These are general business terms and should receive final legal review before publication.
1. Information we collect
We may collect:
- Identity and contact information: name, email address, telephone number, country and billing details.
- Account information: login details, membership plan, subscription status and account preferences.
- Transaction information: selected service, amount, currency, payment provider, transaction reference, payment status, renewal status, refunds and chargebacks.
- Support information: messages, enquiries, complaints and refund requests.
- Technical and usage information: IP address, browser, device information, access times, pages visited and security logs.
We do not intentionally store complete card numbers, card security codes, bank-login credentials or mobile-money PINs. Payment details are entered into and processed by the selected payment provider.
2. How we use information
We use personal information to:
- create and manage customer accounts;
- start, verify and record payments;
- activate, renew, suspend or cancel memberships;
- provide courses, registrations, digital resources and customer support;
- issue transaction confirmations and handle refunds or disputes;
- prevent fraud, misuse and security threats;
- maintain financial and legal records;
- improve the reliability and performance of our website; and
- send marketing messages only where permitted or where consent has been given.
3. Legal bases
Depending on the circumstances and applicable law, we process information because it is necessary to:
- perform our contract with the customer;
- comply with legal, accounting and tax obligations;
- pursue legitimate interests such as payment verification, fraud prevention, customer support and service improvement; or
- act on consent, including for optional marketing or non-essential cookies.
Consent may be withdrawn at any time without affecting earlier lawful processing.
4. The three payment providers
Customers may be offered one or more of these payment options:
- Paddle: Paddle.com acts as Merchant of Record and reseller for purchases processed through Paddle. Paddle handles payment processing, billing, applicable taxes, subscription administration, returns and related customer-service enquiries. Paddle receives the information required to complete and manage the transaction.
- Paystack: Paystack processes supported card, bank and local-payment transactions. Citadel receives transaction references and payment status information needed to confirm the purchase and provide access.
- Flutterwave: Flutterwave processes supported card, bank, mobile-money and other local-payment methods. Citadel receives transaction references and payment status information needed to confirm the purchase and provide access.
The chosen provider processes payment information according to its own privacy notice and legal obligations. Customers should review that provider’s notice before completing payment.
5. Sharing information
We may share personal information with:
- Paddle, Paystack or Flutterwave when required to process or verify a payment;
- providers supporting website hosting, account authentication, communications, analytics and customer service;
- legal, accounting and other professional advisers;
- authorities, regulators or courts where disclosure is legally required; and
- a successor organisation if Citadel is reorganised, merged or sold, subject to appropriate safeguards.
We do not sell personal information.
6. International transfers
Citadel serves customers in several countries, and our payment and technology providers may process information outside the customer’s country. Where required, we use recognised safeguards such as contractual protections, adequacy decisions or other lawful transfer mechanisms.
7. Retention
We retain account and transaction records only for as long as necessary to provide services, manage memberships, resolve disputes and meet legal, tax and accounting obligations. Support and technical records are retained according to operational and security needs. Information is deleted or anonymised when it is no longer required, unless the law requires longer retention.
8. Security
We use appropriate technical and organisational safeguards, including access controls, secure connections, restricted administrative access and payment verification. No online system can be guaranteed completely secure, but we review and improve our protections where reasonably necessary.
9. Cookies and similar technologies
Our website may use:
- essential technologies for sign-in, security, checkout and saved preferences;
- analytics technologies to understand website use and improve services; and
- marketing technologies, where used and permitted, to measure campaigns.
Customers can manage optional cookies through available consent controls and browser settings. Blocking essential technologies may prevent account or checkout functions from working.
10. Customer rights
Depending on applicable law, customers may have rights to:
- access their personal information;
- correct inaccurate information;
- request deletion or restricted processing;
- receive portable information;
- object to certain processing;
- withdraw consent; and
- complain to the appropriate data-protection authority.
UK and EEA requests will normally receive a response within one month, subject to lawful extensions. Some information may need to be retained for legal, fraud-prevention or accounting reasons.
11. Children
Where a learner is under the applicable age of consent, a parent or legal guardian must provide the required information and authorisation. Payment information must be submitted by an authorised adult.
12. Contact
For privacy questions or to exercise your rights, contact:
Citadel Language Company · Email: info@citadellanguages.com
13. Changes
We may update this Privacy Notice when our services, payment options or legal obligations change. The latest version and effective date will appear on this page.
