Privacy policy

Version 1.0 · in force from 1 November 2026

The short version

We collect what we need to run your account, teach you, mark your assessments, issue your certificates and take payment. That's all.
No advertising, no analytics and no tracking cookies, and we never sell your data.
Certificates can be checked publicly. Anyone who has your certificate ID can see your name, the course, the date and that you passed. They can't see your score.
Card payments are handled by Stripe. We never see your card details.
Our servers are in the Netherlands. Some of the companies we use are based in the USA. Section 7 explains the safeguards.
You can ask to see, correct or delete your data at any time by emailing [email protected].

1. Who is responsible for your data

The controller of your personal data is A. Medwid, a sole trader trading as LearnQuality.

Email for anything about your data: [email protected]

2. What we collect, and why

What	Details	Why we use it	Legal basis
Your account	Your name (as it will appear on certificates), email address, whether and when you confirmed it, password and the date you joined. Which versions of our terms and of this policy were shown to you when you signed up, and when. We never keep your password in readable form, so nobody can read it, including us.	To create your account, log you in and contact you about it.	Contract: we need it to provide the service you signed up for.
Your learning	Practice quiz results (which quiz, score, date). Assessment attempts: which questions you were given and in what order, your score, and the times you started and finished. Your individual answers are marked and then not kept. Work you save in course exercises (for example, an FMEA you build).	To show your progress, mark your assessments fairly on our server, and keep your work for you.	Contract.
Your certificates	Your name, the course, your score, the pass mark, the date and the certificate ID.	To issue your certificate and let people you choose check it is genuine (see section 3).	Contract, and legitimate interests (keeping certificates verifiable).
Purchases	Which course you bought, the amount, currency, date and status (paid, refunded or disputed), plus Stripe's reference numbers for the payment. A record of your access to each course: when it started and ends, and if it was ended early, why. We don't receive or store your card details. Your request for immediate access: the exact wording of the tick box you were shown at checkout, its version, which versions of the terms and refund policy it linked to, the name and email on your account at the time, and when you ticked it. This is our evidence of what you agreed to. Withdrawals: if you use "Withdraw from contract here", which purchase, when you sent it, and what we decided. When you first used what you bought: the first time you opened each paid lesson and downloaded each template. Together with whether you've started the assessment (from your assessment attempts above), this decides whether our 14-day refund promise still applies.	To give you the access you paid for, confirm your purchase to you by email, handle withdrawals, refunds and chargebacks, and keep the accounts the law requires.	Contract: your access, and the confirmation email. Legal obligation: the payment records UK tax law requires. Legitimate interests (being able to show what was agreed and what happened if there's a dispute or chargeback): the tick-box record, withdrawals, and when you first used what you bought.
Account history	A record of important actions on your account, such as access granted or ended, a refund, or a password-reset link we issued for you. It contains references and dates, never your password or the link itself.	To keep an honest record we can check if something goes wrong or is disputed.	Legitimate interests (security and dealing with disputes).
Invitations	If we give you access before you have an account, we keep your email address, what we gave you, and when the invitation was sent and used. We get your email address from you or from the person who asked us to give you access (for example, your employer); the invitation email says so.	To give you the access, and to let only the holder of that email address take it up.	Legitimate interests (giving you access you've been offered).
Emails we send you	Only emails about your account and purchases: a link to confirm your email address, password resets, a notice when your password is changed, purchase confirmations (with the terms attached), withdrawal acknowledgements, and a note when an account is closed. If you join the waiting list (above), also the one email saying certificates are open.	To give you the information the law requires, on something you can keep.	Contract and legal obligation.
The waiting list for certificates	Only if you ask to be told when certificates open: your email address, when you gave it, and which page you gave it on. You don't need an account, and it isn't linked to one.	To send you one email when assessments and certificates open. Nothing else: no newsletters, no other offers. We don't sell it or use it for anything else, and we don't use a marketing service: the address is kept in our own database, and our email delivery service (section 5) sends that one email.	Consent. You can withdraw it at any time, with the link in that email or by emailing us, and we'll delete the address.
Password resets	When you ask for a reset, we email you a one-time link, and keep a record that we sent it.	To let you back into your account.	Contract.
Emails you send us	Whatever you choose to tell us.	To answer you and deal with your request.	Legitimate interests (answering you, and keeping a record of what was asked and answered), or contract if it's about a purchase.
Technical data	Like most websites, our hosting and network providers record each visit: your IP address, the date and time, the page or file requested, and your browser type. To stop password guessing and misuse, our server also keeps a count of recent requests: your IP address when you fail to log in, sign up, ask for or use a password-reset or email-confirmation link, join the waiting list, open an invitation or check a certificate; the email address typed into a failed login or a password-reset request; and your account number when you ask for a new confirmation link or try to close your account. Each is deleted automatically once it stops counting: within about an hour, or a day for certificate checks. A successful login leaves nothing behind. None of this is saved in our database. To show prices correctly (for example, with or without VAT for your country), we use the country Cloudflare works out from your IP address while the page loads; we don't store it.	To keep the site running and secure, and to stop password guessing and misuse.	Legitimate interests (security).

We don't collect any special category data (such as health or ethnicity), and we don't use your data for marketing. If we ever want to send you news, we'll ask first, separately.

Automatic marking: assessments are marked by computer against fixed answers, and that decides whether a certificate is issued. If you think a result is wrong, email us and the person who runs LearnQuality will review it personally.

3. Certificate verification is public

Each certificate has an ID, and a QR code that leads to it. Anyone who has the ID can check it on our verification page. The check shows:

your name;
the course;
the date it was issued;
that you passed, and that LearnQuality issued it.

It does not show your score, your email or anything else about your account. The IDs are long and random, so they can't be guessed. Only people you give the ID to (or who see your printed certificate) can look you up. If a certificate is withdrawn, the page says so and no longer shows your name.

Certificates stay verifiable even if you later close your account, because people you've shown them to may still need to check them. If you'd rather a certificate stopped verifying, ask us, or choose that when you close your account, and we'll withdraw it and remove your name from its record.

4. Cookies and storage on your device

We don't use advertising or analytics, and nothing here tracks you across other sites. We use only what the site needs to work, or what remembers something you chose:

What	What it does	How long
Login cookie	Keeps you logged in. Set only when you log in.	30 days from when you log in, or until you log out if that's sooner
Security-check cookie (set by Cloudflare)	Set only if your browser is asked to pass a quick security check; it tells Cloudflare, our network provider, that the check was passed.	Usually up to 30 minutes; Cloudflare sets the exact time (see Cloudflare's cookie policy)
Your place in the courses (browser storage)	Remembers which lessons you've marked done, your GD&T course progress and the learning path you chose. It stays on this device and isn't sent to us.	Until you clear this site's data in your browser
Guide settings (browser storage)	Remembers whether you've switched the GD&T guide on, off or to quiet, and whether you hid it for this visit. On this device only.	Until you clear this site's data; "hidden for this visit" ends when you close the tab
One-time codes from our emails (browser storage)	Holds the code from an email-confirmation or password-reset link while you use it. On this device only.	Until it's used or you close the tab
Offline copies (your browser's cache)	Copies of the site's pages and files, so the GD&T course still opens without a connection. They hold no personal data: logins, scores and certificates always come fresh from our server.	Until the next site update replaces them, or you clear this site's data

Your choices: the login cookie, the security check and the one-time codes are needed for what you asked for, so they can't be switched off while you use those features. The rest only remember things for you. You can refuse or remove them at any time, free, by clearing this site's data in your browser's settings or using a private window: the courses still work, but the site won't remember your place or your guide settings. You can also switch the guide off in the GD&T course.

When you pay, you're taken to Stripe's checkout page. Stripe uses its own cookies there, mainly to prevent fraud. See Stripe's cookie policy.

5. Who we share your data with

We only share data with the services we need to run LearnQuality. They act on our instructions, under data processing agreements, except where we say otherwise. We name the two you deal with directly; the others are described by what they do and where. If you'd like the name of any of them, ask us and we'll tell you.

Service	What they do for us	Where
Our hosting provider (a US-owned cloud hosting company)	Runs the website and stores its database and server logs.	Servers in the Netherlands. As a US company, its staff may be able to access data from the USA.
Cloudflare (Cloudflare, Inc., USA)	Delivers the website securely and quickly, and blocks attacks. All traffic to the site passes through it, and it passes on the emails you send to our contact address.	Its worldwide network, usually the data centre nearest to you.
Our email delivery service (a US-owned company)	Sends our emails: password resets, purchase confirmations, withdrawal acknowledgements and, if you joined the waiting list, the one email saying certificates are open. It receives your email address and the message.	Sent from its EU region (Ireland). Some account and delivery records may be held in the USA.
Stripe	Takes card payments. When you pay, Stripe collects your card and billing details and information about your device, and we pass it your email address, your account number and which course you're buying.	Stripe's UK and EU companies, with transfers worldwide as described in Stripe's policy.
Our email mailbox provider (a US-owned company)	Holds the emails you send to our contact address, and the notices our site sends us about your account (for example, when you send a withdrawal).	Its data centres, including in the USA.

Stripe processes your payment on our behalf, but it is also an independent controller for its own legal duties, such as fraud prevention and anti-money-laundering checks. For that part, Stripe's privacy policy applies.

We'd also share data if the law requires it, for example with HMRC, or with our professional advisers (such as an accountant) where needed. We never sell personal data.

6. How long we keep it

Data	How long
Account, learning records and saved work	While your account is open. You can close your account yourself on the Your account page, or ask us by email (we'll do it within one month). Closing it removes your name, email, password, progress, assessment attempts, saved work and the record of what you accepted at sign-up straight away, along with the records of our email-confirmation links (which hold the address each went to) and your address on any invitation sent to it. The purchase, consent and account-history records stay, linked only to an account number, apart from the copy of your name and email in the consent record (see "Purchase and payment records"). We don't currently delete inactive accounts automatically; if we start to, we'll tell account holders first.
Login sessions	30 days from when you log in, then deleted within a few minutes. Sooner if you log out or close your account.
Password-reset records	While your account is open, as part of its history; deleted when you close it.
Invitations	Once you take up an invitation, it's kept with your access records. If you close your account, your email address is removed from it straight away, and the invitation is deleted 12 months later. An invitation that's never taken up is deleted 12 months after its link expires or is cancelled.
Waiting-list address	Until we send the one email saying certificates are open, then deleted. Sooner if you use the link in that email or ask us. If certificates haven't opened within 2 years of you joining, we delete it anyway.
Purchase and payment records	6 years from the end of the UK tax year (which ends on 5 April) in which you bought, which covers what UK tax law requires. The tick-box record (including the name and email you had at checkout), any withdrawal, the record of when you first used what you bought, your access record for that purchase and the account history about it are kept for the same time, because they're our evidence of what was agreed. Then they're deleted automatically. The payment itself is kept only as the course, amount, currency and month, with nothing that links it to you, for our sales totals.
Certificates	Kept so they can be verified, including after you close your account, unless you ask us to withdraw them (section 3).
Account history	While your account is open. After you close it, entries about a purchase are kept with the purchase records (above); everything else, including the record of any free access you were given, is deleted automatically 12 months after you close it.
Server logs	Deleted automatically by our hosting provider after at most 30 days. Cloudflare keeps its own records for a short time, as set out in its policy.
Backups	An encrypted backup of the database is kept for up to 14 days, with our hosting provider in the EU. Data from a closed account can remain in a backup until that backup is replaced, at most 14 days later. We never restore it into the live site except to recover from a failure, and if we did we'd close the account again.
Emails to us	Up to 2 years after the matter is closed, unless they relate to a purchase (then as long as the purchase records).

7. Data sent outside the UK

Our database is stored in the Netherlands. UK law recognises EU countries as protecting personal data properly.

Our hosting provider, Cloudflare, our email delivery service and our email mailbox provider are US companies, so data may be accessed from or stored in the USA. Cloudflare, the email delivery service and the mailbox provider are certified under the UK Extension to the EU–US Data Privacy Framework, which UK law recognises as giving adequate protection. Our hosting provider's agreement with us uses the standard data protection clauses approved for UK transfers (the EU clauses with the UK Addendum). Stripe's own transfers are described in Stripe's policy. Ask us and we'll send you a copy of the safeguards we rely on.

8. How we protect it

The site is served only over encrypted connections. We never keep your password in readable form, and backups are encrypted. Only the person who runs LearnQuality can see learners' data, and only to run the service.

9. Your rights

You have the right to:

see the personal data we hold about you and get a copy;
correct it if it's wrong (you can change the name on your account yourself, but certificates already issued keep the name they were issued with, so ask us to correct one);
have it deleted, for example by closing your account (we may need to keep some records, as section 6 explains);
restrict how we use it, or object to us using it where we rely on legitimate interests;
take it with you, as a file you can use elsewhere;
ask for a person to review an automatic result, such as an assessment mark.

To use any of these, email [email protected] from the address on your account (or tell us how else we can confirm it's you). It's free. We'll reply within one month. If your request is complicated or you've sent several, we may take up to two more months, and we'll tell you within the first month if so.

Do you have to give us your data? No law requires you to. But you can't have an account without a name, an email address and a password, and we can't sell you a course or issue a certificate without the details in section 2. You can use the free lessons without giving us anything. Where we ever rely on your consent (for example, if you agree to news emails), you can withdraw it at any time, without affecting what we did before.

10. Complaints

If you're unhappy with how we've handled your data, please tell us first at [email protected]. We'll acknowledge your complaint within 30 days, look into it and tell you the outcome.

You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you live in the EU, you can complain to the data protection authority in your country.

11. Age

LearnQuality is for adults learning for work. Please don't create an account if you're under 18.

12. Changes

We'll update this policy when what we do changes. Each version shows its number and the date it was first published at the top of this page, and we keep a copy of every version. If a change matters, we'll tell account holders by email.