Privacy notice
Last updated: 07-10-2026
This notice explains how RICI uses personal data in the LMS learning management system: the website where you register for courses and webinars, attend, sit assessments and receive certificates.
Who is responsible
RICI is the controller of the personal data described here. For any question about your data, or to use your rights, contact the RICI training office.
What we collect
- Identity and contact details: name, email, phone, address, country, company and job title.
- Registration details: the courses and webinars you register for, sales order and invoice references, and, for CQI-IRCA courses, the details on the Applicant Registration Form, including a copy of your ID document and its number.
- Training records: attendance, continuous assessment, exam answers and results, re-sit requests, certificates and course feedback.
- Online exam integrity: for invigilated online exams, webcam images and a log of browser events during the exam.
- Technical data: sign-in records and the security logs needed to protect accounts.
If you tell us about special needs for an exam, we use that only to arrange the support you asked for.
Why we use it
- To register you, deliver the course, record attendance, assess you and issue your certificate (to perform our agreement with you).
- To register you with CQI-IRCA and report results for certified courses, and to keep the records an approved training partner must keep (legal and contractual obligations).
- To invoice and keep accounting records (legal obligation).
- To keep the system secure and prevent exam misconduct (legitimate interests).
- To send you news about future courses and webinars, only if you agreed to it. You can withdraw that consent at any time.
Who we share it with
- CQI and IRCA (United Kingdom), for CQI-IRCA certified courses, under the CQI Learner Privacy Notice.
- Partner training organisations that deliver a course you registered for.
- Service providers that host the system and send its emails, under contract and only on our instructions.
We do not sell personal data. When data is transferred to another country, we use the safeguards the applicable law requires.
How long we keep it
We keep training and certificate records for as long as we must to confirm certificates and meet CQI-IRCA and legal requirements. Copies of ID documents, webinar contact details without marketing consent, and other records are deleted or anonymised after the periods set in RICI's retention policy.
Your rights
Depending on where you live, you can ask to access your data and receive a copy, correct it, have it erased, restrict or object to its use, and withdraw consent. Some records must be kept even after an erasure request, for example the record that a certificate was issued. If you have an account, you can download a copy of your data from your profile page. To use any other right, contact the RICI training office. We reply within one month.
You can also complain to the data protection authority where you live, for example the Saudi Data and AI Authority (SDAIA), the UK Information Commissioner's Office or a supervisory authority in the EU.
Security
Personal files such as ID documents are stored privately and opened only by authorised staff, every export of personal data is logged, and the site is served only over an encrypted connection.