Privacy Notice
This notice explains how we collect, use, share and protect your personal data when you visit our website, buy a course or train with us. It applies to learners, buyers, marketing contacts and website visitors, and sets out the rights you have over your information.
Who we are
This website is operated by MBM Ventures LLC trading as Online CPD Academy ("we", "us", "our"). Fire Marshal Training is one of our trading names. We are the controller responsible for the personal data described in this notice.
If you have any questions about this notice, wish to exercise your rights or want to make a data request, you can contact us at info@onlinecpdacademy.co.uk.
Our services are intended for adults and for use by organisations. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided us with their data, please contact us so that we can remove it.
What personal data we collect
The personal data we collect depends on how you interact with us:
- Learners — your name, email address, password, IP address, course progress, postal address, an optional phone number and, where required for an accredited qualification, any identity verification documents you provide.
- Buyers — your name, email address, phone number and payment information. Card payments are processed securely by our payment processor, Stripe; we do not store full card details on our systems.
- Marketing contacts — your name and email address, where you have asked to hear from us or otherwise consented to receive marketing.
- Website visitors — cookies and similar technologies, which collect limited information about how you use our website. See our Cookie Policy for details.
How we use your data
We use your personal data to:
- deliver your courses and manage your account and learning record;
- issue and verify your certificates;
- process your payments and provide receipts and documentation;
- provide customer support and respond to your enquiries; and
- where you have consented, send you marketing about our courses and related services.
Lawful bases for processing
We only process your personal data where the law allows us to. The lawful bases we rely on are:
- Contract — to provide the course or service you have purchased and to fulfil our obligations to you.
- Legitimate interests — to run, improve and secure our business, provided your rights do not override those interests.
- Legal obligation — to comply with our accounting, tax and other legal and regulatory duties.
- Consent — where you have given us permission, for example to send you marketing communications. You can withdraw your consent at any time.
Use of AI
We do not use your personal data to train artificial intelligence models. Where we use any automated tools to support our service, your personal data is not used to develop or train such models.
Data security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration. These include access controls, encryption of payment data in transit through our payment processor, secure hosting and restricting access to your data to those who need it to do their job. While no online service can be guaranteed to be completely secure, we work to keep our safeguards under review.
Who we share your data with
We share your personal data only where it is necessary to provide our services or where we are required to do so. This may include:
- contracted service providers who help us run our business and deliver our courses;
- our payment processor, Stripe, to take and process payments;
- accreditation bodies (for example CPD) where needed to certify your training;
- IT and hosting providers who support our systems; and
- legal, regulatory and law enforcement bodies where we are required to disclose information.
We do not sell your personal data. Tracking technologies used on our website may include the Meta Pixel and the LinkedIn Insight Tag, which help us measure and improve our advertising. You can control these through our Cookie Policy.
Data retention
We keep your personal data only for as long as we need it:
- Learner records — retained for up to 20 years, so that certificates can be verified long after a course is completed.
- Marketing data — retained until you unsubscribe or ask us to stop contacting you.
- Call recordings — retained for up to 12 months.
- Backups — retained for up to 4 years as part of our routine system backups.
Your rights
Under data protection law you have the right to:
- access the personal data we hold about you;
- rectification of inaccurate or incomplete data;
- erasure of your data in certain circumstances;
- restriction of how we process your data;
- portability, to receive your data in a usable format; and
- objection to certain types of processing, including direct marketing.
To exercise any of these rights, contact us at info@onlinecpdacademy.co.uk. We will respond to a subject access request within one month, although this may be extended by up to a further two months (three months in total) where a request is particularly complex or you have made a number of requests.
If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would ask that you contact us first so that we have the opportunity to put things right.
Updates to this notice
We may update this notice from time to time to reflect changes in our practices or legal requirements. Any changes will be published on this page, so please check back periodically for the latest version.