Privacy Policy

This Privacy Policy explains how HerpDesk Manager, operated by The Reptile Academy Ltd (Company No. 11421088), processes personal data — how we collect, store, manage and protect it. It applies The Reptile Academy's Data Protection Policy (GDPR Policy) to the Platform and should be read alongside it.

• The UK General Data Protection Regulation (UK GDPR).
• The Data Protection Act 2018.
• The Privacy and Electronic Communications Regulations 2003 (PECR).
• Other national and international data protection laws as applicable.

Data Controller: The Reptile Academy Ltd, 71 Shelton Street, London WC2H 9JQ, which determines the purposes and means of processing personal data.

Data Protection Officer: responsible for overseeing data protection practices and compliance. Contact data.protection@reptileacademy.com or telephone 02380 394174.

This policy applies to:

• All HerpDesk Manager account holders, including keepers, breeders, professional centres, youth applicants, team seat holders and oversight (local authority) users.
• Staff, volunteers and contractors of The Reptile Academy who access the Platform.
• External organisations or individuals that process personal data on our behalf.
• Visitors to the HerpDesk Manager website who provide personal information.

• Account data — name, email address, password hash, plan and billing status; used to create and secure your account.
• Collection and husbandry data — animal records, enclosures, feeding, shed, weight, care rounds, UV-B readings and health entries; used to provide the record-keeping service.
• Veterinary and document vault uploads — reports, treatment plans and licences; stored privately and used only to provide the service to you and anyone you explicitly grant access to.
• Compliance data — DWAA, Animal Activities, zoo and pet shop licence details, and verification evidence you submit.
• Youth application data — age, contact email, parental or guardian consent, educational institution and course, and a submitted photograph and written statement; used solely to assess the application.
• Payment data — subscription status and identifiers from our payment processor. We never see or store your full card details.
• Support and feedback data — messages, bug reports and ratings you send us.
• Technical data — log records, device and browser information and IP address; used for security, diagnostics and abuse prevention.

• Contract — to provide the Platform and administer your subscription.
• Legitimate interests — to secure the service, prevent misuse, and improve features.
• Consent — for optional features such as the member leaderboard, public centre directory, citizen-science contributions, marketing emails and non-essential cookies. Consent can be withdrawn at any time.
• Legal obligation — for accounting, safeguarding and lawful requests from authorities.

We process personal data in line with the UK GDPR principles:

• Lawfulness, fairness and transparency.
• Purpose limitation — collected for specific, legitimate purposes only.
• Data minimisation — adequate, relevant and limited to what is necessary.
• Accuracy — kept accurate and up to date.
• Storage limitation — kept no longer than necessary.
• Integrity and confidentiality — processed securely against unauthorised access, loss or damage.

Personal data will not be disclosed to any third party without your explicit consent, unless disclosure is required by law, is necessary to deliver the service, or there is a legitimate business need consistent with data protection law. Our processors include our cloud hosting and database provider, our payment processor, our transactional email provider and our AI provider (for the husbandry assistant and enclosure photo analysis). Each is bound by contract to process data only on our instructions.

Oversight (local authority) access to a professional keeper's records is only ever granted by the keeper, is time-limited, and can be revoked by the keeper at any time.

Access to records is enforced at database level so that keepers, team members and authorised inspectors see only the data they are entitled to. Uploaded documents and photographs are held in private storage. All staff, volunteers and contractors are bound by a duty of confidentiality.

You have the right to:

• Access — request copies of your personal data.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your data in certain circumstances.
• Restriction — request that we restrict processing.
• Portability — receive your data in a structured, commonly used format.
• Object — object to processing on certain grounds.
• Automated decisions — challenge decisions made solely by automated processing.

Requests should be directed to the Data Protection Officer and are answered within one calendar month.

Personal data is retained only as long as necessary for the purposes for which it was collected, after which it is securely destroyed or anonymised in line with our Data Retention Schedule. If you close your account, your collection data is deleted or anonymised, except where we must retain records for legal, accounting or safeguarding reasons.

All breaches must be reported to the Data Protection Officer, who assesses severity and determines whether the Information Commissioner's Office must be notified. Affected individuals will be told where a breach poses a high risk to their rights and freedoms.

Data is hosted within the UK or EEA wherever possible. Where a processor operates outside the UK, transfers are protected by adequacy regulations or the International Data Transfer Addendum to the standard contractual clauses.

HerpDesk Youth is available to keepers aged 8–19. Where an applicant is 17 or under we require confirmation of parental or guardian consent before the account is approved. Youth application material is reviewed only by authorised administrators and is not published.

Compliance is monitored through regular audits and this policy is reviewed annually, or sooner if legislation or our processes change. For further information or to raise a concern, contact the Data Protection Officer at data.protection@reptileacademy.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Legal and licensing guidance is general information only and does not guarantee compliance with the law in your jurisdiction.