# Privacy Notice Canonical URL: https://xpertdpo.com/privacy-notice/ Content type: Page Published: 2026-05-27T23:01:46+01:00 Updated: 2026-08-04T22:25:41+01:00 Author: Philipa Jane Farley, Head of Legal and Operations Summary: When someone contacts XpertDPO, the information they provide is used to understand the enquiry, identify the right conversation and respond... ## Page content Privacy notice # How XpertDPO and XpertAcademy use personal data. This notice covers website enquiries, professional services, direct retail orders, learner accounts, course delivery, certificates, security and rights. [Visit XpertAcademy](https://xpertacademy.com/) ![Professional privacy governance discussion](https://xpertdpo.com/wp-content/themes/xpertdpo-theme/assets/insights.jpg) Privacy notice**Clear information for professional learning and accountable service delivery.** Controller**XpertDPO Limited is responsible for direct retail Academy processing.** Purpose**Order and learning data is used to deliver, secure and evidence the service.** Control**Rights requests can be sent to dpo@xpertdpo.com.** # Privacy Notice **Version XPD-PRIVACY-2026.2. Effective 4 August 2026. Last reviewed 4 August 2026.** ### Who is responsible for your data XpertDPO Limited, trading as XpertDPO and XpertAcademy, is an Irish company registered with the Companies Registration Office under number 628375. Our contact address is 20 Harcourt Street, Dublin 2, D02 H364, Ireland. Privacy questions and rights requests can be sent to [dpo@xpertdpo.com](https://xpertdpo.com/mailto:dpo@xpertdpo.com). We act as controller when you visit our websites, contact us directly, engage us for our own services, or make a direct retail purchase and use a learner account through xpertacademy.com and xpertacademy.com/learning. Where an organisation appoints us to process personal data on its behalf, including organisation-sponsored Academy learning, the parties' respective roles are set out in the applicable agreement and data-processing terms. This public notice does not replace those terms. ### Scope of this notice This notice covers visitors to our websites, prospective and existing clients, people who contact us, and direct retail XpertAcademy learners. Our [Cookie Policy](https://xpertdpo.com/cookie-policy/) separately explains the website technologies and consent controls in use. ### Information used outside the retail Academy Depending on the relationship, we process identity and business contact details, enquiry and correspondence content, service and contract records, billing information, website technical and security logs, and cookie or analytics information where the required consent has been given. Please do not send unnecessary confidential, special-category, criminal-conviction or third-party personal data through a general website or email enquiry. Where a service requires sensitive information, we will agree an appropriate route and handling arrangement. ### Why we use this information | Purpose | Legal basis | | --- | --- | | Respond to an enquiry or take requested steps before a contract | Contract or steps requested before contract | | Deliver and administer an agreed service | Performance of the contract | | Administer billing, tax, accounting and legally required records | Legal obligation | | Protect systems, prevent misuse, operate the business and establish or defend legal claims | Legitimate interests in secure, accountable operation, balanced against individual rights | | Send marketing | Consent, or another lawful basis only where electronic-marketing law permits; every message includes an opt-out | | Use non-essential analytics, embedded media or similar technologies | Consent through the cookie controls | We do not use website or learner activity to make employment, disciplinary or similar decisions. We do not use learner activity to tailor marketing emails. ### Retention outside the retail Academy We keep records only for as long as needed for the purpose, applicable legal duties, contracts, disputes and our approved records schedule. Client, contract, invoice and accounting records may normally be retained for up to seven years after the relevant relationship or financial period. Routine records are reviewed and securely deleted or anonymised when no longer needed. A legal hold, investigation or live dispute may require restricted retention for longer. ### What the retail Academy collects Depending on how you use the service, we process: - identity and contact data, including name, email address, account identifiers and, where supplied, organisation and role; - billing and order data, including billing address, country, selected product, price, order status, invoice, refund and chargeback information; - payment administration data, including payment-provider reference, payment method type, amount and payment status. XpertDPO does not need to store your full payment-card number; - contract and consent evidence, including the version of the Terms and Cancellation Policy, immediate-access wording, acceptance status, timestamp and related communications; - provisioning data needed to connect the purchase to Moodle, including WordPress and Moodle account identifiers, product and course mappings, access start/end dates, enrolment status, retry state and limited error information; - learning data, including enrolments, activity access, course progress, completion, assessment or feedback responses where used, time and technical logs associated with learning; - certificate data, including learner name, course, issue and expiry dates and verification identifier or QR code; - support and communication data, including messages, requests, complaints and our response; - technical and security data, including IP address, browser/device data, authentication events, security alerts and server logs; and - cookie and analytics data described in the Cookie Policy, where the required consent has been given. We do not ask retail learners to provide special-category or criminal-conviction data. Do not place sensitive personal data in feedback, support messages or course activities unless we have specifically requested it through an agreed secure route. ### Why we use the data and our legal bases | Purpose | Legal basis | | --- | --- | | Display products, answer purchase questions and take pre-contract steps | Contract or steps requested before contract | | Create and secure the account, process the order, provision Moodle access, deliver learning, track progress, issue certificates and provide support | Performance of the contract | | Administer invoices, tax, refunds, accounting and legally required records | Legal obligation | | Prevent fraud and misuse, protect systems, reconcile paid orders with enrolment, diagnose faults and establish or defend legal claims | Legitimate interests in secure and reliable operation and legal accountability, balanced against individual rights | | Send marketing | Consent, or another lawful basis only where electronic-marketing law permits; every message includes an opt-out | | Use non-essential analytics, embedded media or similar technologies | Consent through the cookie controls | We do not use learner activity to tailor marketing emails or make employment, disciplinary or similar decisions. ### Automated provisioning After a valid immediate-access request and confirmed payment, our systems automatically match or create the necessary account, map the purchased event to its courses, set the 12-month access dates and attempt enrolment. Failed or inconsistent provisioning is retried and can be referred for human review. If the immediate-access request is not made, the current checkout does not place a paid order or start provisioning. This automation delivers the contract. It is not used to make a solely automated decision that produces legal or similarly significant effects about your suitability, employment or professional standing. Contact [academy@xpertdpo.com](https://xpertdpo.com/mailto:academy@xpertdpo.com) if the result is wrong or access is missing. ### Who receives the data Access is limited to authorised XpertDPO personnel and service providers who need the data for the purposes above. Recipient categories include: - hosting, backup, security and technical support providers; - email and customer-support providers; - the payment provider selected at checkout; - our cookie-consent provider for the existing consent controls; - embedded-media or anti-abuse providers only where their service is used and any required consent has been given; - accountants, auditors, insurers and professional advisers where necessary; and - regulators, courts, law enforcement or public authorities where disclosure is legally required. WordPress/WooCommerce, the XpertAcademy integration components and Moodle are the linked systems used by XpertDPO to deliver the retail service. The purchase and learning record is therefore used across these linked systems rather than remaining within one application. ### International transfers Where a provider processes personal data outside the European Economic Area, we use an applicable adequacy decision or approved safeguards such as Standard Contractual Clauses, together with supplementary measures where required. Specific transfer information is available from [dpo@xpertdpo.com](https://xpertdpo.com/mailto:dpo@xpertdpo.com). ### How long retail Academy data is kept The following retention periods govern retail Academy records. Where a dispute, investigation or legal hold applies, the relevant information may be retained for longer and access will remain restricted to the purpose requiring it. | Record | Retention period | | --- | --- | | Pending unpaid order | One month after last activity | | Failed or cancelled unpaid order | 24 months after last activity, unless needed for fraud, dispute or financial evidence | | Completed or refunded order, invoice, payment/refund reference and accepted contract/consent record | Seven years from the end of the relevant financial year, or longer while a live dispute, investigation or legal hold requires it | | Retail account and active entitlement | For the access period and while another active purchase exists | | Detailed learning activity, progress, feedback and platform account data | Access period plus 24 months, then delete or anonymise unless a dispute or legal hold applies | | Course completion and certificate verification evidence | Seven years from certificate award | | Provisioning failure diagnostics and retry detail | 12 months after resolution; retain only the minimal order/access audit for the longer contract period | | Routine security and authentication logs | 12 months, unless needed to investigate an incident or legal claim | | Support correspondence | 24 months after closure; longer only if it forms part of an order, complaint, dispute or legal record | | Marketing consent | Until withdrawal or the purpose ends; retain a minimal suppression record to respect an opt-out | | Cookie consent and browser storage | The period shown in the current Cookie Policy and consent declaration | | Backups | Under the approved backup rotation; expired records are not restored into live use and age out of protected backups | ### Your rights Subject to applicable law, you may ask for access, correction, erasure, restriction or portability of your personal data, or object to processing based on legitimate interests. You may withdraw marketing or cookie consent at any time without affecting earlier lawful processing. Some information cannot be erased immediately where it must be retained for tax, accounting, contract, certificate verification, fraud prevention, dispute or legal-claim purposes. We will explain any applicable restriction. Send a request to [dpo@xpertdpo.com](https://xpertdpo.com/mailto:dpo@xpertdpo.com). We may ask for information needed to verify identity. You can complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland, at [https://www.dataprotection.ie/](https://www.dataprotection.ie/). ### Children The direct retail Academy is intended for adults aged 18 and over. We do not knowingly offer these retail products to children. Organisation-sponsored learning involving younger learners requires a separately assessed and agreed arrangement. ### Security and changes We use proportionate technical and organisational controls, including access control, encryption in transit, monitoring, backup and incident response. No internet service is risk-free. We will update the notice when material processing changes. The current version and effective date will remain visible. Material changes affecting existing learners will be communicated where required. Questions ## Speak to the right team. For Academy purchase or access questions, contact academy@xpertdpo.com. For privacy rights or data-protection questions, contact dpo@xpertdpo.com. [Contact XpertDPO](https://xpertdpo.com/contact/)