Privacy policy

1. Who we are and what we collect

CPD Qualifications™ is the data controller for the personal data described in this policy. Our address is 4th Floor, Silverstream House, 45 Fitzroy Street, London, W1T 6EB. Our company and ICO registration details will be added when confirmed.

Website enquiries may include your name, contact details, organisation, optional organisation website and country, and message. Technical information may include your IP address, browser, device and the pages visited.

Course applications can include learning materials, delivery information, trainer details and supporting evidence. Provider applications can include organisation details, responsible contacts, policies and certificate records. Assessor applications can include identity information, education, qualifications and professional history.

A public assessor profile is separate from the private verification evidence. If an assessor is approved and agrees to publication, the profile may show agreed details such as their name, photograph, education, qualifications, professional biography, approved scope and unique assessor number.

2. How we use personal data

We use personal data to respond to enquiries, assess applications, verify evidence, administer approvals, maintain reliable records and meet legal or compliance duties. Course, provider and assessor decisions involve human review.

We use a limited internal score to help staff prioritise website enquiries for review. It considers non-sensitive information supplied in the enquiry, such as the selected service, organisation information and whether the message concerns relevant training or accreditation needs. The score does not establish that an organisation is genuine, does not automatically qualify or reject an enquiry and is not used to make a solely automated approval decision.

We do not use personal data for solely automated decisions that produce legal or similarly significant effects. If a processing purpose or legal basis changes materially, this notice will be updated before the new use begins where required.

3. Sharing and international transfers

We do not sell personal data. Private course files, provider evidence, assessor certificates, identity documents, internal correspondence and contact details are not published or shared with competitors or unrelated organisations.

Information may be handled by service providers that support website hosting, email, secure storage or identity checks. Website enquiries are submitted directly to our private staff dashboard. Service providers may use information only to provide the relevant service under appropriate contractual and confidentiality controls.

We may disclose limited information when the law requires it, or to regulators, public bodies and professional advisers where this is necessary and subject to suitable confidentiality obligations.

If a service provider stores or accesses personal data outside the United Kingdom, we will use the transfer safeguards required by UK data protection law. The relevant processor and safeguard details will be added to this policy when those arrangements are confirmed.

4. How long information is kept and protected

We keep information only for as long as it supports the approval, verification, enquiry or legal purpose for which it was collected. Licence expiry and deletion of supporting evidence are separate events.

Access to application and verification evidence is limited to people who need it for assessment and administration. Information should be submitted through the method requested by the assessment office, and applicants should remove unrelated learner or third-party details before sending files.

More practical detail about assessor verification, public profiles and provider records is available on the Data Protection page.

5. Your data protection rights

Depending on the circumstances and the legal basis used, you may ask to access your personal data, correct inaccurate information, request deletion, restrict processing, object to processing or receive portable data.

You can withdraw consent at any time where processing relies on consent. An assessor can ask for a public profile to be removed without automatically withdrawing the underlying assessor approval. Some application or decision records may still need to be retained for contractual, legal or legitimate record-keeping purposes.

Send a request to Show email ↗ with your name, the relevant application or approval reference if known, and a clear description of the information or action requested. We may need to verify your identity before releasing or changing a protected record.

6. Cookies and children's information

The website uses essential cookies to operate securely. With your permission, we also use Meta Pixel and Meta Conversions API to understand whether visits and completed enquiries resulted from advertising on Facebook or Instagram. Meta may receive technical information such as the page visited, browser details, cookie identifiers, selected enquiry type, a non-sensitive lead score and the fact that an enquiry was completed or later qualified by our team. We do not send your name, telephone number, organisation, organisation website, country or enquiry message to Meta. Where marketing consent has been given, the email address may be normalised and converted into a one-way SHA-256 hash on our server before it is sent for matching; the plain email address is not included in the Meta request.

Marketing cookies and Meta Pixel are not loaded until you choose “Accept all” or enable marketing in “Customise preferences”. You can choose “Reject non-essential” and can change or withdraw your choice at any time through the Cookie settings control in the website footer. Withdrawing consent stops future Meta browser and server events linked to that consent choice. It does not affect processing that was lawful before withdrawal. See our Cookie policy for cookie names, purposes and retention periods. Meta may process information outside the United Kingdom under its applicable data-transfer safeguards. More information is available in Meta's privacy policy.

Our services are intended for organisations and adults applying for professional accreditation. They are not directed at children, and we do not knowingly collect personal data from anyone under 18 through the website.

7. Changes to this policy and how to contact us

We may update this policy when our services, systems or legal duties change. The update date at the top of the page shows the latest revision. Where a change materially affects registered providers or assessors, we will take reasonable steps to explain it.

Contact the assessment office if you have a question about this policy or the way your information is handled.

You can also raise a concern with the Information Commissioner's Office if you believe your personal data has been mishandled.