Legal

Privacy Policy

How Ocademy collects and uses personal data when you visit our website, contact us, book a call, buy a course or use our learning platform.

Last updated: 10 November 2026.

Who We Are

Web Fuel Agency Ltd, trading as Ocademy (“Ocademy”, “we”, “us”), is the controller of the personal data described in this policy.

Company details: registered in Gibraltar with company number 115730.

Registered office: Suite 23, Portland House, Glacis Road, Gibraltar GX11 1AA.

Ocademy is a product of Web Fuel Agency Ltd. We sell online courses and CPD training, and a downloadable playbook, to consumers and businesses worldwide through ocademyglobal.com and our own learning platform.

As a company registered in Gibraltar, we are mainly subject to the Gibraltar General Data Protection Regulation (Gibraltar GDPR) and the Data Protection Act 2004. Our main data protection regulator is the Gibraltar Regulatory Authority, acting as Information Commissioner. Because we offer courses to people in the United Kingdom and the European Union, the UK GDPR and the EU GDPR also apply alongside the Gibraltar GDPR, each where it applies. In this policy, “data protection law” means whichever of these laws applies.

What Personal Data We Collect

We collect only what we need. Depending on how you deal with us, this may include:

Identity and contact data — name, email address, company (if you give it), and any phone number or other details you provide when you contact us or book a call.
Enquiry and booking data — your message, preferred call time and any answers you give about your training needs.
Account and course data — the email you use to sign in, sign-in codes, course enrolments, progress, completion and certificates. Sign-in uses a one-time code sent to your email. We do not need a password from you for that flow.
Payment data — payment status, amount, date, and the email or name associated with the purchase. Purchases are made through our learning platform checkout at app.ocademyglobal.com. Card payments are handled by our payment service provider. Ocademy does not see or store your full card number.
Communications — messages you send us, and service emails we send you (for example sign-in codes and access emails).
Technical data — IP address, browser and device type, pages requested, date and time, and referring page, from our website and platform logs and security tools.
Cookie and consent data — your cookie choices, which Consently records and stores, and any analytics data collected if you accept. These are described under Cookies and in our Cookie Policy.
Marketing preferences — whether you have asked to receive updates, or have opted out.

Our website contact form asks for your name, email, an optional company name, your message, and a required tick that we may use those details to reply, as described in this policy.

We do not intend to collect special category data (such as health data) through this website or our courses. Please do not include that kind of information in forms or messages.

Purposes and Lawful Bases

We use personal data only for the purposes below, and only where data protection law gives us a lawful basis.

Purpose	Lawful basis
To reply to enquiries and arrange booked calls	Steps you ask us to take before a contract, or our legitimate interests in responding to enquiries
To take payment and give you access to a course or playbook	Performance of our contract with you
To run your learning account, progress, completion and certificates, and to send service messages such as sign-in codes	Performance of our contract with you
To set up and manage team or business purchases	Performance of our contract, or our legitimate interests in delivering training the organisation has bought
To keep accounting and legal records	Legal obligation
To operate, secure and repair the website and learning platform	Our legitimate interests in keeping our services working and secure
To record and apply your cookie choices through Consently	Legal obligation, and our legitimate interests in honouring and demonstrating consent
To understand how the marketing website is used (analytics cookies)	Your consent. These are off unless you accept
To send optional marketing about Ocademy courses	Your consent, or another basis the electronic marketing rules allow. You can opt out at any time
To handle complaints, disputes and legal claims	Our legitimate interests in establishing, exercising or defending legal claims, or a legal obligation

Where we rely on legitimate interests, we have balanced those interests against your rights and would not use your data in a way you would not reasonably expect. You can object at any time (see Your Rights).

You do not have to give us personal data. We need contact details to reply to you, and an email address to create an account and deliver a course you have bought.

Sharing and Service Providers

We do not sell your personal data. We share it only with service providers who help us run Ocademy, and only as needed for the purposes above, or where the law requires it.

Our payment service provider — processes card payments when you buy through our learning platform checkout at app.ocademyglobal.com. The provider collects the card details you enter. We receive confirmation of payment, not your full card number.
GoHighLevel — the Book a Call calendar and related lead handling. Leads from the website contact form and the booking calendar are sent to GoHighLevel and to Cortex.
Cortex — our internal customer relationship system, which receives leads from the contact form and the booking calendar.
Consently — the consent management platform on this website, provided by Dorik, Inc., a company registered in the United States. Consently presents the cookie banner, records your cookie choices, and stores those records. According to Consently’s published privacy policy and subprocessor list (read on 10 November 2026), its servers and consent data are hosted in the European Union, in Frankfurt. Consently states that some of its staff may access data from outside the EU and that, where this happens, it relies on Standard Contractual Clauses.
DigitalOcean — hosting for our learning platform (a Laravel application we operate ourselves) in DigitalOcean’s London data centre in the United Kingdom.
Hostinger and Cloudflare — hosting, content delivery and security for the marketing website.
Mailgun — transactional email, including sign-in codes and service messages, processed in the United States.
Livid — hosting and embedding of course videos on the learning platform.
Google Analytics — optional website analytics, only if you accept analytics cookies.
Professional advisers and authorities — for example accountants, lawyers, or a regulator, where we must or have a legitimate need to share information.

If a business buys training for its staff, we may share relevant progress or certificate information with the organisation that paid for the places, where that is needed to deliver the purchase.

International Transfers

Some of our providers are in, or can access data from, countries outside Gibraltar, the United Kingdom and the European Economic Area. In particular, GoHighLevel and Google Analytics may process data in the United States, and Mailgun processes our email in the United States. Our payment service provider may also process payment data outside Gibraltar, the United Kingdom or the European Economic Area, depending on the provider. Consently hosts consent records in the European Union (Frankfurt), according to its published terms. Consently is provided by a US-registered company, and some of its staff may access data from outside the EU under Standard Contractual Clauses.

Where a transfer is not covered by an adequacy decision, we use appropriate safeguards. These may include the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where a provider is certified, the EU-US Data Privacy Framework and the UK Extension to it.

You can ask us for more information about these safeguards through the contact form.

How Long We Keep Data

We keep personal data only for as long as we need it for the purposes above, including any legal retention period. Unless a longer period is required by law, our usual periods are:

Enquiries, contact form messages and booking leads — up to two years after our last contact with you, unless you become a customer (in which case the customer periods apply).
Customer account, enrolment, progress and certificates — for the access period of the course or product, and then up to six years, so we can confirm completion and keep records of contracts.
Payment and accounting records — six years.
Marketing contact lists — until you opt out or withdraw consent. We may keep a minimal suppression record so we do not contact you again.
Technical and security logs — up to 12 months, unless we need them for a security investigation or legal claim.
Cookie consent records — recorded and stored by Consently, and in a cookie or similar storage on your device, for the period set by Consently. You can change or withdraw your choice at any time using the Consently cookie settings on this website.

We may keep information for longer if it is needed for a dispute, claim or legal obligation.

Your Rights

Data protection law gives you rights over your personal data. These include the right to:

be informed about how we use your data (which this policy is part of);
access a copy of your data;
have inaccurate data corrected;
ask us to delete your data, in certain cases;
object to processing based on legitimate interests, and to direct marketing;
ask us to restrict processing, in certain cases;
receive your data in a portable format, in certain cases; and
withdraw consent where we rely on it, without affecting the lawfulness of use before you withdrew it.

You also have rights in relation to automated decision-making. We do not use your data for solely automated decisions that have a legal or similarly significant effect on you.

To use these rights, send a message through our contact form. We may need to check your identity. We will respond within the time the law requires.

You can complain to the Gibraltar Regulatory Authority, which is our lead data protection regulator. If you are in the United Kingdom you can also complain to the Information Commissioner’s Office (ICO). If you are in the European Union you can complain to your local supervisory authority. You may also have the right to go to court.

Gibraltar Regulatory Authority: gra.gi. UK ICO: ico.org.uk.

Cookies

We use cookies and similar technologies on the marketing website and, where you have an account, on our learning platform. More detail is in our Cookie Policy.

Cookie choices on the marketing website are collected, recorded and stored by Consently, our consent management platform. Consently sets a strictly necessary cookie (or similar storage) so that your choice can be remembered. The duration of that storage is set by Consently.

Strictly necessary cookies are needed for the site to work, to keep it secure, and to remember your Consently consent choice. They do not require your consent.

Analytics cookies help us understand how the marketing website is used. They are off unless you accept them. If you accept, we use Google Analytics 4, with Google Consent Mode, to collect information such as pages visited, approximate location derived from IP address, device and browser type, and referral source. IP anonymisation is enabled in our configuration. These cookies load only after you click Accept All, or enable the analytics category, in the Consently banner. Their duration is set by Google.

Third-party booking cookies may be set by GoHighLevel when the Book a Call calendar loads. The booking iframe loads only after you click Accept All, or enable the relevant category, in the Consently banner. Any cookies then set have a duration set by GoHighLevel.

Our learning platform uses cookies or similar technologies that are needed to sign you in and deliver the course. Their duration is set by that platform.

You can change or withdraw your consent at any time through the Consently cookie settings link or button on this website. You can also use your browser settings to block or delete cookies, as explained in the Cookie Policy.

Marketing

We will only send you electronic marketing about Ocademy where the law allows, including the Communications (Personal Data and Privacy) Regulations 2006 in Gibraltar and, where they apply, the UK Privacy and Electronic Communications Regulations 2003 (PECR).

The consent tick on the contact form is so we can reply to your message. It is not consent for marketing.

Every marketing message will say who it is from and how to opt out. You can also opt out through the contact form.

Children

Our website, courses and playbook are aimed at adults aged 18 or over. We do not knowingly collect personal data about children. If you think we have done so, please contact us and we will delete it.

Security

We use appropriate technical and organisational measures to protect personal data, including access controls on the learning platform and encrypted payment handling by our payment service provider. No online service can be guaranteed completely secure. Please keep your email account secure, because that is how you sign in.

Changes to This Policy

We may update this policy from time to time. The updated version will be published on this page, with a revised “Last updated” date. If changes are material, we will take additional steps to let you know where it is reasonable to do so.

Contact

For privacy questions, requests or complaints, use our contact form. You can also write to us at:

Web Fuel Agency Ltd (Ocademy)
Suite 23, Portland House
Glacis Road
Gibraltar GX11 1AA

To book a call about training, use the Book a Call page.