Privacy notice
How Noble House of Brattleby handles personal data. This notice describes only processing that is actually implemented on this service; it does not describe features we do not operate.
Last updated 23 August 2026
Who we are
Noble House of Brattleby is the public identity of The Noble House of Brattleby Ltd, a company registered in England and Wales under company number 16636213, registered office 85 Uxbridge Road, London, England, W5 5BW, United Kingdom.
The Noble House of Brattleby Ltd is the data controller for the processing described here. Written enquiries, including requests to exercise your rights, should be addressed to private.secretary@noblehousebrattleby.co.uk.
We are not registered with any accreditation body and claim no regulatory status, governmental recognition or professional-body recognition. Where a registration or clearance has not been evidenced — including VAT registration, data-protection registration and trade-mark clearance — we state nothing rather than assert it.
What we process, why, and on what basis
Account registration and sign-in
Data. Email address, authentication credentials handled by our authentication provider, sign-in timestamps.
Purpose. To create and secure an account and to authenticate each session.
Lawful basis. Contract — we cannot provide an account without it.
Person profile
Data. Given and family name, display name, honorific, country, preferred language, time zone, optional avatar.
Purpose. To identify the learner within the institution and on any credential issued.
Lawful basis. Contract.
Learning enrolment and progress
Data. The exact course version enrolled on, lesson and module progress, learning events and timestamps.
Purpose. To deliver study, resume progress and evidence eligibility for examination.
Lawful basis. Contract.
Examination eligibility, attempts and answers
Data. Eligibility decisions, attempt start and end times, the question set snapshot, submitted answers, scores and pass or fail outcome.
Purpose. To administer examinations under server-authoritative conditions and to score them objectively.
Lawful basis. Contract, and our legitimate interest in examination integrity.
Credentials
Data. Credential number, credential type and version, holder name at issue, issuer identity pinned at issue, issue date, lifecycle state.
Purpose. To issue and maintain a credential record and its lifecycle.
Lawful basis. Contract, and our legitimate interest in maintaining a trustworthy credential register.
Public credential verification
Data. The limited fields a verification response is permitted to disclose, principally the holder name at issue, credential title, issue date and current state.
Purpose. To allow a third party to confirm a credential a holder has shown them.
Lawful basis. Legitimate interest in verifiable credentials, exercised within the disclosure policy recorded against each credential.
Organisation membership and licensing
Data. Membership of an organisation, role within it, and access granted through it.
Purpose. To administer institutional access where an organisation sponsors a learner.
Lawful basis. Contract. Substrate only: there are currently no organisations on this deployment.
Audit and security logging
Data. Actor identity, action performed, target record and timestamp for governed operations.
Purpose. To keep a tamper-evident record of institutional decisions and to investigate misuse.
Lawful basis. Legal obligation and legitimate interest in accountability and security.
Correspondence
Data. Whatever you choose to include when you write to the institutional address.
Purpose. To answer enquiries, complaints, credential appeals and incident reports.
Lawful basis. Legitimate interest in responding to correspondence.
How we obtain personal data
Almost everything we hold is given to us directly by you, or generated by your use of the service: your progress through a course, your examination attempt, the credential that results. We do not buy personal data, and we do not enrich your record from third-party sources.
What we do not do
- We operate no advertising, marketing tracking or behavioural profiling.
- We operate no web analytics on this service.
- We do not use remote proctoring, camera capture or biometric monitoring.
- We take no payments; there is no checkout, no card data and no payment record.
- We send no marketing email.
- We make no automated decision producing a legal effect on you.
Examination scoring is automatic and objective: a submitted answer is compared against the recorded correct answer for the pinned question version. It is arithmetic, not profiling, and the outcome may be reviewed under our examination provisions.
Sharing and processors
We do not sell personal data and we do not share it with third parties for their own purposes. Our service runs on managed hosting and a managed database and authentication platform; those suppliers process personal data on our instructions solely to run the service. We name no other processor here because no other processor is engaged.
The single deliberate disclosure to the public is credential verification: a person holding a credential's verification address may confirm it, and will see only the fields the credential's disclosure policy permits.
International transfers
Our infrastructure suppliers operate internationally, so personal data may be processed outside the United Kingdom. The precise hosting regions and the transfer mechanism relied upon are being confirmed with those suppliers before public launch, and this notice will state them plainly once confirmed. We do not assert a transfer position we have not verified.
Retention
Some retention behaviour follows from how the institution works, and we state it honestly:
- A submitted examination attempt is immutable and is kept as the evidential basis of any result or credential derived from it.
- A credential record and its lifecycle history are kept for as long as verification of that credential is meaningful, so that a credential shown to a third party remains checkable.
- Audit records are append-only and are not edited or removed.
Fixed retention periods for accounts, profiles and progress records have not yet been adjudicated. Rather than publish a number we do not operate to, we record this as an outstanding policy decision; it will be stated here before public launch.
Cookies and browser storage
We set no advertising, analytics or tracking cookies. The only browser storage this service relies on is strictly necessary: your authentication session, stored by the authentication library so you stay signed in between pages, and cleared when you sign out.
Because only strictly necessary storage is used, no consent banner is required and we do not display one. If non-essential storage is ever introduced, consent will be sought before it is set.
Security
Access to records is enforced in the database, not merely in the interface. A candidate never receives answer keys, scoring internals or another candidate's data; an employing organisation cannot see unrelated personal learning or credentials. Governed operations are performed through server-side functions that check authority and write an audit event.
Children
This service is for adults. We do not collect a date of birth or an age, and we operate no registration, enrolment, examination or credential path for children. Course material concerning the conduct of children is written for adults. We do not knowingly process the personal data of a child; if you believe we have, write to us and we will remove it.
Your rights
You have the right to be informed, and to request access to your personal data, its rectification, its erasure, restriction of processing, portability, and to object to processing carried out on the basis of our legitimate interests. Where processing rests on consent, you may withdraw it at any time.
Some rights interact with the integrity of the record. Erasing a submitted examination attempt would destroy the evidence for a credential derived from it, and we will explain the consequence rather than quietly refuse. Write to private.secretary@noblehousebrattleby.co.uk.
If you are not satisfied with our response you may complain to the Information Commissioner's Office, the United Kingdom's supervisory authority for data protection.
Changes to this notice
We will update this notice when our processing changes, and the date above will change with it. Material changes will be described rather than folded silently into the text.
See also our terms of use and our legal and contact particulars.