Privacy statement

Who we are

Oaegis Limited is a consulting and training company registered in England and Wales. For the personal data described on this page we are the data controller, which means we decide what is collected and why. We are responsible to you under the UK GDPR and the Data Protection Act 2018.

Questions about anything here, or any request about your data, go to privacy@oaegis.org.

Who this covers

This statement covers four groups: people who visit oaegis.org, people who create an account and take a programme, people who contact us through the enquiry form or by email, and clients and prospective clients of our consulting work. We do not run recruitment, events or alumni programmes through this site, so nothing here concerns those.

What we collect, and why

If you create an account

Your email address and password, a salutation and name if you give one, and your company name and role if you give them. Passwords are stored only as a cryptographic hash by our authentication provider, so nobody at Oaegis can read your password. We need this to give you an account and to let you back into it. The lawful basis is performance of our contract with you.

While you take a programme

Which lessons you have completed, which quiz answers you selected and whether they were correct, and any feedback you send us. We use this to show your progress, issue your certificate and improve the material. The lawful basis is performance of our contract, and our legitimate interest in improving what we teach.

If you use the self-assessment workspace

The draft answers you write are saved so you can return to them. These are worth singling out, because what you write there may describe your own organisation customs controls, security arrangements and record keeping. That is commercially sensitive even though it is not special category personal data. Your drafts are visible only to you and to our administrators, they are never shared with other learners, and we do not use them as teaching examples.

If you buy a programme

Payment is taken by Stripe. Your card details go directly to Stripe and never reach our servers, so we do not hold them and could not disclose them. We keep a record that a payment was made and a reference that identifies it, which we need for the contract and for our accounting and tax obligations.

If you contact us

Your name, email address, organisation if you give one, and your message. Enquiries are emailed to us and answered from an inbox; they are not written to a database. The lawful basis is our legitimate interest in responding to people who approach us, and performance of a contract where the enquiry leads to one.

Whenever you visit

Our hosting provider records standard server information including your IP address, the pages requested and your browser type. This is used to keep the service running and secure, on the basis of our legitimate interest. We also use Google Analytics, described in the next section.

We do not collect special category data such as health, ethnicity, religion or biometric information, we do not ask for it, and you should not put it into the self-assessment workspace or an enquiry. We do not make any decision about you by automated means that produces a legal or similarly significant effect.

Cookies and analytics

Two kinds of cookie are set on this site. Strictly necessary cookies keep you signed in and keep the session secure; without them the site cannot work, and no consent is required for them.

We would also like to use Google Analytics to understand which pages people read and where they leave. That is not strictly necessary, so we ask first: the Google tag is not loaded and no analytics cookie is set unless you accept it. Declining costs you nothing on the site, and the two choices are presented with equal prominence.

You can change your mind at any time using the analytics control at the foot of every page. Turning it off removes the analytics cookies already set and stops the tag loading on future visits. Your choice is remembered in your browser local storage rather than in a cookie.

Who we share it with

We do not sell personal data and we do not share it for anyone else marketing. We use the following suppliers to run the service, each under a contract that limits them to acting on our instructions.

We will also disclose personal data where the law requires it, for example to a regulator or a court, and to our professional advisers where necessary. If the business were ever sold or reorganised, data would pass to the buyer under the same protections.

Sending data outside the UK

Some of the suppliers above process data outside the United Kingdom, principally in the European Economic Area and the United States. Where data goes to a country the UK has found to provide adequate protection, that finding is what permits the transfer. Where it does not, we rely on the UK International Data Transfer Agreement, or the European Commission standard contractual clauses together with the UK Addendum, which contractually bind the recipient to protect the data.

How long we keep it

• Account and learning records: for as long as your account is open, and for twelve months afterwards so a certificate can be reissued if you ask. You can ask us to delete them sooner.
• Payment and accounting records: six years from the end of the financial year they relate to, because company and tax law requires it. This is the one category we cannot delete on request.
• Enquiries: up to twenty-four months from your last contact with us, unless the enquiry becomes a client relationship.
• Server logs: short retention periods set by our hosting provider, typically measured in weeks.

Your rights

Under UK data protection law you can ask us to give you a copy of your data, correct it if it is wrong, delete it, restrict what we do with it, or provide it in a portable format. You can object to processing we carry out on the basis of legitimate interests, and withdraw any consent you have given at any time, which does not affect anything done before you withdrew it.

Write to privacy@oaegis.org and we will respond within one month. These rights are not all absolute: where we must keep something by law, such as an accounting record, we will say so and explain why.

If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.

Keeping data secure

Access to learning records is controlled at the database level, so one learner cannot read another learner records even if they try. Traffic to the site is encrypted in transit, passwords are stored only as hashes, card details never reach our systems, and administrative access is limited to those who need it. No system is perfectly secure, and we will tell you and the Information Commissioner's Office where a breach requires it.

Children

Our programmes are professional training for people at work and the site is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, tell us and we will delete it.

Changes to this statement

We update this page when what we do with data changes, and the date at the top always shows the current version. Where a change materially affects you we will say so rather than relying on you noticing the date.