Privacy Notice

Who is responsible for your data?

EVO TRAINING CENTRE LTD, trading as Evo Academy Solutions and Evo CPD, is the data controller for the personal data we use to run this website and deliver our services. Contact us using the details below with privacy questions or requests.

Data we collect and why

• Account and identity: name, email address, authentication details and, if you choose social sign-in, identity information supplied by the sign-in provider. We use these to create and secure your account and identify the certificate recipient. Legal basis: contract performance and legitimate interests in security.
• Orders and learning: order and transaction references, course purchased, payment status, access dates, module completion, progress and certificate name/code/date. We use these to verify purchases, provide access, process refund outcomes and issue completion records. Legal basis: contract performance, legal obligations for transaction records and legitimate interests in preventing fraud.
• Enquiries and support: contact details and messages you submit. We use these to respond and discuss requested services. Legal basis: steps at your request before entering a contract, contract performance and legitimate interests in customer support.
• Technical information: IP address, device/browser information and service, error or security logs collected when operating the website. These support availability, fault diagnosis and abuse prevention. Legal basis: legitimate interests in operating a secure service.
• Preferences: your selected language and sign-in session information stored in your browser to maintain your choices and account access. Legal basis: contract performance and legitimate interests in essential website operation.

Paddle separately collects payment-related information as Merchant of Record. Do not send card details to us by email or through our enquiry form.

Who receives data?

• Paddle: for sale of the product, subscription management where applicable, payment processing, tax compliance, invoicing and refunds. Our current course offering is not a subscription. Paddle also acts as an independent controller for its own payment and compliance activities; see Paddle's Privacy Notice.
• Service providers: Lovable Cloud for hosting, account authentication, records and private files; FormSubmit for forwarding enquiries; and our email provider for receiving and responding to messages. Website font delivery and any social sign-in provider you choose may receive technical information required to provide those services.
• Professional advisers: legal and accounting advisers where needed to advise us or meet obligations.
• Authorities: where disclosure is legally required or necessary to protect rights and address fraud or security incidents.

We share only information needed for the relevant purpose and do not sell personal data.

Retention

We keep account and learning records while needed to provide the account, purchased access and completion records. The three-month course access period is not an automatic deletion deadline for order or certificate records. Order, invoice and refund records are retained for applicable tax/accounting requirements and the resolution of disputes. Enquiries and technical logs are retained only while needed for support, security and related legal obligations. When information is no longer needed, we delete or anonymise it. Ask us about deletion or retention of your particular records.

International transfers

Our service providers may process data outside your country, including outside the UK or EEA. Where applicable data protection law requires safeguards, we use recognised mechanisms such as adequacy decisions or standard contractual clauses, together with appropriate supplementary safeguards. Contact us to ask about safeguards relevant to your data.

Your rights

Depending on the law that applies to you, you may request access, correction, deletion, restriction, portability or object to processing, including processing based on legitimate interests. Where consent is used, you may withdraw it without affecting earlier lawful processing. Some information may need to be retained to meet legal obligations.

UK/EEA individuals have the GDPR rights described above and the right to complain to their supervisory authority, such as the UK Information Commissioner's Office or their local EEA authority. We respond to rights requests within one month where GDPR applies, subject to permitted extensions and identity verification. Contact us using the details below.

Security

We use appropriate technical and organisational measures, including encrypted connections, access controls and restricted access to paid course files and personal records. No system can guarantee absolute security; keep your password private and report suspected unauthorised access promptly.

Cookies and browser storage

Essential cookies and similar browser storage support sign-in, security and checkout; local storage remembers your language preference and session. Third-party sign-in and Paddle checkout may use storage necessary for those services. You can manage or clear cookies and site data in your browser settings, although blocking essential storage may prevent sign-in or checkout. We do not currently use optional analytics or marketing cookies in the application; if introduced, we will provide appropriate notice and consent controls before using them where required.

Updates

We may update this notice as our services change. The date at the top identifies the latest version.