Hiup – Privacy Policy

Last updated: 10 November 2026

This Privacy Policy explains how HIUP LIMITED (“Hiup”, “we”, “us” or “our”) collects, uses, shares and protects your personal data when you use our website at https://hiupapp.com, the Hiup mobile application, and any related services that link to this policy (together, the “Services”), for example when you:

create an account and manage your profile;
browse or purchase training courses;
browse job listings and click through to an employer’s website to apply; or
contact us, or engage with our marketing or events.

If you have any questions about this policy or how we handle your personal data, please contact us at compliance@hiupapp.com.

Summary of Key Points

Who we are: HIUP LIMITED is the data controller responsible for your personal data.
What we collect: account and profile details, purchase records, course progress, information about how you use the Services, and device and technical data.
Sensitive data: we do not ask for, and do not intentionally process, special category data (such as health, ethnicity or religious beliefs).
Job applications: Hiup does not receive or process your job applications. When you apply for a job, you are redirected to the employer’s own website, and the employer’s privacy policy applies to the information you give them.
Payments: courses are purchased on our website only, and card payments are handled by Stripe; we do not store your full card details.
We do not sell your personal data. Your data is hosted and stored in the EU (Ireland).
Your rights: you can access, correct, delete or export your data, object to certain processing and withdraw consent at any time by emailing compliance@hiupapp.com.

1. Who We Are

The data controller for the Services is:

HIUP LIMITED
Company number: 09823547 (England and Wales)
Registered office: 82 St. John Street, London, EC1M 4JN, United Kingdom
Data and compliance contact: compliance@hiupapp.com

Our operations are carried out in Ireland. We process personal data in accordance with the EU General Data Protection Regulation (EU GDPR), the Irish Data Protection Acts 1988–2018, the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018, as applicable.

2. What Personal Data We Collect

Information you provide to us

Account and profile data: name, email address (accounts are registered with an email address and password only), password (stored in encrypted/hashed form), and, where you choose to provide them, a profile photo, phone number, location (county/city), date of birth or age confirmation, education level, skills, career interests and job preferences.
Purchase data: courses purchased, order history, billing name and address, and transaction records. Your card details are collected and processed directly by our payment provider (see Section 5).
Learning data: course enrolments, progress, completion status, assessment results and certificates issued.
Communications: messages, support requests and feedback you send us, and your marketing preferences.
Contributions: any reviews, ratings or other content you post on the Services.

Information we collect automatically

Usage data: pages and screens viewed, searches, courses and job listings viewed, job listings you click through to (“Apply” clicks), features used, and dates and times of access.
Device and technical data: IP address, browser type, device model, operating system, app version, unique device identifiers, language settings and crash/error reports.
Approximate location: your general location derived from your IP address, used to show relevant jobs and courses. The App does not request access to your device’s precise (GPS) location.
Cookies and similar technologies: see Section 7.

Information from third parties

Payment provider: confirmation of payment status and limited transaction details (e.g. last four digits and card type).
Training providers: where a course is delivered by a third-party provider, we may receive information about your completion or certification.

Information we do not collect

Hiup does not receive your CV, cover letter or any information you submit when applying for a job on an employer’s or recruiter’s website. We do not ask for special category data. Please do not include such information in your profile or any Contributions.

Mobile app permissions

The App only asks for a device permission when you use the feature that needs it. Both permissions are optional, and you can change them at any time in your device settings without affecting the rest of the App.

Permission	What we use it for	Required?
Camera	To take and upload a profile photo	No – optional
Push notifications	To send you notifications and messages related to your recent feed (for example, new courses or jobs)	No – optional

The App does not request access to your microphone, contacts, calendar or precise location.

3. How and Why We Use Your Personal Data

We only use your personal data where we have a lawful basis to do so. The table below sets out our purposes and the lawful basis we rely on for each.

Purpose	Personal data used	Lawful basis
Creating and managing your account, and authenticating you	Account and profile data, device data	Performance of a contract
Selling and delivering courses, processing payments, issuing receipts and certificates	Account, purchase and learning data	Performance of a contract
Showing you job listings and redirecting you to employers’ sites when you choose to apply	Profile preferences, usage data, approximate location	Performance of a contract; legitimate interests (making the Services relevant to you)
Providing customer support and responding to queries	Account data, communications	Performance of a contract; legitimate interests
Sending service messages (order confirmations, account and security notices, changes to our terms)	Account data	Performance of a contract; legal obligation
Personalising course and job recommendations within the Services	Profile, learning and usage data	Legitimate interests (providing relevant content)
Sending marketing emails and push notifications about courses, jobs and offers	Account data, marketing preferences	Consent (or, for existing customers, legitimate interests where permitted by law — you can opt out at any time)
Analytics to understand how the Services are used and to improve them	Usage and device data, cookies	Consent (for non-essential cookies); legitimate interests
Keeping the Services secure, preventing fraud and abuse, and enforcing our Terms	Account, usage, device and purchase data	Legitimate interests; legal obligation
Keeping financial and tax records	Purchase data	Legal obligation
Establishing, exercising or defending legal claims	Any relevant data	Legitimate interests
Reporting aggregated, anonymised statistics to partners (e.g. on course uptake)	Anonymised data only	Not personal data once anonymised

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about this assessment and you have the right to object (see Section 9).

Automated decision-making. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. If we introduce features that use automated or AI-driven matching or recommendations in the future, we will update this policy and inform you before they go live. Records of any such automated decisions, and the related audit logs, will be kept for 12 months.

4. Job Listings and Employer Websites

When you click “Apply” (or similar) on a job listing, you leave the Services and are redirected to the employer’s or recruiter’s own website or application system.

We do not send your profile, CV or contact details to the employer as part of this redirect.
The link may contain technical information (such as a referral tag showing the visit came from Hiup) so the employer or job source can measure traffic. This does not identify you by name.
Any information you then provide to the employer is collected and controlled by the employer, under its own privacy policy. Hiup is not responsible for how employers or recruiters process your data.

We record that you clicked through to a listing so we can show you jobs you have viewed, improve recommendations and report anonymised, aggregated click statistics to job sources. This click data is kept with our other usage data (see Section 8).

5. Who We Share Your Personal Data With

We do not sell your personal data. We share it only in the following circumstances:

Service providers (processors) who act on our instructions under written contracts:

– Amazon Web Services (AWS) – cloud hosting and infrastructure, in the AWS Europe (Ireland) region (eu-west-1);

– Amazon Simple Email Service (Amazon SES) – sending account, transactional and marketing emails;

– Google Analytics – website and app usage analytics;

– Google Firebase (Firebase Cloud Messaging) – delivering push notifications to the App;

– customer support tools; and

– learning platform and course delivery providers.

These providers are configured to store data in the EU (Ireland). We do not use any video-conferencing or calendar integrations in the current version of the Services.

Our payment provider Stripe Payments Europe Ltd, which processes card payments as an independent controller under its own privacy policy (https://stripe.com/ie/privacy).
Third-party training providers and awarding bodies, where you purchase a course they deliver or certify, limited to the information needed to deliver the course, record completion or issue a certificate.
Professional advisers such as lawyers, accountants and auditors, under duties of confidentiality.
Group companies and business transfers: with companies in our corporate group for administration and support, and with a prospective buyer, investor or successor in connection with a merger, acquisition, financing or sale of all or part of our business, subject to appropriate confidentiality protections.
Authorities and legal requirements: with regulators, law enforcement, courts or other public bodies where required by law or to protect the rights, safety or property of Hiup, our users or others.

6. International Data Transfers

Hiup is a UK-registered company with operations in Ireland, so your personal data will be processed in both the European Economic Area (EEA) and the United Kingdom. The UK and the EU each recognise the other as providing an adequate level of data protection.

We host the Services and store your personal data in the EU, in the AWS Europe (Ireland) region, and our email, analytics and push-notification providers are configured to use EU (Ireland) data locations. Some of these providers belong to groups headquartered outside the UK and EEA (for example, Amazon and Google in the United States) and may access data remotely to support, secure or provide their service. Where this happens, we ensure appropriate safeguards are in place, such as an adequacy decision (including the EU–US Data Privacy Framework and UK Extension where the provider is certified), the European Commission’s Standard Contractual Clauses, or the UK International Data Transfer Addendum. You can request a copy of the relevant safeguards by contacting us.

7. Cookies and Similar Technologies

We use cookies, software development kits (SDKs) and similar technologies on our website and App to:

keep the Services working — for example, keeping you logged in and remembering items at checkout (strictly necessary);
remember your preferences (functional);
understand how the Services are used so we can improve them (analytics); and
measure the effectiveness of our marketing (marketing).

We only place non-essential cookies and SDKs with your consent, which you can give or withdraw at any time through our cookie banner/settings or your device settings. For more detail, including a list of the cookies we use, please see our Cookie Policy.

Google Analytics. We may use Google Analytics to understand how the Services are used. You can opt out using Google’s browser add-on at https://tools.google.com/dlpage/gaoptout. For more information see https://policies.google.com/privacy.

Do Not Track. There is currently no agreed standard for responding to browser “Do Not Track” signals, so we do not respond to them. You can manage tracking through our cookie settings.

8. How Long We Keep Your Data

We keep personal data only for as long as necessary for the purposes described in this policy:

Data	Retention period
Account, profile and learning data	For as long as your account is active. If your account is inactive for 24 months, we will notify you and then delete or anonymise it.
Closed accounts	Deleted or anonymised within 90 days of closure
Purchase and transaction records	6 years after the end of the financial year in which the purchase was made, to meet tax and accounting obligations
Course completion and certificate records	For as long as your account is active, or longer where required by an awarding body (we will tell you if this applies)
Customer support communications	2 years after the query is closed
Marketing preferences and consent records	Until you withdraw consent or close your account, plus a short period to evidence compliance
Technical, log and analytics data	24 months
Automated decision and audit logs (if AI features are introduced)	12 months
Backups	Deleted data is permanently removed from backups within 90 days

When you close your account, we delete or anonymise your personal data within 90 days, except where we need to keep it for the reasons above (such as legal, tax or fraud-prevention obligations). Deleted data is permanently removed from our backups within 90 days.

9. Your Rights

Under data protection law, you have the right to:

Access — request a copy of the personal data we hold about you;
Rectification — ask us to correct inaccurate or incomplete data (you can also update most details in your account settings);
Erasure — ask us to delete your personal data;
Restriction — ask us to limit how we use your data in certain circumstances;
Data portability — receive data you provided to us in a structured, machine-readable format, or ask us to transfer it to another organisation;
Object — object to processing based on our legitimate interests, and to object at any time to direct marketing;
Withdraw consent — where we rely on your consent, withdraw it at any time (this does not affect processing carried out before you withdrew it); and
Not be subject to solely automated decisions that have legal or similarly significant effects on you.

How to exercise your rights. Email compliance@hiupapp.com. We may need to verify your identity before acting on your request. We will respond within one month, which may be extended by up to two further months for complex requests (we will tell you if this applies). There is normally no charge.

Unsubscribing. You can opt out of marketing emails at any time by clicking the “unsubscribe” link in any marketing email or by updating your account settings, and turn off push notifications in your device settings.

Complaints. If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with a supervisory authority:

Ireland: Data Protection Commission — www.dataprotection.ie
United Kingdom: Information Commissioner’s Office — www.ico.org.uk
Or the data protection authority in the EU country where you live or work.

10. How We Keep Your Data Secure

We host your data on Amazon Web Services in the EU (Ireland) region and use appropriate technical and organisational measures to protect it, including encryption of data in transit (TLS), hashed passwords, access controls limited to staff and providers who need access, and regular review of our security practices.

However, no method of transmission over the internet or electronic storage is completely secure. Please use a strong, unique password and keep your login details confidential. If we become aware of a personal data breach that is likely to result in a high risk to you, we will notify you and the relevant supervisory authority as required by law.

11. Children

The Services are not intended for children under 15, and we do not knowingly collect personal data from anyone under 16. If you believe a child under 15 has provided us with personal data, please contact us at compliance@hiupapp.com and we will delete it.

Users aged 15 – 17 may use the Services with the permission of a parent or guardian. We do not send direct marketing to users we know to be under 18 without appropriate consent.

12. Third-Party Websites

The Services contain links to third-party websites, including employers’ and recruiters’ application pages and training providers’ sites. This policy does not apply to those websites. We encourage you to read their privacy policies before providing any personal data.

13. Changes to This Policy

We may update this Privacy Policy from time to time, including when we introduce new features. We will change the “Last updated” date at the top and, where changes are material, notify you by email or in-app notice before they take effect.

14. Contact Us

If you have any questions about this Privacy Policy, or wish to exercise your rights, please contact us:

HIUP LIMITED — Data and Compliance
82 St. John Street, London, EC1M 4JN, United Kingdom
Email: compliance@hiupapp.com