.
10Data retention
We retain personal data only for as long as necessary for:
- provision of Services;
- legal compliance;
- dispute resolution;
- legitimate business purposes.
Retention periods vary depending upon:
- customer agreements;
- legal requirements;
- operational needs.
Where possible, information will be anonymised or deleted when no longer required.
11Security
We implement reasonable technical and organisational measures designed to protect personal data.
Measures may include:
- encryption;
- access controls;
- monitoring systems;
- vulnerability management;
- authentication controls;
- backup procedures.
No system can be guaranteed completely secure.
12Your rights
Subject to applicable law, individuals may have rights including:
- access;
- rectification;
- erasure;
- restriction of processing;
- objection;
- data portability;
- withdrawal of consent.
Requests may be submitted to privacy@cortexa.co.uk.
We may request proof of identity before responding.
13Automated decision-making
Cortexa does not intentionally make legally significant decisions solely through automated processing.
Where AI-generated recommendations are provided:
- human review remains required;
- users remain responsible for decisions based on AI outputs.
14Children and young people
Our Services are not generally directed to children under 16 unless provided through educational institutions or authorised training programmes.
Where Services are provided to minors, the relevant institution remains responsible for obtaining necessary permissions and applying appropriate safeguards.
15Marketing communications
We may send marketing communications where permitted by law.
You may unsubscribe at any time by:
- following unsubscribe links;
- contacting us directly.
Service-related communications may still be sent where necessary.
17Third-party websites
Our Services may contain links to third-party websites.
We are not responsible for the privacy practices of third parties.
Users should review third-party privacy policies separately.
18Changes to this policy
We may update this Privacy Policy periodically.
Updated versions will be published on our website and/or within the Services.
Material changes will be notified where appropriate.
19Complaints
If you have concerns regarding our handling of personal data, please contact privacy@cortexa.co.uk.
You also have the right to complain to the Information Commissioner’s Office (ICO): https://www.ico.org.uk
20Contact us
Privacy enquiries may be directed to:
Privacy Officer
Cortexa Limited
Timsons Business Centre
Bath Road
Kettering
Northamptonshire
NN16 8NQ
Email: privacy@cortexa.co.uk
Version 2026.1 · Effective date: 10 June 2026
