Privacy Policy

This Privacy Policy explains how CPDs.Academy collects, uses and protects your personal data when you visit cpds.academy, create an account, purchase or attend our courses and seminars, or contact us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the applicable laws of the Republic of Cyprus.

1. Who we are

CPDs.Academy is operated by Iverance Ltd, a company registered in the Republic of Cyprus under registration number HE 451648, which acts as the data controller for the personal data described in this policy.

The contact details are as follows:

  • Business address: 42-44 Griva Digeni Avenue, Second Floor, 1096 Nicosia, Cyprus
  • Email: [email protected]

2. The personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

  • Account details: your name, email address and password when you register on the platform.
  • Purchase and invoicing details: the courses or bundles you purchase, billing name and address, company name and VAT number where an invoice is issued to your employer, and transaction records. Card payments are handled by our payment provider and we do not store your full card details.
  • Learning records: course enrolments, progress, assessment results, CPD hours completed and certificates of completion issued.
  • Communications: messages you send us by email, through the website or on LinkedIn, and any information you choose to share in them, such as the CySEC certificate you hold.
  • Corporate bookings: where an employer books training for its staff, the names, email addresses and selected courses of the participants provided by the employer.
  • Website usage data: information about how you use the website, such as pages visited, clicks, scrolling, referring website, device type, browser and approximate location, collected through cookies and similar technologies as described in section 6.

3. How we use your personal data and on what legal basis

We use your personal data only for the purposes below, each of which is supported by a legal basis under the GDPR:

  • To provide our courses and services, including creating your account, giving you access to the courses you purchase, tracking your progress and issuing certificates of completion. Legal basis: performance of a contract with you.
  • To process payments and issue invoices, and to keep accounting and tax records. Legal basis: performance of a contract and compliance with our legal obligations.
  • To deliver training booked by your employer, including setting up accounts and sharing completion records with the employer who booked and paid for the training. Legal basis: our legitimate interest in performing our agreement with your employer.
  • To respond to your enquiries and provide support. Legal basis: our legitimate interest in responding to you, or steps taken at your request before entering into a contract.
  • To send you information about our courses and offers where you have agreed to receive it or where you are an existing customer and the information relates to similar services. You can unsubscribe at any time. Legal basis: your consent or our legitimate interest in direct marketing to existing customers.
  • To understand and improve how the website is used through analytics and session recording tools. Legal basis: your consent, given through our cookie banner.
  • To protect our website and platform against fraud, misuse and security threats. Legal basis: our legitimate interest in keeping our services secure.

4. Who we share your personal data with

We do not sell your personal data. We share it only with the following categories of recipients, and only as far as necessary:

  • Our learning platform provider, uTeach, which hosts the website, your account and our courses on our behalf.
  • Payment providers, which process your card payments securely.
  • Analytics providers, Google (Google Analytics and Google Tag Manager) and Microsoft (Microsoft Clarity),which help us understand how the website is used.
  • Trainers and partners who deliver a course or seminar you have booked, limited to the information needed to deliver it.
  • Your employer, where your employer booked and paid for your training, limited to enrolment and completion information.
  • Professional advisers and authorities, such as our accountants, auditors and legal advisers, or public authorities where we are required to do so by law.

We do not report your CPD hours to the Cyprus Securities and Exchange Commission (CySEC). Your certificates of completion are issued to you so that you can submit them yourself.

5. International transfers

Some of our service providers, including Google and Microsoft, may process personal data outside the European Economic Area, including in the United States. Where this happens, the transfer is protected by appropriate safeguards, such as the EU-US Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission.

6. Cookies, analytics and session recording

Our website uses cookies and similar technologies. Some are strictly necessary for the website and your account to work, such as keeping you logged in and processing your purchases. Others are analytics cookies, which are only set with your consent.

We use Google Analytics and Microsoft Clarity to understand how visitors use our website, so that we can improve our courses and services. These tools collect information such as pages visited, clicks, scrolling and the type of device used. Microsoft Clarity may also create session replays and heatmaps showing how the website is used. Sensitive information, such as text typed into forms and payment details, is masked and is not collected.

You can withdraw your consent at any time by clearing the cookies in your browser, after which the cookie banner will appear again. For more information on how Microsoft and Google process this data, please see the Microsoft Privacy Statement and the Google Privacy Policy.

7. How long we keep your personal data

We keep your personal data only for as long as necessary for the purposes described in this policy:

  • Account and learning records, including certificates of completion, are kept for as long as your account is active and for up to six years after your last activity, so that you can retrieve your certificates if needed.
  • Invoices and accounting records are kept for the period required by Cyprus tax and company law, currently at least six years.
  • Enquiries and correspondence are kept for up to two years after our last contact, unless they form part of a contract.
  • Analytics data is kept in line with the retention settings of Google Analytics and Microsoft Clarity.

8. Your rights

Under the GDPR, you have the following rights in relation to your personal data:

  • The right to access the personal data we hold about you.
  • The right to have inaccurate data corrected.
  • The right to have your data erased, where there is no legal reason for us to keep it.
  • The right to restrict or object to our processing, including to direct marketing at any time.
  • The right to data portability, where processing is based on consent or contract.
  • The right to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise any of these rights, please email us at [email protected]. We will respond within one month. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus at www.dataprotection.gov.cy.

9. Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. Our website is served over an encrypted connection, access to personal data is limited to those who need it, and our service providers are bound by data protection obligations.

10. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page, with the date of the last update shown at the top.

11. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at [email protected] or write to us at Iverance Ltd, 42-44 Griva Digeni Avenue, Second Floor, 1096 Nicosia, Cyprus.