Privacy Policy

This Privacy Policy explains how TransFormIQ Ltd, providing ProCertMax, collects, uses, stores and protects personal information.

ProCertMax is a certificate management and generation platform designed for training organisations.

We are committed to handling personal information in accordance with applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018.

1. Who We Are

ProCertMax is provided by:

2. Our Role in Handling Personal Information

Our role depends on the type of information being processed.

Where we collect information directly for our own business purposes, such as account registration, subscription management, support or sales enquiries, TransFormIQ Ltd generally acts as the data controller.

Where a training organisation uploads learner, trainer or certificate information to ProCertMax for the purpose of providing its own training services, the training organisation will generally act as the data controller and ProCertMax will process that information on its behalf.

In those circumstances, ProCertMax acts as a data processor and processes the information only as necessary to provide the service and in accordance with the customer's instructions.

3. Information We May Collect

We may collect and process the following categories of personal information.

Account and Organisation Information

• Full Name.
• Email Address.
• Telephone Number.
• Organisation Name.
• Account Role.
• Login and Authentication Information.
• Subscription and Plan Information.

Training and Certificate Information

• Learner Names.
• Trainer Names.
• Course Information.
• Training Dates.
• Certificate Dates.
• Certificate Numbers.
• Certificate Expiry Information.
• Certificate Templates.
• Organisation Logos and Branding.

Support and Communication Information

• Support Requests.
• Support Messages.
• Demo Enquiries.
• Enterprise Enquiries.
• Plan Help Requests.
• Email Correspondence.
• Other Information You Choose to Provide.

Technical Information

• IP Address.
• Browser or Device Information.
• Login Activity.
• Security and System Logs.
• Information Used to Diagnose Errors or Protect the Platform.

Payment information is processed primarily by our payment provider, Stripe.

We do not normally store full payment card details ourselves.

4. How We Collect Information

We may obtain personal information:

• Directly From You When You Register or Contact Us.
• When You Use ProCertMax.
• When You Submit a Support or Demo Request.
• When You Purchase or Manage a Subscription.
• When Your Organisation Uploads Information to ProCertMax.
• Automatically Through Security, Authentication and Technical Logs.
• From Service Providers Where Necessary to Operate the Platform.

5. How We Use Personal Information

We may use personal information to:

• Create and Manage ProCertMax Accounts.
• Authenticate Users and Protect Accounts.
• Provide Certificate Management and Generation Services.
• Store and Process Customer-Uploaded Training Information.
• Manage Subscriptions and Payments.
• Provide Customer Support.
• Respond to Demo, Sales and Enterprise Enquiries.
• Send Important Service Communications.
• Investigate Errors and Technical Problems.
• Prevent Fraud, Misuse and Security Incidents.
• Maintain and Improve the Reliability of ProCertMax.
• Comply With Legal and Regulatory Obligations.

We will not use personal information in ways that are incompatible with the purposes for which it was collected unless permitted by law.

6. Lawful Bases for Processing

We must have a lawful basis for processing personal information.

Contract

We may process personal information where necessary to provide ProCertMax, manage an account, process a subscription or fulfil our contractual obligations.

Legitimate Interests

We may rely on legitimate interests where appropriate, including for:

• Protecting ProCertMax Against Fraud or Misuse.
• Maintaining Platform Security.
• Improving Service Reliability.
• Responding to Business Enquiries.
• Managing Our Business Operations.

Where we rely on legitimate interests, we consider whether those interests are balanced against the rights and interests of the individual.

Legal Obligation

We may process information where necessary to comply with legal, regulatory, accounting or taxation obligations.

Consent

Where consent is required, we will ask for it separately.

You may withdraw consent where applicable.

7. Learner and Certificate Data

Training organisations may upload learner and certificate information to ProCertMax.

The customer is responsible for:

• Ensuring It Has a Lawful Basis for Collecting and Uploading Learner Information.
• Providing Appropriate Privacy Information to Learners Where Required.
• Ensuring Information Uploaded to ProCertMax Is Accurate and Appropriate.
• Responding to Applicable Data-Subject Requests Where the Customer Is the Controller.

ProCertMax processes this information to provide certificate-management functionality on behalf of the customer.

We do not independently decide which learners a customer should upload or why certificates should be issued.

8. Special Category Information

ProCertMax is not designed to require customers to upload special category personal information such as information about health, ethnicity, religion, political opinions or sexual orientation.

Customers should avoid uploading unnecessary special category information into free-text fields, support messages, certificate records or other areas of the platform.

If such information is provided, the relevant organisation remains responsible for ensuring that an appropriate lawful basis and any additional UK GDPR condition required for that processing applies.

9. Sharing Personal Information

We may share personal information with trusted service providers where necessary to operate ProCertMax.

These may include providers of:

• Cloud Hosting.
• Database and Authentication Services.
• Payment Processing.
• Email Delivery.
• Error Monitoring and Technical Services.
• Professional, Accounting or Legal Services.

Current technology providers may include Stripe, Supabase, Vercel and email-delivery providers.

Service providers are only given access to information needed for the services they provide.

We may also disclose information where required by law or where reasonably necessary to protect our rights, users or systems.

10. International Transfers

Some service providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate measures required under UK data protection law to protect the information.

Where required, safeguards may include adequacy regulations, approved contractual protections or other lawful transfer mechanisms.

11. Data Security

We take reasonable technical and organisational measures to protect personal information against:

• Unauthorised Access.
• Accidental Loss.
• Unlawful Disclosure.
• Alteration.
• Destruction.
• Misuse.

Measures may include authentication controls, access restrictions, encryption provided by our infrastructure providers, secure hosting and monitoring.

No internet-based service can guarantee absolute security.

12. How Long We Keep Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, security and contractual requirements.

Retention periods may vary depending on the type of information.

For example:

• Account Information May Be Retained While an Account Is Active and for an Appropriate Period Afterwards.
• Billing Records May Be Retained Where Required for Tax or Accounting Purposes.
• Support Records May Be Retained for Operational, Security and Customer-Service Purposes.
• Customer-Uploaded Certificate Information May Be Retained While the Customer Account Is Active and in Accordance With the Applicable Service Arrangements.

Where information is no longer required, we will delete, anonymise or securely dispose of it where reasonably practicable.

13. Account Closure and Customer Data

When a subscription ends or an account is closed, access to ProCertMax may be restricted.

Customer data may not be deleted immediately because limited retention may be necessary for:

• Account Recovery.
• Security.
• Legal Obligations.
• Billing and Accounting.
• Resolving Disputes.
• Backup and Recovery Processes.

Where appropriate, customers should download information they require before their access ends.

14. Your Data Protection Rights

Depending on the circumstances, individuals may have rights including:

• The Right to Be Informed.
• The Right of Access.
• The Right to Rectification.
• The Right to Erasure.
• The Right to Restrict Processing.
• The Right to Data Portability.
• The Right to Object to Certain Processing.
• Rights Relating to Certain Automated Decision-Making.

Some rights are subject to legal conditions and exemptions.

Where ProCertMax acts only as a processor for a customer's learner information, we may refer the request to the relevant customer or assist the customer in responding.

15. Exercising Your Rights

To exercise a privacy right relating to information for which TransFormIQ Ltd is the controller, contact:

• Email: support@procertmax.com

We may need to verify your identity before fulfilling a request.

Where your request relates to learner or certificate information uploaded by a training provider, you may also need to contact the relevant training organisation directly.

16. Automated Decision-Making

ProCertMax does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects on individuals.

If this changes, we will update this Privacy Policy and provide any information required by law.

17. Marketing Communications

We may send business or marketing communications where permitted by law.

Where required, you will be provided with an appropriate way to opt out of marketing communications.

Opting out of marketing does not prevent us from sending necessary service, security, billing or account communications.

18. Cookies and Similar Technologies

ProCertMax may use cookies or similar technologies for purposes such as:

• Authentication.
• Security.
• Maintaining User Sessions.
• Remembering Necessary Preferences.
• Understanding Platform Performance Where Permitted.

Further information will be provided in the ProCertMax Cookie Policy.

Where non-essential cookies require consent, they will not be used unless the appropriate consent has been obtained.

19. Children's Information

ProCertMax is a business platform and is not intended for use by children as account holders.

Training organisations remain responsible for ensuring they have an appropriate lawful basis when processing information relating to learners, including younger learners where applicable.

Customers should only upload information necessary for legitimate training and certificate-management purposes.

20. Links and Third-Party Services

ProCertMax may contain links to third-party services.

We are not responsible for the privacy practices of independent third-party websites or services.

Customers should review the relevant third party's privacy information where appropriate.

21. Changes to This Privacy Policy

We may update this Privacy Policy where our services, legal obligations or data-processing practices change.

Where changes are material, we will take reasonable steps to inform affected users.

The latest version will be made available through ProCertMax.

22. Complaints

If you have concerns about how we handle personal information, please contact us first so that we can investigate.

You also have the right to raise concerns with the UK Information Commissioner's Office where applicable.

23. Contact

For privacy questions, requests or concerns:

The production email address and registered office will be updated before Go-Live.