Privacy Policy
Speedy Skills — a trading name of Qjarli Limited
Last updated: 25 September 2026 | Version 1.1
This Privacy Policy explains how Qjarli Limited, a private limited company incorporated in England and Wales and trading as "Speedy Skills" ("Speedy Skills", "Qjarli", "we", "us" or "our"), collects, uses, shares and protects your personal data when you register for, access or use our online training modules and related website and services (together, the "Services"). Qjarli Limited is the data controller responsible for your personal data.
Our Services are provided worldwide and are intended for adults only. They are not directed at children — see Section 12 (Children's Data) below.
Controller contact details:
Data controller: Qjarli Limited (trading as Speedy Skills)
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Contact email for privacy matters: [email protected]
1. About this Policy and the law that applies
Because anyone in the world may register for the Services, we design our data-protection practices around the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR), as our baseline. Where you are located in a jurisdiction with additional or different rights — in particular California (United States) and Canada — supplementary regional disclosures apply to you, and these are set out in Section 10 (California Privacy Rights) and Section 11 (Canada — PIPEDA) below.
In this Policy, "personal data" and "personal information" mean information that identifies you or relates to an identifiable individual and are used interchangeably.
2. Personal data we collect
We collect the following categories of personal data:
- Identity and account data: your first name, surname, and the username and password associated with your account.
- Contact data: your email address, which may be a personal or a corporate/organisation email address.
- Learning-progress data: information about your enrolment, course and module activity, quiz and assessment results, completion status, certificates and other progress data generated as you use the training modules.
- Transaction and payment data: records of purchases and the products or courses you have bought. Card details are handled directly by our payment processor and are not stored by us — see Section 4 (Payment).
- Usage and technical data: your IP address, device type, operating system and version, browser type, log data, and information collected through cookies and similar technologies about how you interact with the Services — see Section 15 (Cookies and Tracking).
Communications data: the content of, and metadata relating to, messages you send us (for example support enquiries) and your marketing preferences. We do not intentionally collect special-category data (such as health, racial or ethnic origin, or biometric data) and ask that you do not provide it to us.
3. How we use your data and our lawful bases
We only process your personal data where the law allows us to. Under the UK GDPR and EU GDPR, we rely on the following lawful bases:
Performance of a contract: to create and administer your account, provide access to the training modules, deliver the digital content you have purchased, track your learning progress, issue certificates, and provide customer support.
Legitimate interests: to operate, secure, maintain and improve the Services, to understand how learners use our modules, to prevent fraud and misuse, and (for enterprise-enrolled learners) to make progress data available to the enterprise manager of the organisation through which you were enrolled — see Section 6. Where we rely on legitimate interests, we have assessed that these interests are not overridden by your rights and freedoms.
Consent: for optional marketing communications and for non-essential cookies and tracking technologies. You may withdraw your consent at any time (see Section 7 and Section 15), without affecting the lawfulness of processing before withdrawal.
Legal obligation: to comply with our legal, tax, accounting and regulatory obligations, and to respond to lawful requests from public authorities.
We will not use your personal data for a materially different purpose without first informing you and, where required, obtaining your consent.
4. Payment
If you make a purchase, payment is processed by a third-party payment processor (such as Stripe or PayPal). Your card details are collected and processed directly by that processor under its own privacy policy and are encrypted in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). We do not store your full card number. We retain records of your transaction only for as long as necessary to fulfil the purchase and to meet our legal and accounting obligations.
5. Third-party processors and sub-processors
We use a small number of trusted service providers who process personal data on our behalf, under written terms that require them to protect it and to use it only for the purposes we specify. Our principal processors are:
- Thinkific: Thinkific Labs Inc. provides the learning management system through which our training modules are hosted and delivered, and processes your registration, account and learning-progress data. Thinkific hosts and processes data in the United States and Canada — see Section 8 (International Transfers).
- Make.com: Make.com (Celonis) provides workflow automation that we use to extract learner email addresses and group learners so that a dedicated enterprise manager can monitor their organisation's learners' progress through the training modules (see Section 6). The purpose of this processing is to enable enterprise reporting and administration; our lawful basis is legitimate interests (and, for the enterprise arrangement itself, performance of our contract with the enterprise client).
- Payment processors: as described in Section 4.
We may also disclose your personal data to professional advisers, and to a buyer or successor in the event of a merger, acquisition or reorganisation of our business (in which case we will require the recipient to honour this Policy), and where required to comply with the law, a court order, or a lawful request by a public authority.
6. Enterprise-enrolled learners and the enterprise manager
Some learners access the Services because their employer or organisation has enrolled them under an enterprise or organisation arrangement with Qjarli (governed by a separate enterprise licence agreement). If you have been enrolled in this way:
We use Make.com to extract your email address and group you with the other learners from your organisation. This allows your organisation's designated enterprise manager (the "dedicated manager" under the enterprise licence agreement) to view a partitioned dashboard showing the learning progress and completion data of your organisation's learners only.
Your progress data (for example the modules you have started and completed and your assessment results) will therefore be visible to your organisation's enterprise manager. Your data is kept isolated from that of other organisations, and the enterprise manager cannot see the data of learners from any other organisation.
Our lawful basis for making your progress data available to your organisation is our legitimate interests (and the performance of our contract with your organisation) in enabling the organisation to administer the training it has arranged for you. If you did not access the Services through an enterprise arrangement, this Section does not apply to you and your progress data is not shared with any enterprise manager.
7. Marketing and your choices
Where permitted, we may send you emails about our Services, related products, updates and offers. You can opt out of marketing at any time by using the unsubscribe link in any marketing email or by contacting us at [email protected]. Opting out of marketing does not affect service communications that we need to send you about your account or purchases.
8. Hosting and international transfers
The Services are hosted on Thinkific, and your registration, account and learning-progress data are processed and stored in the United States and Canada. This means your personal data is transferred outside the United Kingdom and the European Economic Area (EEA).
When we transfer personal data outside the UK/EEA, we put in place an appropriate safeguard recognised under the UK GDPR and EU GDPR, being one or more of the following:
For transfers to the United States: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission's Standard Contractual Clauses (SCCs), and, for EU-origin data, the EU SCCs; and/or, where the recipient is certified, reliance on the EU-US Data Privacy Framework and its UK Extension.
For transfers to Canada: we rely on the finding of adequacy in respect of Canadian commercial organisations recognised for UK/EU purposes, supplemented by contractual protections where appropriate.
Transfer-risk note: notwithstanding these safeguards, you should be aware that the transfer of personal data to a third country such as the United States carries residual risks inherent in transfers outside the UK/EEA, including the possibility of access by foreign public authorities under local law. We carry out transfer risk assessments and apply supplementary technical and organisational measures where appropriate. You may contact us at [email protected] to obtain a copy of the relevant safeguards.
9. Your rights under the UK GDPR and EU GDPR
If you are located in the UK or the EEA (and in most cases wherever you are located), you have the following rights in relation to your personal data:
- the right to be informed about how we use your data;
- the right of access to a copy of the data we hold about you;
- the right to rectification of inaccurate or incomplete data;
- the right to erasure ("right to be forgotten") in certain circumstances;
- the right to restrict processing in certain circumstances;
- the right to data portability, to receive your data in a structured, commonly used, machine-readable format;
- the right to object to processing based on our legitimate interests, and to object to direct marketing at any time; and
- the right to withdraw consent at any time where we rely on consent.
To exercise any of these rights, contact us at [email protected]. We will respond within the time limits required by law (usually one month). We do not charge a fee unless your request is manifestly unfounded or excessive.
10. California privacy rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you additional rights. This Section is our notice at collection and rights disclosure for California residents.
Categories collected and purposes: in the preceding 12 months we have collected the categories of personal information described in Section 2 (identifiers such as name and email, internet/network activity, commercial information, and account and learning data), for the purposes described in Section 3.
Your California rights: the right to know what personal information we collect, use and disclose; the right to access and to delete your personal information; the right to correct inaccurate personal information; the right to opt out of the "sale" or "sharing" of personal information; and the right not to receive discriminatory treatment for exercising your rights.
Do not sell or share: we do not sell your personal information for money, and we do not "share" it for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. If this changes, we will update this Policy and provide a "Do Not Sell or Share My Personal Information" mechanism.
Sensitive personal information: we do not collect or use sensitive personal information for purposes that would trigger the right to limit its use.
To exercise your California rights, contact us at [email protected]. You may use an authorised agent to submit a request. We will verify your identity before responding.
11. Canada — PIPEDA
If you are located in Canada, we handle your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. We collect, use and disclose your personal information only for purposes that a reasonable person would consider appropriate in the circumstances, with your knowledge and consent (express or implied as appropriate). You have the right to access your personal information and to request correction, and to withdraw consent (subject to legal or contractual restrictions) by contacting us at [email protected]. As noted in Section 8, some data is stored in the United States and may be subject to access by U.S. authorities under U.S. law, including United States legislation such as the USA PATRIOT Act.
12. Children's data
The Services are intended for adults aged 18 or over. They are not directed at children, and we do not knowingly collect personal data from anyone under 18. By using the Services, you confirm that you are at least 18 years old. If we become aware that we have collected personal data from a person under 18, we will delete it. If you believe a minor has provided us with personal data, please contact us at [email protected].
13. Data retention
We keep your personal data only for as long as necessary for the purposes for which it was collected. In general, we retain account and learning-progress data for the duration of your account and for a reasonable period afterwards to allow you to reactivate or obtain certificates, and we retain transaction records for as long as required by tax and accounting law (typically six years). When personal data is no longer needed, we securely delete or anonymise it.
14. Data security
We take appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, including encryption in transit, access controls, and reliance on providers that follow recognised security standards (including PCI-DSS for payment data). No method of transmission or storage is completely secure, but we work to protect your data and to notify you and any relevant regulator of a personal data breach where required by law.
15. Cookies and tracking
We use cookies and similar tracking technologies to recognise your device, keep you signed in, remember your preferences, measure performance and engagement, and understand how the Services are used. Strictly necessary cookies are always active; non-essential cookies (such as analytics) are used only with your consent, which you can give or withdraw through our cookie banner or your browser settings. Because there is no consistent industry standard for responding to "Do Not Track" browser signals, we do not currently respond to them.
16. Links to other sites
Our Services may contain links to third-party websites that we do not control. Once you leave our Services, this Policy no longer applies. We are not responsible for the privacy practices of other sites and encourage you to read their privacy notices.
17. Complaints
If you have a concern about how we handle your personal data, please contact us first at [email protected] so we can try to resolve it. You also have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EEA, you may complain to your local data protection authority. California and Canadian residents may contact their applicable regulator.
18. Changes to this Privacy Policy
We may update this Policy from time to time. We will post the updated version here with a revised "Last updated" date and version number, and where changes are material, we will take reasonable steps to notify you. Please review this Policy periodically.
19. How to contact us
If you would like to access, correct, amend or delete any personal data we hold about you, exercise any of your rights, register a complaint, or ask any question about this Policy, please contact:
Qjarli Limited (trading as Speedy Skills)
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Email: [email protected]