Training Centre Privacy Policy

1. Who is responsible

This notice covers the DPS Training Centre: browsing and buying paid courses, learner access, assessments, downloads, reporting, staff learning and training supplied to Enhanced and Premium DPO clients. Data Privacy Services is the trading name of Data Privacy and Data Security Services Limited, company number HE 432380, registered at Griva Digeni 51, Athineon Court, Office 202, 8047 Paphos, Cyprus. Contact info@dataprivacyservices.co.uk.

DPS is the controller for its own customer relationship, booking administration, billing, security, support and staff-training administration. For learning records handled on an employer or client organisation’s documented instructions, that organisation is normally the controller and DPS acts as processor under the relevant processing agreement. The organisation’s privacy notice explains its purposes and legal grounds. A standalone individual purchaser’s own learning administration is managed by DPS as controller.

2. Information and sources

We process names, work email addresses, organisation and optional department; booking contact details, selected course and version, quantity, amount, payment method, reference and payment status; licence allocation and expiry; email verification and session records; lessons completed, submitted assessment responses, attempts, results, completion and refresher dates, and certificate identifiers. We also process necessary technical, delivery, activity and security records and information you send to support.

Information comes from you, the purchaser, your employer or client administrator, authorised DPS staff, the sign-in provider and payment confirmations. A purchaser can supply your name and email before you first use the Training Centre. Verification and invitation messages identify the relevant training or booking context. Do not provide special-category information, criminal records or unrelated confidential material in ordinary booking fields or course activities.

Revolut processes checkout information under its own privacy notice. DPS records payment references and settlement information needed to manage the booking; the Training Centre does not collect or store full card numbers or card security codes.

3. Purposes and legal grounds

We use booking and contact information to administer purchases, match cleared funds, allocate the correct number of places, issue access messages and answer enquiries. When you are personally the contracting purchaser, necessary processing is based on that contract. When acting for a business purchaser, our legitimate interests are administering the business relationship and delivering the training it ordered.

We use learner information to provide verified access, save learning, mark assessments, issue certificates and provide the agreed reports. For employer-controlled learning, DPS follows documented instructions and the employer determines its legal basis. For DPS-controlled learning and staff administration, we rely on the relevant contract or our legitimate interests in providing learning and keeping proportionate evidence of completion.

Security, misuse prevention, error investigation and essential audit records support our legitimate interests in protecting the service and its users. Billing, tax and other records may be used to meet applicable legal obligations. We retain information needed to establish, exercise or defend legal claims where justified. Optional marketing or other processing requiring consent needs a separate choice; accepting training terms is not consent to marketing.

4. Who can see learning information

Learners can access their own learning and available downloads. Authorised DPS staff can administer bookings, allocate places, provide support and manage records. An employer’s authorised training managers may see identity, assigned training, progress and permitted assessment or completion information under the agreed service.

For multiple-user paid purchases, the holder of the private booking link can view the named learners, progress, completion, refresher dates and access expiry for that purchase and download a CSV report. This buyer report does not include individual assessment answers or scores. Single-user purchases do not provide that manager report. Protect the link and exported files: forwarding the private link can give the recipient booking-management access.

We use service providers necessary for delivery, including Hostinger for hosting and storage, Microsoft for configured identity and email services, and Revolut for payments. Advisers, insurers, public authorities or other recipients may receive information where necessary and lawful. We do not sell learner records.

5. AI and assessment

Some course narration and illustrations are generated using AI from course scripts. This does not require sending learner assessment answers to a narration service. Final assessments are marked against the course answer rules; a result is a training outcome, not an employment, regulatory or professional-licensing decision.

If you choose an enabled AI-assisted help feature, your message and relevant conversation context may be sent to the configured OpenAI service. Do not include unnecessary personal or confidential information. AI guidance requires human judgement. The Training Centre does not itself make decisions with legal or similarly significant effects about individuals.

6. Cookies, sessions and browser storage

Essential cookies and session mechanisms keep sign-in and learner access secure. Learner sessions currently last up to eight hours; email-verification links are single-use and expire after fifteen minutes. Staff Microsoft sign-in uses its own authentication cookies and account-session rules. Signing out or expiry may require a fresh verification link.

Browser storage may save course position, draft answers, preview preferences or the private booking token so you can return. Use a private device and sign out on shared computers. These mechanisms support the requested service; blocking them can prevent it working. This notice does not authorise optional advertising or analytics storage: any such use requiring consent must offer a separate choice.

7. Retention

A licence expiry is an access limit, not an automatic deletion date. Paid awareness learning lasts twelve months from purchase; paid DPO learning lasts up to 180 days from payment confirmation and ends earlier on passing. Completion notes and certificates can remain available afterwards while the relevant record is retained.

For organisation-controlled learning, retention follows the client’s instructions and configured retention period. The current client setting defaults to 730 days since the record was last updated unless a different period is agreed and configured. Contact your organisation or DPS for the period applying to you; deletion and backup expiry also depend on the agreed operational arrangements.

For DPS-controlled paid bookings and learner records, the retention criteria are providing the agreed access and download library, evidencing the purchase and completion, resolving queries or disputes, protecting security, and meeting applicable accounting or legal duties. Information no longer needed for those purposes should be erased or anonymised. Contact DPS to request deletion or the applicable retention information. We do not promise that signing out, passing or reaching licence expiry immediately removes a record or a backup.

8. International processing and protection

DPS is established in Cyprus. Hosting, email, payment and optional AI suppliers may process data or provide support from other countries, including outside the UK or EEA. Where a restricted transfer occurs, the relevant controller must use an applicable adequacy decision or appropriate safeguards, such as approved contractual clauses, together with any required assessment. Ask DPS for applicable destinations, safeguards or a copy of the relevant safeguards, subject to necessary redactions.

The Training Centre uses HTTPS, email verification or authenticated staff sign-in, permissions, time-limited session tokens and audit records. No online service can guarantee absolute security. Keep private links confidential, use your own learner identity and report suspected unauthorised access promptly.

9. Your choices, rights and complaints

You normally need to provide the requested name and email for a named licence and verification. Booking information is needed to administer payment and the correct package. If necessary information is withheld, we may be unable to issue access, allocate a place or provide a certificate.

Depending on the processing and applicable law, you can ask for access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw any consent without affecting earlier lawful processing. Contact info@dataprivacyservices.co.uk. We may need proportionate identity checks. For employer-controlled records, contact your employer; DPS will assist or direct the request appropriately.

You can complain to DPS, the UK Information Commissioner’s Office at ico.org.uk, the Cyprus Commissioner for Personal Data Protection at dataprotection.gov.cy, or the competent authority where you live or work. You do not have to complain to DPS first. The applicable authority and rights depend on the processing and your circumstances.

10. Changes and contact

The version and date above identify this notice. We will communicate material changes through the Training Centre or appropriate service communications. This notice supplements the client’s own privacy notice and processing agreement where relevant. Questions about your training data can be sent to info@dataprivacyservices.co.uk.