# Privacy & Data Protection - Canonical URL: https://transition-architect.co.uk/privacy-data-protection/ - Published: 2026-01-30T09:34:35+00:00 - Last modified: 2026-10-06T19:06:32+00:00 Transition Architect privacy policy and UK GDPR data protection notice explaining how personal data, student information, Transition Audit submissions, payments, reports, enquiries, cookies and optional email communications are handled. Privacy & Data Protection # Privacy Is Not a Feature. *It Is a Professional Standard.* This notice explains, in plain language, what personal information Transition Architect uses, why it is needed, how long it is kept and the choices available to students, parents and clients. Version 2.1 · Last reviewed 6 October 2026 · United Kingdom **Data minimisation**Only what the purpose requires **No data sale**Personal information is not sold **No admission profiling**No automated offer prediction **Human review**Diagnostic context matters 01 · Controller ## Who is responsible for the information? The data controller is **Dr Jarosław Jarzynka, trading as Transition Architect / Dr Jarek Academic Architecture**. Privacy and rights requests may be sent to [drjarek@transition-architect.co.uk](mailto:drjarek@transition-architect.co.uk) or through the [contact page](https://transition-architect.co.uk/diagnostic-consultation/). No Data Protection Officer has been appointed because the present scale and nature of the practice do not require one. The controller remains personally responsible for data-protection decisions. 02 · Scope ## What information may be collected? - **Identity and contact data:** names, email addresses and parent or guardian details. - **Academic context:** education system, current stage, predicted or achieved grades, intended subjects, courses, institutions, application year and educational objectives. - **Diagnostic data:** Transition Audit answers, written reasoning, confidence ratings, timing records, result metadata and reviewer notes. - **Engagement records:** correspondence, consultation notes, agreed objectives, programme documents, progress records and scheduling information. - **Transaction records:** product selected, amount, currency, Revolut order identifier, payment status and fulfilment dates. Transition Architect does not receive or store full payment-card details. - **Technical and consent data:** security logs, attribution information, cookie choices, privacy acknowledgement, marketing choice and unsubscribe records. Information is normally obtained directly from the student, parent, guardian or client. Where a parent, school or adviser supplies information about a student, they should ensure they are authorised to do so and make this notice available to that student where appropriate. 03 · Use & lawful basis ## Why information is used. | Purpose | Typical information | Lawful basis | | --- | --- | --- | | Responding to enquiries and assessing fit | Contact details, academic context, intended route | Steps requested before a contract; legitimate interests in responding accurately | | Delivering consultation or advisory services | Academic records, objectives, correspondence, programme records | Contractual necessity | | Operating the Transition Audit and reports | Profile, responses, timings, confidence and result data | Steps before a contract, contractual necessity where purchased, and legitimate interests in secure diagnostic delivery | | Taking payment and keeping accounts | Contact, order and transaction records | Contractual necessity and legal obligation | | Security, fraud prevention and service integrity | Technical logs, order verification, security events | Legitimate interests in protecting users and the service | | Optional briefings and marketing | Name, email, interests and consent record | Consent, which may be withdrawn at any time | Where legitimate interests are used, those interests are the secure and proportionate operation of a specialist advisory practice, accurate response to requested contact, prevention of misuse and maintenance of professional records. They are balanced against the individual’s rights and reasonable expectations. 04 · Admissions Tools ## Different tools process information differently. ### Requirements and Timeline The Requirements Checker and full or compact Timeline Planner are designed so that answers remain in the visitor’s browser. They do not create a candidate record or transmit the entered planning answers to Transition Architect. Standard website hosting, security and consent logs may still be generated when the page is visited. ### Readiness / Transition Audit The Quick Readiness Scan and Full Institutional Audit transmit the profile, responses, timing and calibration information shown in the tool. The record is stored in the protected WordPress administration area for private review. If configured, a controlled copy may also be passed into Fluent Forms so that authorised email, workflow or client-management actions can operate. The Audit may generate a concise result automatically, but it does **not** make a solely automated decision with legal or similarly significant effect, calculate admission probability or determine whether a university will make an offer. Paid reports and preparation blueprints are private deliverables based on the submitted diagnostic record and additional planning information. ### Payments through Revolut When a paid report or blueprint is selected, the candidate email, order reference, product, amount and currency are passed to Revolut to create and verify hosted checkout. Payment credentials are handled by Revolut under its own privacy notice. Transition Architect stores only the transaction information required to verify payment and provide access. 05 · Students under 18 ## Additional care for children’s information. Many services concern students under 18. A parent or person with parental responsibility should normally initiate an enquiry, purchase or extended engagement and should ensure the student understands how their information will be used. Where consent is relied upon for a child’s information, reasonable steps may be taken to confirm the authority of the person giving it. Optional promotional email should not be selected by a child who does not understand that choice. No child is required to accept marketing in order to use a diagnostic tool or receive a contracted service. Please do not submit medical, safeguarding or other special-category information through a general form unless it is genuinely necessary and an appropriate secure route has been agreed. 06 · Recipients ## Who may process the information? Information is not sold. It may be disclosed only where necessary to carefully selected service providers acting as processors or independent controllers, including website hosting and security providers, professional email and document platforms, video-conferencing and scheduling services, Fluent Forms or configured workflow providers, payment provider Revolut, accountants or professional advisers, and public authorities where disclosure is legally required. Confidentiality does not prevent proportionate disclosure where required by law, needed to establish or defend legal rights, or reasonably necessary to address a serious safeguarding or safety concern. 07 · International transfers ## Services may operate across borders. Some technology providers may process or make information accessible outside the UK. Before a restricted transfer is used, the relevant transfer mechanism is considered. Depending on the destination and provider, this may include UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved contractual clauses, together with a transfer-risk assessment where required. Information about a relevant safeguard may be requested using the privacy contact details above, subject to protection of confidential security and contractual information. 08 · Retention & security ## Information is not kept indefinitely. - **Unsuccessful or preliminary enquiries:** normally up to 12 months, unless continued correspondence or a legal reason requires longer. - **Transition Audit submissions:** normally up to 365 days, with automatic deletion controlled by the live Audit retention setting. - **Paid private report access:** normally 180 days from confirmed payment; accounting and transaction records may be retained longer where legally required. - **Client and contractual records:** for the engagement and a proportionate period afterwards, normally up to six years where needed for tax, contractual or legal purposes. - **Optional mailing records:** until consent is withdrawn, the address becomes invalid or the list is no longer used, while a minimal suppression record may be retained to honour an opt-out. Measures include access restriction, encrypted transmission, strong authentication, software updates, data minimisation, protected administration areas, verified payment webhooks and avoidance of full diagnostic responses in ordinary notification emails. No online system can be guaranteed risk-free; suspected personal-data breaches are assessed and handled under applicable law. 09 · Individual rights ## Your rights depend on the processing involved. Subject to legal conditions and exemptions, individuals may request access, correction, erasure, restriction, portability or object to particular processing. Consent may be withdrawn at any time without affecting earlier lawful processing. **Your right to object** You may object at any time to direct marketing. You may also object to processing based on legitimate interests; the circumstances and any compelling lawful grounds will then be considered. Requests should be sent to [drjarek@transition-architect.co.uk](mailto:drjarek@transition-architect.co.uk). Identity may need to be verified. A response will normally be provided within one month, subject to any lawful extension. 10 · Cookies & communications ## Choice must remain meaningful. The site uses a first-party preference cookie named **ta_analytics_consent** for up to 180 days. It records whether analytics were accepted or rejected, so that the site can respect that choice. This storage is treated as strictly necessary for the consent mechanism. Google Analytics 4 is not loaded unless analytics are expressly accepted. If accepted, Google may set first-party cookies including **_ga**, used to distinguish visitors, and **_ga_**, used to maintain session state. Google documents a default expiry of up to two years, subject to browser restrictions and configured settings. Analytics may process interaction, device, browser and approximate location information for aggregate website measurement. Advertising personalisation and Google signals are disabled in the Transition Architect implementation. Consent is optional and rejecting analytics does not restrict access to the website or its services. A choice can be changed at any time using the **Privacy choices** control displayed on the website. Withdrawing consent prevents Analytics from loading on subsequent page views. Other strictly necessary storage may be used for security, submitted forms, payment continuity or authenticated administration. If new non-essential technologies are introduced, this notice and the consent controls will be reviewed before they are enabled. Transactional messages — such as an enquiry response, Audit receipt, report-access email or service notice — are not marketing. Strategic Briefings and promotional guidance are optional. Every marketing email should provide a clear way to unsubscribe; a request may also be sent directly by email. 11 · Complaints & updates ## Questions should be raised directly first. If you believe information has been handled incorrectly, contact Transition Architect so the matter can be investigated. You also have the right to complain to the UK Information Commissioner’s Office (ICO), including through its online complaint service, or to another competent supervisory authority where applicable. This notice is reviewed when services, processors or legal requirements change. Material new uses of personal information will be brought to affected individuals’ attention before they begin where required. This notice explains current processing and is not a substitute for individual legal advice. Operational settings and processor contracts should be checked against it whenever the website or service stack changes. Questions about your information? ## Privacy questions should receive a direct, intelligible answer. Contact the controller to ask how information is used, exercise a right or raise a concern. [Email the data controller →](mailto:drjarek@transition-architect.co.uk)