Privacy Policy

GlinTiss Ltd and Dr Yannis Educational Services

Last updated: 23 September 2026

GlinTiss Ltd respects your privacy and is committed to
protecting your personal information.

This Privacy Policy explains how we collect, use, store,
share and protect personal information when you use
our websites, educational resources, live events,
digital products and related services.

It also explains your rights under UK data protection
law and how to contact us about your information.

1. Who we are

GlinTiss Ltd is a private limited company registered
in England and Wales.

GlinTiss Ltd owns and operates the GlinTiss and
Dr Yannis educational websites and services.

GlinTiss Ltd is the data controller responsible
for the personal information described in this
Privacy Policy.

GlinTiss Ltd
Company number: 14895106
Registered office: 86–90 Paul Street,
London EC2A 4NE

Privacy enquiries:

ioannis.glinavos@glintiss.co.uk

Dr Yannis (Ioannis Glinavos) is the founder
and company director.

2. What this Privacy Policy covers

This policy applies to the websites and educational
services operated by GlinTiss Ltd, including:

• 
  glintiss.co.uk
  
• 
  dryannis.co.uk
  
• 
  app.dryannis.co.uk
  
• 
  events.dryannis.co.uk
  
• 
  labs.dryannis.co.uk
  

It also covers our related educational activities,
including:

• Live Dr Yannis Super Sessions;
• Event applications and bookings;
• Digital Resource Pack purchases;
• Manually authorised access to purchased resources;
• Edited educational recordings;
• The Dr Yannis SQE Newsletter;
• Dr Yannis Labs and Mistake Lab;
• Educational enquiries and customer support; and
• Optional purchaser benefits and community activities.

Some of our services use third-party platforms,
including Stripe, Google Drive, Supabase,
Netlify, Substack, YouTube and video-conferencing
providers.

When you use a third-party service, that provider
may also process personal information under its
own privacy policy.

This policy concerns the processing for which
GlinTiss Ltd is responsible.

3. What personal information we collect

The information we collect depends on how you
interact with our services.

It may include:

• Your name and email address.
• Information contained in enquiries, applications
  and correspondence.
• Newsletter subscription and unsubscribe records.
• Event applications and booking information.
• Information reasonably needed to assess eligibility
  or potential conflicts of interest.
• Order details, product titles, payment status,
  transaction references and refund records.
• The Google-account email address supplied
  for access to purchased resources.
• Records of access authorisation, changes
  and expiry dates.
• Information about applicable discounts,
  membership eligibility or promotional benefits.
• Attendance information and information you
  choose to share during a live event.
• Images, voices or chat contributions that may
  be captured when an event is recorded.
• Labs account information and Mistake Lab
  learning progress.
• WordPress comments and associated metadata.
• Technical information such as IP address,
  browser type, requested pages, access times
  and security logs.
• Cookie preferences and relevant browser-storage
  information.

We do not normally collect or store complete
payment-card details.

Payments are processed by the relevant
payment provider.

Please do not send confidential, highly sensitive
or unnecessary personal information through
ordinary contact forms or event discussions.

4. Why we use personal information

We use personal information for the following purposes:

• To operate our websites and educational services.
• To respond to enquiries and requests.
• To assess applications for live events.
• To manage limited-capacity bookings.
• To identify and manage potential conflicts
  of interest.
• To process purchases and administer refunds.
• To verify orders and authorise access to
  purchased digital resources.
• To provide purchased educational content
  for the agreed access period.
• To provide technical support and resolve
  access problems.
• To record, edit and distribute educational
  material in accordance with the arrangements
  explained in this policy.
• To administer optional benefits included
  with purchased products.
• To maintain Labs accounts and saved
  learning progress.
• To send the SQE Newsletter to subscribers.
• To communicate essential information about
  bookings, purchases and services.
• To maintain security, investigate misuse
  and prevent fraud.
• To keep appropriate business and accounting
  records.
• To comply with applicable legal obligations.

We do not sell personal information.

5. Our lawful bases for processing

Under the UK General Data Protection Regulation
(UK GDPR), we must have a lawful basis for
processing personal information.

The principal lawful bases we use are described
below.

5.1 Performance of a contract

We process information where necessary to
provide a service you have requested or to
take steps before entering into a contract.

Examples include:

• Considering an event application.
• Managing a confirmed booking.
• Processing a Digital Resource Pack order.
• Authorising Google Drive access.
• Managing an agreed access period.
• Providing purchased educational materials.
• Administering contractual purchaser benefits.
• Maintaining a requested Labs account.
• Saving Mistake Lab progress.

5.2 Consent

We rely on consent where required, including
for optional newsletters and other marketing
communications where consent is the applicable
basis.

We also obtain consent where required for
particular uses of identifiable recordings
or other personal information.

You may withdraw consent at any time.
Withdrawal does not affect processing that
was lawful before withdrawal.

Consent to early digital-content supply under
consumer contract law is separate from consent
to process personal information under data
protection law.

5.3 Legitimate interests

Where appropriate, we rely on legitimate interests
to operate, secure and improve our educational
services and manage our business.

These interests include:

• Responding to enquiries.
• Maintaining proportionate business records.
• Preventing spam, fraud and unauthorised access.
• Managing event capacity and suitability.
• Identifying potential conflicts of interest.
• Investigating access problems or misuse.
• Maintaining the security of purchased resources.
• Understanding how our educational services
  are used and improving them.
• Producing and distributing recordings of our
  own teaching while taking appropriate steps
  to protect participants’ privacy.

Before relying on legitimate interests, we
consider whether the processing is necessary
and proportionate and whether individuals’
rights or interests override our interests.

5.4 Legal obligations

We process and retain certain information
where necessary to comply with applicable
legal obligations, including company,
accounting, tax and consumer-protection
requirements.

Where processing is necessary to establish,
exercise or defend legal claims, we may
retain the relevant information as permitted
by law.

6. Live Super Sessions: applications and bookings

If you apply for or book a Dr Yannis Super
Session, we may collect your name, email
address and information reasonably needed
to assess the application.

We use this information to:

• Review your application;
• Communicate the outcome;
• Manage limited capacity;
• Identify potential conflicts of interest;
• Issue payment instructions;
• Administer bookings and attendance;
• Send event joining information; and
• Provide any resources included with
  your booking.

An expression of interest or application
does not automatically create a booking
or guarantee a place.

We may retain relevant booking,
correspondence, payment and attendance
records after an event where necessary
for legitimate business, accounting or
legal purposes.

Where an event is delivered through a
third-party video-conferencing platform,
that provider may process information
required to operate the session.

7. Recording live Super Sessions

Some live Super Sessions are recorded
so that we can provide educational
recordings and related resources.

Where recording is planned, participants
will be informed before the event and,
where appropriate, at its start.

7.1 Information that may be captured

Depending on the event platform and
recording arrangements, an original
recording may capture:

• Participant display names;
• Participant images;
• Participant voices;
• Questions and comments;
• Information displayed on screen; and
• Chat contributions, where these form
  part of the captured material.

Participants should avoid sharing
unnecessary personal, confidential or
sensitive information.

Where the platform permits, participants
may use appropriate display names and
keep cameras or microphones switched
off when they are not contributing.

We may pause recording during
audience participation or discussion.

7.2 Editing recordings

Recordings may be edited to create
educational resources for attendees
and purchasers of Digital Resource Packs.

Our intention is for commercially
distributed teaching recordings to
contain the presenter’s teaching and
supporting educational material rather
than identifiable audience contributions.

We take reasonable steps to remove
or anonymise incidental participant
images, voices, names and contributions
before distributing recordings to
other purchasers or the public.

Questions may be repeated or paraphrased
by the presenter without identifying
the participant.

7.3 Publication and sale of recordings

Edited teaching recordings may be
provided to the original participants,
included in separately purchased
Digital Resource Packs or used in
educational and promotional extracts.

We do not treat acceptance of booking
terms as unrestricted permission to
publish identifiable participants.

Where identifiable participant material
is to be used beyond the original event,
we will establish an appropriate lawful
basis and obtain permission where required.

A participant who has concerns about
a recording should contact us using
the privacy contact details in section 1.

7.4 Retention of recordings

Original recordings containing
participant information are retained
only for as long as reasonably needed
for editing, quality control, event
administration and any relevant
complaint or legal matter.

We review the need to retain original
recordings and remove unnecessary
participant information when it is
no longer required.

Edited recordings containing only
the presenter’s teaching may be
retained for as long as they remain
part of our educational offering,
subject to applicable legal obligations
and the rights of any identifiable
individuals.

8. Digital Resource Pack purchases

When you purchase a Digital Resource
Pack, we process the information
necessary to administer your order
and supply the purchased content.

This may include:

• Your name;
• Your purchase email address;
• Your Google-account email address;
• The product purchased;
• The amount paid;
• Discounts or promotional codes used;
• Payment status and transaction references;
• Order confirmation records;
• Applicable early-supply consent
  and acknowledgement records;
• Access authorisation and expiry dates;
• Support correspondence; and
• Refund or cancellation records.

We use this information to fulfil
the purchase contract, provide access,
verify entitlements, handle refunds
and maintain appropriate business
records.

The relevant purchase terms are
available at:

GlinTiss Ltd Terms and Conditions

Additional Digital Resource Pack
terms are available at:

Digital Resource Pack Terms

9. Stripe payments

Payments for our educational products
are normally processed through Stripe.

Stripe may collect and process
payment-card information, billing
details, transaction information
and information needed for payment
security and fraud prevention.

GlinTiss Ltd normally receives
information such as payment status,
purchase amount, transaction reference
and relevant customer details.

We do not normally receive or store
complete payment-card numbers or
card security codes.

Stripe may also process information
under its own privacy policy and
applicable legal obligations.

For further information, visit:

Stripe Privacy Policy

10. Google Drive and manual resource access

Unless otherwise stated in the relevant
product description, purchased Digital
Resource Packs are hosted privately
on Google Drive.

A Google account is required to access
a Google Drive-hosted pack.

Purchasers provide the email address
associated with the Google account
to which access should be granted.

The email address does not need to
end in gmail.com, but it must be
associated with a valid Google account.

We use this information to:

• Verify the relevant purchase;
• Identify the authorised purchaser;
• Grant access to the appropriate
  private folder;
• Administer the agreed access period;
• Resolve access problems;
• Transfer access following appropriate
  identity and order checks; and
• Prevent unauthorised sharing or misuse.

Access is authorised manually rather
than automatically.

The Google-account email is used
for access administration and is
provided to Google as necessary
to configure the relevant folder
permissions.

Google may process account,
access and technical information
under its own applicable terms
and privacy policy.

Purchasers should not send us their
Google account password.

Our usual digital-pack access period
is one year from purchase unless
a different period is expressly
specified for the product.

Access information may be retained
during that period and for a reasonable
period afterwards where necessary
for support, accounting, security
or legal purposes.

Google’s privacy information is
available at:

Google Privacy Policy

11. Purchaser benefits and community activities

Some Digital Resource Packs may
include optional benefits such as
membership access, additional
educational resources or community
engagement opportunities.

The benefits available with a
particular product will be explained
in its product description.

Where a purchaser requests an
included benefit, we may use
their name, email address,
purchase details and relevant
eligibility information to
administer that benefit.

Where a benefit is delivered
through a third-party platform,
we may need to provide or confirm
the information necessary to
arrange access.

We will not disclose unnecessary
purchase or account information
to other community participants.

Where participation involves
joining a third-party community
or platform, other participants
may be able to see information
made visible through that platform,
such as a display name, profile
image, username or telephone number,
depending on the service and its
settings.

Participation in optional
community benefits is not a
condition of using the purchased
teaching materials unless
expressly stated otherwise
before purchase.

Third-party platforms have
their own privacy policies
and account settings.

12. Marketing and the SQE Newsletter

The Dr Yannis SQE Newsletter
is an optional educational
mailing list.

You may subscribe by emailing:

newsletter@glintiss.co.uk

Use “subscribe” in the subject line.

Signed-in Labs users may also
subscribe through the separate
newsletter form on the Labs
gateway where available.

For requests made through that
form, we may collect:

• The name entered;
• The signed-in email address;
• The Labs account identifier;
• The date and time of the request; and
• The subscription statement submitted.

Netlify may process form submissions
and send us notifications.

We manage the newsletter subscriber
list and distribution manually.

The newsletter may include SQE-style
questions, explanations, learning
resources and information about
relevant Dr Yannis educational
activities.

We use subscription information
to administer the list, send the
newsletter, maintain consent
records and respond to enquiries.

12.1 Purchasing does not mean subscribing

Purchasing a Super Session or
Digital Resource Pack does not,
by itself, subscribe you to
the SQE Newsletter or any
optional marketing mailing list.

Creating a Labs account does
not automatically subscribe
you either.

We may send essential service
messages concerning a purchase,
booking, access arrangement,
refund or other contractual
matter without treating those
messages as optional marketing.

We will send direct marketing
only where permitted by
applicable law, including
the Privacy and Electronic
Communications Regulations.

Where we rely on marketing
consent, it will be obtained
separately from acceptance
of purchase terms.

12.2 Unsubscribing

You can unsubscribe at any
time by emailing:

newsletter@glintiss.co.uk

Use “unsubscribe” in the subject line.

We will remove your address
from the active distribution list.

We may retain a limited
suppression record where
necessary to respect your
choice and prevent unwanted
future messages.

Unsubscribing does not cancel
an existing purchase or delete
your Labs account.

13. The SQE study app

The study planner and question-bank
functions at:

app.dryannis.co.uk

may use browser storage to
remember your answers, progress
and preferences.

This progress is kept in
your browser.

It is not saved to a personal
GlinTiss account or synchronised
across devices.

Locally stored progress may
be lost if you:

• Clear site data;
• Change browser or device;
• Use a private browsing window; or
• Disable browser storage.

This storage supports the study
functions you request and is
not used for advertising or
cross-site tracking.

Ordinary hosting and security
logs may still be created
when you visit the app.

14. Dr Yannis Labs accounts

At:

labs.dryannis.co.uk

you can use an email sign-in
link to access Labs and
its available learning resources.

Supabase provides account
authentication.

Your email address and account
identifier are used to:

• Create and maintain your account;
• Recognise you when you return;
• Provide account access; and
• Respond to account enquiries.

Sign-in links and essential account
messages are service communications.

Your browser stores the information
needed to maintain your signed-in
session.

Signing out ends that session
on the device.

Clearing site data may also end
the local session, but does not
delete your account or saved
Mistake Lab progress.

Creating a Labs account does not
subscribe you to the SQE Newsletter.

15. Mistake Lab

Mistake Lab is a beta learning
resource within Dr Yannis Labs.

For each question you attempt,
we may save:

• The question identifier;
• Your most recent selected answer;
• Your stated confidence level;
• Whether that answer was correct;
• The number of attempts;
• The time of your latest answer; and
• Whether you added the question
  to your review queue.

We use this information to
show your progress and review
queue when you return,
including on another device.

Mistake Lab keeps the latest
result and an attempt count
for each question rather than
a complete record of every
attempt.

Supabase processes this
account-linked information
on our behalf.

15.1 Learning analytics

We may use aggregated or
appropriately de-identified
information to understand
usage, question performance
and areas in which the
learning resource may
need improvement.

Where information remains
linked to an account or
could reasonably identify
a user, we treat it as
personal information.

Access to identifiable
account and learning
information is restricted
to authorised administration
and service functions.

We do not sell Mistake Lab
learning information or
use it for unrelated
third-party marketing.

Mistake Lab may link to
SRA questions and resources
on YouTube, Substack or
other websites.

Opening one of those links
may allow the destination
to process information
under its own privacy policy.

16. Website visits and technical information

Our hosting and technical
providers may process:

• IP addresses;
• Browser and device details;
• Requested pages;
• Access times;
• Referral information; and
• Security and error logs.

We use this information
to deliver our websites,
maintain security,
investigate faults,
prevent misuse and
understand service
performance.

Some pages obtain fonts
or software from external
providers, including
Google Fonts and jsDelivr.

Requesting those resources
may disclose your IP address
and technical connection
information to the provider.

17. Cookies and browser storage

Our websites may use cookies
and other browser-storage
technologies to provide
requested functionality,
maintain security and
remember preferences.

Different websites in the
Dr Yannis ecosystem may
use different technologies.

17.1 WordPress

WordPress may offer to save
your name, email address
and website in cookies
when you comment.

These cookies can last
for one year.

WordPress may use a temporary
cookie to check whether
your browser accepts cookies
when you visit a login page.

Login and display-preference
cookies may be set if
you log in to WordPress.

Editing or publishing an
article may set a short-lived
cookie identifying that article.

17.2 Labs and the study app

Labs uses browser storage
to maintain your Supabase
sign-in session.

The separate SQE study app
may use browser storage
for local study progress
and preferences.

These functions are described
in sections 13 and 14.

17.3 Cookie choices

On glintiss.co.uk,
Real Cookie Banner provides
controls for cookie preferences
and applicable consent records.

You can use the privacy controls
displayed on that website
to review or change
your settings and withdraw
applicable consent.

The cookie controls on one
website may not manage
technologies used on a
different website or
third-party platform.

Where consent is legally
required for cookies or
similar technologies,
we will obtain it before
using them.

Where a statutory exception
applies, we will provide
the required information
and any applicable means
of objecting.

18. Comments on glintiss.co.uk

If you leave a comment,
we process the information
entered in the comment form,
together with your IP address
and browser user-agent
information, to help detect
spam.

A hash derived from your
email address may be sent
to Gravatar to check whether
you use that service.

If your comment is approved,
your profile picture may
appear publicly alongside it.

Gravatar’s privacy information
is available at:

Automattic Privacy Policy

Comments may be checked
by an automated
spam-detection service.

19. Embedded content and external links

Some pages may contain
embedded content from
another website,
such as a video.

Embedded content may
behave as though you
visited the provider’s
website.

The provider may collect
technical information,
use cookies or recognise
you if you are signed
in to its service.

External links take you
to separate websites
governed by their own
privacy policies.

20. Who receives personal information

We use service providers
where necessary to operate
our educational activities.

Depending on the service,
these may include:

• Stripe for payment processing.
• Google Drive for hosting and
  controlling access to purchased
  digital resources.
• Netlify for website hosting
  and form submissions.
• Supabase for Labs authentication
  and saved learning progress.
• Email and website-hosting
  providers.
• Video-conferencing and
  recording platforms.
• Newsletter and educational
  content platforms.
• Security, backup and
  spam-detection providers.
• Professional advisers
  where necessary.
• Public authorities
  where disclosure
  is legally required.

Providers receive information
relevant to the service
they perform.

Some providers act on
our instructions, while
others may also act as
independent controllers
for particular processing
activities.

We do not sell personal
information.

21. International processing

Some service providers
may process personal
information outside
the United Kingdom.

Where a transfer is
subject to UK
data-protection restrictions,
we assess the applicable
requirements and rely
on an appropriate legal
transfer mechanism or
safeguard where required.

These may include
applicable UK adequacy
regulations or approved
contractual safeguards,
depending on the provider
and transfer.

You may request further
information about relevant
international transfers
using the privacy contact
details in section 1.

22. How long we keep information

We keep personal information
only for as long as reasonably
necessary for its purpose,
taking account of contractual,
legal, accounting, security
and dispute-resolution
requirements.

Our retention arrangements
include the following.

22.1 Labs accounts

Account information and
Mistake Lab progress are
normally retained while
the account remains active.

You may request deletion
of your account and
associated progress.

Limited information may
be retained where a continuing
legal or security reason applies.

22.2 Newsletter records

Active subscriber information
is retained while you
remain subscribed.

Limited consent and
suppression records may
be retained afterwards
where needed to demonstrate
or respect your choice.

22.3 Enquiries

Ordinary enquiries and
correspondence are retained
for as long as needed
to respond and maintain
an appropriate record.

22.4 Event applications

Information from unsuccessful
event applications is normally
deleted within 12 months
after the event unless
needed for a complaint,
dispute or legal matter.

22.5 Purchases and accounting

Booking, purchase,
transaction and accounting
records may be retained
for up to six years,
or longer where required
by applicable law or
a continuing legal matter.

This may include records
of agreed terms, applicable
discounts, order confirmations,
refunds and early digital
supply arrangements.

22.6 Digital resource access

Google Drive access
information is retained
for the agreed access
period and for a reasonable
period afterwards where
needed for support,
security, accounting
or legal purposes.

We review whether continued
access to or retention of
individual account details
remains necessary.

22.7 Event recordings

Original recordings containing
participant information are
reviewed and retained only
for as long as reasonably
necessary for editing,
quality control,
administration and
relevant legal matters.

Edited teaching recordings
may be retained while
they remain part of our
educational offering,
subject to applicable
individual rights and
legal obligations.

22.8 Comments and technical records

Comments and associated
metadata may be retained
so that follow-up comments
can be recognised
and moderated.

Security logs and backups
are retained for periods
determined by security
and operational needs.

Information may be
deleted sooner when
it is no longer needed.

23. Security

We use reasonable technical
and organisational measures
to protect personal information
against unauthorised access,
alteration, disclosure
and loss.

These may include
restricted administrative
access, account authentication,
private resource sharing
and appropriate service
provider security controls.

No online service or
ordinary email system
is completely risk-free.

Please avoid sending
unnecessary confidential
or sensitive information.

24. Your data protection rights

Depending on the circumstances,
you may have the right to:

• Access personal information
  we hold about you.
• Request correction of
  inaccurate information.
• Request deletion of
  information where the
  right to erasure applies.
• Request restriction
  of processing.
• Object to processing
  based on legitimate
  interests.
• Receive certain information
  in a portable format.
• Withdraw consent where
  we rely on consent.
• Exercise applicable rights
  concerning qualifying
  automated decision-making.

These rights are subject
to the conditions and
exemptions in applicable
data-protection law.

For example, we may need
to retain certain transaction
records even after a customer
requests deletion.

You have the right to object
at any time to the processing
of your personal information
for direct marketing.

Where you exercise that
right, we will stop
processing your personal
information for that purpose.

To exercise your rights,
contact:

ioannis.glinavos@glintiss.co.uk

We may request information
reasonably necessary to
verify your identity.

We will respond within
the applicable legal
time limit.

25. Data protection complaints

If you have a concern about how GlinTiss Ltd
uses your personal information, you can make
a data protection complaint by emailing:

ioannis.glinavos@glintiss.co.uk

You may also write to our registered office:

GlinTiss Ltd
86–90 Paul Street
London
EC2A 4NE

25.1 Acknowledging your complaint

We will acknowledge your data protection complaint
within 30 days of receiving it.

The 30-day period begins on the day after we receive
the complaint. Where the final day falls on a weekend
or public holiday, the applicable deadline is extended
to the next working day.

Our acknowledgement will confirm that we have
received your complaint and explain how we intend
to consider it.

25.2 Investigating your complaint

We will take appropriate steps to investigate
your complaint without undue delay.

The steps required will depend on the nature
and circumstances of the complaint.

Where necessary, we may ask you to provide
additional information or information reasonably
needed to verify your identity or authority to
act on another person’s behalf.

We will take reasonable steps to consider the
relevant facts fairly and accurately.

25.3 Keeping you informed

We will keep you informed of relevant progress
while your complaint is being investigated.

We will communicate the outcome of our
investigation without undue delay.

Our final response will explain the outcome
and, where appropriate, any steps taken
to address the matter.

The requirement to acknowledge a complaint
within 30 days does not mean that every
complaint must be fully resolved within
that period.

25.4 Complaining to the ICO

You also have the right to complain to the
Information Commissioner’s Office (ICO)
if you are concerned about our handling
of your personal information.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Telephone: 0303 123 1113

Website:

https://ico.org.uk/

You can find further information about
making a data protection complaint at:

How to make a data protection complaint

26. Changes to this Privacy Policy

We may update this Privacy
Policy as our educational
services, technology or
legal obligations change.

The current version
will be published
on this page with
its revision date.

Where appropriate,
we will communicate
significant changes
directly to affected
individuals.

We will not use an
updated Privacy Policy
as a substitute for
obtaining consent or
establishing another
lawful basis where
one is required.

GlinTiss Ltd
Company number: 14895106
86–90 Paul Street
London EC2A 4NE

Last updated:
23 September 2026