PRIVACY POLICY
Last updated: October 2026
1. About This Privacy Policy
This Privacy Policy explains how EMSA Publication Ltd collects, uses, stores and protects personal information when you use the EMSA Educational Publishing website, create an account, purchase or download publications, request resources, contact us or otherwise interact with our services.
The data controller is:
EMSA Publication Ltd
Trading as EMSA Educational Publishing
Company registration number: 17490117
Registered office: 128 City Road, London, United Kingdom, EC1V 2NX
Registered in: England and Wales
Website: emsa.org.uk
Privacy contact: learn@emsa.org.uk
2. Personal Information We May Collect
Depending on how you use the website, we may collect personal information including:
- your name;
- email address;
- billing address;
- telephone number where provided;
- EMSA account username and account information;
- order and transaction information;
- publications and resources purchased or requested;
- communications you send to EMSA;
- information submitted through contact forms, diagnostic-resource forms and answer-booklet request forms;
- marketing preferences and records of consent or withdrawal where applicable;
- technical information associated with use of the website, such as IP address, browser/device information and relevant website logs; and
- cookie and similar technology information where applicable.
We aim to collect only the personal information reasonably necessary for the relevant purpose.
3. How We Obtain Personal Information
We primarily obtain personal information directly from you when you:
- create an EMSA account;
- place an order;
- download or request a publication or resource;
- complete a form;
- contact EMSA;
- choose whether to receive marketing communications; or
- otherwise interact with the website.
Some technical information may be collected automatically when you use the website, including through essential website technologies, server logs and, where applicable, cookies or similar technologies.
We may also receive limited information from service providers involved in processing transactions or operating the website.
4. Why We Use Personal Information
We may use personal information to:
- create and administer EMSA customer accounts;
- process and administer orders;
- provide access to purchased digital publications;
- provide requested free resources, diagnostics or answer booklets;
- communicate about orders, accounts, downloads and customer-service matters;
- respond to enquiries;
- maintain appropriate business, transaction and accounting records;
- operate, maintain and secure the website;
- prevent or investigate fraud, misuse and security incidents;
- comply with applicable legal and regulatory obligations;
- manage privacy choices and consent records; and
- send marketing communications where permitted by applicable law.
We will not use personal information for an unrelated purpose without considering whether further information, consent or another lawful basis is required.
5. Our Lawful Bases for Processing
Depending on the purpose, EMSA may rely on one or more lawful bases under UK data-protection law.
Contract: where processing is necessary to enter into or perform a contract with you, for example processing an order and providing access to a purchased publication.
Legal obligation: where processing is necessary for EMSA to comply with a legal obligation, including relevant accounting, tax and regulatory requirements.
Legitimate interests: where processing is necessary for a legitimate business purpose and those interests are not overridden by your rights and interests. This may include appropriate website administration, security, fraud prevention and managing customer enquiries.
Consent: where we ask for and rely upon your consent, including certain marketing activities or non-essential technologies where consent is required.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
ICO guidance requires the privacy notice to explain both the purposes and lawful bases for processing and, where legitimate interests are relied upon, what those interests are.
6. Purchases and Payment Information
When you purchase an EMSA publication, we process information necessary to administer the transaction, including your identity and contact details, order information and billing information.
Payment transactions may be processed by third-party payment service providers.
EMSA does not need to receive or retain your full payment-card details where those details are processed directly by the payment provider.
The payment provider’s own privacy terms may also apply to its processing of your information.
Important: Once we choose the live EMSA payment provider, we will update this section to identify the provider where appropriate.
7. EMSA Accounts and My EMSA
When you create an EMSA account, we process information necessary to create and administer the account and provide account functions.
Your account may provide access to information such as:
- orders;
- downloads;
- addresses; and
- account details.
You are responsible for keeping your login credentials secure.
Passwords are not displayed to EMSA through the normal account administration process.
8. Free Diagnostics, Answer Booklets and Other Free Resources
EMSA may offer diagnostic assessments, answer booklets and other educational resources free of charge.
We may ask for information such as your email address where it is necessary to provide the requested resource, administer access or communicate with you about that request.
Requesting a free resource does not by itself mean that you have consented to receive EMSA marketing emails.
Where EMSA invites you to receive marketing communications, the marketing choice will be presented separately where required.
9. Marketing Communications
Where required, EMSA will obtain an appropriate marketing choice or consent before sending electronic direct marketing.
Where consent is the applicable basis, choosing to receive marketing communications is optional and will not be a condition of purchasing a publication or obtaining a resource where such a condition would be inappropriate.
You can withdraw marketing consent or unsubscribe from marketing communications at any time using the unsubscribe method provided in the communication or by contacting:
learn@emsa.org.uk
Transactional communications concerning orders, accounts, requested resources or customer-service matters are separate from optional marketing communications.
ICO guidance requires organisations to provide appropriate privacy information about direct marketing when collecting information for that purpose.
10. Cookies and Similar Technologies
The EMSA website may use cookies and similar technologies necessary for functions such as website operation, customer accounts, baskets, checkout and security.
Other cookies or technologies may be used for additional purposes where configured.
Where consent is legally required for non-essential cookies or similar technologies, they will not be used until the appropriate choice has been obtained.
Further information will be provided through EMSA’s cookie information and consent mechanism.
11. Who We Share Personal Information With
Where necessary, EMSA may share personal information with organisations that help us operate the website and provide our services, including categories such as:
- website and hosting providers;
- ecommerce and website-technology providers;
- payment service providers;
- email-delivery providers;
- form and communications providers;
- security, backup and technical-support providers;
- professional advisers such as accountants or legal advisers where necessary; and
- public authorities, regulators, courts or law-enforcement bodies where disclosure is legally required or otherwise permitted by law.
We do not sell personal information to advertisers.
Where another organisation processes personal information on our behalf, we take appropriate steps to ensure the processing is handled in accordance with applicable data-protection requirements.
12. International Data Transfers
Some technology or service providers may process personal information outside the United Kingdom.
Where personal information is transferred internationally, EMSA will take appropriate steps to ensure that the transfer is made in accordance with applicable UK data-protection requirements, including using an applicable adequacy arrangement or appropriate safeguards where required.
Information about relevant safeguards may be requested by contacting:
learn@emsa.org.uk
13. How Long We Keep Personal Information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting, tax, contractual, security and dispute-resolution requirements.
Different categories of information may therefore be retained for different periods.
When determining retention periods, we consider:
- why the information was collected;
- whether an account or customer relationship remains active;
- contractual and customer-service requirements;
- legal and accounting obligations;
- fraud and security requirements; and
- whether information is required to establish, exercise or defend legal claims.
Where information is no longer required, it will be deleted, anonymised or otherwise appropriately disposed of in accordance with applicable requirements.
This approach is preferable to inventing a fixed retention period today. The ICO permits a notice to state the criteria used to determine retention where a specific period is not available.
14. Security
EMSA takes appropriate technical and organisational measures intended to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.
No internet-based service can guarantee absolute security. For this reason, we do not claim that unauthorised access can never occur.
Customers should use appropriate passwords and keep their EMSA account credentials confidential.
15. Your Data-Protection Rights
Depending on the circumstances and applicable law, you may have rights relating to your personal information, including the right to:
- request access to personal information held about you;
- request correction of inaccurate or incomplete information;
- request erasure of personal information in certain circumstances;
- request restriction of processing in certain circumstances;
- object to certain processing;
- request data portability where applicable; and
- withdraw consent where processing is based on consent.
These rights are subject to the conditions and exemptions provided by applicable law.
You have the right to object to certain processing based on legitimate interests and to the use of your personal information for direct marketing.
To exercise a data-protection right, contact:
learn@emsa.org.uk
The ICO specifically requires the rights available to individuals to be explained, and says the right to object should be brought to people’s attention clearly and separately.
16. Complaints
If you have concerns about how EMSA handles your personal information, please contact us first at:
learn@emsa.org.uk
You also have the right to complain to the UK data-protection supervisory authority, the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
You are not required to contact EMSA before exercising your right to complain to the ICO.
The ICO recommends that UK organisations identify the ICO in their privacy information and explain the individual’s right to complain.
17. Children and Educational Resources
EMSA publishes educational resources that may be used by children and young people.
The fact that a publication is designed for a particular educational age group does not necessarily mean that EMSA needs to collect personal information directly from a child.
Where EMSA introduces a service that specifically collects personal information directly from children, we will assess the applicable data-protection requirements and provide appropriate privacy information and safeguards before introducing that processing.
18. Automated Decision-Making
EMSA does not currently intend to use personal information to make solely automated decisions that produce legal or similarly significant effects on individuals.
If this changes, this Privacy Policy will be updated as required.
19. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in the EMSA website, services, processing activities or applicable requirements.
Where appropriate, significant changes will be brought to users’ attention.
The date shown at the top indicates when this Privacy Policy was last updated.
20. Contact EMSA About Privacy
For questions about this Privacy Policy or the use of your personal information, contact:
EMSA Publication Ltd
Trading as EMSA Educational Publishing
128 City Road
London
United Kingdom
EC1V 2NX
Company registration number: 17490117
Registered in: England and Wales
Privacy email: learn@emsa.org.uk