Privacy Policy

This Privacy Policy explains how Multiply Academy Limited ("we", "us", "our", "Multiply Academy®") collects, uses, and protects your personal data when you use our training platform at multiply.academy (the "Service").

Most of this policy is about people who use the Service. If you are not a customer or a user, and you are here because you engaged with one of our posts on LinkedIn, Section 2A is the part written for you.

We are committed to protecting your privacy and being transparent about how we use your data. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Multiply Academy Limited is the data controller for your personal data.

• Company number: 05505845
• Registered office: Available on the Companies House register
• Data protection contact: hello@multiply.academy

This Privacy Policy should be read alongside our Terms and Conditions, which govern your use of the Service.

We collect the following categories of personal data:

Information You Provide

• Account information: Name, email address, and login credentials
• Profile information: Information about your professional context that helps us personalise your training
• Content you submit: Reflections, messages, and other content you provide through the Service
• Payment information: Payment details necessary to process transactions (handled by our payment processor)

Information Collected Automatically

• Usage data: How you interact with the Service, including pages visited and features used
• How you reached us: The page you first arrived on, the website that referred you, and any campaign or referral details carried in the link you followed. If you then make an enquiry or a purchase, this is stored alongside the details you give us, so we know which of our own channels brought you.
• Device information: Browser type, operating system, and device characteristics
• Network information: IP address and approximate location (country level)
• Cookies: See Section 9 (Cookies and Analytics)

Information From Third Parties

If you sign in using a third-party authentication provider (such as Google or Microsoft), we receive your name and email address from that provider. We do not receive your password.

Separately from the Service, we record public engagement with our LinkedIn posts. That data is not collected from the people it describes, and what we hold, why, and for how long is set out in Section 2A.

We use your data for the following purposes:

To Deliver the Service (Lawful Basis: Contract)

• Creating and managing your account
• Providing access to training modules
• Processing your payments
• Communicating about your subscription and account

This processing is necessary to perform our contract with you.

To Personalise Your Experience (Lawful Basis: Legitimate Interests)

• Using information you provide about your professional context to generate content tailored to your work
• Using content you submit to improve your experience and subsequent interactions
• Adapting the Service to your technical environment

Our legitimate interest is providing effective, personalised training that delivers better learning outcomes. We have assessed that this processing is necessary for our service and does not override your privacy rights. You can object to personalisation at any time (see Section 8).

To Improve the Service (Lawful Basis: Legitimate Interests)

• Analysing usage patterns to understand what works and what doesn't
• Identifying technical issues and fixing bugs
• Developing new features and content

Our legitimate interest is improving our training platform. We use aggregated and anonymised data where possible.

To Create Aggregated Resources (Lawful Basis: Legitimate Interests)

• Analysing patterns across users in similar roles to identify common workflows and challenges
• Creating role-specific resources from aggregated insights
• Improving our curriculum based on what works for different user groups

Our legitimate interest is developing better training materials. Individual contributions are aggregated and anonymised in these resources.

To Understand How People Find Us (Lawful Basis: Legitimate Interests)

• Recording how you reached us — the page you first arrived on, the referring website, and any campaign or referral details in the link you followed
• Understanding which of our own channels lead to enquiries and purchases

Our legitimate interest is knowing where our enquiries and customers come from, so we can spend our effort where it works. This uses only information about how you arrived, never the content of what you write to us. We have assessed that it is limited in scope and does not override your privacy rights, and you can object at any time (see Section 8). We do this without cookies or any other storage on your device.

To Communicate With You (Lawful Basis: Legitimate Interests)

• Sending service-related communications (account updates, security notices, subscription reminders)
• Sending marketing communications about our products and services

For marketing emails, we rely on the "soft opt-in" under the Privacy and Electronic Communications Regulations (PECR). This means we may email you about our products and services because you provided your email when signing up. Every marketing email includes an easy unsubscribe option, and you can opt out at any time.

This section is for people who are not customers or users of our platform. If you publicly reacted to, commented on or reshared a post by Phil Hewinson or Multiply Academy on LinkedIn, we record:

• your name, your LinkedIn profile address, and the professional headline shown on your profile
• which post you engaged with, what you did, and when
• the text of any public comment you left

We take this only from what LinkedIn already displays publicly. We never sign in as you, use your account, or collect anything you have not made public, and we do not store your profile picture, collect your email address or phone number, add information from other sources, or share any of it, except where the law requires us to.

We use it to understand which of our posts are useful, and to recognise people who engage with our work more than once. Our legitimate interest is understanding our own audience and building professional relationships. We have assessed that this does not override your rights: it is information you chose to publish on a professional network, LinkedIn already shows it to us, and we make no automated decisions about you.

If you engaged once and not since, we delete your name, profile address and headline after twelve months, keeping only the anonymous fact that a post received a reaction or a comment. If we ever contact you because of something you engaged with, we will tell you in that first message how we came to have your details.

You can ask what we hold, have it corrected, or object — in which case we will stop and delete it. See Section 8.

We use artificial intelligence to personalise your experience. This section explains how it works and how we protect your data.

How It Works

1. You provide profile information about your professional context
2. You submit content through the Service
3. This information is processed by our AI service provider to generate personalised responses and content
4. Personalised content is stored in your account for you to access

Our AI Service Providers

We use third-party AI services to generate personalised content. When your data is sent to these providers:

• It is processed solely to generate your personalised content
• It is not used to train their AI models
• Our agreements require them to maintain appropriate security and delete data when no longer needed
• We only use providers who offer data protection terms consistent with UK GDPR

What AI Processing Involves

The AI analyses your profile information and the content you submit to:

• Understand your professional context
• Provide relevant responses and recommendations
• Generate content tailored to your situation

This is automated processing, but it does not make decisions about your access to the Service. It only personalises your experience.

Your Rights Regarding AI Processing

• Right to information: This notice explains how AI processes your data
• Right to object: You can object to AI processing. As personalisation is core to how the Service works, we may not be able to continue providing the Service if you object, in which case we will close your account. Any refund will be at our discretion, taking into account the training content you have already accessed.
• Right to access: You can request copies of all AI-generated content about you
• Right to erasure: You can request deletion of your data and AI-generated content

To exercise these rights, contact us at hello@multiply.academy.

We share your data only as described below. We do not sell your personal data.

Categories of Recipients

We use service providers by category rather than naming specific companies. This allows us to change providers without updating this policy, while maintaining equivalent data protection standards.

Our agreements with these providers require them to:

• Process data only on our instructions
• Maintain appropriate security measures
• Not use your data for their own purposes
• Delete data when no longer needed

When We May Disclose Data

We may also disclose your data:

• To comply with legal obligations or valid legal requests
• To protect our rights, property, or safety, or that of our users
• In connection with a business transfer (merger, acquisition, or sale of assets) - you would be notified of any change in controller
• With your consent

4A.1 Manager Email

If your access is provided through your organisation, we collect your line manager's email address during account creation. This is used to:

• Enable management-level reporting on team training progress
• Build organisational hierarchy for reporting purposes
• Communicate team-level insights to the appropriate manager

Legal basis: Legitimate interests (your employer has a legitimate interest in monitoring the effectiveness of training programmes it has purchased for its employees) and consent (you provide explicit consent during account creation).

4A.2 Data Shared With Your Organisation

The following data may be shared with your organisation, attributed to you individually:

• Your training progress, including your name, email address, current module, completion status, last active date, and overall progress through the programme
• Training reflections and other content you submit through the Service

The specific categories of data shared may evolve as the Service develops. We will update this section to reflect any material changes.

4A.3 Who Can See Your Data

Your training progress, reflections, and insights are accessible to managers in your reporting chain and may be visible in summarised form to others within your organisation.

4A.4 Legal Basis

We process this data under two legal bases:

• Legitimate interests: Your employer has purchased training licences and has a legitimate interest in understanding adoption, progress, and return on investment. This includes visibility into individual training reflections to enable programme management and targeted support. We have assessed that this processing is proportionate and does not override your privacy rights, given the professional development context of the data.
• Consent: You provide explicit consent to enterprise data sharing during account creation (a separate checkbox from standard consent). You may withdraw this consent at any time by contacting us, though this may affect your access to the Service as data sharing is integral to organisational access.

4A.5 Data Retention

Enterprise data is retained in accordance with the Data Processing Agreement between Multiply Academy and your organisation. See Section 6 of this Privacy Policy for general retention periods.

Your data may be transferred to and processed in countries outside the United Kingdom. This may include transfers to the United States or other countries where our service providers operate.

When we transfer data internationally, we ensure it is protected by appropriate safeguards, which may include:

• Adequacy decisions: Transfers to countries the UK has determined provide adequate data protection
• UK-US Data Bridge: For US providers certified under the Data Privacy Framework
• Standard Contractual Clauses (SCCs): UK-approved contractual terms requiring the recipient to protect your data to UK standards

You can contact us for more information about the specific safeguards in place for any transfer.

We retain your data for as long as necessary to fulfil the purposes described in this policy, which includes:

• Providing the Service while your account is active
• Allowing you to return and reactivate your account
• Answering and following up an enquiry, whether or not it leads to a purchase — this includes the enquiry record itself and how you reached us (Section 1)
• Improving our training based on how users learn
• Creating aggregated resources for users in similar roles
• Complying with legal obligations (e.g., tax records must be kept for 7 years)
• Defending against potential legal claims (the limitation period for most claims is 6 years)

We do not automatically delete your account data when your subscription ends or your account becomes inactive. This allows you to reactivate your account in future without losing your progress. The LinkedIn engagement records described in Section 2A are the exception: those are deleted on the timetable set out there, without you having to ask.

Your control: You can request deletion of your data at any time (see Section 8). We will delete it unless we have a legal obligation to retain it (such as tax records).

Anonymised data (which cannot identify you) may be retained indefinitely for research and analysis.

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption of data in transit and at rest
• Secure authentication systems
• Access controls limiting who can access your data
• Use of reputable service providers with strong security practices

While we take reasonable precautions, no system is completely secure. You are responsible for keeping your login credentials confidential.

In the unlikely event of a data breach affecting your personal data, we will notify you and the relevant authorities as required by law.

Under UK GDPR, you have the following rights:

How to Exercise Your Rights

Contact us at hello@multiply.academy with your request. We will respond within one month. If your request is complex, we may extend this by up to two months (we will let you know).

We may ask you to verify your identity before processing certain requests.

There is no fee for most requests. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act.

Right to Complain

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

We would appreciate the opportunity to address your concerns directly before you contact the ICO.

For Users in Canada

If you are in Canada, you may also complain to the Office of the Privacy Commissioner of Canada:

• Website: priv.gc.ca

For Users in the United States

If California privacy law applies to you (based on residency and our business operations), you may have additional rights including the right to know what personal information we collect and the right to request deletion. Contact us at hello@multiply.academy to exercise these rights.

Cookies are small text files placed on your device when you visit our website. Our full Cookie Policy is included in our Terms and Conditions (Section 15).

Cookies

The only cookies we set are strictly necessary ones: authentication and security, session management, and completing actions you have asked for (such as holding an invitation code while you sign in, or completing a purchase). No consent is required for these, so we do not show a cookie banner. We set no analytics, functionality, marketing or advertising cookies. You can control cookies through your browser settings; blocking the strictly necessary ones will stop parts of the Service working.

How Our Analytics Works

Our analytics is storage-free: it sets no cookies and stores nothing on your device.

• On our public website, analytics is anonymous. We measure page and video engagement in aggregate, and we do not link that activity to a named individual. Separately from analytics, if you make an enquiry or a purchase we record how you reached us (Section 1) with the details you provide — that record is not built from your analytics activity.
• Inside the platform, once you are signed in, usage events (such as the modules and screens you view and the actions you take) are linked to your account. This is part of the usage data described in Section 1 and is used for the purposes in Section 2. The content you write in the Service, such as your reflections and your work, is not captured by analytics.
• We do not use session replay. If we ever introduce it, it will be off by default and run only with your opt-in consent.
• Our analytics provider processes this data on our instructions, under a data processing agreement, hosted in the EU.

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18.

If we become aware that we have collected data from someone under 18, we will delete it promptly. If you believe we may have data about someone under 18, please contact us.

We may update this Privacy Policy from time to time. When we make changes:

• Material changes: We will notify you by email when material changes are made and explain what has changed and why. Where we do not hold an email address for you, the updated policy on this page is the notice.
• Minor changes: May be made without separate notification; check the "Last updated" date

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or how we handle your data, please contact us at hello@multiply.academy.

We aim to respond to all enquiries within 5 working days.