Privacy notice

Who we are

The organisation responsible for your information (the data controller) is Asteem Ltd, trading as Trauma Informed Parenting, Asteem Ltd, c/o Trauma Informed Parenting, Suite 201F, 60 Frederick Street, Birmingham, B1 3HS. For privacy questions, email truaminformedparenting@yahoo.com.

This notice covers visitors, learners on the free Foundation course, and people who buy Level 1, Level 2, Level 3 or the three-level bundle. This website provides education, not therapy or clinical assessment.

Information we use

Account: when you create an account, the account service receives your name, email address and password. Passwords are handled by the account service and are not visible to us. Your account also records whether you chose the optional new-course email preference.

Learning records: which modules you mark as complete and when, and your latest and best score and number of attempts for each knowledge check. These are self-check results, not assessed exam results. If you have bought a course, we also record which courses your account can open and when that access ends. Your written reflections stay in your own workbook or notebook; this website does not collect them.

Enquiries: the contact form stores your name, email, message and when you sent it. Please do not send children's names, diagnoses, trauma histories or other sensitive family details. If you email us directly, our email provider (Yahoo) receives your message.

Certificates are not issued automatically. If that changes, this notice will be updated first.

Payments

Payments are handled by Stripe. You type your card details into Stripe's own payment form; we never see or store your full card number or security code.

For each order we keep: your account, what you bought, the price and price period (early bird or regular), the currency, the order and payment references from Stripe, your Stripe customer reference, the payment status and date, when access starts and ends, any refund or card dispute, and a record of the consents you gave at checkout (the exact wording, the version and the time). We also keep a short record of each payment notification Stripe sends us, so the same one is not processed twice.

Stripe creates a customer record with your email address and your account reference. Stripe also collects payment and device information for processing the payment, security and fraud prevention. Stripe explains its own use of information at stripe.com/privacy.

Test payments: before real sales start, the provider and approved test accounts can make test payments using Stripe's test system and test card numbers. No real money is taken and no real card details are used. Test orders are stored with the same kinds of record as above, marked as test payments, and give no access to the public.

Why we use it (lawful bases)

We rely on these lawful bases under UK data protection law:

• Providing your account, free course and any course you buy, taking payment, giving and ending access, and sending your order confirmation: contract (or steps you ask for before entering a contract).
• Recording the checkout consents you gave: legal obligation, because the law requires us to get and confirm them before supplying digital content during the cancellation period.
• Keeping sales and accounting records: legal obligation (company and tax record-keeping law).
• Handling refunds, card disputes, complaints and legal claims, preventing fraud and misuse, keeping the website secure, and running test payments before launch: legitimate interests in running a safe, working course business. You can object to these uses.
• Optional emails about new courses: your consent, which you can withdraw at any time. No promotional emails are being sent at present.

Service providers and where they store information

We use these service providers to run the website. They handle information on our behalf or, in some cases, for their own legal and security purposes. We do not sell your information or share it for advertising.

• Lovable Cloud (Lovable): Website hosting, accounts and sign-in, the database for learning and purchase records, and private storage for the paid workbooks. Where: The database and stored files are kept in Ireland (European Union). Web pages are delivered through a worldwide network of servers, so a page request may be handled at a data centre near you, which can be outside the UK.
• Lovable email sending: Account emails, such as confirming your email address or resetting your password. Where: May be handled in the European Union or the United States.
• Stripe: Card payments, test payments, refunds and disputes. For fraud prevention and its own legal duties, Stripe decides how it uses information itself. Where: The United Kingdom, the European Union and the United States. Stripe is certified under the UK–US data bridge and also uses the UK International Data Transfer Addendum.
• Yahoo: Our email inbox, for enquiries you email to us. Where: Ireland, the United States and other countries where Yahoo and its suppliers operate. Yahoo uses standard contractual clauses and adequacy decisions for these transfers.
• Google Fonts (Google): The website's fonts. Your browser contacts Google when pages load, which shares your IP address with Google. Where: The United States and other countries. Google is certified under the UK–US data bridge.

Information outside the UK

Some of the services above store or access information outside the UK. Whenever that happens, we make sure one of the safeguards approved under UK data protection law, listed below, is in place. You can ask us which safeguard applies to a particular service, and for a copy of it, by emailing truaminformedparenting@yahoo.com.

• European Union and European Economic Area countries: the UK government has confirmed these countries protect personal information to a UK standard (adequacy regulations).
• The United States: transfers to companies certified under the UK Extension to the EU–US Data Privacy Framework (the 'UK–US data bridge').
• Anywhere else: the UK International Data Transfer Agreement, or the UK Addendum to the European Union's standard contractual clauses.

How long we keep information

We keep each kind of record only for as long as shown below. When the time is up, we delete it or make it anonymous.

Ending course access is not the same as deleting records: sales records must be kept for the full period even after access has ended.

• Your account (name, email address, sign-in details) and course progress and knowledge-check scores: Kept while your account is open. If you ask us to close your account, we delete these within 30 days, apart from the purchase records below. If an account has not been signed in to for 3 years, we may delete it.
• Orders, payments, refunds, card disputes, course access dates, order confirmations and the checkout consents you gave: 6 years from the end of the company's financial year in which the order was made, because company and tax law require us to keep sales records.
• Complaints and legal claims: Until the matter is settled, then 6 years, the usual time limit for legal claims in England and Wales.
• Enquiries sent through the contact form: Deleted automatically 2 years after they were sent.
• Enquiries sent to our email inbox: Deleted within 2 years of our last message with you.
• Records of payment notifications from Stripe (used so the same notification is not processed twice): Deleted automatically 12 months after they arrive.
• Test payments made before real sales start: Deleted before real sales start. They never give access to the public.

Browser storage and cookies

Essential browser storage keeps you signed in. A saved colour preference may remain in browsers that used the earlier colour editor. The website has no analytics or advertising tools at present.

When you open the payment form, Stripe may use its own cookies or similar storage for security and fraud prevention. If any non-essential tracking is added in future, it will not start until any consent the law requires has been given.

Your rights and complaints

Depending on the situation, you can ask to see or correct your information, ask for it to be deleted or restricted, object to some uses, or ask for a copy to take elsewhere. You can withdraw consent at any time; this does not affect what happened before. Some rights have legal limits, for example we may need to keep payment records.

To use your rights, email truaminformedparenting@yahoo.com. We may ask for proportionate proof of identity. You can complain to the Information Commissioner's Office at ico.org.uk.

We do not make automated decisions that have legal or similarly significant effects on you.