Last updated: June 2026
RegNexus Limited ("we", "us", "our") is the data controller for personal data processed through RegNexus Lumen. We are registered in England and Wales.
We collect the following categories of personal data:
We process personal data for the following purposes:
We process your data under the following legal bases: performance of a contract (providing the service), legitimate interest (platform security and improvement), consent (where applicable), and legal obligation (regulatory record-keeping).
Account data is retained for the duration of your account. Competence records and hash-chained evidence are retained for a minimum of 7 years to meet regulatory requirements. You may request deletion of non-regulatory data at any time.
We do not sell your personal data. We share data only with: infrastructure providers (Supabase, Vercel) for platform operation, AI providers (Anthropic, OpenAI) for AI-assisted features (no personal data is sent to AI models without anonymisation), and regulators or auditors when required by law.
Our primary infrastructure is hosted in EU regions (eu-west-2). Where data is transferred outside the UK/EEA, appropriate safeguards are in place including Standard Contractual Clauses.
Under UK GDPR, you have the right to: access your data, rectify inaccurate data, erase your data (subject to regulatory retention requirements), restrict processing, data portability, and object to processing. To exercise these rights, contact us at privacy@reg-nexus.com.
The Platform is used by schools, academies and training providers, some of whose learners are under 18. For those learners, the enrolling organisation is the data controller and is responsible for the lawful basis of processing, including any parental or guardian consent required. RegNexus Limited acts as processor on the organisation's instructions. We do not advertise to learners, do not use learner data for marketing or profiling beyond the educational features the organisation has enabled, and do not sell personal data. Progress information is shared with parents or guardians only through links the organisation's staff explicitly generate, which expire and can be withdrawn.
We use essential cookies for authentication and session management. We do not use third-party tracking or advertising cookies.
For privacy enquiries, contact us at privacy@reg-nexus.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).