Privacy Policy

How Packt Publishing Limited collects, uses and protects personal data across the ExpertEdge website and learning platform, and your rights.

How we collect, use and protect personal data

This policy explains how personal data is collected, used and protected across the ExpertEdge marketing website and the ExpertEdge learning platform. It sets out the lawful bases we rely on, who we share data with, how long we keep it, and the rights you have. Where ExpertEdge acts only on a customer organisation's instructions, this policy explains that too, and points you to the right place to exercise your rights.

Who we are

ExpertEdge is the business-to-business learning platform operated by Packt Publishing Limited (Packt). Packt is the data controller responsible for the personal data described in this policy that ExpertEdge controls.

  • Entity: Packt Publishing Limited
  • Registered office: Grosvenor House, 11 St Paul's Square, Birmingham B3 1RB, United Kingdom
  • Company number: 04759694
  • Contact: privacy@expertedge.org
When we are a controller and when we are a processor

ExpertEdge plays two different roles depending on the data in question, and your rights differ accordingly. This distinction is central to this policy, so we state it up front.

We are the controller, deciding why and how data is processed, for:

  • the ExpertEdge marketing website
  • sales and contact enquiries
  • ExpertEdge's own product and usage analytics

We are a processor, acting only on a customer organisation's documented instructions, for the personal data that a customer organisation's administrators or learners upload to, or generate within, the platform. We refer to this category as "Platform Learning Data" throughout this policy.

Where a customer organisation is itself a processor (for example, where it provides ExpertEdge to a third party), we act as a sub-processor.

For Platform Learning Data, the customer organisation (typically a learner's employer) is the controller, not Packt. If you are a learner, you should read your own organisation's privacy notice to understand how your learning data is used, and you should contact your organisation to exercise your data protection rights. We will support your organisation in responding to your request, but we cannot act on it directly without that organisation's instruction.

What this policy covers

This policy governs the personal data that ExpertEdge controls: the website, sales and contact enquiries, and our own product and usage analytics.

Where we act as a processor of Platform Learning Data, the customer organisation's own privacy notice governs that data. This policy describes what we process in that role for transparency, but the controller's notice is the document that tells learners how their data is used and how to exercise their rights.

The personal data we collect

We handle two distinct groups of personal data.

Website and enquiry data we control

When you contact us through a form, book a meeting, or email us, we collect:

  • your name
  • your email address
  • your job title
  • your company name
  • the content of your message

We also collect analytics data automatically when you use the website. The categories and tools are described in the section on cookies and in our cookies policy, and the legal basis is set out below.

Platform Learning Data we process

When a customer organisation uses the platform, we process the following on that organisation's instructions.

  • Identity: email, first name and last name, profile image, and the organisation id and role. Sign-in may be delegated to your organisation's own system, so we do not store passwords.
  • Learning activity: course launches, completions and views, progress percentage, assessment scores, session start and end times, and bookmarks.
  • Learning records: the underlying interaction and progress records produced as a learner works through a course.

We want to be plain about two things. ExpertEdge does not send Platform Learning Data to any large language model. ExpertEdge does not use Platform Learning Data for automated profiling.

Each purpose below sets out the data involved and the lawful basis under the UK GDPR and the EU GDPR.

Respond to enquiries and book meetings

  • Data: website and enquiry data
  • Lawful basis: consent, or our legitimate interest in responding to people who contact us

Provide and operate the platform on the customer's behalf

  • Data: Platform Learning Data
  • Lawful basis: performance of our contract with the customer organisation, processed on that organisation's documented instructions

Improve and secure the platform, including product analytics

  • Data: usage analytics
  • Lawful basis: our legitimate interest in improving and securing the service

Marketing

  • Data: contact data
  • Lawful basis: consent

Comply with legal obligations

  • Data: as needed
  • Lawful basis: compliance with a legal obligation

We also share usage analytics back to a customer organisation so that it can understand how its learners use the platform. We do this on the basis of that organisation's legitimate interest in understanding usage of the service it has purchased.

Automated decisions, profiling and AI

We do not make decisions about you using solely automated means that produce legal effects or that similarly significantly affect you.

We do not carry out artificial intelligence or large language model processing of Platform Learning Data, and we do not use it to build profiles of learners.

How we share data

We share personal data only where there is a clear basis to do so, with:

  • Service providers who help us run the website and the platform. These are listed in the sub-processor list.
  • The customer organisation, for its own learners' data, since that organisation is the controller of Platform Learning Data.
  • Professional advisers, such as our auditors and lawyers, where reasonably required.
  • Authorities and regulators, where we are legally required to disclose data.
  • An acquirer, in connection with a merger, acquisition or other change of control, subject to appropriate safeguards.

We do not sell personal data.

Sub-processors

We use the third parties listed at the sub-processor list to provide the website and the platform. We keep that list current and post any changes there. Under our data processing addendum, a customer organisation may object to a new sub-processor.

International data transfers

Our sub-processors are located in the United States. As a result, personal data, including learner data, is transferred to the United States. To protect those transfers, we rely on:

  • the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses
  • the EU Standard Contractual Clauses
  • the EU-US Data Privacy Framework and its UK Extension, where a provider is certified under it

The specific mechanism relied on for each provider is set out in our data processing addendum.

How long we keep data

We keep personal data only for as long as we need it for the purposes described in this policy, and we delete or anonymise it when it is no longer needed. Retention periods vary depending on the type of data and why we hold it. If you would like your account or personal data deleted, contact us at privacy@expertedge.org or, for learner data, your organisation, and we will action your request within a reasonable time.

How we protect data

We protect personal data using encryption in transit, access controls that limit who can see data, and trusted providers selected for their security standards. The full set of technical and organisational measures is detailed in the security annex of our data processing addendum.

Your rights

Where ExpertEdge is the controller, you have the right to:

  • access the personal data we hold about you
  • have inaccurate data rectified
  • have your data erased
  • restrict how we use your data
  • object to our use of your data
  • receive your data in a portable form
  • withdraw consent at any time, where we rely on consent

To exercise any of these rights, email privacy@expertedge.org.

If you are a learner, and your request concerns Platform Learning Data, please contact your own organisation, which is the controller of that data. We will support your organisation in responding.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at www.ico.org.uk. If you are in the European Union, you may complain to your local supervisory authority.

Cookies

The website uses cookies and similar technologies, described in our cookies policy. Non-essential cookies, including analytics, are governed by your choices in the consent banner.

Children

The platform is intended for workplace and professional use by adults. It is not directed at children, and ExpertEdge does not knowingly collect personal data from anyone under 16.

Changes to this policy

We may update this policy from time to time. Where a change is significant, we will notify affected parties. Previous versions are available on request. Questions about this policy, or about how we handle personal data, can be sent to privacy@expertedge.org.

Last updated: 24 June 2026