Purpose and relationship

This notice supplements the Privacy Policy. For individual Academy services, Tafkeer for Systems and Information Technology generally determines why and how account, learning, transaction, and certificate data is processed. For a contracted organisation programme, the written agreement may assign controller, joint-controller, or processor responsibilities differently.

Processing instructions and scope

Organisation-sponsored learner data is processed to create accounts, allocate seats and entitlements, deliver courses or chapters, provide support, report agreed progress, maintain security, and satisfy payment or legal obligations. We process only documented, lawful instructions that are consistent with the service and may refuse an instruction we reasonably believe violates applicable law.

People and data categories

• Learners, customer administrators, instructors, purchasers, certificate holders, and support contacts.
• Identity and contact details, organisation and role information, enrolment and entitlement data.
• Learning activity, progress, completion, assessment, support, and certificate data.
• Order, invoice, currency, payment-status, refund, reconciliation, and access-revocation data.
• Technical logs, security events, session and device information reasonably needed to operate and protect the service.

Confidentiality and security

Access is limited by role and operational need. Personnel and providers are expected to preserve confidentiality. Security measures include access controls, secure transport, environment separation where practical, backups, monitoring, patching, reconciliation, and incident handling. Controls are reviewed in proportion to risk, platform capability, and service scope.

Service providers and transfers

We may use vetted providers for hosting, Moodle infrastructure, payment processing, protected video, email, security, backup, and support. Providers receive only the data reasonably required for their role and are subject to appropriate contractual or legal obligations. Cross-border processing is assessed and safeguarded under applicable requirements.

Rights requests and assistance

We provide reasonable assistance with verified access, correction, deletion, restriction, portability, objection, consent withdrawal, or complaint requests where applicable. For organisation-sponsored accounts, a request may need coordination with the sponsoring organisation. We verify identity and protect other people’s rights before disclosure.

Incidents and continuity

Suspected personal-data incidents are investigated, contained, documented, and escalated. Where legally required, affected controllers, individuals, or authorities are notified within the applicable timeframe. Backup and recovery controls support availability, but restored data remains subject to retention and deletion controls.

Return, deletion, retention, and evidence

At the end of a service relationship, data is returned, deleted, anonymised, or restricted within 90 days, subject to the periods below and technical feasibility. Transaction, invoice, and dispute evidence is retained for 7 years from the transaction date. Certificate-integrity and verification records are retained indefinitely to support ongoing public verification. Security and abuse-prevention evidence is retained for 12 months unless a longer period is needed for an active investigation or legal obligation. Backup copies are retained on a rolling 30-day cycle and age out through that cycle rather than being individually purged; a deletion or anonymisation request is applied to live systems immediately and to backups on their normal rotation.

Business agreements and contact

This public notice is not a signed data processing agreement. Business customers requiring specific audit, subprocessor, location, security, breach, deletion, or transfer commitments should request a written agreement through the Contact page before programme launch.