Privacy policy

01Who is responsible for your data

OBA, The Online Business Academy, is a trading name of Next Collective LLC, a limited liability company formed in the State of Wyoming, USA. Next Collective LLC is the data controller for the personal data described in this policy, which means it decides why and how that data is used.

For anything about your data, email support@oba.uk.

02What we collect

We keep data collection to what OBA actually needs. Depending on how you use it, that is:

• Account details: your name and email address, and your password, which is stored only as a secure one-way hash. If you sign in with Google, we receive your name and email address from Google instead.
• Purchase details: what you bought, the price, the billing name and address you gave at checkout, your card brand and its last four digits, and the payment reference. Full card numbers go straight to our payment provider and never touch our systems.
• Info pack requests: your first name, email address, phone number, the course or subject you asked about, and which page you asked from.
• The OBA Advisor, the chat on our website: your name, email address and phone number, what you type to the advisor and what it replies, the page you were on, the courses it recommended and any you tapped to enrol on, and whether you asked us to ring you. To stop the chat being abused we keep a scrambled, one-way form of your IP address for two days.
• Learning activity: the lessons and steps you complete, your answers, quiz and assessment results, the notes you write, XP and streaks, your answers to the three questions when you first log in, and the certificates you earn, including the name you choose to print on them.
• The OBA Tutor and Career Centre: the questions you ask the OBA Tutor, the CVs you upload or build, job descriptions you paste in, and your interview practice answers, including audio recordings if you choose to record them.
• Messages: anything you send through the contact form, and your email address if you join the newsletter.
• Calls you book: your name and email address, your phone number if we are ringing you, what you would like to talk about and anything you add, the time you chose and your time zone, and the page you booked from. The call goes into our team's Google Calendar, with a Google Meet link if you chose a video call. If you ask us to ring you instead, we keep your name, email address, phone number and the part of the day that suits you.
• The pages you visit: on our marketing pages, and only if you allow analytics, we keep our own record of which pages you look at, when, the site or advert that brought you to us, how long each page was in front of you and how far down you scrolled. It is kept against a random code in a cookie (oba_vid), not your name, and we never keep your IP address, your device details or an advertising click code. If you allow it, Google Analytics records similar information, along with basic details of your device. Until you choose, we only add one to a count of how often that page was seen that day, with nothing about you.
• If you then ask for an info pack, join a list, write to us, make an account or start a checkout, we link the pages that browser visited to your record, so whoever helps you choose a course can see what you have already looked at. If somebody else then fills in a form on the same browser, we start a fresh record for them rather than mixing the two.
• Technical data: when we email you, we record whether the email was delivered and which of its links you clicked (each link goes through our own website first); we do not track whether you opened it. When somebody checks at checkout whether an email has an account, we keep a scrambled, one-way form of their IP address for a day, only to stop that check being abused.

03How we use it

We use this data to:

• Run your account, deliver your courses, track your progress and issue your certificates.
• Take payments, send receipts and handle refunds.
• Run the OBA Tutor, mark short answers and power the Career Centre tools.
• Send you the info pack you asked for, and follow up by phone or email to help you choose a course when you have asked for the info pack, chatted with the OBA Advisor or asked for a call.
• Arrange the call you booked: confirm it, remind you the day before and an hour before, and let you move or cancel it from the link in your email.
• Answer your questions in the OBA Advisor chat and recommend a course that fits what you tell it.
• Send the emails you have chosen in your email preferences, and the account and order emails every learner gets.
• Keep a record of your enquiries, orders, chats and the emails we have sent you, with notes from our team, so whoever you speak to knows what you have already asked. We also work out a simple score from what you have asked for, so the team knows who to ring first. It never decides anything about you on its own.
• Keep OBA secure and stop abuse, such as the same email being tried over and over at checkout.
• See which pages and courses you looked at before getting in touch, if you allowed analytics, so our team can help you choose.
• Improve the product by understanding how lessons, tools and pages are used.

04Our lawful bases

In plain terms: when you buy a course or use your account, including the OBA Tutor and the Career Centre, we process your data because we have a contract with you. When you request the info pack, book a call or start a chat with the OBA Advisor, we contact you because you asked us to, and you can tell us to stop at any time. We send marketing emails (news, offers and course recommendations) when you have said yes: by ticking the box that says so, joining the newsletter or signing up on our website. On our UK site, if you ask for an info pack, enrol or book a call, we may also send you a few emails about our courses because you asked about them, unless you tick the box to say no when you give us your email. Every one of these emails lets you unsubscribe in one click. Our own record of the pages you visit, and linking it to you when you fill in a form, rests on your consent, which you give and take back through Cookie settings at the bottom of every page. Keeping records of orders is a legal obligation. Everything else, like keeping OBA secure and improving lessons, rests on our legitimate interest in running a good education platform, balanced against your rights.

05Who we share it with

We never sell personal data. Not to advertisers, not to data brokers, not to anyone.

Our customer records (your enquiries, orders, chats, our team's notes, the emails we have sent you and, if you allowed analytics, the pages you visited) are kept in our own database in London, not with a separate customer relationship provider.

We use a small number of service providers to run OBA. They process data on our behalf and only for the job we use them for:

• Supabase, for our database, sign-in and file storage, hosted in London.
• Vercel, which hosts the website and the app. Our servers run in London.
• Stripe, which takes payments, including Link if you choose to save your payment details with it. Stripe also uses some payment data for its own fraud prevention, under its own privacy policy.
• Resend, which sends our emails and tells us whether each one was delivered.
• OpenAI, which powers the OBA Tutor, short-answer marking, the Career Centre tools and the OBA Advisor chat, and receives what you send to those features.
• Vimeo, which plays the lesson videos.
• Google, for Sign in with Google, for our team's calendar and Google Meet when you book a call, and for Tag Manager and Analytics on marketing pages.
• Meta and LinkedIn, whose advertising tags may run on marketing pages to measure whether our advertising works.

06Where your data goes

Our database is in London. Next Collective LLC is based in the United States, and some of the providers above process data in the United States or elsewhere outside the UK; our email provider, for example, sends from Japan.

When personal data leaves the UK we protect it the way UK law requires, for example through the UK Extension to the EU-US Data Privacy Framework where a US provider is certified, or the Information Commissioner's International Data Transfer Agreement or Addendum.

07How we keep it safe

Your data is encrypted in transit, every table in our database is locked down so each learner can reach only their own records, and the people who work on OBA see only what their job needs. Our back office has no way to open your CV or your interview recordings.

When you choose a password, we check it against a public list of passwords exposed in data breaches. Only the first five characters of a one-way hash of it leave our servers, which is not enough to work out the password, so the password itself is never shared.

08How long we keep it

• Your account and learning record: for as long as your account is open. If you ask us to delete your account, we delete it after 30 days, which gives you time to change your mind.
• Order and payment records: for as long as tax and accounting law requires, even after an account is deleted.
• Interview sessions and recordings: until you delete them, which you can do yourself in the Career Centre. CVs: until you ask us to delete them.
• Info pack and contact requests, calls you book, and OBA Advisor conversations: until you ask us to delete them or to stop contacting you. Chats our spam filter catches are deleted after a week.
• The pages you visited: 13 months after that browser was last on our site, then deleted automatically. The daily counts of how often each page was seen, which say nothing about anybody, are kept for 25 months.

09AI and automatic decisions

The OBA Tutor, short-answer marking, the OBA Advisor and the Career Centre tools give you answers and feedback generated by an AI model, not by a person, and it can be wrong. None of them makes decisions about you with legal or similarly significant effects.

Certificates are issued automatically when you reach the published pass mark for a course. If you think a result is wrong, email support@oba.uk and a person will look at it.

10Your rights

Under UK GDPR you have rights over your data, and using them costs nothing. Email support@oba.uk: we confirm within 1 working day and respond in full within one month. You can:

• Get a copy of the personal data we hold about you. You can download most of it yourself, any time, from your account settings.
• Ask us to correct anything that is wrong.
• Ask us to delete your data. Some records, like order history, we must keep for legal and tax reasons.
• Ask us to restrict how we use your data, or object to it, including to direct marketing at any time.
• Stop marketing emails with the link at the bottom of every one, or on your email preferences page.
• Say no to analytics, or change your mind, with Cookie settings at the bottom of every page. Saying no deletes our record of the pages that browser visited straight away. If your browser sends a Global Privacy Control signal, we treat it as a no.
• Complain to the Information Commissioner's Office at https://ico.org.uk if you think we have handled your data badly.

11Changes to this policy

If we change how we use your data, we update this page and the date at the top, and we tell you by email first if the change is significant.