Leon Learning Partners Limited | Last updated 18 October 2026
1.1 Leon Learning Partners Limited is a company incorporated in Jersey with registered number 144959 (Leon, we, us and our). Leon is registered with the Jersey Office of the Information Commissioner under registration number 100118.
1.2 In this privacy notice, the following definitions apply.
(a) Data Protection Laws means the Jersey Data Law, the Data Protection Authority (Jersey) Law 2018, the EU Data Law where it applies, and any other relevant equivalent legislation, each as amended from time to time.
(b) Data Subject means the person who is the subject of the Personal Data in question.
(c) EU Data Law means the General Data Protection Regulation (EU) 2016/679.
(d) Jersey Data Law means the Data Protection (Jersey) Law 2018.
(e) JOIC means the Jersey Office of the Information Commissioner.
(f) LMS means the web-based learning management system we use to provide our courses.
(g) Personal Data means any information that identifies or could identify you and which is about you.
(h) Processing means any operation performed on Personal Data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
(i) Special Category Data means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (when processed to identify an individual uniquely), data concerning health, sex life or sexual orientation, and, in Jersey, criminal records or alleged criminal conduct.
(j) User means an individual who has been given access to one of our courses through the LMS, usually by their employer.
2.1 We take the protection of your privacy seriously. This notice explains how and why we collect, use, keep and share your Personal Data, your rights in relation to it, and how to raise any concerns.
2.2 This notice applies when you deal with us as a Data Subject, including as a client or a contact at a client, as a User of our courses, as someone who has enquired about our services, or as a visitor to our website.
2.3 We are the controller of the Personal Data we process for our own business purposes. Where we provide courses to a client, we handle Personal Data about its Users, and about its directors and staff named in course tailoring information, on the client's behalf. Clause 7 explains how this works for Users.
2.4 The JOIC is the data protection regulator in Jersey. Jersey's data protection regime is recognised by the European Commission as providing an adequate level of protection for Personal Data.
2.5 If you have any questions about this notice or the information we hold about you, want to exercise any of your rights, or wish to make a complaint, please contact us at hello@leon.je or by post at Leon Learning Partners Limited, Caversham House, 19 Queen Street, St Helier, Jersey, JE2 4WD.
2.6 You also have the right to complain to the JOIC:
(a) online at jerseyoic.org;
(b) by email to enquiries@jerseyoic.org;
(c) by telephone on +44 (0)1534 716530; or
(d) by post to 2nd Floor, 5 Castle Street, St Helier, Jersey, JE2 3BT.
2.7 We may update this notice from time to time. The current version is always available at leon.je/privacy, and we will send a copy to anyone on request.
3.1 Under the Data Protection Laws, we can only use your Personal Data if we have a proper reason for doing so, including:
(a) where you have given your consent;
(b) to comply with our legal obligations;
(c) to perform a contract with you, or to take steps at your request before entering into a contract;
(d) to protect your vital interests; or
(e) where it is necessary for our legitimate interests (as described in clause 6) or those of a third party.
3.2 A legitimate interest is where we have a business or commercial reason to use your non-sensitive Personal Data, provided your rights and interests do not override it. When we rely on legitimate interests, we carry out an assessment to balance our interests against yours.
3.3 Where we rely on your consent, you can withdraw it at any time without penalty. This does not affect Processing carried out before you withdrew it.
4.1 We process Personal Data in accordance with the law and your reasonable expectations. Depending on how we deal with you, this may include:
(a) contact information, including name, job title, employer, postal address, email addresses, telephone numbers and, where applicable, social media contact details;
(b) User account information, including your name, email address, log-in details and the user group you belong to;
(c) learning records, including the courses you have been given access to, your progress, completion dates, in-course acknowledgements, and your answers and scores for every quiz attempt;
(d) course tailoring information, being the information and documents a client gives us through our course tailoring form, such as details of its business, customers, products and services, and documents such as its risk appetite statement, business risk assessment and policies and procedures, which may include the names, roles, contact details and photographs of its directors and staff;
(e) account sign-up information, if you create an account on our website, such as your company size, profession and country, and basic profile details from a social sign-in provider (for example Google or LinkedIn) if you choose to use one;
(f) preference information, including marketing preferences;
(g) correspondence between you, your agents or representatives, and us;
(h) billing, transaction and payment information; and
(i) technical data, including information about how you use our website and the LMS, such as log-in times, IP address, browser and device type.
4.2 For information on how we use cookies, please see our cookie policy at leon.je/cookies.
4.3 We collect and use this Personal Data to provide our services. If you do not provide the Personal Data we ask for, it may delay or prevent us from providing those services.
5.1 We collect most Personal Data directly from you, or from your employer, in person, by telephone, video call, text message or email, through our course tailoring form, and through our website and the LMS. We may also collect information:
(a) from publicly accessible sources;
(b) from a third party, including with your consent;
(c) from cookies on our website;
(d) from a social sign-in provider, if you choose to use one to create your account; and
(e) through the LMS and our IT systems, for example through automated records of your activity on the LMS and monitoring of our website, communications systems and email.
5.2 We may, from time to time, record telephone or video calls. We will tell you at the start of any call we record.
6.1 We may use your Personal Data in the following ways and for the following reasons.
What we use your data for Why (our reason for processing)
Setting up User accounts, giving Users access to courses through the LMS, and providing support: On behalf of your employer, to provide the courses it has asked us to provide (see clause 7)
Producing reports of progress, completion and test results for the User's employer: On behalf of your employer, which uses the reports to meet its own training obligations (see clause 7)
Tailoring courses using the information and documents a client gives us through our course tailoring form: On behalf of the client, to tailor the courses it has asked us to provide
Preventing and detecting fraud or other unlawful financial activity against you or us: To minimise fraud or other unlawful financial activity that could damage you or us (legitimate interests; legal obligations)
Meeting our legal obligations, for example keeping accounting and tax records, and responding to requests from public authorities: To comply with our legal obligations
Operating the LMS, IT systems, software and business applications: To provide agreed services safely and efficiently (contract; legitimate interests)
Protecting the confidentiality of commercially sensitive information, and preventing unauthorised access to, and changes to, our systems: To protect commercially valuable information, to prevent and detect criminal activity that could damage you or us, and to comply with our legal obligations
Communicating with clients and people who enquire about our services: To perform our contract with you or take steps at your request before entering into one, to keep in touch about existing and new services, and to keep our records up to date
Marketing our services to existing and former clients, and to people who have expressed an interest in our services: To promote our business to existing and future clients (legitimate interests or consent, see clause 12)
Enforcing or defending our rights: To protect our rights (legitimate interests)
7.1 If you are a User, your employer (our client) decides that you should take our courses, gives us your name and email address so we can set up your account, and receives reports of your progress, completion, acknowledgements and test results, either by downloading them from the LMS or from us.
7.2 We process your learning records on behalf of your employer and in line with its instructions, so that it can provide training to its people. Your employer is responsible for keeping its own records of the training you have completed, for example to evidence that training to its regulators, and its own privacy notice will apply to how it uses those records.
7.3 If your employer runs our courses on its own learning management system, using SCORM files we provide, your learning records are held on your employer's system and we do not receive them.
7.4 The LMS scores quizzes automatically. We do not make decisions about you based on your results. Any decisions about your role or employment are made by your employer.
7.5 If you have questions about why you have been asked to take a course or how your results are used, please contact your employer. You can also contact us at hello@leon.je, and we will pass your request to your employer where appropriate.
8.1 We do not usually need to process Special Category Data to provide our services. If you tell us about an accessibility need, for example so that we can adjust how you access a course, we will use it only for that purpose.
8.2 Where we process Special Category Data, we will also make sure we are permitted to do so under the Data Protection Laws, for the following reasons:
(a) to protect your (or someone else's) vital interests where you are physically or legally incapable of giving consent;
(b) to comply with another law;
(c) to establish, exercise or defend legal claims; or
(d) where we have your explicit consent.
9.1 Where necessary, we may share your Personal Data with:
(a) if you are a User, your employer, including your user group manager, who can see your progress, completion and test results;
(b) our LMS provider and other third parties who help us run our business, for example administrative and marketing agencies or website hosts;
(c) professional advisers, including lawyers, accountants and tax advisers;
(d) IT service providers;
(e) our insurers and banks;
(f) third parties you approve, for example social media sites you choose to link to or third-party payment providers;
(g) government agencies to whom we have a disclosure obligation; and
(h) courts and tribunals which issue an order we are obliged to comply with.
9.2 We only allow our service providers to handle your Personal Data if we are satisfied they take appropriate measures to protect it. We also require them by contract to use your Personal Data only to provide services to us and to you.
9.3 We may also need to:
(a) share Personal Data with external auditors;
(b) disclose information to law enforcement agencies and other public authorities where the law requires us to; and
(c) share Personal Data with other parties, such as potential buyers of some or all of our business or in a restructuring. We will anonymise the information where possible, and the recipient will be bound by confidentiality obligations.
10.1 Some of our service providers, such as our LMS provider and our email and cloud storage providers, may process Personal Data outside Jersey.
10.2 Where Personal Data is transferred outside Jersey, we will only transfer it to the UK, a member of the European Economic Area or another jurisdiction recognised as providing an adequate level of protection, or where appropriate safeguards are in place as required by the Data Protection Laws, such as the EU standard contractual clauses with the JOIC's Jersey Addendum. You can contact us for more details of the safeguards we use.
11.1 We keep your Personal Data while you have a relationship with us or we provide services to you or your employer. After that, we keep it for as long as necessary:
(a) to respond to any questions, complaints or claims made by you or on your behalf;
(b) to show that we treated you fairly; and
(c) to keep records required by law.
11.2 We keep learning records only while we provide courses to your employer. When our agreement with your employer ends, we give your employer final reports of progress, completion, acknowledgements and test results, and then delete the learning records from the LMS within 30 days without keeping any copies, unless the law requires us to keep them. After that, your employer is responsible for keeping its own training records.
11.3 We keep the documents a client gives us through our course tailoring form only for as long as we need them to tailor and update its courses, and we return or delete them when our agreement with the client ends.
11.4 Different retention periods may apply to different types of Personal Data. To manage your data efficiently, we may keep all of your Personal Data for the longest period that applies to any item of it. At the end of the relevant period, we will delete or anonymise it.
12.1 We may use your Personal Data to send you updates about our services, such as offers, new courses or other services, by email, text message, telephone or post. We do not use Users' details for marketing unless they are also a contact at a client or have asked to hear from us.
12.2 We send marketing only to business contacts, such as existing and former clients and people who have asked about our services, relying on our legitimate interests. We do not buy in marketing lists. Where the law requires your consent, we will ask for it clearly and separately.
12.3 You have the right to object to direct marketing at any time. We will tell you about this right clearly and separately in or before our first marketing communication to you. Every marketing email includes an unsubscribe link, or you can contact us at hello@leon.je. If you object, we will stop sending you marketing.
12.4 If you ask for more services in future, or if there are changes in the law, regulation or our business structure, we may ask you to confirm or update your marketing preferences.
13.1 You may have the following rights in relation to your Personal Data, which you can usually exercise free of charge:
(a) access: to be given a copy of your Personal Data;
(b) rectification: to require us to correct any mistakes in your Personal Data;
(c) erasure (also known as the right to be forgotten): to require us to delete your Personal Data in certain situations;
(d) restriction of processing: to require us to restrict the Processing of your Personal Data in certain circumstances;
(e) data portability: to receive Personal Data you have provided to us in a structured, commonly used, machine-readable format, and to have it transferred to another controller, in certain circumstances;
(f) objection: at any time to your Personal Data being processed for direct marketing (including profiling) and, in certain other situations, to our continued Processing of your Personal Data, for example Processing carried out for our legitimate interests;
(g) automated decision-making: not to be subject to a decision based solely on automated Processing (including profiling) that produces legal effects concerning you or similarly significantly affects you; and
(h) withdrawal of consent: where we rely on your consent, to withdraw it at any time.
13.2 If you are a User and your request relates to learning records we hold on behalf of your employer, we may pass it to your employer to respond to, and will tell you if we do.
13.3 We will usually respond to your request within four weeks. In some cases, this may be extended by up to a further eight weeks. If so, we will tell you within four weeks, with our reasons. The clearer and more specific your request, the more quickly we can help.
14.1 We use appropriate technical and organisational measures to protect your Personal Data against unauthorised access, loss, misuse or alteration, including access controls on the LMS so that each employer can see only its own Users' records.
14.2 If there is a Personal Data breach and we are the controller, we will notify the JOIC within 72 hours where the law requires, and you without undue delay if the breach is likely to result in a high risk to you. Where we act on behalf of your employer, we will notify your employer, which is responsible for any notifications.
