Privacy
Effective 7 November 2026.
1. Who we are and what this notice covers
EA HOW TO LTD, trading as EA How To, is responsible for the personal information described in this notice. Our company number is 14270233. Our registered office is Building 2a, D Site Kemble Airfield, Kemble, Cirencester, Gloucestershire, England, GL7 6BA.
You can contact us about privacy at privacy@eahowto.com, or write to our registered office marked “Privacy”. You do not need to use a special form or quote legislation to exercise your rights.
This notice covers the EA How To member portal at members.eahowto.com, its account and resource-access journeys, event registration and attendance services, learning records, and certificate/transcript verification pages. It also explains the relevant administrative work we carry out to provide these services. Our marketing website and external services may have additional notices; this notice explains our portal processing and our own use of information received from those services.
2. Information we use and where it comes from
We receive information directly when you request access, update your details, register for events, contact us or use portal features. We also receive membership, purchase and registration records from our membership/checkout service, and attendance or playback records from services used to deliver events and recordings. Authorised staff may add or correct operational records, for example an in-person check-in or attendance correction.
Depending on the features you use, this includes:
- Your name, email address, country, account/contact identifiers and other profile/contact information you choose to provide or that is needed for the event you book.
- Memberships, purchases, access entitlements, transaction references, status and relevant billing records. Payments are handled through the checkout/payment provider; our portal does not ask you to enter full payment-card details into its own forms.
- Sign-in requests, session information, security and access records, technical request information such as IP address/browser details where included in service logs, and administrative audit records.
- Event registrations, booking changes, cancellations, attendance/check-in records, meeting participation information and any event-specific information explained when collected.
- Replay progress, watched portions, saved position, completion records and self-reported attendance. These distinguish measured completion from statements you provide yourself.
- Bookmarks, requested downloads, consent/preference records, certificates, transcripts and associated verification information.
- Your correspondence with us and the records needed to resolve requests or disputes.
- If you opt in, optional analytics, event sponsor-link counts and named sponsor-click records described in section 5.
Please avoid submitting sensitive personal information about yourself or other people in general-purpose fields. If an event needs accessibility, health or other sensitive information, we will explain the specific collection and handling separately before asking for it.
3. Why we use information and our legal bases
We select a legal basis for each purpose rather than treating all use as consent-based.
| Purpose | Information used | Basis |
|---|---|---|
| Provide an account, verify sign-in, deliver requested resources and honour membership/purchase access | Identity, session, entitlement and request details | Performance of our contract with you, or steps you request before a contract. Where an employer or another organisation contracts, our assessed legitimate interests in providing the authorised service apply to the relevant individual records. |
| Register you for events, send necessary booking messages and administer attendance | Contact, booking, joining and attendance details | Contract for the service you request; proportionate legitimate interests where attendance verification or administration is not necessary for your individual contract. |
| Save replay progress and provide requested completion records, certificates or transcripts | Watched portions, saved position, event/completion evidence and document details | Contract for requested features; assessed legitimate interests in accurate records and preventing false certification where appropriate. |
| Help you, correct errors and investigate service problems | Relevant account, activity and correspondence records | Contract where needed to resolve your service request; assessed legitimate interests in proportionate support and service reliability otherwise. |
| Secure the portal, prevent misuse and audit privileged access | Session, security and administrative records | Assessed legitimate interests in protecting members and the service; legal obligations where a specific security or disclosure duty applies. |
| Keep required accounting records and respond to binding legal duties | Relevant transaction and legal records | Legal obligation, with any separately necessary claim/dispute records assessed for the particular purpose. |
| Send promotional emails under the free-resource marketing journey | Contact details and marketing choices | Consent recorded through the marketing agreement is the basis we rely on for promotional emails. The free-resource journey requires that displayed agreement before access is requested. You can unsubscribe at any time. Essential account and booking messages are separate and are not stopped by unsubscribing from promotions. |
| Count views and clicks of sponsor messages, including by country (and by industry once collected), as anonymous totals | That a view or click happened, whether you were signed in, and the country recorded on your member account | Our legitimate interests in measuring and reporting sponsor engagement in anonymous aggregate form. You can object at any time by turning sponsor analytics off in Privacy choices, or by contacting privacy@eahowto.com. |
| Measure optional service usage or event sponsor-link engagement, and keep named sponsor-click records | Permitted activity and preference records | Your separate consent, as explained below. |
Where we rely on legitimate interests, we consider your expectations, necessity and privacy impact, limit access and collection, and assess whether your rights outweigh our interests. You can ask about an assessment or object to that use. We do not use a legitimate-interest claim to bypass consent required for nonexempt browser storage or tracking.
Some information is necessary for the feature you request. For example, without an email address we cannot send a sign-in link, and without relevant booking details we cannot register you. Optional analytics and marketing choices are not required to retain purchased access.
4. Events, recordings and learning documents
Live and physical events
When we use an external meeting or registration service, we pass the details needed to arrange your participation and receive relevant registration/attendance information. Display names, contributions or attendee information may be visible to other participants depending on the event format; we explain relevant arrangements in the event information. Please consider what you share in public chat or discussion.
For physical events, authorised staff may use attendee rosters, check-in records and printed badges. Staff check-in devices may temporarily store an offline event roster and pending check-in actions. These copies are restricted to authorised event operations and subject to the device cleanup periods below.
Recordings
Events may be recorded, including attendee display names, voices, camera images and chat or other contributions captured by the event format. Event information and recording notices explain the intended use. Recordings may be made available to members or purchasers and may also be reused publicly or in promotion. Speaker/presenter arrangements may be governed by a separate agreement.
You can turn your camera and microphone off to limit what is captured, but your name or chat contributions may still appear. Turning a camera or microphone on is not blanket permission for every use. Recording for event learning delivery and the learning library is a distinct purpose from public educational content and service promotion. Requested learning delivery may rely on contract where necessary to provide your service. Educational content and service promotion may rely on legitimate interests where a purpose-specific assessment justifies that use; specific consent is required where that is the appropriate basis. You can object to legitimate-interest use or ask about the basis for a recording by contacting privacy@eahowto.com. Contact privacy@eahowto.com before participating if you have concerns; available technical arrangements vary by event.
Certificates and transcripts
We use measured attendance/replay evidence and clearly marked self-reports to produce the records you request. Not every type of evidence qualifies for a certificate. Ask us to review an inaccurate record or access/completion decision.
A verifiable document has a code or link that can reveal your name and the event/completion information shown on that document. Anyone who obtains that code or link may view its verification page without signing in. We explain this before you request or share a verifiable document. Avoid sharing a verification link publicly if you do not want others to see those details. You can contact us to withdraw a verification link; withdrawal stops our page confirming it but cannot recall copies already downloaded or shared by other people.
The optional PDF authenticity check calculates a file fingerprint in your browser; it does not upload the PDF to us. The verification page itself still involves normal web requests and any separately permitted measurement.
5. Marketing, analytics and sponsorship
The free-resource journey requires agreement to the marketing wording displayed on its access form; marketing is not an optional checkbox in that journey. You can unsubscribe from promotional emails at any time using the email unsubscribe link or by contacting us. Unsubscribing does not cancel a paid membership or remove purchased access. Essential account and booking messages are separate.
Optional portal analytics and sponsor analytics are separate, off-by-default choices in Privacy choices. Core saved position, watched coverage, completion and attendance history persist for the requested service regardless of optional analytics choice. Optional per-playback session measurement includes playback ID, watched duration/position and timestamps; this measurement and verification-page view measurement stop when portal analytics is rejected. Operational attendance recording continues for the requested service. Refusing or withdrawing them does not prevent ordinary portal use, sponsor links or access to services you bought. These controls do not change your marketing subscription.
If you allow sponsor analytics, we also record permitted event sponsor-link activations to understand and verify sponsor engagement. For signed-in members, authorised EA How To staff can see the account associated with a sponsor click (on an event or a sponsor message), including your name/email and first/last click times and counts, for 12 calendar months per click. You do not have to be registered for that event for a signed-in click to be associated with your account. For logged-out visitors who allow measurement, we record anonymous click counts rather than a member identity. We do not fingerprint anonymous visitors or treat click counts as a count of distinct people.
We count views and clicks of sponsor messages (the sponsor bar and cards in the portal) for every visitor who has not turned sponsor analytics off. Each view or click adds one to counters for that message: a total, a daily total, signed in or logged out, and a group such as a country, using the country recorded on your member account (and industry once we collect it). These counters hold no name, email, account, browser or session and no per-person or per-view time; we do not record who viewed or clicked, and we do not work out your location from your IP address. Logged-out views and clicks are counted as unknown. We only ever report these breakdowns in groups of 10 or more, combining smaller groups.
If you turn sponsor analytics off, we do not count your views or clicks of sponsor messages or event sponsor links, and keep no named record of your clicks. When you are signed in, that choice applies to your account in every browser for as long as it lasts. Sponsor links still work. Coverage may therefore be incomplete, and statistics represent recorded engagement rather than every visit.
We share only genuinely anonymous aggregate engagement summaries with sponsors under this policy. These may include totals, daily counts and breakdowns of views and clicks by country, region or industry. None of them carries a name, email, account, browser or session, and country, region and industry breakdowns are only shared in groups of 10 or more, with smaller groups combined. We do not send them your name, email, member ID or a list identifying people who clicked. Any future sharing of named leads would require a separate decision, explanation and applicable legal basis before it happens; this notice does not authorise it.
Sponsor links may include generic campaign parameters identifying EA How To, the event and placement. These parameters do not contain your member identity. When you visit a sponsor's site, that organisation receives the web request and handles information under its own notice. Our consent controls do not control a sponsor's website.
Withdrawing optional analytics consent stops future consent-based measurement. When you withdraw sponsor analytics while signed in, we erase your account’s identifiable sponsor-click history and invalidate prior account grants, including older grants in other sessions. Account deletion also erases that history. Clearing cookies stops permission in that browser but does not erase account history: sign in and withdraw, or contact privacy@eahowto.com. Genuinely anonymous aggregate totals remain indefinitely, with signed-in and logged-out categories preserved. Withdrawal does not make previously lawful processing unlawful; minimal choice evidence may remain for its own retention purpose.
6. Who can receive information
Access is limited to people and organisations with a relevant purpose. These include:
- Authorised EA How To staff and support personnel with a relevant operational role. For troubleshooting, authorised administrators may temporarily view the portal as a member; privileged access is restricted and auditable.
- Hosting, database, email, membership, checkout/payment, meeting, video delivery and other suppliers needed to operate the service. Some operate as our processors; some may be independent controllers for their own payment, security or platform purposes.
- Event participants, venue/check-in staff and document verifiers, to the extent explained in section 4 and the relevant event information. We do not publish the full member database or make it available to all members.
- Professional advisers, regulators or authorities where necessary and lawful, and a potential business successor subject to appropriate safeguards and relevant notice.
We do not sell personal information or provide member-identifying sponsor reports under this policy. Sponsors may receive aggregate breakdowns of views and clicks by country, region or industry, only in groups of 10 or more and with no name, email, account, browser or session attached. This does not mean no service provider processes information on our behalf. External sites, communities, payment and meeting platforms may have their own terms and privacy notices.
7. International processing
Suppliers may process information or allow support access outside the UK. The countries and arrangements depend on the service used. Applicable UK transfer requirements must be considered for restricted transfers, including whether an adequacy route or appropriate safeguards and additional measures are needed. A supplier’s brand, billing address or selected database region alone does not establish the transfer position.
Contact privacy@eahowto.com to request information about the recipients, processing countries and applicable transfer arrangements for your information, including relevant safeguards where applicable. We will explain the arrangements relevant to your request rather than assume every supplier uses the same mechanism.
8. How long we keep information
We keep identifiable information only for its stated purpose and review it when that purpose ends. Our retention schedule is below. Periods describe our operational retention requirements; technical expiry and automated deletion are different. The periods apply whether cleanup is manual or automated.
| Category | Retention |
|---|---|
| Account profile, bookmarks, entitlement-serving records and member-visible attendance, replay progress and completion history | While your account or an ongoing purchased entitlement requires them; remove unnecessary account-linked data within one month after account closure, retaining separately justified financial, verification, suppression or dispute records only for their own periods. |
| Sign-in links and pending access requests | Sign-in links stop working after 15 minutes; a session normally lasts up to 30 days; an uncompleted resource-access request expires after 24 hours. Used/expired temporary requests must be removed within seven days; historical expired-session/security records follow the security period below. |
| Accounting and transaction records required for company records | Generally six years from the end of the relevant company financial year, or longer where the applicable rules require it. This does not justify retaining unrelated browsing or learning data for six years. |
| Event attendance/completion evidence and issued document verification records | Up to six years after the event or document issue, for retained attendance evidence or an issued-document snapshot; this is distinct from member-visible learning history kept for the account or ongoing purchased entitlement, unless an earlier valid erasure/withdrawal request applies. Verification can be withdrawn earlier. |
| Participant-containing recordings | While needed for the stated learning, public educational or promotional purpose, with review required at least annually. Copies in our live library and EA How To-controlled public/promotional channels must be removed within one month after withdrawal from the relevant purpose, subject to any separately justified restricted dispute/legal record. We cannot recall copies independently held or shared by third parties outside our control. |
| Detailed technical replay-session and operational attendance/participation logs | Up to 90 days; useful saved progress/completion records are handled separately above. |
| Named sponsor-click records | Up to 12 calendar months from each click; earlier where consent is withdrawn or a valid erasure request applies. New clicks do not extend the period for old clicks. |
| Sponsor view, click and breakdown counters | Kept indefinitely as counts per sponsor message version and placement, per UTC day, and per group (such as a country). They hold no name, email, account, browser or session; daily totals are day-level counts with no per-person or per-view time, and group counts have no day. Withdrawal and erasure do not change them. Country, region and industry breakdowns are only reported in groups of 10 or more. |
| Truly anonymous aggregate statistics | May be kept indefinitely because they cannot reasonably be used to identify people. We assess small groups, linked records and other re-identification risks before treating data as anonymous. |
| Routine security/access logs; privileged admin audit | Normally 90 days for routine logs and twelve months for privileged audit, unless a specific incident requires a restricted, reviewed hold. |
| Support correspondence and privacy-request records | Normally two years after a support case closes; three years after a privacy request closes for the minimal record of how it was handled. |
| Marketing choices and evidence | While subscribed; minimal opt-out details while needed to avoid contacting you again, reviewed annually. Consent evidence is normally retained for three years after we last rely on it or record withdrawal. |
| Offline event-device copies | Remove within 72 hours after the event, or earlier at authorisation expiry, logout or loss of permission; pending actions must be securely synchronised or resolved without retaining an unnecessary roster. |
| Staff-held printed operational attendee lists and spare badges | Remove within 72 hours after reconciliation. |
| Deleted material in isolated backups | Must age out within 90 days and must not be used for routine processing. If restored, deletion/withdrawal instructions must be applied again before normal use. |
A documented legal duty, live dispute or security incident may require a limited exception. We restrict such material to that purpose and review it rather than keeping an entire account indefinitely. Technical expiry of a login link or offline access does not, by itself, mean a database or device copy has been deleted.
Cancelling renewal, unsubscribing from marketing and requesting erasure are different actions. Cancellation does not automatically erase a required invoice, and withdrawing marketing consent does not cancel your membership. Tell us if you want to close your account or request deletion.
9. Security and your choices
We use access controls and other appropriate technical and organisational measures to protect information. Access to private records is restricted according to role and purpose; no system can guarantee absolute security. Keep your sign-in links and verification codes private, and tell us promptly if you suspect misuse.
Read our Cookies and privacy choices notice for essential storage, optional features, embedded media and preference controls. Clearing browser storage may sign you out or remove local preferences; it does not automatically delete information held in your portal account.
10. Your rights
Depending on the circumstances, you may ask us to access, correct, erase, restrict or provide a portable copy of your personal information. You may object to processing based on legitimate interests and to direct marketing. Where we rely on consent, you can withdraw it. Withdrawing optional measurement or unsubscribing from marketing does not remove purchased access; the required marketing agreement in the free-resource journey is explained above.
Email privacy@eahowto.com or contact us by post. We normally respond without undue delay and within one calendar month, with any lawful extension or permitted timing adjustment explained. We may ask for proportionate information to confirm identity or authority. Requests are normally free; any lawful refusal or charge will be explained. Some rights depend on the purpose/legal basis, and another person's rights or a legal retention duty may limit what we can disclose or erase.
Access and certificate eligibility use automated checks of membership, purchases and attendance/completion evidence. Contact us for a human review if you believe a result is wrong. Sponsor-click data is not used to decide membership access or certificate eligibility under this policy.
11. Concerns, complaints and changes
Please contact us if you have a concern so we can investigate. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. If another country's data protection law gives you a complaint route, this notice does not remove that right.
The portal is intended for adult professionals. If you believe a child has supplied information through it, contact us so we can assess and handle it appropriately.
We review this notice as the portal changes. We publish the effective date and bring material changes to your attention where appropriate. An updated notice does not automatically authorise a new optional tracking purpose; where needed, we ask for a fresh choice before that processing starts.