Privacy notice

Last updated: 6 November 2026

Who we are

Whytebloom is a trading name of Net Werth Ltd, a company registered in England and Wales with company number 12718042. Our registered office is International House, 64 Nile Street, London N1 7SR. We are registered with the Information Commissioner's Office (ICO), registration reference ZC088338.

Net Werth Ltd is the controller of the personal data described in this notice. This means we decide how and why your data is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this notice or your data, email us at hello@whytebloom.com.

What this notice covers

This notice explains what personal data we collect when you visit whytebloom.com, contact us, buy from us or study with us, why we use it, who we share it with, how long we keep it and what rights you have.

Some parts of our service are not live yet. These are the online study platform (sign-in, your study timetable, progress and practice scores), online payment and course videos. The sections below say "when you buy or sign in" where they describe these parts. Until they go live, we do not collect that data.

The data we collect

When you visit our website

We do not use analytics or advertising tools on our website, and we do not set cookies. Our cookie policy explains this in more detail.

Like every website, our site cannot work without some technical data. Our host, Cloudflare, receives your IP address, browser details and the pages you request, so that it can deliver the site to you and protect it from attacks.

The fonts on our pages are stored on our own website, so loading them does not send your data to anyone else.

You can try free previews of our courses (a short part of a video, the first page of a summary and sample questions) without giving us any personal data. Your answers to preview questions stay in your browser and are not sent to us.

When you send us an enquiry

Our contact form asks for your name, email address and message, and you can also tell us your exam and planned exam date. Our firm quote form asks for your name, work email, firm, role, the exams and number of candidates, planned exam dates and any support or reporting needs.

When you send a form, we store what you entered, the date and time, and the country your connection comes from (which Cloudflare works out from your IP address). We do not store your IP address with your enquiry.

To stop automated spam, our forms use Cloudflare Turnstile. Turnstile checks signals from your browser and device, including your IP address, to tell whether a person or an automated program is sending the form.

When you email us or message us on WhatsApp

We keep the emails you send us and our replies. If you choose the option with tutor support, your tutor answers your questions on WhatsApp, so we will see your phone number, your WhatsApp name and profile picture (if you have set them), and the messages, images and files you send.

When you buy or sign in

When you buy or sign in, we will collect:

your name and email address, which we use to create your account;
details of what you bought, when, and how much you paid;
your exam, exam date and the hours you can study each week, which we use to build your study timetable;
your study progress, such as which videos, summaries and questions you have opened or completed, your practice and Mock Test scores, and when you last signed in;
technical data needed to keep your account secure, such as your IP address, browser details and sign-in times.

You will sign in with a link we email to you, so we do not hold a password for you.

Payments will be handled by Stripe. You give your card details to Stripe, not to us. Stripe tells us whether your payment worked and gives us limited details such as the card type, the last four digits and the billing country. Stripe also uses payment and device data to prevent fraud.

Weekend live revision courses

Weekend courses run on Zoom. Zoom receives your name, email address and the details of your device and connection. During the course, other participants and the tutor can see the name you use, and your video, voice and chat messages if you turn them on.

We record each weekend course and make the recording available to the participants for 30 days. The recording may include your name, voice, image and chat messages if you have them turned on. You can keep your camera off and use a first name only if you prefer.

If you claim a free repeat weekend because you did not pass your exam, we will ask you to show us your exam result.

Private tutoring

For private tutoring we keep your contact details, the hours you have bought and used, the dates of your sessions and the notes your tutor makes about the topics you have covered and what to work on next.

If your employer pays

If your firm buys a course for you, the firm will give us your name and work email address so that we can give you access. We also keep the contact details of the person at the firm who arranges the purchase and pays the invoice.

We will share your study progress with your firm only if we agree this with your firm when it buys, and we will tell you what we share before your access starts. We will never share your messages to your tutor with your firm.

What you must give us, and what is optional

On our forms, your name and email address (or work email) and the fields not marked optional are needed so that we can reply. If you leave them out, the form cannot be sent. Fields marked optional are up to you.

When you buy, we need your name and email address to create your account and give you access, and your exam and exam date to build your study timetable. If you do not give them, we cannot provide the course. For tutor support we need your WhatsApp number, and for weekend courses and private tutoring we need an email address to send you joining details. We also need the details that company and tax law require us to keep about sales.

Why we use your data, and our legal reasons

Data protection law says we must have a lawful basis for each use of your data. These are ours.

To answer your enquiry or quote request: our legitimate interest in replying to people who contact us, or, if you are asking about buying a course, the steps you ask us to take before entering into a contract.
To provide what you buy (your account, course access, study timetable, progress tracking, tutor support, weekend courses, recordings, private tutoring and free repeat weekends): to perform our contract with you.
To give access to staff whose employer pays: our legitimate interest in performing our contract with your employer.
To share progress with an employer that pays, where agreed: our legitimate interest, and your employer's, in knowing that the training it pays for is being used. You can object to this at any time (see "Your rights" below).
To take payment, send invoices and keep accounting records: to perform our contract, and to meet our legal duties under company and tax law.
To send you emails about your account, such as sign-in links, receipts and changes to your course: to perform our contract with you.
To deliver our website to you and keep it, our forms and accounts secure, and to prevent spam and fraud: our legitimate interest in protecting our business and our customers.
To deal with complaints, refunds and legal claims: our legitimate interest in handling them properly, and our legal duties.

We do not send marketing emails at present. If we start, we will ask for your consent first, unless we collected your email address when you bought from us or asked about buying, gave you a clear and simple chance to opt out of marketing at that time, and you did not opt out. In that case we may email you about our own similar courses. Every marketing email will include a simple, free way to unsubscribe.

We do not use your data to make decisions about you by purely automated means that have legal or similarly significant effects on you. Your study timetable is created automatically from the details you give us, but it is a study plan only and you can change it.

We do not ask for special category data (such as health information). If you choose to tell us something like this, for example to explain why you need to change a booking, we will use it only to deal with your request and only with your explicit consent.

Who we share your data with

We do not sell your data. We share it with the recipients listed below, for the purposes explained in this notice. Most of our providers process data only on our instructions. Where a provider acts as a separate controller for some of its own purposes, we say so below.

Cloudflare: hosts our website and stores enquiries and (when you buy or sign in) account and study data; runs the Turnstile spam check. Cloudflare also acts as a separate controller when it uses Turnstile browser and device signals to improve its bot detection. Its Turnstile Privacy Addendum, on cloudflare.com, explains this and how to use your rights with Cloudflare.
Google: provides our business email (Google Workspace).
Resend: sends emails from our website, such as enquiry notifications to our team and (when you buy or sign in) sign-in links and receipts. We use Resend's EU region.
Stripe: processes card payments when you buy online. Stripe acts as a separate controller for some data it uses to meet its own legal duties and prevent fraud.
Bunny Stream (BunnyWay d.o.o.): delivers course videos when you watch them in the course.
Zoom: runs our weekend live revision courses and may be used for private tutoring sessions.
WhatsApp (Meta): carries messages if you choose the option with tutor support. WhatsApp acts as a separate controller under its own terms and privacy policy. Messages are end-to-end encrypted, but WhatsApp receives information such as phone numbers and when messages are sent.
Our tutors: see the details they need to teach and support you.
Our accountant and professional advisers: where they need the data to give us advice or prepare our accounts.
Your employer: only as described in "If your employer pays" above.
Public authorities such as HM Revenue and Customs, the police or a court: only where the law requires us to.

We do not share your data with CISI. Whytebloom is an independent provider and is not connected to CISI.

Transfers outside the UK

Some of our providers are based in, or may access data from, countries outside the UK. When this happens, we make sure the transfer is protected as UK law requires.

Cloudflare, Google, Stripe and Zoom are US companies. We rely on UK adequacy regulations for US companies certified under the UK Extension to the EU-US Data Privacy Framework, which these companies are.
We use Resend's EU sending region, but Resend stores email content and related data in the United States. For these transfers we rely on the EU standard contractual clauses with the UK Addendum, which are part of Resend's data processing terms.
Bunny Stream is based in Slovenia, in the European Economic Area, which the UK government has found to protect personal data adequately.
WhatsApp acts as a separate controller and is responsible for its own transfers.

Where we rely on contract terms, you can ask for a copy by emailing hello@whytebloom.com. We may remove commercially sensitive details.

How long we keep your data

Enquiries that do not lead to a purchase: 2 years from our last contact with you.
Your account, study timetable, progress and scores: until 12 months after your access ends, so that you can return for a resit and so that we can deal with any questions. If you ask us to delete your account sooner, we will, except for the records below that we must keep.
Records of purchases, payments and invoices: 6 years after the end of the financial year they relate to, as company and tax law requires.
Emails and WhatsApp messages with your tutor: until 12 months after your access ends.
Weekend course recordings: deleted 30 days after the course.
Private tutoring notes: until 12 months after your last session.
Records of complaints, refunds and legal claims: 6 years after the matter ends.

Our providers may keep technical records, such as security logs, for shorter periods under their own policies.

How we keep your data safe

We use reputable providers with strong security, we limit access to the people who need it, and we send data over encrypted connections. Sign-in will use one-time links sent to your email, so there is no password to steal from us. If a data breach puts you at high risk, we will tell you as the law requires.

Your rights

You have the right to:

ask for a copy of the personal data we hold about you;
ask us to correct data that is wrong or incomplete;
ask us to delete your data;
ask us to limit how we use your data;
object to us using your data where we rely on legitimate interests, and to stop marketing at any time;
ask us to give the data you gave us to you, or to another organisation, in a common electronic format;
withdraw your consent at any time, where we rely on consent.

Some of these rights apply only in certain situations. To use any of them, email hello@whytebloom.com. We may need to check who you are first. We will reply within one month, and we do not charge a fee in most cases.

Complaints

If you are unhappy with how we have used your data, please tell us first at hello@whytebloom.com so that we can try to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Changes to this notice

We will update this notice when we change how we use personal data, including when the study platform and online payment go live. The date at the top shows when it last changed. If a change affects you significantly, we will tell you by email before it takes effect.