What Solar School collects, why, and how to have it erased.
Last updated 13 August 2026
Solar School is a free, openly licensed course. You can read every module, take every knowledge check and sit the final assessment without giving us anything about yourself. One thing on this site collects personal data, and only if you ask for it: the certificate.
Solar School is run by Chris Lloyd, who is the data controller for the purposes of the UK GDPR. Contact details are at the foot of this page.
Nothing you do in the modules reaches us. Your progress — which lessons you have finished, which quizzes you have passed — is stored by your own browser in local storage and never leaves the device. Clearing your browser data clears it, and we cannot see it, restore it or link it to you.
There are no analytics, no advertising, and no tracking cookies anywhere on this site.
Sitting the assessment does not require an account and does not identify you. While a paper is open, we hold a record of which questions were served and what was answered, so the paper can be marked and cannot be submitted twice. That record is not linked to your name unless you go on to claim a certificate, and it is deleted after 30 days.
If you pass and choose to claim a certificate, we store what is needed to issue it and to let anyone check it later.
| What | Why |
|---|---|
| The name you give | It appears on the certificate and on its public verification page. It can be any name you want on it. |
| Your email address | To find your record if you ask us to erase it, and to tell you if a certificate ever has to be withdrawn. It is never shown publicly, and nothing else is sent to it unless you tick the optional box described below. |
| Your score, the date, and the course version | So the certificate says what was actually achieved, and against which version of the material. |
| Whether you opted in to hearing from us, and when | Only if you tick the box. See below. |
The verification page shows your name, the issue date and the course version. Nothing else. Your email address and your score are never published.
Our lawful basis is contract: you have asked us to issue and maintain a certificate, and we cannot do that without holding these details.
The certificate form offers a tick box for occasional email about solar and battery storage. It is entirely optional, it is never ticked for you, and whether you tick it makes no difference to your certificate.
If you do tick it, our lawful basis is your consent, and we record the moment you gave it so we can show it was freely given. We send a few messages a year at most — new modules, and developments in solar and storage worth knowing about. We never pass your address to anyone else.
Every message carries an unsubscribe link, and you can email us at any time to be taken off the list. Withdrawing consent is as easy as giving it, takes effect immediately, and leaves your certificate untouched.
| Record | Kept for |
|---|---|
| Certificates | Indefinitely, unless you ask us to erase yours |
| Assessment sessions | 30 days |
| Rate-limiting records | 7 days |
Certificates are kept indefinitely on purpose. A credential that stops verifying after a few years is not worth much to the person holding it, so the register is meant to outlast any particular version of this website.
To stop the assessment being automated or the answers being extracted by brute force, we count requests per visitor. We do not store your IP address to do it: the address is put through a one-way cryptographic hash with a secret salt, and only that hash is kept, for seven days. We cannot recover an address from it.
Nobody. We do not sell, share or transfer your data, and there are no third-party analytics or marketing tools on this site.
Two technical points, for completeness. This site is hosted by Krystal Hosting in the United Kingdom, who process data on our behalf as our hosting provider. And some pages load web fonts, and offer an optional translation widget, from Google — using those features means your browser contacts Google directly, under Google's own privacy policy. The translation widget only runs if you choose a language.
You can ask us to give you a copy of what we hold, correct it, or erase it. Email us and we will act within one month, usually much sooner.
Erasure works a little differently here, and it is worth understanding before you ask. We do not delete the row outright — we blank your name and email address and mark the certificate withdrawn. Its verification page then reads no longer valid rather than no such certificate. This is deliberate: it means a genuine certificate that has been erased stays distinguishable from an invented number, which protects everyone who still holds a valid one. If you would rather the record disappeared entirely, say so and we will remove it.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
If this notice changes materially, the date at the top changes with it. We will not start collecting anything new without saying so here first.