CPD Tag Privacy Policy

1	Privacy and UK Data Protection
1.1	The privacy and security of people using CPD Tag are important to us. This policy explains what personal information CPD Tag collects and uses, why it is needed, when it may be shared, how long it may be retained, and the choices and rights available to you.
1.2	This policy applies to CPD Tag and should be read alongside its Terms and Conditions.
2	Contact Details
2.1	CPD Tag is operated by Routine One Ltd, which is the data controller for personal information processed in operating the platform. For questions about this policy or to exercise your data protection rights, please contact info@cpdtag.com .
3	Background
3.1	Personal information is information relating to an identified or identifiable individual. In the UK, its use is governed principally by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended. These laws require us to use personal information fairly, transparently, securely and only for appropriate purposes.
4	CPD Tag and Your Personal Data
4.1	CPD Tag is designed to help you organise your Continuing Professional Development (CPD), maintain a record of your activities, plan future development and participate in CPD events. Depending on which features you use, CPD Tag may process the following categories of information:
(a)	Your name: CPD Tag asks for a name so that it can address you within the platform, identify you where necessary for event registration and attendance, and include your chosen name on reports and certificates. You may use a preferred display name; however, you are responsible for ensuring that names used on professional records or certificates are appropriate for their intended use.
(b)	Your email address and account details: An email address is used to identify and administer your account, support sign-in and account recovery, and send relevant service or event communications. CPD Tag also processes account settings and authentication information necessary to provide secure access.
(c)	Your CPD Activity Record: The primary purpose of CPD Tag is to help you create and maintain a record of CPD activities. Activities may be added manually or created through participation in CPD Tag events, including QR-code attendance and host confirmation. Records may include activity details, dates, durations, attendance status, learning reflections, supporting information and links to your CPD Plan. You can use these records to review your development and generate reports or certificates where the relevant conditions are met.
(d)	Your Professional Profile, CPD Plan and Portfolio: You can choose to record information about your education, career, qualifications, professional memberships and other experience, and upload supporting documents or images. You can also maintain development interests, skills, objectives and progress in your CPD Plan. Much of this additional information is optional. You should avoid uploading sensitive information that is not needed for your professional development purposes.
(e)	Event registration and attendance: When you register for an event, CPD Tag may record your chosen session, registration or waiting-list status, attendance and confirmation status, and related administration details. Event organisers may record or confirm attendance, including through QR-code check-in. If you provide a vehicle registration or indicate a photographic preference for an event, that information may also be recorded for the event's administration.
(f)	Event feedback: Where feedback is enabled, CPD Tag may store feedback or comments you choose to provide. Feedback is made available to the relevant CPD Host as explained in Section 8. Please avoid including unnecessary personal information about yourself or other people in free-text feedback.
(g)	Organisations and following: CPD Tag may record your relationships with CPD Hosts, such as organisations you follow, and use that information to show relevant events or deliver selected updates. Your preferences can be managed through the available platform controls.
(h)	Reports and certificates: CPD Tag can generate reports and certificates using information held in your account or recorded for an event.
(i)	Technical information: To operate and protect the service, we may process necessary technical data such as session identifiers, IP addresses, browser or device information and server or security logs.
4.2	We use this information to provide and administer accounts, CPD Records, Plans, Profiles and Portfolios; manage events and attendance; produce requested certificates and reports; deliver relevant communications; maintain platform security; respond to requests; and meet applicable legal requirements.
4.3	Some information is provided directly by you. Other information may be recorded by CPD Hosts when administering an event, or generated by CPD Tag as you use the service, such as attendance status or technical session data.
4.4	Your CPD Record, CPD Plan, Professional Profile and Portfolio are private to your account. Section 8 explains the event-related information available to CPD Hosts.
4.5	We seek to collect only information that is reasonably needed for the features you use. You can choose whether to add many types of professional information, supporting documents, CPD reflections and Plan entries. Certain information, such as account details and event registration information, is needed when you use the relevant feature.
4.6	CPD Tag uses a third-party hosting provider to operate the platform and store the information required to provide its functionality. Further details about hosting, data security and international transfers are provided in Section 10.
4.7	Our aim is to make it straightforward for people to maintain and evidence their professional development. Personal information is only used for the purposes described in this policy.
5	Legal Basis for Processing Personal Information
5.1	Data protection law requires us to have a lawful basis for processing your personal information. The lawful basis depends on the purpose for which the information is used.
5.2	Performance of a Contract
	When you register for CPD Tag, you enter into an agreement with Routine One Ltd under the platform's Terms and Conditions. We process personal information where necessary to provide the services covered by that agreement.
	This includes creating and maintaining your account, managing your CPD Record, CPD Plan, Professional Profile and Portfolio, recording participation in CPD events, and generating reports and certificates.
5.3	Legitimate Interests
	We process limited personal information where necessary for the legitimate interests of operating, maintaining and protecting CPD Tag, provided these interests are not overridden by your rights and freedoms.
	These interests include maintaining platform security, preventing misuse and retaining relevant historical event administration records where necessary and proportionate.
5.4	Consent
	Where particular optional features or communications require your consent, we will explain what you are agreeing to and provide an appropriate way to withdraw that consent.
5.5	Legal Obligations
	We may process personal information where necessary to comply with applicable legal obligations, including responding to requests or disclosures required by law.
6	Your Rights
6.1	Data protection law gives you a number of rights in relation to your personal information. These rights depend on the circumstances and are not absolute.
(a)	Right to be informed: You have the right to understand how your personal information is collected and used. This policy is intended to provide that information, and we will explain material new uses where required.
(b)	Right of access: You may ask for a copy of the personal information held about you. Much of your CPD information can be viewed within the platform, but some information, such as event administration or technical records, may not be shown in your account. Please contact us if you need access to information that is not available there.
(c)	Right to rectification: You may ask us to correct inaccurate or incomplete personal information. Many account and professional profile details can be updated directly in CPD Tag. Some records, such as host-confirmed event attendance, may require the relevant organiser to check or correct them.
(d)	Right to erasure: You may ask for your personal information to be erased in certain circumstances. CPD Tag provides options to remove activities and close an account, but deletion of an account does not necessarily mean that every historical event record is deleted immediately. Section 9 explains what may be retained and why.
(e)	Right to restrict processing: In certain circumstances you may ask us to limit how personal information is used while an issue is resolved. Contact us so that we can consider your request.
(f)	Right to object: You may object to processing based on legitimate interests in certain circumstances. We will consider your objection and stop the relevant processing unless there is a lawful reason to continue.
(g)	Right to data portability: In certain circumstances, you have the right to receive personal information you have provided to us in a structured, commonly used, machine-readable format, or to request that we transfer it directly to another provider where technically feasible. Please contact us if you wish to exercise this right.
(h)	Rights concerning automated decision-making: CPD Tag does not use automated decision-making or profiling to make decisions that have legal or similarly significant effects on users.
6.2	Requests to exercise your rights are normally free of charge. We will respond without undue delay and generally within one month, subject to any lawful extension or exception. We may need to verify your identity before disclosing or changing information. Where a request cannot be fulfilled in full, we will explain why and how you can challenge our response.
6.3	You can make a request by emailing info@cpdtag.com , including enough information for us to identify the relevant account or event. Please do not send passwords or unnecessary sensitive documents.
7	How to Complain
7.1	If you have concerns about how CPD Tag uses your personal information, please contact us at info@cpdtag.com . We will acknowledge data protection complaints within 30 days, investigate them appropriately and communicate the outcome without undue delay.
7.2	You can also complain to the Information Commissioner's Office (ICO) if you are unhappy with how your personal information has been handled or with our response.
	The ICO can be contacted at:
	Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
	Telephone: 0303 123 1113 Website: www.ico.org.uk
8	Sharing Information with CPD Hosts
8.1	When you register for an event, the relevant CPD Host can view your name, email address and any options you select during registration. The Host can also manage event registrations, waiting lists and attendance confirmation.
8.2	If you submit feedback about an event, the relevant CPD Host can view your feedback together with your name. If you subsequently close your account, your name is removed from the feedback.
8.3	When you choose to follow a CPD Host organisation, its administrators can see that you are following their organisation.
9	How Long Information Is Kept and What Happens on Deletion
9.1	While your account remains active, CPD Tag keeps the information needed to provide the features you use, subject to your ability to edit or remove particular records. We aim not to keep identifiable information longer than reasonably necessary for the purpose for which it is held.
9.2	When you close your CPD Tag account, your name, email address and login credentials are removed or anonymised. Your Professional Profile, CPD Plan, Portfolio, independently recorded CPD activities and account notifications are deleted.
	Records associated with CPD events you have participated in are retained to preserve the historical records of those events. Personal information such as vehicle registration details and learning reflections is removed from these records. Historical event records are retained for as long as they remain necessary for event administration and historical reporting.
	Any feedback you have submitted about events is retained, but your name is replaced with "Deleted User". Files that are no longer required by the platform are removed through our automated cleanup procedures.
9.3	If you have registrations for future events, CPD Tag may ask you to resolve those registrations before completing account closure through the self-service tools. You can still contact us about exercising your statutory privacy rights; self-service restrictions do not remove those rights.
9.4	Limited technical information, such as server and security logs, may be retained to maintain platform security and investigate technical problems. Backups are retained solely to safeguard data integrity and enable recovery in the event of data loss or corruption. Information deleted from the platform may remain in backups until they expire through normal backup rotation. Logs and backups are retained only for as long as necessary for these purposes.
10	Security, Hosting and International Transfers
10.1	We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse and accidental disclosure. These include account authentication, secure connections and controls restricting access to personal information and platform administration.
10.2	CPD Tag uses a third-party web hosting provider, with its servers located within the European Economic Area (EEA).
10.3	Where personal information is accessed or processed outside the UK or EEA, appropriate safeguards are applied in accordance with UK data protection law, including recognised international data protection arrangements where applicable.
11	Cookies, Sessions and Communications
11.1	CPD Tag uses session cookies to support secure sign-in and account access, and browser local storage to remember your settings and preferences. These technologies help the platform function correctly and retain your chosen settings between visits.
11.2	CPD Tag may send communications relating to your account, event registrations, attendance, security and other service matters. If you choose to follow a CPD Host, you may also receive notifications about events organised by that Host. Optional notification preferences can be managed through the settings provided within CPD Tag. Essential service communications may still be sent when necessary to operate your account or an event you have joined.
12	Updates to This Policy
12.1	We will review this policy when CPD Tag's functionality or data-handling practices change. The current version will be made available through CPD Tag, and we will draw material changes to your attention where appropriate.
	Last updated: 20 October 2026