Privacy notice

Last updated: 28 September 2026

Who we are

This notice explains how Waleed Tariq uses personal data through waleedtariq.academy. In this notice, "we" and "us" mean Waleed Tariq, who runs Waleed Tariq Academy.

Under UK and EU law, we are the controller of your data. Under Canadian law, Waleed Tariq is the person responsible for it.

Email: support@waleedtariq.academy
Address: 6 Page Crescent, London CR0 4DT, United Kingdom

We are based in Canada. We follow the UK GDPR for people in the UK and the EU GDPR for people in the EU. We also follow Canada's privacy law, PIPEDA.

The data we collect

Account details: your email address and the name you give for your certificates.
Membership details: Paddle tells us your plan and its status. It also tells us your renewal date and country. We never see your card details.
Learning records: how far you are in each lesson and the certificates you have earned.
Topic requests: the topics you send us and the ones you vote for.
Free account: the date you made it, and when you first used a sign-in link.
Email news: whether you asked for news and new lessons by email. We keep the time you asked and the page you were on. We also keep the exact words you agreed to, and the time you unsubscribed.
Saved tool answers: the answers you save in a member tool, with the name you give each set.
Team details: if your employer buys team seats, the team manager gives us your email address.
Messages: what you write to us, and our replies.
Technical data: your IP address and basic details of your browser. We and our providers use these to keep the site secure.

How we use your data

For each use, we give the lawful basis under UK and EU law.

To run your account and give you access to the membership. Basis: our contract with you.
To save your progress and issue your certificates. Basis: our contract with you.
To run your free account and save your progress on the free modules. Basis: our contract with you.
To keep the tool answers you save, so you can open them again. Basis: our contract with you.
To send you news and new lessons by email, only if you ask for them. Basis: your consent.
To keep a record of your consent and of any unsubscribe. Basis: our legitimate interest in showing that we follow the law on marketing emails.
To send you sign-in links and other emails about your account. Basis: our contract with you.
To handle refunds and answer your questions. Basis: our contract with you.
To show approved topic requests on the site, without your name. Basis: our contract with you.
To keep records of payments and memberships. Basis: our legitimate interest in keeping the business records that tax law requires. It also helps us deal with claims.
To keep the site secure and stop misuse, such as shared accounts. Basis: our legitimate interest in protecting the site and our content.
To set up team seats. Basis: our legitimate interest in giving access to the people the team manager adds.

You must give your email address to join. Without it, we cannot give you access.

We do not sell your data. We do not use it for advertising. We do not make automated decisions about you that have legal or similar effects.

Email news

We send news only if you tick the box for it. The box starts unticked, and a free account does not need it.
Your consent counts only once you use a sign-in link we email you. This shows the email address is yours.
Every news email has a link to unsubscribe in one click. You can also turn news off in My library at any time.
Unsubscribing does not close your account or change your progress.
We do not send news emails from this site. We will name the service that sends them here before the first one goes out.

Cookies and browser storage

We set one cookie ourselves. It keeps you signed in for 30 days on that device.
We do not use cookies for analytics or advertising. We do not track you on other sites.

We also keep these items in your browser's local storage:

the lesson theme you choose, light or dark
the lesson screen you reached in each lesson
the name you give for your certificates, and the date you finished each course
your strategy answers in the NEC4 Contract Preparation course
a note that you have signed in on this browser, so the menu shows My library

When you are signed in, we also copy your lesson screens and certificate details to your account. That way they follow you to your other devices. With a free account, we copy only your lesson screens in the free modules.

You can clear local storage at any time in your browser settings. This also deletes your saved strategy answers.

UK law allows storage that is strictly necessary for a service you ask for. It also allows storage that remembers a display choice, if we tell you about it and you can object. So we do not show a cookie banner.

Other storage on our site:

Only our checkout page loads Paddle.js, Paddle's payment script. We checked this script. It does not set cookies or use local storage on our site.
The payment form runs in a frame from Paddle's own website. Paddle may use its own cookies inside that frame. Paddle is responsible for them.
Cloudflare hosts our site. It may set a short-lived security cookie, for example to check for bots. Cloudflare treats these cookies as strictly necessary.

Who we share data with

Paddle, our reseller. Paddle takes your payments and makes any refund. It also deals with tax. It uses your data as a separate controller. See Paddle's privacy notice.
Cloudflare hosts the site and our database. It also sends our emails, such as sign-in links, and forwards emails sent to our support address.
The service that sends our news emails, if you asked for them. We will name it here before the first one goes out. We give it your email address and your unsubscribe link.
Google keeps our support emails in a Gmail inbox.
Our professional advisers, when we need their help.
Public authorities, where the law requires it.

Where a provider acts for us, it may only use your data to provide its service to us.

If the academy moves to a company we own, or to a new owner, your data will move with it. We will tell you first.

Where your data goes

We are based in Canada. Some of our providers are in the United States or store data there.
When your data leaves the UK or the EU, we use a legal safeguard.
For Canada, the safeguard is a decision by the UK and the EU that Canada's law protects personal data well.
For US providers, it is the EU-US Data Privacy Framework and its UK Extension, or approved data transfer contracts.
Data held in another country may be accessed by courts and public bodies there, under that country's laws.

How long we keep data

Account and learning records: while your account is open. If you close your account, we delete them within 30 days.
Certificate records: for as long as the academy runs, so that anyone can check a certificate you share. You can ask us to delete yours.
Membership and payment records: 6 years after the membership ends. We need them for tax and for any claims.
Topic requests: while they are on the site. When we remove one, we delete it within 30 days.
Free accounts that nobody signs in to: we delete them 30 days after they are made.
Email news records: while your account is open. This includes the record of your consent and when you unsubscribed.
A news consent waiting for its sign-in link: one day at most.
Saved tool answers: while your account is open. You can delete a saved set in the tool at any time.
Sign-in links last 15 minutes. Records of sign-in requests, kept to stop misuse, last one day.
Support emails: 2 years after we last hear from you.

Your rights

Under UK and EU law, you can ask us to:

give you a copy of your data
correct it
delete it
limit how we use it
send it to you or to another company in a format you can reuse

You can also object when we rely on our legitimate interests.

Where we rely on your consent, you can withdraw it at any time. This does not affect what we did before you withdrew it.

Under Canadian law, you can ask to see your data and to correct it. You can also challenge how we handle it.

To use any of these rights, email us. We will reply within 30 days. We may ask you to confirm who you are.

Complaints

If you are unhappy with how we use your data, tell us first. We will confirm we have your complaint within 30 days. We will then reply as soon as we can.

You can also complain to a regulator:

in the UK, the Information Commissioner's Office
in the EU, the data protection authority where you live
in Canada, the Office of the Privacy Commissioner of Canada

Security

Only the people and providers who need your data can access it.
The site uses encrypted connections. We store sign-in links and sessions only in a scrambled form.
If a data breach puts you at risk, we will tell you as the law requires. We will also tell the regulator.

Children

Our courses are for adults who work with construction contracts. We do not knowingly collect data from children.

Changes to this notice

We will update this notice when our practices change. The date at the top shows the latest version. If a change is important, we will email you.