Last updated 2026-10-12
This statement explains what personal data this site holds about you, why, who handles it for us, and what you can ask us to do with it.
Who is responsible for your data
Qeep Ltd, trading as Affirm LGBT, is responsible for your personal data. In data protection law, that makes us the "controller".
We are registered in England and Wales with company number 13369961, and our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Our registration number with the Information Commissioner's Office (ICO) is ZC271895.
What we hold
Your account. Your email address, your name, and your role on the site (learner, or one of our staff). Your name is what appears on your certificates. When you ask for a sign-in link, we keep a scrambled copy of it, the address it was sent to, and when it expires, until it is used. If the address has no account yet, your account is created only when you open a link. To stop the site being used to send email to anyone, we count sign-in links asked for each email address, and from each internet address (for an IPv6 address, the block of addresses it belongs to), for 1 hour, in the server's memory only.
Your learning. Which lessons you have started and finished, and when. Where you stopped in a video, so you can carry on from there. Your quiz answers and scores. Your certificates: the number, the course, the CPD hours and the date.
Your purchases. Stripe takes your payment and holds your card and billing details. We never see your card number. We give Stripe your email address, so that it can send your receipt, and our reference numbers for you and for the course. We keep which course you bought, the amount you paid, Stripe's reference for the payment, and the time you agreed to get access straight away.
Emails you send us. If you write to info@affirm.lgbt, we keep your message and our reply.
Visits to the site. Vercel, which hosts the site, records each request in its logs, including the internet (IP) address it came from.
The certificate check. Anyone you give your certificate number to can check it on this site by entering the number with your surname. The check confirms the course, the date and the CPD hours. It never shows your name. To stop anyone guessing numbers, the check counts attempts from each internet address for 1 hour, in the server's memory only.
Our admin panel shows your account only to our administrators. The people who build and maintain the site can reach the database to do that work.
If you do not give us these details. We need your email address to give you an account: without it we cannot send you a sign-in link. We need your name to issue a certificate: without one on your account, we do not issue your certificate until you give us the name to print. Your dashboard asks for it.
If you studied with us on our old site. Your account, the courses you bought, your progress and quiz results, and your certificates were moved here from it. That data was collected by Affirm LGBT Ltd, which ran the old site and has transferred the site, the courses and their records to Qeep Ltd. Certificates you earned there were reissued here with new numbers, keeping the date you earned them.
Why we hold it, and our lawful basis
To provide the courses you signed up for. We need your email address to send you sign-in links, and your learning record to show your progress and issue your certificates. Our lawful basis is the contract between us.
To keep the records the law requires. Records of sales are kept for tax and accounting. Our lawful basis is a legal obligation.
To let others check your certificate. The public certificate check lets someone you have given your certificate number to confirm it is real. Our lawful basis is our legitimate interest, and yours, in certificates that can be trusted.
To prevent abuse. We count certificate checks, sign-in emails and contact-form messages per internet address (for an IPv6 address, the block of addresses it belongs to), and sign-in emails and contact-form messages per email address as well, and our host keeps request logs, to stop the site being misused. The counts are held in memory for an hour and never written to our database. Our lawful basis is our legitimate interest in keeping the site and your data safe.
To carry over your learning from our old site. If you studied with us before, we moved your record here so you keep your courses and certificates. Our lawful basis is our legitimate interest, and yours, in your keeping what you bought and earned.
To answer you. If you email us, or write to us through the contact form, we use what you send to reply. A message from the form reaches our mailbox as an email, and we do not keep a copy of it on this site. Our lawful basis is our legitimate interest in answering, or the contract if you are writing about a course you bought.
Automated decisions. We make no decisions about you by automated means that have a legal or similarly significant effect on you. Quizzes are marked automatically, and a quiz you have not passed keeps the next part of the course closed until you pass it. You can take a quiz again as many times as you like.
What we never do
- We never put the name of a course in an email, or in a link in one. A sign-in email carries the link and nothing about your courses.
- We never send the name of a course to Stripe. There, every course is "Affirm LGBT online course (ref N)", where N is a reference number. Stripe sees the price you paid and that reference, not the course's name.
- We never use tracking cookies or advertising. The cookie policy lists every cookie this site sets.
- We never track whether you open our emails or which links in them you click.
- We never sell your data, or share it with anyone for their own marketing.
Who processes it
These services handle personal data for us. Stripe also acts in its own right for some of what it does, such as preventing fraud, and its privacy notice explains this.
| Service | What it does for us | Where it holds data |
|---|---|---|
| Stripe | Takes payment, and sends receipts and invoices. | See their privacy notice |
| Resend | Sends the sign-in link, messages from the contact form and other emails from the site. | See their privacy notice |
| Google Workspace | The support mailbox: the email you send us, and our replies. | See their privacy notice |
| Bunny | Plays the video lessons. | EU |
| Amazon Web Services | Stores images and downloadable files. | Ireland |
| Vercel | Hosting. | EU region; see their privacy notice for the rest |
| Neon | Holds the database: accounts, enrolments and progress. | Frankfurt, Germany |
Some of these services handle data outside the UK. Neon, Amazon Web Services and Bunny hold it in the European Union, as does Vercel's EU region. These may also handle it in the United States or elsewhere:
- Stripe, under the UK–US data bridge, and otherwise under standard contractual clauses with the UK Addendum;
- Resend, under standard contractual clauses with the UK Addendum;
- Google Workspace, under the UK–US data bridge and standard contractual clauses with the UK Addendum;
- Vercel, under the UK–US data bridge and standard contractual clauses with the UK Addendum.
To ask for a copy of the safeguards that cover a transfer, email us at info@affirm.lgbt.
How long we keep it
- Your account, enrolments, progress and quiz answers: until you ask us to delete your account. Nobody's access to a course expires, so we do not delete accounts on a timer.
- Your certificates: while you have an account. When it is deleted, a record that each certificate was issued remains, as the record of issue: its number, the course, the CPD hours and the date. It no longer carries your name. Download your certificates before you ask us to delete your account; we cannot reissue them afterwards.
- A sign-in link: it works for 15 minutes. Asking again sends another link and leaves the earlier ones working. When you use any of them, the records of every link for your address are deleted. A link nobody uses stops working when it expires, and its record is deleted the next time anyone asks for or uses a sign-in link.
- The sign-in cookie: lasts 60 days, or until you sign out.
- Certificate-check counts: they count checks for 1 hour, and are kept only in the server's memory until it restarts or the list fills.
- Sign-in link counts: the same, for 1 hour, in the server's memory only.
- Payment records: Stripe keeps the record of each payment, which is the record of the sale. We keep our accounting records, which include each sale, for 6 years after the end of the financial year they belong to, as UK tax law requires.
- Emails you send us: for 2 years after our last exchange with you. We clear older messages once a year. They are not deleted with your account unless you ask.
- Our providers' logs: Resend keeps a log of each email it sends for us for 30 days. Vercel keeps its request logs for 1 day.
When you ask us to delete your account, your account, enrolments, progress and quiz answers are deleted together.
Your rights, and how to complain
You have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct it;
- ask us to delete it;
- ask us to limit how we use it;
- object to how we use it, where we rely on our legitimate interests;
- ask for your data in a form you can take elsewhere.
To use any of these rights, email us at info@affirm.lgbt. Writing from the address on your account helps us confirm it is you, but you do not have to. We will answer within one month, as the law requires.
If you are unhappy with how we have handled your data, please tell us first, so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at any time:
- online at ico.org.uk;
- by post to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Contact
Email us at info@affirm.lgbt, or write to Qeep Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.