PRIVACY POLICY

How HRC Online collects, uses and protects personal information

1. Who we are

HR Courses Online Limited, trading as HRC Online, is the data controller for the personal information described in this notice unless we explain otherwise.

Company number: 13625680

Contact address: The Wellsprings, HRC Online – Office 1.22, Howell Croft South, Bolton, BL1 1SB

Website: https://hrcoursesonline.com

Privacy enquiries and data rights requests: admin@hrcoursesonline.com

General course enquiries: cipd@hrcoursesonline.com | Telephone: 0161 552 7908

2. The services covered by this notice

This notice covers our website, enquiry and brochure forms, free trials, learner accounts, online learning services, tutor and assessment support, payment arrangements, employer-funded enrolments and the delivery of our CIPD qualifications, including:

CIPD Level 3 Foundation Certificate in People Practice;

CIPD Level 5 Associate Diploma in People Management;

CIPD Level 5 Associate Diploma in Organisational Learning and Development; and

CIPD Level 7 Advanced Diploma in Strategic People Management.

It also applies to related courses, services and qualifications that we may introduce, unless a separate privacy notice is provided.

3. Personal information we collect

The information we collect depends on how you interact with us. It may include:

Contact information: your name, email address, telephone number, postal address and preferred contact method.

Enquiry and trial information: the qualification or payment plan that interests you, brochure requests, questions, free-trial activity and records of our responses.

Identity and account information: usernames, learner identifiers, identity verification information and account security records.

Learning and qualification information: your chosen qualification, enrolment details, prior learning, study activity, progress, engagement, course access and completion or withdrawal status.

Assessment information: assessment submissions, feedback, grades, resubmissions, academic integrity checks, internal quality assurance records and information required for CIPD moderation or certification.

Support information: tutor communications, meeting bookings, support notes, learning plans, extension or break requests and records needed to provide learning support.

Accessibility and wellbeing information: information about a disability, health condition, caring responsibility or other circumstances when you choose to disclose it so that we can consider reasonable adjustments or other support. This may be special category data.

Payment and contract information: payment status, invoices, refunds, payment-plan information and limited transaction details. Full card or bank details are generally processed by our payment providers rather than stored by us.

Employer or sponsor information: employer contact details, invoice information, purchase orders, funding or approval records and limited progress information where an employer or another organisation pays for your course.

Communications: emails, telephone records, form submissions, complaints, feedback, survey responses and relevant notes about our contact with you.

Technical and usage information: IP address, device and browser information, cookie identifiers, pages visited, referral source, interaction data, approximate location and security logs.

4. How we obtain your information

We normally collect information directly from you when you use our website, request information, begin a trial, enrol, make a payment, submit assessment work, attend a support meeting or communicate with us.

We may also receive information from an employer or sponsor, CIPD, a payment provider, a referral or delivery partner, publicly available professional sources, or another person acting with your authority. Where we receive your information from another source, we will provide relevant privacy information when required.

5. How and why we use your information

Responding to enquiries and arranging trials

We use contact and enquiry information to send requested brochures or course information, answer questions, assess which qualification may be suitable and arrange a free trial. We rely on steps taken at your request before entering a contract and, where appropriate, our legitimate interests in responding to prospective learners.

Providing your course and learner support

We use account, learning, assessment and support information to enrol you, provide platform access, deliver teaching and support, monitor progress, mark assessments, provide feedback, manage course access and administer completion or withdrawal. This processing is necessary to perform our contract with you.

Assessment, quality assurance and certification

We process assessment work, results, feedback and quality records to maintain academic standards, complete internal quality assurance, support external quality assurance and enable registration, moderation and certification through CIPD. We rely on our contract with you, legitimate interests in protecting qualification standards and any legal or regulatory obligations that apply.

Payments and business administration

We use payment, contract and employer information to take or reconcile payments, issue invoices, manage payment plans and refunds, prevent fraud and maintain accounting and tax records. We rely on our contract, legal obligations and legitimate business interests.

Improving and protecting our services

We may analyse service use, feedback and technical information to improve course content, learner support, website performance and security; prevent misuse; diagnose technical problems; and establish, exercise or defend legal claims. We rely on our legitimate interests, provided those interests are not overridden by your rights.

Marketing

We may send information about relevant HRC Online courses, discounts, events or services where you have consented or where the law permits us to use the existing-customer or prospective-customer soft opt-in. Every electronic marketing message provides a way to unsubscribe. We do not use a service message to disguise marketing.

Special category information

Where you provide health, disability or other special category information, we use only what is necessary to consider adjustments, extensions, breaks in learning or other support. We rely on your explicit consent or another condition permitted by data protection law. You may withdraw consent, although this may affect our ability to provide the requested adjustment or support.

6. CIPD registration, quality assurance and certification

As a CIPD Approved Study Centre, we may share relevant learner information with CIPD for learner registration, assessment administration, quality assurance, moderation, complaints, malpractice investigations, certification and regulatory purposes. This can include identity and contact details, qualification and unit information, assessment results, completion status and supporting records.

CIPD may process this information as a separate data controller for its own purposes. You should also read CIPD’s privacy information and student membership terms. Providing certain information is necessary if you want to be registered for, complete and receive certification for a CIPD qualification.

7. Tutor meetings, notes and artificial intelligence tools

We may use Google Workspace tools, including Google Meet and Gemini Meeting Notes, to create notes of professional learner-support meetings. We will indicate when an automated note-taking feature is active. The notes may include discussion points, agreed actions and information relevant to your learning or support.

We do not routinely make audio or video recordings of learner-support meetings. If a recording is proposed, we will explain why and provide additional information before it begins.

Automated notes support administration and do not replace professional judgement. Tutors, assessors and authorised staff remain responsible for decisions about support, assessment and learner progression.

8. Cookies, analytics and advertising

Our website uses cookies and similar technologies. Some are necessary for security, forms, account access and website operation. With your consent, we may also use analytics and advertising technologies to understand website use, measure campaigns, prevent invalid advertising activity and show relevant advertising.

These technologies may involve services provided by Google, Meta, LinkedIn, Trustpilot, anti-spam or advertising-protection providers, and our website or hosting providers. Non-essential cookies should not be activated until you have made a choice through our cookie banner. You can change or withdraw your cookie choices using the cookie controls on our website.

Embedded content, including videos, reviews, forms or social media content, may allow the supplying organisation to collect usage information as if you had visited its website directly. Its own privacy and cookie terms will apply.

9. Direct marketing and your preferences

You can ask us to stop direct marketing at any time by using the unsubscribe link in an email or contacting us. Your right to object to direct marketing is absolute. We may retain a minimal suppression record so that we can respect your request and avoid adding you back to a marketing list.

Choosing not to receive marketing will not prevent us from sending essential messages about an enquiry, trial, payment, learner account, assessment, course access or contract.

10. Who we share information with

We disclose personal information only where necessary and proportionate. Recipients may include:

CIPD, for registration, quality assurance, moderation, certification, complaints and qualification administration;

authorised tutors, assessors, markers, internal quality assurers and professional advisers who are subject to confidentiality requirements;

website hosting, learning-platform, customer-management, email, cloud storage, video-meeting, productivity, security, analytics and technical-support providers;

payment processors, banks, direct-debit providers, accountants and debt-recovery services where required;

an employer, sponsor or delivery partner, but only to the extent agreed or reasonably necessary for payment, administration, safeguarding or progress reporting;

review, survey and feedback services when you choose to participate;

regulators, courts, law-enforcement bodies or other authorities when disclosure is required or permitted by law; and

a buyer, investor or adviser involved in a genuine business sale, restructuring or due-diligence process, subject to appropriate confidentiality safeguards.

We do not sell personal information.

11. International transfers

Some of our technology providers may store or access information outside the United Kingdom. Where this happens, we use an appropriate safeguard required by UK data protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another lawful transfer mechanism. You can contact us for more information about the safeguards relevant to your data.

12. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including contractual, qualification, quality-assurance, accounting, legal and complaints requirements. Our usual retention approach is:

Enquiries and trials that do not lead to enrolment: normally up to 24 months after the last meaningful contact.

Learner, contract, assessment and quality-assurance records: normally for the course period and up to six years after completion, withdrawal or the end of the contractual relationship, unless CIPD requirements or an ongoing complaint, appeal or legal issue require longer retention.

Financial and tax records: normally six years after the end of the relevant financial year.

Complaints, safeguarding and legal records: normally up to six years after closure, or longer where necessary to manage an active risk or claim.

Tutor meeting notes: normally for the duration of the course and up to 12 months afterwards, unless required for an assessment, complaint, appeal, safeguarding concern or legal claim.

Marketing records: until you unsubscribe, withdraw consent or the information is no longer needed; a minimal suppression record may then be retained.

Cookies and analytics information: according to the lifespan shown in our cookie controls and the settings of the relevant provider.

We may securely delete or anonymise information earlier when it is no longer needed.

13. How we protect information

We use appropriate organisational and technical measures designed to protect personal information from accidental loss, unauthorised access, alteration or disclosure. These measures include access controls, role-based permissions, secure systems, staff confidentiality requirements, backups and supplier checks. No online system is completely risk-free, but we review our safeguards and respond to suspected personal data breaches in accordance with legal requirements.

14. Your data protection rights

Depending on the circumstances, you may have the right to:

be informed about how your information is used;

request access to the personal information we hold about you;

ask us to correct inaccurate or incomplete information;

ask us to erase information where there is no lawful reason to continue using it;

ask us to restrict how information is used;

receive certain information in a portable format;

object to processing based on legitimate interests;

object at any time to direct marketing; and

withdraw consent where processing relies on consent.

These rights are not absolute and exemptions may apply. We may ask for information to verify your identity before responding. We normally respond within one month, although the law permits additional time for particularly complex or numerous requests. There is normally no charge.

15. Automated decision-making

We do not use solely automated decision-making that produces legal or similarly significant effects for learners. Automated tools may assist with administration, analytics, security, note-taking or academic integrity checks, but relevant decisions about enrolment, support, assessment and progression involve authorised people.

16. Children and young people

Our services are primarily intended for adults. If a person under 18 applies or enrols, we may need to collect parent or guardian information and apply additional safeguards appropriate to the learner’s age and circumstances. A parent or guardian should contact us before a learner under 18 provides sensitive information.

17. Comments, profiles and uploaded media

If comments are enabled and you leave a comment, we collect the information shown in the comments form together with your IP address and browser information to support moderation and spam detection. An anonymised version of your email address may be sent to Gravatar to determine whether you use that service. Once a comment is approved, a linked profile picture may be publicly visible.

If you upload an image, avoid including embedded location information such as EXIF GPS data, because visitors may be able to download and extract it.

18. External links

Our website and learning materials may link to websites operated by other organisations. We are not responsible for their privacy practices. Review the privacy information provided by the relevant organisation before submitting personal information.

19. Changes to this notice

We review this notice regularly and update it when our services, qualifications, technology or legal obligations change. The effective date at the top shows when this version took effect. If a change materially affects how we use existing personal information, we will take reasonable steps to bring it to the attention of affected people before the new use begins.

20. Contacting us and making a complaint

Please contact admin@hrcoursesonline.com if you have a question, want to exercise a right or believe we have not handled your information properly. You can also write to HR Courses Online Limited at The Wellsprings, HRC Online – Office 1.22, Howell Croft South, Bolton, BL1 1SB.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. We would appreciate the opportunity to address your concern first. ICO information is available at https://ico.org.uk/make-a-complaint/.

Last updated: 7 September 2026