Privacy policy

This policy describes how Corporate Business Alliance Ltd (“CBA”, “we”) handles personal data. We are the data controller for everything described here.

The short version

• We collect what you type into a form, what you do inside your account, and what an examination records about your sitting.
• We run no advertising trackers, no analytics cookies and no third-party pixels. Loading a page tells nobody but us that you were here.
• Your database record lives in Frankfurt. Two suppliers — for email and for file storage — process some of it outside the EEA under the safeguards set out below. Card payment is taken on the payment provider’s own page, never on ours, and we never see your card.
• The public register shows your name, your credential and its dates. It never shows your email address or your score.
• We never sell or rent your personal data, and we share it with an Approved Learning Partner only if you came to us through one.

What we collect, and when

When you browse

Nothing that identifies you. There are no analytics cookies and no third-party requests: fonts, icons and images are served from our own domain, so viewing a page does not disclose your IP address to anyone else. Our hosting provider keeps short-lived server logs containing IP addresses, as every web host does, for security and fault diagnosis.

If you add something to your cart, what you chose is kept in your own browser, not on our servers, until you place an order. The cookie policy says exactly what is stored and how to clear it.

When you contact us

Your name, email address, and — if you give them — your country, the programme you are interested in, and your message. If you tick the optional marketing box we also record that you ticked it, when, on which page, and the exact wording you agreed to, so that we can show what you consented to rather than merely assert it.

When you apply as a training provider or partner

Your name, job title, work email, phone number, organisation name, country, website, organisation type, approximate learner volume, the programmes you are interested in, and your message.

When you buy something

At the checkout we ask for your full name, your email address and your country, and, if you want it on the invoice, your organisation. We record these with your order, together with its reference, each item you ordered and the price charged for it, whether member prices applied, the total and its currency, and the date and time you accepted the terms of enrolment and the refund policy. We email you a confirmation of the order, and our staff are notified of it so that it can be fulfilled.

You then pay in one of two ways. Where card payment can be taken at the checkout, you go on to Paddle, who are the merchant of record — the seller on your statement and on your receipt. They take the card details, run the fraud checks and handle the tax; we receive your email address, your name, the order reference and the fact that a payment succeeded. Their own privacy notice governs what they do with your payment details, and it is separate from this one. Otherwise, a member of our staff emails you an invoice for the order, to the address you gave, with a secure link to pay by card, within one working day; we record on the order when the invoice was sent and when payment was received.

We never see your card. Card details are entered on the payment provider’s own page, never on this site, and are not passed to us.

Where what you ordered is used through an account — study material or membership — we create a candidate account for you once the order is paid, if you do not already have one, and email you a link to set a password. An examination voucher is emailed to you.

When you become a member

Membership is bought at the checkout like anything else here, so we collect what is described under “When you buy something”. On your account we also record that you are a member, the date your membership began, the date it runs to, and the order that last paid for it. If you do not already have an account, we create one and email you a link to set its password.

When you hold an account

Your email address, your name, your country if you gave it, your role on the system, the fields you follow, your marketing preference, the date your email address was first confirmed, and a cryptographic hash of your password. We never store the password itself and cannot tell you what it is. We also keep a list of your active sign-in sessions, so that signing out actually ends them.

Your email address counts as confirmed the first time you use an emailed link to set your password, because that is what shows the address belongs to you. We send marketing only to a confirmed address, and only if you asked for it.

When you study

Which lessons you have opened and completed, your attempts at each assessed workbook, the score of each attempt, whether you passed it, and whether you revealed a worked solution before passing. The last of these matters at Practitioner level, where the workbook is part of the assessment rather than a study aid.

When you sit an examination

Your name and email address as given at the sitting; which questions you were served and in what order; the answer you selected for each; when you started, when you submitted, and when the attempt was due to end; your score; the pass mark in force on that day; and your performance in each domain of the blueprint.

This is kept in full for ten years, because an appeal, a re-mark or the withdrawal of a defective question can require the paper you sat and the answers you gave.

When you are awarded a credential

Your name, the programme, the version of the scheme you were assessed against, the issue and expiry dates, the status, and — held privately, never published — a score band and the voucher or partner the award came through.

When you claim professional experience

For the Professional level only: your current role, your organisation, the years you are claiming, whether you hold a relevant degree, your own account of the work, your signed undertaking to the Code of Professional Conduct, and your referee’s name, role, organisation, email address and relationship to you.

If you have been named as somebody’s referee

We hold your name, your role, your organisation, your email address, how the candidate says you know their work, and your answer when you give it. You did not give us any of this — the candidate did, and you are entitled to know that, which is why the email you receive says so and why this paragraph exists.

We use it for one thing: asking you to confirm a claim, once. We do not add you to any list, we do not contact you about anything else, and if you tell us you are not the right person we will not write to you again. Your answer is kept on the candidate’s assessment file, is read by our assessment staff, and is never published or shown to an employer. Every right in the Your rights section below is yours as much as the candidate’s, including the right to have your details erased — write to us and we will do it.

If you ask for a reasonable adjustment

Evidence supporting a request for an adjustment usually concerns your health, and health data is a special category under UK GDPR. It gets its own section below.

If you give us a quotation

We publish a testimonial only where the person named has agreed to it, and we record who agreed, when, and what they were shown. Something said to us in an email is not used as a quotation without that agreement.

Why we are allowed to hold it

Under UK GDPR we must have a lawful basis for each purpose. Ours are:

• Performance of a contract — running your account and your membership, giving you the materials you bought, delivering and marking your examination, issuing and verifying your credential, and handling refunds. Without this data we cannot do the thing you paid for.
• Legitimate interests — replying to an enquiry, assessing a partner application, contacting a referee, keeping assessment records that make appeals and malpractice investigations possible, and protecting the integrity of the examination. We have weighed these interests against your privacy and consider the processing proportionate, and you may object at any time.
• Consent — marketing email, publishing a testimonial, and holding medical evidence for an adjustment. Each is separate, unticked by default, and withdrawable without consequence to anything else.
• Legal obligation — tax and accounting records relating to a purchase.

Asking to hear about a programme is not consent to a newsletter. If you asked to hear about one programme, that is the only thing we will email you about.

Special category data

The only special category data we hold is health information, and only where you have sent it to support a request for a reasonable adjustment. We ask for your explicit consent before holding it.

It is treated differently from everything else on this site:

• It is read only by the people deciding the request.
• It is held apart from your examination record, and is not visible to anyone assembling papers, reviewing questions or verifying a credential.
• It is never given to an employer, a referee, or anyone verifying your credential.
• It is deleted twelve months after the last sitting at which the adjustment was applied. What survives is the fact that an adjustment was agreed and what it was, so you never have to make the case twice.

You can withdraw that consent at any time. An adjustment that depends on the evidence cannot continue without it, and we will tell you so before anything is deleted.

Decisions made by machine

Your examination is marked automatically. The score is computed against a stored answer key with no person involved, and it decides whether you are awarded a credential. That is a decision by solely automated means with a significant effect on you, and UK GDPR gives you specific protection against it.

So:

• You may ask for the result to be reviewed by a person. The appeals procedure sets out the grounds and the thirty-day window, and a named member of staff decides it.
• The blueprint the paper was assembled from is published for every programme, and your domain-by-domain performance is shown to you, so you can see what the decision was based on.
• Where an appeal establishes that a question was defective, every candidate that question affected is re-marked without it, not only the person who complained.

No other decision here is automated. Experience verification, reasonable adjustments, malpractice findings and partner applications are all decided by a named human being.

Who else sees it

Our database and application servers are in Frankfurt, Germany, which is in the European Economic Area. Our processors are:

• Supabase — the database, holding everything described above. Frankfurt, EU.
• Vercel — application hosting. Our server functions run in Frankfurt. Static pages are cached worldwide, and contain no personal data.
• Vercel Blob — storage for uploaded files such as images. Hosted in the United States.
• Resend — sending transactional email: your password link, your voucher, the request to your referee. They process the recipient address and the message. United States.
• Paddle — payment, as merchant of record. Paddle.com Market Ltd is a UK company and is a controller in its own right for the payment, not merely our processor.

Each of them is under a contract that binds them to process data only on our instructions and to keep it secure. None of them may use it for their own purposes, and we do not sell or rent personal data to anyone, ever.

If you came to us through an Approved Learning Partner, that partner can see that you hold a voucher they bought and whether you have used it. They cannot see your examination record or your answers.

Data that leaves the UK and EEA

Resend and Vercel Blob process data in the United States. Those transfers are made under the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, which is the mechanism UK law provides for exactly this. The data involved is limited: an email address and message content in Resend’s case, uploaded files in Blob’s. Your examination record and your credential history never leave Frankfurt.

The public credential register

Every credential we award has a public verification page showing the holder’s name, the programme, the level, the scheme version, the issue and expiry dates and the current status. This is the entire point of a certification register: an employer must be able to confirm that a certificate on a CV is real.

That page shows nothing else. Not your email address, not your score, not your score band, not any internal note. There is no way to browse or search the register: it answers a credential ID you already hold, and nothing else, so it cannot be used as a directory of certified people.

You are told this before you enrol, and it is a condition of holding the credential.

How long we keep it

• Enquiries, including a request to hear about a programme — two years from your last contact with us.
• Unsuccessful partner applications — two years from the decision.
• Account and enrolment records — while your account is open, and two years after you close it.
• Study and workbook records — with the enrolment they belong to.
• Examination records — ten years from the sitting. See above: an appeal or a re-mark years later needs the paper you sat. The candidate records policy gives the reasoning for that period in full.
• Credential records — permanently. A register that forgets past awards cannot do its job, and a withdrawn credential must stay visible as withdrawn.
• Experience declarations and referee responses — with the credential they support.
• Medical evidence for an adjustment — twelve months after the last sitting it applied to.
• Payment and tax records — six years, as UK law requires.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete it;
• restrict what we do with it;
• send it to you or to somebody else in a portable form;
• stop processing it where we rely on legitimate interests;
• stop sending you marketing, which you can do at any time and which we will act on immediately.

We answer within one month, and we do not charge for it.

The limits. We cannot delete a credential record on request, because that would let somebody erase the evidence that a credential was withdrawn. We cannot delete an examination record while an appeal or a malpractice investigation is live. Where a limit applies to you we will say which one and why, rather than refusing without explanation.

Everything else is yours to take back. If you want your account and everything in it gone, and you hold no credential, we will do exactly that.

Keeping it safe

Passwords are hashed, never stored. Sign-in locks for ten minutes after eight failed attempts, on the candidate side as well as the staff side. Everything travels over TLS. Access to the administration system is limited to named staff accounts, and the credential register — the one public surface — returns a fixed set of fields and no more, whatever is asked of it.

If a breach ever occurs that risks your rights, we will tell the Information Commissioner’s Office within 72 hours and tell you without undue delay.

Cookies

We set no tracking cookies of any kind. The full list of what we do set or store in your browser, and why, is on the cookies page.

Complaints

Tell us first: contact us and we will look into it. If you are not satisfied with our answer you have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113. Complaining to them costs nothing.

Contact

Questions about this policy, or to exercise any right above: write to support@cba-uk.com or get in touch. The data controller is Corporate Business Alliance Ltd. Registered office: 167–169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom.