Controller: MMC Learning Ltd
Trading name: MMC Learning

Registered and postal address:
MMC Learning Ltd
Base
Manchester Science Park
Greenheys Lane
Manchester
M15 6LR

Company number: 5400598
Privacy contact email: dpo@mmclearning.com

MMC Learning Ltd acts as the data controller for the personal data described in this policy, unless we state otherwise. This means that we decide why and how your personal data is processed.

Where we process personal data of individuals in the United Kingdom, we comply with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. Where we offer services to, or monitor the behaviour of, individuals in the European Economic Area, we also comply with the EU General Data Protection Regulation where applicable.

For privacy queries, data protection requests or questions about this policy, please contact us at dpo@mmclearning.com

This policy applies when you:

• visit or use our website;
• contact us by phone, email, web form, live chat, social media or other communication channels;
• request information about our courses, qualifications, services, events or resources;
• enrol on a course, qualification, programme, webinar, event or learning service;
• use our online learning platforms, communities, assessment systems or learner support services;
• attend live training sessions, tutor-led one-to-one sessions or group sessions;
• purchase a course or service from us;
• interact with our marketing communications, advertisements or online content;
• provide services to us as a supplier, tutor, assessor, consultant or business partner;
• otherwise interact with MMC Learning.

This policy does not apply to third-party websites, platforms or services that we do not control. Where our website or services contain links to third-party websites or platforms, those third parties are responsible for their own privacy practices.

Our services are intended for adults and professional learners. We do not knowingly provide courses, qualifications or learning services to learners under the age of 18. If we become aware that we have collected personal data from a person under 18 without an appropriate lawful basis, we will take appropriate steps to review and, where necessary, delete or restrict that data.

The personal data we collect depends on your relationship with us and how you interact with our websites, platforms, services and communications.

We may collect and use the following categories of personal data.

Identity and contact data
This may include your name, title, email address, telephone number, postal address, country, employer, job title, organisation, username, learner ID, membership number, account details and similar identifiers.

Learner and enrolment data
This may include date of birth, gender, nationality, education history, employment details, sector, course enrolment details, course progress, attendance, assessment submissions, assignment results, qualification status, certification details, learning support queries, tutor communications and records of contact with learner support teams.

Payment and transaction data
This may include billing details, payment confirmation, transaction references, invoice details, refund records, purchase history, funding information and related financial records. We do not intentionally store full payment card details where payments are processed by third-party payment providers.

Website, device and usage data
This may include IP address, browser type, device identifiers, operating system, pages viewed, links clicked, forms submitted, referral source, session information, cookie identifiers, analytics data and information about how you interact with our websites, emails, advertisements and online learning platforms.

Marketing and communications data
This may include your marketing preferences, communication preferences, email engagement, event registration, downloaded resources, webinar attendance, survey responses, feedback, competition entries and records of consent or opt-out requests.
Community, event and platform data
Where you use our online communities, learning portals, webinar platforms or related services, we may process profile information, posts, comments, messages, uploaded content, participation history, event attendance, chat messages, recordings where notified, and platform activity.

Live session and recording data
Where you attend live training sessions, tutor-led one-to-one sessions, webinars or group learning sessions, we may process your name, image, voice, questions, comments, chat messages, shared screen content, attendance, participation and any personal data you choose to disclose during the session.

Supplier, tutor and business contact data
Where you work with us as a supplier, tutor, assessor, consultant, professional adviser or business contact, we may process your contact details, role, organisation, payment details, contract details, tax information, due diligence records, professional credentials, communications and service delivery records.

Special category personal data
We do not routinely require special category personal data. However, in some circumstances you may voluntarily provide, or we may need to process, information such as accessibility requirements, disability-related support needs, health-related learning support information, dietary requirements for events, or other sensitive information.

Where we process special category personal data, we will do so only where necessary and where we have both a lawful basis and an additional condition under applicable data protection law. This may include explicit consent, compliance with legal obligations, provision of reasonable adjustments, or the establishment, exercise or defence of legal claims.

Criminal offence data
We do not routinely collect criminal offence data. If criminal offence data is ever required for a specific purpose, we will process it only where permitted by law and with appropriate safeguards.

We collect personal data in several ways.

We may collect personal data directly from you when you complete a form, make an enquiry, enrol on a course, create an account, attend a session, submit an assessment, contact learner support, make a payment, subscribe to marketing communications, use our website or communicate with us.

We may also receive personal data from third parties, including:

• employers, sponsors or organisations funding your course;
• training partners, referral partners or resellers;
• awarding bodies, professional bodies, accreditation bodies and regulators;
• payment providers and finance platforms;
• learning platforms, webinar platforms, event platforms and community platforms;
• analytics, advertising and social media platforms;
• publicly available professional sources, such as business websites or professional networking platforms;
• suppliers, tutors, assessors, consultants and business partners.

We may also collect website, device, usage and cookie data automatically when you visit our website or interact with our emails, advertisements, platforms or online content.

Where we receive personal data from a third party, we will use it only where we have a lawful basis and where the use is consistent with this Privacy and Cookies Policy.

We use personal data only where we have a lawful basis to do so. The lawful bases we rely on may include:

• Contract: where processing is necessary to enter into or perform a contract with you.
• Legal obligation: where processing is necessary to comply with a legal obligation.
• Legitimate interests: where processing is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights and freedoms.
• Consent: where you have given clear consent for a specific purpose.
• Vital interests: where processing is necessary to protect someone’s life.
• Public task: where applicable, if processing is necessary for a task carried out in the public interest.

The table below explains the main purposes for which we process personal data.

Where we rely on legitimate interests, our legitimate interests may include responding to enquiries, managing learner and customer relationships, delivering and improving our courses and services, supporting learners, maintaining academic and certification records, managing awarding body and accreditation relationships, protecting our systems, preventing fraud, promoting relevant services where permitted by law, managing session recordings for learner access and quality assurance, and handling complaints, disputes, audits, insurance matters and legal claims.

You have the right to object to processing based on legitimate interests in certain circumstances. You always have the right to object to direct marketing.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn. It may also not affect processing that we carry out on another lawful basis, such as contract, legal obligation or legitimate interests.

We may send you marketing communications about courses, qualifications, events, webinars, resources, services and educational content that may be relevant to you.

We will send electronic marketing, such as email or SMS marketing, only where we are permitted to do so under applicable law. This may be because you have given consent, you are an existing customer and the communication relates to similar products or services, you are a business contact and the communication is permitted under applicable electronic marketing rules, or another lawful route applies.

You can opt out of marketing communications at any time by clicking the unsubscribe link in our emails, updating your preferences where available, or contacting us at dpo@mmclearning.com.

We may still send you non-marketing service messages where necessary, including messages about your course, account, enrolment, assessment, certification, payment, platform access, policy updates or other important service information.

Our website and online services use cookies and similar technologies, such as pixels, tags, scripts, local storage, device identifiers, embedded media technologies and analytics tools. These technologies may store information on your device or access information already stored on your device. They may also collect personal data, including online identifiers, IP address, device information, browser information, usage information, interaction data and information about how you use our website, emails, advertisements and online content.

We use cookies and similar technologies for purposes including website functionality, security, user preferences, analytics, performance measurement, embedded media, advertising, marketing, conversion tracking and service improvement.

Our website may use cookies and similar technologies provided by third parties, including providers used for analytics, advertising, embedded video, live chat, payment processing, website security, marketing automation, customer relationship management and website functionality. These may include technologies provided by Google, Wistia, Vimeo, YouTube, LinkedIn, Stripe, WooCommerce, WordPress, Wordfence, Tawk, LiveChat, Keap and similar service providers.

We use the following broad categories of cookies and similar technologies:

• Strictly necessary cookies and technologies: required for the website or service to function properly, including security, fraud prevention, session management, account login, payment processing and consent preference storage.
• Functional cookies and technologies: used to remember choices or support enhanced functionality, such as embedded videos, chat tools, forms, preferences, settings or website features.
• Analytics and performance cookies and technologies: used to understand how visitors use our website and online services, including pages visited, traffic sources, engagement, conversion rates, technical performance and areas for improvement.
• Advertising, marketing and tracking cookies and technologies: used to measure advertising performance, understand campaign effectiveness, support conversion tracking, build or exclude audiences, deliver relevant advertising and improve marketing activity.
• Embedded media and third-party content technologies: used to display or support videos, forms, chat tools, scripts, widgets, platform integrations and similar third-party features.

Where required by law, we will ask for your consent before using non-essential cookies and similar technologies, including analytics, advertising, marketing, tracking and certain embedded media technologies.
Further information about the cookies and similar technologies used on our website, including cookie categories, providers, purposes and durations, is available in our Cookie Policy (UK):

https://mmclearning.com/cookie-policy-uk/

You can manage your cookie preferences through the cookie banner or cookie settings tool available on our website. You may also be able to control cookies through your browser settings. If you disable or reject certain cookies, some parts of the website may not function properly.

We share personal data only where necessary and where we have an appropriate lawful basis.

We may share personal data with:

• awarding bodies, professional bodies, accreditation bodies and regulators, including CIM, CMI, DMI and Ofqual-related parties where relevant;
• learning platform providers, assessment platforms, online community platforms and course delivery systems;
• tutors, assessors, moderators, trainers and learner support providers;
• employers, sponsors or funding organisations where they have arranged, purchased or funded training and where sharing is lawful and appropriate;
• payment processors, banks, accounting providers and finance systems;
• customer relationship management, email marketing and communications platforms used to manage enquiries, customer records, learner communications, marketing preferences, sales processes and related service communications;
• website analytics and advertising providers used to measure website performance, understand campaign effectiveness and manage advertising activity;
• embedded media, video hosting and content delivery providers used to display or deliver video, webinar, learning or marketing content;
• live chat, form, website functionality and customer support providers;
• website hosting, IT support, security, cookie consent, analytics and system administration providers;
• webinar, event, video conferencing and content delivery providers;
• advertising, analytics and search advertising platforms where permitted and subject to cookie consent where required;
  professional advisers, auditors, insurers and legal advisers;
• public authorities, regulators, law enforcement bodies or courts where required by law or necessary to protect our rights;
• business partners where necessary to deliver a course, qualification, event or service you have requested;
• prospective buyers, investors, funders or advisers in connection with a business sale, merger, acquisition, restructuring or similar transaction, subject to appropriate safeguards.

Where we use service providers that process personal data on our behalf, we require them to process personal data only in accordance with our documented instructions, applicable data processing agreements and appropriate contractual safeguards.

Some third-party providers may also act as independent controllers for certain processing activities, for example where they process data for their own security, analytics, advertising, fraud prevention or service improvement purposes. Where this applies, their own privacy notices will also apply.

Where you enrol on a course, qualification or programme connected to an awarding body, professional body or accreditation partner, we may need to share your personal data with that organisation. This may include your identity details, contact details, date of birth, learner registration details, assessment submissions, results, certification information, attendance records, support information and other data required for course administration, assessment, certification, audit, quality assurance, regulatory or accreditation purposes.

Awarding bodies, professional bodies and accreditation partners may act as independent controllers for some processing activities. Where they act as independent controllers, they are responsible for their own privacy notices and data protection compliance.

Where your course, qualification or service is arranged, purchased or funded by your employer, sponsor or another organisation, we may share relevant information with that organisation where lawful and appropriate.

This may include your enrolment status, attendance, course progress, module progress, completion status, assessment status, certification status and related service information.

We share this information so that the employer, sponsor or funding organisation can monitor participation, understand progress against the training programme, support completion of the course, manage internal learning and development records, and confirm that funded training is being used for the intended purpose.

We will not share more information than is necessary for the relevant purpose. We do not normally share detailed private communications with tutors, learner support queries, sensitive personal information, or unnecessary assessment detail with employers or sponsors unless there is a lawful basis and a clear need to do so.

We may record live training sessions, tutor-led one-to-one sessions and group learning sessions. Recordings may include your name, image, voice, questions, comments, chat messages, shared screen content, participation in discussions and any personal data that you choose to disclose during the session.

We use recordings for purposes such as providing access to learners who could not attend the live session, allowing learners to revisit course content, supporting tutor quality assurance and training quality reviews, resolving learner queries, complaints or disputes, maintaining appropriate records of course delivery, and supporting accessibility and learning support where appropriate.

Where sessions are recorded, we will take reasonable steps to notify participants before or at the start of the session. Participants should avoid sharing unnecessary personal, confidential or sensitive information during recorded sessions.

Where appropriate, we may provide options to participate without using a camera, to use display names, or to submit questions through chat or alternative channels. These options may vary depending on the course, platform and session format.

Session recordings are stored securely and access is limited to authorised individuals and learners who require access for legitimate course-related purposes. We do not use session recordings for unrelated marketing purposes unless we have obtained appropriate consent.

MMC Learning is based in the United Kingdom. However, some of our service providers, platforms, partners or systems may process, store or access personal data from outside the United Kingdom.

Where personal data is transferred internationally, we will ensure that appropriate safeguards are in place as required by applicable data protection law. These safeguards may include:

• transferring personal data to a country that has been recognised as providing an adequate level of protection;
• using the UK International Data Transfer Agreement;
• using the UK Addendum to the European Commission Standard Contractual Clauses;
• using European Commission Standard Contractual Clauses where the EU GDPR applies;
• carrying out transfer risk assessments where required;
• applying supplementary technical, contractual or organisational measures where appropriate.

You may contact us at dpo@mmclearning.com for more information about the safeguards used for international transfers of your personal data.

We keep personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law, regulation, awarding body rules, accreditation requirements, audit requirements, contractual obligations or the establishment, exercise or defence of legal claims.

We maintain a retention schedule that sets out how long different categories of personal data are kept and what happens when the retention period ends. Retention periods may vary depending on the course, qualification, awarding body, professional body, funding arrangement, legal requirement or business need.

Our standard retention periods are summarised below.

Where we no longer need personal data, we will delete it, anonymise it or securely archive it in accordance with our retention procedures.

We may retain anonymised or aggregated information for longer where individuals can no longer be identified from that information.

We may also retain personal data for longer than the periods above where necessary to comply with law, meet awarding body or accreditation requirements, respond to regulatory enquiries, resolve disputes, enforce agreements, prevent fraud, protect our systems or establish, exercise or defend legal claims.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction.

These measures may include access controls, password protection, multi-factor authentication where appropriate, encryption where appropriate, secure configuration of systems and platforms, user access management, supplier due diligence and contractual controls, staff training, data minimisation, backup controls, logging and monitoring, incident response procedures and secure disposal processes.

No website, platform, email system or internet transmission is completely secure. However, we take reasonable steps to protect personal data and to respond appropriately to suspected personal data breaches.

Depending on the circumstances and applicable law, you may have the following rights:

• the right to be informed about how we collect and use your personal data;
• the right of access to request a copy of the personal data we hold about you;
• the right to rectification if your personal data is inaccurate or incomplete;
• the right to erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to object to processing based on legitimate interests in certain circumstances;
• the right to object to direct marketing at any time;
• the right to data portability in certain circumstances;
• the right to withdraw consent where processing is based on consent;
• rights relating to decisions based solely on automated processing, including profiling, where those decisions produce legal or similarly significant effects.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for individuals, unless we tell you otherwise and have a lawful basis to do so.

We may use limited profiling or segmentation to understand learner interests, improve services, personalise communications, measure engagement or send relevant marketing, where permitted by law and subject to consent where required for cookies, tracking or electronic marketing.

To exercise your rights, please contact us at dpo@mmclearning.com or write to us at:

MMC Learning Ltd
Base
Manchester Science Park
Greenheys Lane
Manchester
M15 6LR

We may need to verify your identity before responding to a request. We may also ask for clarification where necessary to help us respond.

We will respond within the timeframe required by applicable law. In the UK, this is normally one month from receipt of a valid request. This period may be extended where permitted by law for complex or multiple requests.

You will not usually have to pay a fee to exercise your rights. However, we may charge a reasonable fee or refuse to comply with a request where the law allows us to do so, for example where a request is manifestly unfounded or excessive.

If you have concerns about how we use your personal data, please contact us first at dpo@mmclearning.com so that we can investigate and respond.

You also have the right to complain to the UK Information Commissioner’s Office, the UK supervisory authority for data protection matters.

Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113

If you are located in the European Economic Area, you may also have the right to complain to your local data protection supervisory authority.

Our website, emails, platforms or resources may contain links to third-party websites, applications, platforms or services. We are not responsible for the privacy practices, notices or content of third-party websites or services. You should review the privacy notices of those third parties before providing personal data to them or using their services.

We may update this Privacy and Cookies Policy from time to time to reflect changes in our business, services, systems, legal obligations, regulatory guidance or data protection practices.

Where we make material changes, we may notify you by appropriate means, such as updating our website, sending a notice by email, or displaying a notice within our services.

The latest version of this policy will always be available on our website.