Privacy Policy

This explains what personal data MEP-QS collects, why, who it is shared with and what you can do about it. It is deliberately specific rather than generic: it describes how this site actually works.

Last updated: 3 September 2026.

1. Who is responsible for your data

MEP-QS is the data controller for the personal data described here. Contact us at admin@mep-qs.com about anything in this policy.

Postal address: [POSTAL ADDRESS TO BE ADDED]

ICO registration number: [ICO REGISTRATION TO BE ADDED]

2. What we collect

From everyone who creates an account:

• your email address

• your name, if you give it

• sign-in records, so we can keep your account secure

From everyone who buys a course:

• a record of what you bought and when

• payment confirmation and receipt details from Stripe

From everyone who joins the mailing list:

• your email address, and your name if you gave it

• whether our emails were delivered, opened and clicked

Automatically, as with any website:

• IP address and browser information in server logs, kept for security and troubleshooting

We do not collect card details. Those go directly to Stripe and never reach our servers.

If you accept analytics when we ask, we also collect information about how you use the site: the pages you view, the links and buttons you click, and general device and approximate location information derived from your IP address. This is described in section 7 below. If you decline, none of it is collected.

We do not run advertising pixels, and we do not track you across other websites.

3. Why we use it, and our lawful basis

To create your account and give you access to what you bought, because it is necessary to perform our contract with you.

To send you sign-in codes, receipts and messages about a course you own, necessary to perform our contract with you.

To keep records of sales for tax and accounting, because we are under a legal obligation to do so.

To send you marketing emails about new courses, with your consent, which you gave when you joined the list and can withdraw at any time.

To understand how the site is used so that we can improve it, with your consent, which you give by accepting analytics and can withdraw at any time.

To keep the site secure and working, which is our legitimate interest in running a functioning, secure service, balanced against your own interests.

4. Who your data is shared with

We do not sell your data and we do not share it for anyone else's marketing. It is handled by the following service providers on our behalf:

• Hetzner Online GmbH, website and database hosting, Helsinki, Finland

• Cloudflare, file and media storage, held under EU jurisdiction

• Resend, sending our emails, United States

• Stripe, payment processing, Ireland and United States

• PostHog, website analytics, servers in Germany

Each is bound by contract to process data only on our instructions. We may also disclose data where the law requires it.

5. Where your data is held

Your account and purchase data is held on servers in Finland, within the EEA. Files and media are held under Cloudflare's EU jurisdiction.

Analytics data, if you accept analytics, is held by PostHog on servers in Germany, within the EEA.

Email delivery and payment processing involve providers in the United States, so some data, principally your email address and transaction details, is transferred outside the UK. Those transfers rely on the UK's approved transfer mechanisms, including the UK extension to the EU-US Data Privacy Framework and standard contractual clauses with the UK addendum, depending on the provider.

6. How long we keep it

• Account and course access records: for as long as your account exists. Because course access is permanent, so is this record, unless you ask us to delete it.

• Sales and payment records: six years from the end of the relevant tax year, as UK tax law requires.

• Mailing list: until you unsubscribe, after which we keep a minimal record that you opted out so we do not email you again by mistake.

• Server logs: a short period, typically no more than 90 days.

• Analytics: only for as long as it is useful for understanding how the site is used, and deleted sooner on request.

7. Cookies and similar technologies

This site sets one cookie: a session cookie that keeps you signed in. It is strictly necessary for the site to work, and it is removed when your session ends. Under UK law, consent is not required for strictly necessary cookies, so you are not asked about it.

We also use PostHog to understand how the site is used, so that we can see which courses people look at and where the site is confusing. We ask before any of it starts. Until you accept, nothing is stored on your device and no information is sent to PostHog at all.

If you accept, PostHog stores an identifier in your browser's local storage. That lets a single visit be understood as one journey rather than a series of unconnected page views, including where you return from Stripe after paying. It is not technically a cookie, but the law treats it the same way, which is why we ask first.

What we see is which pages were viewed, which links and buttons were clicked, and general device and approximate location information. We do not record your screen, and we do not use it for advertising or share it with advertisers.

If you give us your email address - by joining the mailing list, buying a course, or signing in - and you have accepted analytics, that activity is linked to your email address rather than left anonymous. Against it we hold your email address, your name if you gave one, the organisation part of your email address, and, if you buy, which courses you bought and what you spent. We do this so we can see which courses people actually buy and how they found us, rather than only how many clicks a page received.

If you decline analytics, none of that happens: no purchase is recorded in our analytics and nothing is linked to your email address there. Buying a course still works exactly the same way.

You can ask us to delete your analytics record at any time by emailing admin@mep-qs.com, and we will remove it whether or not you also close your account.

You can change your mind at any time by clearing this site's data in your browser. That removes both the stored choice and the identifier, and you will be asked again on your next visit.

Stripe sets its own cookies on its checkout pages, governed by Stripe's own privacy notice.

8. Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you

• have inaccurate data corrected

• have your data deleted, in the circumstances where that right applies

• restrict or object to how we use it

• receive your data in a portable format

• withdraw consent to marketing at any time

To exercise any of these, email admin@mep-qs.com. We will respond within one month, and there is no charge.

One practical point on deletion: if you ask us to delete your account, you lose access to any courses you have bought and we cannot restore them afterwards. We will make sure you understand that before acting on the request. We must also keep sales records for six years regardless, as tax law requires.

Every marketing email carries an unsubscribe link that works in one click.

9. Complaints

If you are unhappy with how we have handled your data, please tell us first at admin@mep-qs.com so we have a chance to put it right.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. You do not have to come to us first.

10. Changes to this policy

If we change how we handle personal data we will update this page and change the date at the top. If the change is significant we will email the people on our list rather than relying on you to notice.