Privacy Policy

Who we are

This website is operated by MBM Ventures LLC trading as Online CPD Academy ("we", "us", "our"). We are the controller responsible for the personal data described in this notice. We act as a data controller when we handle the personal data of individual customers and learners, and as a data processor where corporate clients provide us with learner information.

If you have any questions about this notice, wish to exercise your rights or want to make a data request, you can contact us at info@onlinecpdacademy.co.uk.

Our services are intended for adults and for use by organisations. We do not knowingly collect personal data from children under the age of 16, nor do we process special category data unless identity verification is required. If you believe a child has provided us with their data, please contact us so that we can remove it.

What this notice covers

This notice explains how we collect and use your personal data when you:

• visit our website;
• purchase or access online training;
• contact us via phone, email or social media;
• subscribe to marketing communications; and
• provide information during course enrolment or certification.

Our website may contain links to third-party sites. Please consult their privacy policies, as we are not responsible for how they handle your data.

What personal data we collect

The personal data we collect depends on how you interact with us:

• Learners — your name, email address, password, IP address, course progress, postal address (for certificate delivery), an optional phone number and, where required for an accredited qualification, any identity verification documents you provide.
• Buyers and administrators — your name, email address, phone number and order and payment information. Card payments are processed securely by our payment processor, Stripe; we do not store full card details on our systems.
• Marketing contacts — your name and email address, where you have asked to hear from us or otherwise consented to receive marketing.
• Competition entrants — additional data such as a postal address or ID may be collected for prize fulfilment.
• Website visitors — cookies and similar technologies, which collect limited information about how you use our website. See our Cookie Policy for details.
• Social media users — your username and any content you share with us for service-related interactions.

How we use your data

We use your personal data to:

• deliver your courses and manage your account and learning record;
• issue and verify your certificates;
• process your payments and provide receipts and documentation;
• provide customer support and respond to your enquiries; and
• where you have consented, send you marketing about our courses and related services.

Lawful bases for processing

We only process your personal data where the law allows us to. The lawful bases we rely on are:

• Contract — to provide the course or service you have purchased and to fulfil our obligations to you.
• Legitimate interests — to run, improve and secure our business, gather feedback and send course reminders, provided your rights do not override those interests.
• Legal obligation — to comply with our accounting, tax, invoicing and other legal and regulatory duties.
• Consent — where you have given us permission, for example to send you marketing communications, newsletters, promotions or to enter competitions. You can withdraw your consent at any time.

Use of AI

We do not use your personal data to train artificial intelligence models. Where we use automated tools to support our service, your personal data is not used to develop or train such models.

Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration. These include password-protected accounts with minimum complexity standards, encrypted data transfers (SSL/TLS), role-based access to internal systems, secure storage and destruction of paper records, firewall and malware protection, ongoing staff training on data protection, and encrypted offsite backups with disaster recovery in place. While no online service can be guaranteed to be completely secure, we keep our safeguards under review.

Who we share your data with

We share your personal data only where it is necessary to provide our services or where we are required to do so. This may include:

• contracted service providers who help us run our business and deliver our courses, such as email platforms and learning platform providers;
• our payment processor, Stripe, to take and process payments;
• accreditation bodies (for example RoSPA) where needed to certify and validate your training;
• IT and hosting providers who support our systems; and
• legal, regulatory and law enforcement bodies where we are required to disclose information.

We do not sell your personal data. We use Google Analytics and Cloudflare Web Analytics to understand visits, course interest and website performance. Google Analytics identifiers may be passed to our payment website to measure checkout activity. Our Cookie Policy describes these tools and the available browser controls. Where personal data is transferred internationally, applicable data-protection safeguards are required.

Social media interactions

When you contact us through social media, the platform processes information under its own privacy policy. We may use the details you send to respond and manage your enquiry; do not post sensitive account or payment information publicly.

Data retention

We keep your personal data only for as long as we need it:

• Learner records — retained for up to 20 years, so that certificates can be verified long after a course is completed.
• Marketing data — retained until you unsubscribe or ask us to stop contacting you.
• Call recordings — retained for up to 12 months.
• Backups — retained for up to 4 years as part of our routine system backups.

Your rights

Under data protection law you have the right to:

• be informed about how your data is used;
• access the personal data we hold about you;
• rectification of inaccurate or incomplete data;
• erasure of your data in certain circumstances (the "right to be forgotten");
• restriction of how we process your data;
• portability, to receive your data in a usable format; and
• objection to certain types of processing, including direct marketing.

To exercise any of these rights, contact us at info@onlinecpdacademy.co.uk. We will respond to a subject access request within one month, although this may be extended by up to a further two months (three months in total) where a request is particularly complex or you have made a number of requests.

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would ask that you contact us first so that we have the opportunity to put things right.

Contact details

Data Protection Lead
MBM Ventures LLC trading as Online CPD Academy
Email: info@onlinecpdacademy.co.uk
Phone: 0800 852 7229

Updates to this notice

We may update this notice to reflect changes in our practices or legal requirements. Changes will be published on this page. This notice was reviewed on 15 October 2026.