Privacy Policy
Last updated: 29th September 2026
This privacy notice explains what Wanda Digital Learning Limited does with your personal information: what I collect, why, who I share it with, how long I keep it and what your rights are. In this notice, "Wanda", "I" and "me" mean Wanda Digital Learning Limited.
Contact details
Wanda Digital Learning Limited is the data controller for the personal information described in this notice.
Company: Wanda Digital Learning Limited, registered in England and Wales, company number 17275401
Registered office: Monomark House, 27 Old Gloucester Street, London WC1N 3AX
Email: hello@wandalearning.co.uk
ICO registration number: ZC250824
What information I collect, use and why
To provide and improve my services for clients, I collect or use:
Names and contact details
Addresses
Occupation, such as your organisation and job role
Transaction data, including details of payments and the services you have bought
Usage data, including how you interact with my website
Website user information
Information relating to compliments or complaints
Records of meetings and decisions
Recordings and transcripts of calls, only where you've agreed to this
For the operation of client accounts, I collect or use:
Names and contact details
Addresses
Purchase or service history
To comply with legal requirements, I collect or use:
Names
Contact information
Client account information, such as invoices and payment records
For dealing with queries, complaints or claims, I collect or use:
Names and contact details
Correspondence, including messages sent through my contact form
Purchase or service history
Client accounts and records
Financial transaction information
Recordings and transcripts of calls, only where you've agreed to this
Website analytics and spam protection
If you accept analytics cookies on the cookie banner, my website collects information such as the pages you visit, how you arrived at the site, and your browser and device type. I use this to understand how the site is used and to improve it. If you decline, these cookies aren't set. See my Cookie Policy for details.
My contact form uses Google reCAPTCHA to prevent spam. It processes limited technical information, such as your IP address and how you interact with the page.
Call recordings and AI note-taking
I don't currently record calls. In the future I may record and transcribe some calls, including with an AI note-taker, but only with your permission, and I'll tell you which tool I'm using beforehand. I'll update this notice before I start using one. If your organisation has its own rules about recording, I'll follow them.
What I don't do
I don't sell or rent your information.
I don't add you to a mailing list or send you marketing unless you've clearly asked me to.
I don't use automated decision-making or profiling.
Lawful bases and your data protection rights
Under UK data protection law, I must have a "lawful basis" for collecting and using your personal information. Which lawful basis I rely on may affect your data protection rights, which are set out briefly below. You can find out more about lawful bases, your rights and the exemptions that may apply on the ICO's website, ico.org.uk.
Your right of access: you can ask me for copies of your personal information, and for other details such as where I got it from and who I share it with. Some exemptions may mean you don't receive all the information you ask for.
Your right to rectification: you can ask me to correct or complete personal information you think is inaccurate or incomplete.
Your right to erasure: you can ask me to delete your personal information.
Your right to restriction of processing: you can ask me to limit how I use your personal information.
Your right to object to processing: you can object to me processing your personal information.
Your right to data portability: you can ask me to transfer the personal information you gave me to another organisation, or to you.
Your right to withdraw consent: when I rely on consent, you can withdraw it at any time.
If you make a request, I must respond without undue delay and within one month. To make a request, email hello@wandalearning.co.uk.
My lawful bases
To provide and improve my services for clients
Consent: for website analytics cookies, which only run if you select Accept on the cookie banner. All of your data protection rights may apply, except the right to object. You can withdraw your consent at any time.
Contract: I need the information to enter into or carry out a contract with you. All of your data protection rights may apply, except the right to object.
Legitimate interests: all of your data protection rights may apply, except the right to portability. My legitimate interests are:
I use clients' names, contact details, project records and feedback to improve how I design and deliver digital learning. For example, I review what worked well on past projects, refine my process and respond to feedback. This benefits clients directly, through better learning, clearer processes and fewer delays. It also helps Wanda run as a sustainable business. If I record and transcribe calls in future with permission and prior notice, that will give me an accurate record of what we agreed, so nothing is missed or misremembered. I only use information that clients would reasonably expect me to hold as their learning design partner, and nothing more sensitive. I keep it in as few places as possible and protect it with 2-step verification. I never sell it, share it for marketing or use it to make automated decisions, and I delete it in line with my retention rules. The impact on people is very low, so these benefits outweigh any risk. You can object to this use at any time by emailing hello@wandalearning.co.uk.
For the operation of client accounts
Contract: I need the information to enter into or carry out a contract with you. All of your data protection rights may apply, except the right to object.
Legal obligation: I need the information to comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
To comply with legal requirements
Legal obligation: I need the information to comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
For dealing with queries, complaints or claims
Contract: I need the information to enter into or carry out a contract with you, including replying to enquiries about possible work. All of your data protection rights may apply, except the right to object.
Legitimate interests: all of your data protection rights may apply, except the right to portability. My legitimate interests are:
When someone contacts me through my website or by email, I use their name, contact details, organisation and message to reply and deal with their query, complaint or claim. People who get in touch expect a response, so this benefits them directly. It also helps me run the business properly and resolve any issues fairly. I only use the information they choose to send me, and only for the purpose they contacted me about. I don't add them to a mailing list or use their details for marketing. Enquiries that don't lead to work are deleted after 12 months. The impact on people is minimal, and anyone can ask me to delete their details at any time by emailing hello@wandalearning.co.uk.
For more information about how I use legitimate interests, email hello@wandalearning.co.uk.
Where I get personal information from
Directly from you, for example through my contact form, by email or in conversation
Publicly available sources, such as LinkedIn and organisation websites
Third parties: recruitment agencies, and existing or previous clients and professional contacts who recommend my services or introduce me to someone who may need them
How long I keep information
Enquiries that don't lead to work are deleted after 12 months.
Client records, including correspondence, project records and invoices, are kept for 6 years after the work ends, for tax and contract purposes.
Call recordings and transcripts are deleted within 3 months of the call, once the key points are in my project notes.
Website analytics are kept in line with Squarespace's analytics retention settings.
I review and delete old information every six months.
Keeping your information secure
Your information is stored in password-protected accounts with 2-step verification switched on. I keep it in as few places as possible and don't copy it into other systems.
Who I share information with
Data processors
These organisations handle personal information on my behalf, only on my instructions:
Squarespace (Squarespace Ireland Limited, with data also processed in the USA): hosts my website, including the contact form, and provides website analytics.
Google (Google Ireland Limited and Google LLC, with data also processed in the USA): provides my business email through Google Workspace, where contact form enquiries are delivered, and reCAPTCHA spam protection on the contact form.
Video-calling providers, such as Microsoft Teams and Zoom, used when we meet online.
Others I share personal information with
Professional advisors, such as my accountants
Insurance companies or brokers, only if needed for an insurance claim
Organisations I'm legally obliged to share personal information with, such as HMRC
Sharing information outside the UK
Where necessary, I and my data processors may transfer personal information outside the UK. When this happens, it complies with UK GDPR and appropriate safeguards are in place. To find out more, or for a copy of the safeguard for any of the transfers below, email hello@wandalearning.co.uk.
Squarespace Ireland Limited
Category: website hosting and analytics provider
Country: Ireland
Safeguard: adequacy regulations (UK data bridge), which recognise that the country protects personal information to UK standards
Squarespace, Inc.
Category: website hosting and analytics provider
Country: United States
Safeguard: UK Addendum to the EU Standard Contractual Clauses
Google Ireland Limited
Category: email and website security provider
Country: Ireland
Safeguard: adequacy regulations (UK data bridge), which recognise that the country protects personal information to UK standards
Google LLC
Category: email and website security provider
Country: United States
Safeguard: UK Addendum to the EU Standard Contractual Clauses
Video-calling providers, such as Microsoft and Zoom
Category: video-calling providers
Country: EU and United States
Safeguard: adequacy regulations (UK data bridge) or the UK Addendum to the EU Standard Contractual Clauses, depending on the provider
How to complain
If you have any concerns about how I use your personal information, please contact me first so I can put it right:
Email: hello@wandalearning.co.uk
Post: Monomark House, 27 Old Gloucester Street, London WC1N 3AX
If you're still unhappy after raising a complaint with me, you can complain to the Information Commissioner's Office (ICO):
Address: ICO Head Office, 4th Floor, No. 3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
Changes to this notice
I may update this notice from time to time. The date at the top shows when it was last changed.