FourthRev Privacy Policy

Effective date: 6 August 2026
Version: 2.0

How FourthRev collects, uses, shares and protects personal information.

At a glance

Contents

1. Executive summary
2. Who we are and who is responsible
3. Information we collect and its sources
4. How and why we use information
5. Sensitive information and reasonable adjustments
6. Recordings, AI and automated processing
7. Marketing and communications
8. Who we share information with
9. International transfers
10. Security and data breaches
11. How long we keep information
12. Your rights and choices
13. Cookies, complaints, contact and updates

1. Executive summary

FourthRev provides online education and career-development services with university, employer and industry partners. We use personal information to respond to enquiries, assess applications, enrol and support learners, deliver and improve courses, assess performance, issue awards, report to authorised employers and partners, protect our systems, comply with law and communicate about relevant services. We limit collection to what is reasonably necessary, use appropriate safeguards, and provide choices and rights under applicable law.

2. Who we are and who is responsible

The FourthRev entities, privacy roles and controller arrangements.

2.1 The FourthRev group

In this policy, FourthRev, we, us and our refer to the relevant FourthRev company that determines why and how your personal information is used. The FourthRev group includes:

• FourthRev Ltd, registered in England and Wales under company number 12333799, with registered office at Harwood House, 43 Harwood Road, London, England, SW6 4QP.
• FourthRev Pty Ltd, registered in Australia under ACN 632 361 061 and ABN 92 632 361 061, with registered address at 10 Oxley Road, Hawthorn, Victoria 3122.
• FourthRev Ltd, registered in South Africa as an external company under registration number 2022/237363/10, with registered address at 50 Sea Mist Crescent, Coral Grove, Milnerton, Cape Town, South Africa, 7441.

FourthRev delivers online courses and related learner, employer and partner services. We work with universities, awarding bodies, employers, industry organisations, instructors and other service providers.

2.2 Which entity is responsible

The responsible entity depends on the service, contract, location and decisions being made about the information:

• FourthRev Ltd in the United Kingdom generally manages the main FourthRev website, central marketing activity and group services, unless a collection notice says otherwise.
• FourthRev Pty Ltd is responsible where it contracts for or determines Australian processing activities.
• The South African external company is a responsible party where it determines processing activities in South Africa.
• For partner-delivered courses, FourthRev and the relevant university, employer or partner may act as independent controllers or responsible parties, joint controllers, or in a controller-processor relationship. The applicable course notice, enrolment terms or contract will explain the arrangement.

Where FourthRev and a partner are joint controllers, the parties allocate their responsibilities in an arrangement. A summary of the essence of that arrangement is available on request from privacy@fourthrev.com.

2.3 Privacy contacts and registrations

2.4 Additional notices

This policy is a general notice. Additional notices may apply to a particular course, partner arrangement, application form, event, research activity, cookie, employee, contractor or recruitment process. A more specific notice applies to that particular processing where it provides additional or different information.

3. Information we collect and its sources

The main categories of information and how FourthRev receives them.

3.1 What personal information means

Personal information includes information that identifies you directly and information that can reasonably be linked to you. The term includes personal data under United Kingdom data protection law and personal information under the Australian Privacy Act and South African POPIA.

3.2 Categories of information

3.3 Information you must provide

Some information is necessary to respond to an enquiry, assess an application, create an account, enter into or perform a contract, verify identity, deliver a course, provide an adjustment, issue an award or comply with law. If required information is not provided, we may be unable to process an application, enrol you, provide part of the service, verify an award or respond fully to a request. Information described as optional or voluntary is not required.

3.4 Information received indirectly

We may receive information from a university or industry partner, your employer, an awarding body, an authorised referrer, instructors, service providers, public professional sources or another person acting with authority. Where required, we or the organisation collecting the information will tell you about the collection.

3.5 Anonymous and aggregated information

We may remove identifying details and combine information to produce statistics and trends. Information that can no longer identify you is not treated as personal information. We do not attempt to re-identify properly anonymised information.

4. How and why we use information

Purposes, legal grounds and expected uses.

4.1 Our main purposes

4.2 Australia and South Africa

Australian and South African privacy laws use different legal terminology from the United Kingdom. In those jurisdictions, FourthRev collects, uses and discloses personal information only where reasonably necessary for its functions or activities and where permitted by law, including on the basis of consent, contractual necessity, legal obligations, legitimate interests or other lawful grounds and exceptions.

4.3 Legitimate interests and new purposes

Where United Kingdom law permits us to rely on legitimate interests, we consider the purpose, necessity and likely impact on you. Our interests include delivering and improving education services, administering partner and employer relationships, protecting people and systems, preventing fraud, maintaining academic integrity, managing complaints and establishing or defending legal claims. We do not rely on legitimate interests where your rights and interests override ours. If we intend to use information for a materially different and incompatible purpose, we will identify a valid legal basis and provide additional information before doing so, unless law permits or requires the use without further notice.

5. Sensitive information and reasonable adjustments

Additional protection for health, disability, diversity and other sensitive information.

5.1 Sensitive and special-category information

Sensitive information can include health and disability information, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, biometric identifiers, sexual orientation and other information given additional protection by law. The precise definition differs by jurisdiction. We collect sensitive information only when it is necessary for a clear purpose and a valid legal condition applies.

5.2 Reasonable adjustments and accessibility

We may use health, disability or accessibility information to consider and implement reasonable adjustments, provide accessible learning, communicate with an authorised support person, protect health and safety, and meet anti-discrimination or other legal obligations. We limit access to people who need the information for the approved purpose.

5.3 Voluntary diversity information

Diversity questionnaires are voluntary unless a form clearly states otherwise. We generally use responses in aggregated form to understand participation and improve inclusion. We do not use voluntary diversity responses to make adverse admissions, assessment or employment decisions.

5.4 Safeguarding, emergencies and legal claims

Where necessary, we may process sensitive information to protect vital interests, respond to a safeguarding concern, establish or defend legal claims, comply with a legal obligation or meet another condition permitted by applicable law. We record the reason and apply proportionate safeguards.

5.5 Identity documents and biometrics

We request identity documents only where reasonably necessary for identity verification, examinations, funding, visa, accreditation, award or fraud-prevention requirements. We do not use biometric identification unless a specific service requires it and an additional notice explains the purpose and safeguards.

6. Recordings, AI and automated processing

How FourthRev uses recordings, transcription and AI-enabled services.

6.1 Calls and live sessions

FourthRev may record calls, webinars, teaching sessions or live support sessions for delivery, access, quality, training, safeguarding, note-taking and evidence purposes. We provide notice before or at the start of a recording. Where participation is optional, you can usually keep your camera and microphone switched off or use another contact method. Course-specific requirements may apply to assessments or identity checks.

6.2 Transcription and note-taking

Approved tools may create transcripts, summaries, action items or notes from calls and live sessions. These outputs can contain errors. Authorised personnel must review material information before relying on it for support, assessment, complaint handling or another decision affecting a person.

6.3 Artificial intelligence

FourthRev uses approved AI-enabled tools to support activities such as drafting, search, transcription, summarisation, classification, analytics, learner support and operational administration. AI tools are subject to access, confidentiality, supplier and data-protection controls appropriate to the use. Personnel must not enter personal or confidential information into an unapproved AI tool.

• AI output is reviewed by an authorised person where accuracy or impact matters.
• AI is not treated as an authoritative source merely because an output appears confident.
• Sensitive information is used with AI only where the tool, purpose, legal basis and safeguards have been approved.
• FourthRev does not sell learner information or authorise personnel to use it to train public AI models.

6.4 Automated decisions

FourthRev does not currently rely solely on automated processing to make decisions about learners that produce legal or similarly significant effects. If this changes, we will explain the information used, the kind of decision, the role of human review and the rights available before the processing begins. Automated tools may assist with routine routing, recommendations, risk indicators or administrative checks, but an authorised person remains responsible for material decisions.

6.5 Your information in AI features

Where you directly use an AI-enabled feature, the information you submit and the resulting output may be processed to provide the feature, maintain security, investigate misuse and improve the service within the limits described at collection. Do not submit information about another person unless you are authorised to do so.

7. Marketing and communications

How FourthRev communicates with individuals and business contacts.

7.1 Service communications

We send operational communications needed to manage an enquiry, application, enrolment, course, account, payment, event, policy update, support request or partner relationship. These are not marketing where they are necessary to provide the requested service or important information about it.

7.2 Marketing rules

7.3 Business contacts

We may contact people in their professional capacity about an existing or prospective university, employer, supplier or industry relationship. We use professional contact details, keep communications relevant to the person’s role and respect objections.

7.4 Email engagement

Marketing and service emails may use links and pixels to measure delivery, opens, clicks, approximate location, email service and campaign performance. We use these technologies only as permitted by applicable law and subject to relevant consent or preference controls. You can disable non-essential tracking through available settings or contact us.

7.5 Marketing retention

If an individual marketing lead has no meaningful engagement with us for 18 months, we may ask whether they still wish to hear from us. If there is no response, we normally stop active marketing and delete or suppress the details by 24 months after the last meaningful engagement, unless another relationship or legal reason requires retention.

8. Who we share information with

Recipients, service providers and disclosure safeguards.

8.1 Recipient categories

8.2 Current service examples

Depending on the service and configuration, providers may include HubSpot, JustCall, Typeform, Zapier, n8n, Canvas, Google, Meta, LinkedIn, website and cloud-hosting providers, payment providers, video-conferencing providers, and approved AI services such as Claude, ChatGPT, JustCall AI, WINN.AI and Granola. The provider list changes as services are reviewed or replaced.

8.3 Roles and contracts

A recipient may act as FourthRev’s processor or operator, an independent controller or responsible party, or a joint controller, depending on the activity. We use appropriate processing, data-sharing, joint-controller, confidentiality and transfer terms for the relevant role. Providers acting on our instructions may use information only for the contracted service and authorised purposes, subject to applicable law.

8.4 Legal requests

If we receive a court order, warrant, regulatory demand or other legal request, we assess its validity, scope and impact before disclosing information. We seek legal advice where appropriate and disclose only what is reasonably required, unless law prevents us from telling you.

FourthRev does not sell personal information.

9. International transfers

Where information may be processed and how transfers are protected.

9.1 Transfer locations

FourthRev operates across the United Kingdom, Australia and South Africa and works with international partners and service providers. Personal information may therefore be accessed, stored or processed in those countries, the United States, countries in the European Economic Area and other locations in which an authorised partner, provider or subprocessor operates.

9.2 Transfer safeguards

9.3 Further information

You can contact privacy@fourthrev.com to ask about the countries and safeguards relevant to a particular service or transfer. We may provide a summary rather than commercially sensitive contractual terms.

10. Security and data breaches

How FourthRev protects information and responds to incidents.

10.1 Security measures

FourthRev uses proportionate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, misuse, disclosure or access. Measures may include:

• role-based access, user authentication and multi-factor authentication;
• encryption in transit and, where appropriate, at rest;
• device, endpoint, network, cloud and security monitoring;
• logging, vulnerability management, testing and incident response;
• staff and contractor confidentiality obligations, policies and training;
• supplier assessment, data-protection terms and access restrictions;
• backups, business continuity and disaster-recovery arrangements; and
• data minimisation, retention controls and secure deletion or anonymisation.

No system is completely secure. You are responsible for protecting your credentials, using appropriate device security and reporting suspected compromise promptly.

10.2 Security incidents

We investigate suspected security incidents, take steps to contain and remediate them, preserve appropriate evidence and assess the effect on individuals. Where FourthRev is the controller or responsible party, we notify the relevant regulator and affected individuals when applicable law requires it. Where FourthRev acts as a processor or operator, we notify and support the relevant controller or responsible party.

10.3 Reporting concerns

Please contact privacy@fourthrev.com immediately if you notice unusual activity, receive a suspicious communication, believe your account has been compromised, or think personal information has been sent to the wrong person.

11. How long we keep information

Retention periods and deletion criteria.

11.1 Our approach

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including service delivery, partner or accreditation requirements, legal claims, security, tax, accounting and regulatory obligations. We then delete, securely destroy or anonymise it.

11.2 Typical retention periods

11.3 Backups and legal holds

Deleted information may remain temporarily in secure backups until it is overwritten through the normal backup cycle. We may suspend deletion where information is subject to a complaint, investigation, litigation hold, regulatory requirement or another lawful preservation need.

12. Your rights and choices

How to access, correct, delete or object to the use of information.

12.1 Making a request

Email privacy@fourthrev.com and describe what you need. You do not have to use legal wording. We may ask for information reasonably necessary to verify your identity, authority and the scope of the request. Rights are not absolute and may be limited by law, another person’s rights, confidentiality, legal privilege, academic integrity, regulatory duties or a valid retention need.

12.2 Rights by jurisdiction

12.3 Response periods and fees

We respond within the period required by the law that applies. United Kingdom requests are generally answered within one month, subject to a permitted extension. Australian access or correction requests are generally answered within 30 days. South African requests are handled within the applicable POPIA or PAIA period. Requests are usually free. We charge a fee only where law permits it and tell you in advance.

12.4 Requests relating to a partner

If another organisation is responsible for the information or FourthRev holds it only as that organisation’s processor or operator, we may refer the request to that organisation or respond under its instructions. We will explain this where we can.

12.5 Withdrawing consent

Where we rely on consent, you may withdraw it at any time. Withdrawal does not make earlier lawful processing unlawful. It may affect our ability to provide an optional feature, communication or service that depends on the consent.

13. Cookies, complaints, contact and updates

Online technologies, escalation routes and policy changes.

13.1 Cookies and similar technologies

Our website, platform and communications use cookies, pixels, tags, local storage and similar technologies. These can keep you signed in, remember preferences, protect accounts, measure use, improve services and support relevant advertising.

Non-essential technologies are used only after the required permission has been obtained. The cookie banner allows you to accept or reject non-essential categories and Cookie Settings allows you to change your choice. Your browser or device may also provide controls. Blocking some technologies can reduce functionality.

Third-party technologies may include Google Analytics, Meta, LinkedIn, HubSpot and our website, learning, communication and hosting providers. The current cookie list, provider, purpose and duration are available through Cookie Settings or the Cookie Notice on our website.

13.2 Contact FourthRev

13.3 Complaints

Please contact us first so that we can investigate and try to resolve the concern. Include enough information for us to understand the issue and the outcome you seek. We may ask for clarification or identity verification. If you remain dissatisfied, you may contact the regulator that applies to you:

• United Kingdom: Information Commissioner’s Office, ico.org.uk.
• Australia: Office of the Australian Information Commissioner, oaic.gov.au.
• South Africa: Information Regulator, inforegulator.org.za.

13.4 Changes to this policy

We review this policy at least annually and sooner when our services, technologies, partners, legal obligations or information practices change materially. We publish the current version on our website and update the effective date. We take reasonable steps to bring material changes to your attention before or when they take effect, for example by email, an account notice or a website message.

13.5 Version record