Privacy notice

This notice explains how personal data is handled in Derma Direct Academy (“the Academy”), a private training library for practitioners who are Derma Direct customers.

The controller of your personal data is Derma Direct UK Limited, a company registered in England and Wales under company number 15629396, whose registered office is at M1, Atria, Spa Road, Bolton, BL1 4AG, United Kingdom (“Derma Direct”, “we”, “us”). For any data-protection question, contact info@dermadirect.co.uk.

We have not appointed a data protection officer, as we are not required to. Where the law requires us to have a representative in the European Union, we will appoint one and publish their details on this page. Until then, please contact info@dermadirect.co.uk.

When you request access:

• your full name, email address and phone or WhatsApp number
• your clinic or practice, city and country of practice
• your profession and, if you give it, your professional registration number
• if you choose to give them: the email address you order from Derma Direct with, and your clinic’s Instagram account and website
• the versions of the terms and this notice you agreed to

To confirm your purchases, our team looks up your orders in Derma Direct’s own order records. Nothing from those records is copied into the Academy except the decision and the checks our team ticked.

When you use the Academy:

• your account: name, email address, country, preferred language, and your password, which is stored only in a scrambled (hashed) form that we cannot read
• your membership: approval, renewal and suspension dates, and the reasons recorded with them
• your sign-in sessions: when you signed in, your IP address and your browser and device type
• a record of the emails we send you
• a record of important actions — for example each decision on your request
• how much of each training video you have watched, so you can carry on where you left off, and the courses you have completed, for your certificates

To stop repeated attempts (for example many sign-up requests in a row), we briefly keep a counter linked to your IP address or email address, which is deleted when its time window ends.

We do not use analytics or advertising trackers.

• To check that you are a practitioner and a Derma Direct customer before giving you access.
• To run your account, give you access for 12 months, and handle renewals.
• To email you about your request, your account and your access.
• To keep the Academy secure and prevent shared accounts and misuse.
• To withhold training in countries where it may not be shown.
• To show your progress through the training and issue course certificates.

Our legal bases are:

• Creating and running your account, giving you access, and sending service emails: to perform our agreement with you (the terms of use).
• Checking that you are a practitioner and a Derma Direct customer, including checking our order records: our legitimate interest in making sure the training only reaches qualified professionals who use our products.
• Keeping the Academy secure, including limiting repeated attempts and preventing misuse: our legitimate interests.
• Keeping records we need to meet legal obligations, or to establish or defend legal claims: legal obligation and legitimate interests.
• We do not use your Academy information to send you marketing.

We do not make automated decisions about you: every request is reviewed by a person.

• Derma Direct staff who manage Academy access. They must use two-step login.
• Our service providers, listed below, who act only on our instructions.

We do not sell your data.

We may share information where the law requires it, for example with regulators, courts or the police, or where we need to protect our legal rights. If our business or the Academy is sold or reorganised, your information may pass to the new owner, who must protect it in the same way.

• Render — hosts the Academy and its database, in Frankfurt, Germany.
• Cloudflare — manages our domain name records (DNS); the Academy’s traffic does not pass through Cloudflare’s network.
• Mailgun — sends our emails, from its European Union region.
• Mux — streams the training videos. Mux receives what any video stream needs, such as your IP address and device type, and may collect technical playback-quality data. It is not given your name or email address, and the player is set not to use cookies. Mux may process this data outside the UK and the European Union, including in the United States.

Our hosting is in the European Union. Some service providers may process data outside the UK, for example the video service. Where they do, we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as appropriate.

• Sign-in sessions: up to 30 days, or until you log out.
• Backup copies of the database are kept for up to 30 days.
• Links in our emails expire: email confirmation after 24 hours; choosing your password after 7 days; replying to a request for information after 14 days; checking the status of your request after 30 days.
• Counters used to stop repeated attempts: deleted when their time window ends.
• We keep your account, your requests, the emails we sent you and records of actions on your account for 2 years after your access ends, or after your request is refused or withdrawn. We then delete them, unless we need to keep something longer to meet a legal obligation or to deal with a legal claim.

We use only the cookies the Academy needs to work:

• a sign-in cookie that keeps you logged in, for up to 30 days. Staff also receive a short-lived cookie while completing two-step login.
• NEXT_LOCALE, which remembers the page language, for one year.

We do not use analytics, advertising or tracking cookies, and the video player is set not to use cookies.

• Passwords are stored only in scrambled (hashed) form.
• Staff must use two-step login.
• Every request to watch training is checked again on our server, including whether your access is still current.

Under the UK GDPR and the EU GDPR, you have the right to:

• ask for a copy of your personal data
• have inaccurate data corrected
• ask for your data to be deleted — which will end your access to the Academy
• object to, or ask us to restrict, how we use your data
• receive the data you gave us in a portable format

To use any of these rights, contact info@dermadirect.co.uk. We may need to confirm your identity first. You can also complain to a data-protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the European Union, the authority in the country where you live or work.

Each version of this notice has a version number, shown at the top of this page. When you request access, we record which version you were shown.