Privacy Notice

1. Scope of this notice

This notice applies to personal information Program Backed processes as a controller when you visit our site, apply to enrol in a programme through the framework, sign a Framework Agreement, or contact us for support. Where a participating provider separately processes your information (for example, to deliver instruction or manage placement), that provider acts as an independent controller and its own privacy notice applies to that activity in addition to this one.

2. Information we collect

Directly from you

• Identity information: full legal name, date of birth (where required for age verification), country of residence.
• Contact information: email address, phone number, correspondence address.
• Enrolment information: the programme you have selected, the cohort, and the terms of the Framework Agreement you have signed.
• Signature information: the electronic signature, IP address at signing, timestamp, and a hash of the signed document.
• Payment reference information: the Stripe payment identifier for your enrolment. Card details are collected and stored by Stripe, not by Program Backed.
• Correspondence: emails, support tickets, and case notes when you contact us.

Automatically

• Usage information: pages viewed, actions taken, timestamps, referrer, and approximate location from IP.
• Device and browser information: user agent, screen size, and language settings.
• Cookies and similar technologies — see the Cookies Notice.

From participating providers

• Placement outcome information: whether you were placed, the role, the employer, the start date, and the reported salary at placement.
• Progress information relevant to the Framework Agreement (for example, whether you have completed the programme requirements that condition your rights under Schedule B).

3. How and why we use your information

• Deliver the framework. To present, sign, hold, and enforce the Framework Agreement between you and the provider (contract).
• Administer refunds. To assess and pay refunds under Schedule C (contract).
• Audit outcomes. To verify that a programme's published outcomes reconcile to source records (legitimate interests — an independent audit is what makes the framework meaningful).
• Investigate complaints. To handle disputes between you and a provider (contract and legitimate interests).
• Improve the service. To understand usage, prioritise features, and prevent abuse (legitimate interests).
• Comply with law. To meet record-keeping, financial, and regulatory obligations (legal obligation).
• Communicate with you. Transactional notices about your enrolment and, where you have opted in, updates about the framework (contract or consent).

4. Who we share information with

• The participating provider you have enrolled with, to the extent required to deliver instruction, run placement, and administer the Framework Agreement.
• Stripe, our payments processor, to collect payment for your enrolment. Stripe is an independent controller for the card data it collects.
• Service providers that host our infrastructure, send transactional email, and provide error monitoring. These providers act on our documented instructions.
• External adjudicators on the Program Backed panel, when a complaint is escalated to review.
• Regulators, auditors, and law enforcement, where we are legally required to disclose.
• A successor, if the framework is transferred to another entity through a merger, acquisition, or reorganisation. Any successor must accept this notice.

We do not sell personal information and we do not share it for behavioural advertising.

5. International transfers

Program Backed operates from the United States. If you are located in the United Kingdom, the European Economic Area, or another jurisdiction with cross-border transfer rules, we transfer your information to the US and to our service providers under the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an equivalent lawful transfer mechanism. A copy of the safeguard in force for a specific transfer is available on request.

6. Retention

• Signed Framework Agreements and Schedules: for the life of the commitment plus six years after the last obligation under the agreement expires.
• Payment references: seven years, to meet financial record-keeping obligations.
• Support correspondence: three years after the case is closed.
• Marketing preferences: until you withdraw consent, plus a minimal suppression record so we do not re-contact you.
• Server logs: up to 90 days.

7. Your rights

Depending on where you are, you may have some or all of the following rights: access, correction, deletion, restriction, objection, portability, withdrawal of consent, and the right to lodge a complaint with a supervisory authority. To exercise a right, write to info@programbacked.com from the email address associated with your account or enrolment, or use the contact page. We respond within one calendar month. If you are in the UK or the EEA and are unhappy with our response, you may complain to your local data protection authority — in the UK, the Information Commissioner's Office at ico.org.uk.

8. Security

We use encryption in transit, encryption at rest for stored agreements, access controls scoped to job function, multi-factor authentication for privileged accounts, and audit logging of access to sensitive systems. This is a description of enabled controls today and is not a certification.

9. Minors

The Program Backed Framework is aimed at adults enrolling in career-outcome programmes. We do not knowingly collect information from anyone under 16. If you believe a minor has provided information to us, contact us and we will delete it.

10. Changes to this notice

We review this notice at least annually and update it when our practices change. The "last updated" date at the top of the page indicates the current version. Material changes are announced by email to registered account holders at least fourteen days before they take effect.