Privacy notice

1. Who we are and how to contact us

1.1 The controller is AVERON TECHNOLOGIES LIMITED, a private limited company registered in England and Wales under company number 17479274, registered office: Unit C Piccadilly Business Centre, Aldow Enterprise Park, Manchester M12 6AE, United Kingdom (“we”, “us”). For anything about personal data, write to privacy@makemefit.net or to the registered office.

1.2 We are not required to appoint a data protection officer. Our privacy contact handles all requests and complaints about personal data.

1.3 Representative in the EU. Because we offer services to people in the European Union, we appoint a representative in the EU under Article 27 EU GDPR. The representative's name and contact details will be shown in this section. Until then, people in the EU can contact us directly at privacy@makemefit.net; this does not affect your rights.

2. Whose data this notice covers

2.1 This notice applies to: (a) visitors to makemefit.net; (b) people who send us an enquiry, a booking request, a Readiness Plan or a consultation request; (c) learners and customers who book or take a course, path or mentor consultation; (d) contact persons of companies and other organisations that buy business packages or pay for their staff; and (e) mentors and people who apply to become mentors.

2.2 Our Terms of service, Mentor terms, Cookies statement and Responsible AI statement contain further information and should be read together with this notice.

3. What data we collect and where it comes from

3.1 We collect the following categories of personal data:

• Contact and identity data: name, email address, phone or messenger contact (optional), country of residence, preferred language and, if you book for a company, company name and your role.
• Request and Readiness data: the content of your messages, the course or path you are interested in, your Readiness Check answers and Readiness Plan if you choose to send them, preferred start date.
• Booking, invoicing and payment data: booked services, support level, start dates, prices, invoices, billing address, payment status, and the details shown on the bank transfer we receive (payer name and bank reference). We do not receive or store your card details.
• Learning data: account details (your email address and a password stored only as a one-way hash), progress in the result tracker, assignments and other submissions, assessment results, certificates and their verification records, attendance at calls and clinics, messages with mentors and coordinators, and feedback you give us.
• Mentor data: application details (experience, areas, languages, availability, profile links), engagement letter, services provided, invoices or self-billing statements, payment details, quality reviews and learner ratings.
• Business customer data: names and business contact details of contact persons, purchase orders, contracts and invoices, and the names and email addresses of nominated learners.
• Technical data: IP address, browser type and time of access processed by our hosting provider in server logs, and data needed to keep accounts and the learning platform secure.

3.2 We collect personal data from you directly; from your employer or another organisation if it books a course for you or nominates you as a learner; from mentors and coordinators (for example feedback on your work); and from our bank when we receive your payment.

3.3 You do not have to give us your personal data, but without the data marked as required we cannot answer your request, conclude or perform a contract or issue an invoice.

4. Why we use your data and on what legal basis

4.1 We use personal data for the following purposes and on the following legal bases under Article 6(1) UK GDPR and, where it applies, EU GDPR:

• Answering enquiries and booking requests, preparing offers and invoices: steps at your request before entering into a contract (Art. 6(1)(b)); for contact persons of companies, our legitimate interest in dealing with the organisation they represent (Art. 6(1)(f)).
• Performing the contract: giving access to courses, mentor and coordinator support, calls and clinics, assessments, certificates and post-course support (Art. 6(1)(b)).
• Invoicing, accounting and record-keeping: compliance with our legal obligations under company and tax law (Art. 6(1)(c)).
• Certificate verification: performing the contract and our legitimate interest in letting third parties check that a certificate is genuine (Art. 6(1)(b) and (f)).
• Quality assurance: reviewing samples of mentor feedback and learner ratings to keep standards high (Art. 6(1)(f)).
• Reporting to a business customer: attendance, progress, completion and assessment results of learners whose course the business customer pays for, as explained to those learners (Art. 6(1)(b) towards the business customer and Art. 6(1)(f)).
• Mentor applications and engagements: steps before a contract and performance of the engagement (Art. 6(1)(b)); tax and accounting obligations (Art. 6(1)(c)).
• Security, fraud prevention and sanctions compliance: our legitimate interest in protecting our services and users, and our legal obligations (Art. 6(1)(f) and (c)).
• Service messages: information about your booking, schedule changes and important updates (Art. 6(1)(b)).
• Marketing: news about our courses by email only with your consent (Art. 6(1)(a)) or, for existing customers, about similar services under the soft opt-in rule, with a free opt-out in every message (Art. 6(1)(f) and regulation 22(3) of the Privacy and Electronic Communications Regulations 2003).
• Legal claims: establishing, exercising or defending legal claims (Art. 6(1)(f)).
• Improving our courses: using anonymised or aggregated information from which you cannot be identified.

4.2 Where we rely on legitimate interests, we have balanced them against your interests and rights. You can ask us for details of that assessment and object at any time (see section 13).

5. Special categories of data and children

5.1 We do not ask for health data or other special categories of personal data. If you tell us about a disability or other need so that we can adapt a course for you, we use that information only for the adjustment, on the basis of your explicit consent (Art. 9(2)(a)), which you can withdraw at any time. Please do not include special categories of data in assignments unless the task expressly requires it.

5.2 Our services are intended for adults. Learners under 18 can take part only where a parent, guardian or business customer books for them and we have agreed in writing; in that case we process only the data needed for the course.

6. Automated decisions and AI

6.1 In Essential courses, quizzes and final assessments may be scored automatically. These results do not have legal or similarly significant effects for you within the meaning of Article 22 UK GDPR and EU GDPR, and you can ask a member of our team to review any result within 14 days. In Guided and Premium courses and paths, mentors make the assessment decisions.

6.2 The Readiness Check is a rule-based questionnaire that runs in your browser. It does not use artificial intelligence and does not send your answers to us unless you choose to send your Readiness Plan.

6.3 Where a course offers AI practice features, we send the AI provider only the data the feature needs, under a data processing agreement. We do not use learner data to train AI models and do not allow our providers to do so. More in our Responsible AI statement.

7. Who we share data with

7.1 We share personal data only as far as necessary with:

• Service providers acting as our processors under data processing agreements: website hosting, email, form processing, the online learning environment, video-call, messaging and file-sharing tools, and AI practice tools.
• Mentors and coordinators, who access learner data on our platform only to provide the services, on our instructions and under confidentiality obligations.
• Business customers, for the reporting described in section 4, and only for learners whose course they pay for.
• Banks and payment service providers, to receive payments and make refunds and mentor payments.
• Professional advisers such as accountants, auditors, insurers and lawyers, who are bound by confidentiality.
• Authorities, courts and regulators, where the law requires it or to establish, exercise or defend legal claims.
• A buyer or successor of our business, if all or part of it is transferred, subject to this notice.

7.2 We do not sell personal data and do not share it with third parties for their own advertising.

8. International transfers

8.1 Our team, mentors and service providers may be located in the United Kingdom, the European Economic Area or other countries. Transfers between the UK and the EEA rely on the adequacy decisions in force.

8.2 Where personal data is transferred to a country without an adequacy decision, we use the safeguards provided by law: for transfers from the UK, the UK International Data Transfer Agreement or the EU standard contractual clauses with the UK Addendum, or the UK Extension to the EU–US Data Privacy Framework where the recipient is certified; for transfers from the EEA, the EU standard contractual clauses or the EU–US Data Privacy Framework. Mentors outside the UK and EEA access learner data only on our platform under contractual data protection obligations. You can ask us for a copy of the relevant safeguards.

9. How long we keep data

9.1 We keep personal data only as long as necessary for the purposes described, in particular:

• Enquiries, booking requests and Readiness Plans that do not lead to a booking: 24 months after our last contact.
• Contract, booking and invoicing records: for the duration of the contract and six years after its end, to meet company and tax law requirements and limitation periods.
• Learning data and submissions: until 12 months after the end of your access period, then deleted or anonymised.
• Certificate verification records (name, course, date, result): for as long as the certificate is valid, so that it can be verified; you can ask us to deactivate the public verification link at any time.
• Mentor applications: 12 months after the decision; mentor engagement records: for the duration of the engagement and six years after its end.
• Server logs: up to 30 days, unless needed to investigate a security incident.
• Marketing preferences: until you unsubscribe, after which we keep only a suppression record so that we do not contact you again.

9.2 We keep data longer only where the law requires it or where we need it to establish, exercise or defend legal claims.

10. How we protect your data

10.1 We use appropriate technical and organisational measures, including encrypted connections, access controls based on need-to-know, confidentiality obligations for staff and mentors, data processing agreements with our providers and regular reviews of who has access to what.

10.2 If a personal data breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, and we notify the competent supervisory authority where the law requires it.

11. Marketing communications

11.1 We send marketing emails only with your consent or, if you are already our customer, about similar courses under the soft opt-in rule. Every marketing email contains an unsubscribe link, and you can also write to privacy@makemefit.net. Service messages about your booking are not marketing and are sent as long as your contract requires.

12. Cookies, the website and the Readiness Check

12.1 The public website does not set cookies and does not use analytics, advertising or social media trackers. Fonts are hosted on our own server. Details are in our Cookies statement.

12.2 Your Readiness Check answers are processed only in your browser. They reach us only if you send your Readiness Plan with your contact details.

12.3 If you send a form, it is delivered to us either through our form-processing provider or through your own email programme, depending on how the form is configured.

12.4 The course area sets one strictly necessary session cookie when you sign in, and the courses store your language, voice settings and test scores in your browser's local storage on your device. Video-call tools used in courses may also use cookies that are strictly necessary for logging in and security. If any tool needs other cookies, we will ask for your consent first.

13. Your rights

13.1 Under UK GDPR and, where it applies, EU GDPR you have the right to: access your personal data and receive a copy; have inaccurate data corrected; have your data erased; restrict processing; receive data you provided to us in a structured, commonly used and machine-readable format and have it transmitted to another controller; and object to processing based on legitimate interests. You can object to direct marketing at any time, without giving reasons.

13.2 Where processing is based on your consent, you can withdraw it at any time with effect for the future. This does not affect the lawfulness of processing before withdrawal.

13.3 To exercise your rights, write to privacy@makemefit.net. We may ask you to confirm your identity. We respond within one month, which may be extended by two further months for complex or numerous requests, in which case we will tell you why. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

14. Complaints

14.1 If you are unhappy with how we handle your personal data, please write to privacy@makemefit.net first. We acknowledge data protection complaints within 30 days and reply without undue delay.

14.2 You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk, telephone +44 303 123 1113) or to the data protection supervisory authority in the EU or EEA country where you live, work or where the alleged infringement took place.

15. Changes to this notice

15.1 We update this notice when our services or the law change. The version and effective date are shown at the end of this page. If a change significantly affects how we use data you have already given us, we will tell you in advance by email.

AVERON TECHNOLOGIES LIMITED · 17479274 · Version 2.0 · Effective from 29 October 2026