Privacy Policy

This policy explains how HygieneReady uses personal data. The data controller is HygieneReady, a sole trader business (enkeltpersonforetak) registered in Norway, organisation number [Organisation number]. Contact: hello@hygieneready.com. We follow the EU GDPR (which applies in Norway through the EEA Agreement) and the UK GDPR.

What we collect and why

• Account details (name, email, country): to give you access to the course. Legal basis: contract.
• Learning records (progress, quiz and exam results, certificates): to run the course, issue and verify certificates. They are kept in your browser and, with an account, on our server, so you can carry on from any device. Legal basis: contract.
• ID number (DNI or NIE), only if you add it to Spain's certificate: it is printed on the certificate and kept with it so the certificate can be issued again. It is never shown on the verification page. Legal basis: contract.
• Team records: if your employer invited you, they can see your progress, score and certificate. Legal basis: contract and your employer's legitimate interest in keeping training records.
• Messages and quote requests you send us: to answer you. Legal basis: legitimate interest.
• Sign-in and order notices: when you create an account, sign in or buy, we get a private notice, and keep a log, with your name, email, the approximate place of your connection (city and country, worked out from your IP address, which we do not keep) and the type of device, so we can follow sign-ups and spot misuse. Legal basis: legitimate interest.
• Payment details are collected by Stripe, not by us. We never see or store your card details; we receive the order details only.
• Visit statistics: when you open a page we add one to a daily count of that page, by the country you connect from, the site you came from and whether you use a phone, tablet or computer. We keep only those totals: no cookies, no IP address and nothing that identifies you. See the Cookie Policy. Legal basis: legitimate interest.

Certificate verification

Anyone with a certificate ID can see the learner's name, course, completion date, score, refresher date and status on the verification page. Email addresses are never shown.

Who we share data with

• Clerk, which manages accounts and sign-in
• Stripe, which processes payments and handles the VAT on each purchase
• Cloudflare, which hosts the website and our database and works out the country and city of each connection
• Telegram, which delivers the sign-in, order and quote request notices to us

Some of these providers process data outside the UK and EEA. Where they do, they use safeguards approved under the GDPR, such as standard contractual clauses.

How long we keep data

We keep learning records and certificates for 6 years after completion so certificates can still be verified, and order records as long as accounting law requires. You can ask us to delete your account earlier; the certificate will then no longer be verifiable.

Your rights

You can ask for a copy of your data, and to correct, delete, restrict or move it, or object to how we use it. Email us. You can also complain to Datatilsynet (Norway), the ICO (UK), the Data Protection Commission (Ireland) or the AEPD (Spain).