Privacy Policy

NProject is a company registered in England and Wales under company number 12098527. Our registered office is:

Email: hello@nproject.co.uk

For the purposes of applicable UK data protection law, NProject is generally the data controller of the personal information described in this Privacy Policy.

In some consultancy assignments, we may process personal information solely on the instructions of a client. In those circumstances, the client is normally the controller and NProject acts as its processor. The client's privacy information will govern that processing, and our responsibilities will also be set out in our contract with the client.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information relating to:

• visitors to our website;
• people who contact us or book a discovery call;
• individual and corporate customers;
• consultancy clients and their personnel;
• delegates, learners and course participants;
• people whose employer or another organisation purchases training for them;
• newsletter subscribers and business contacts;
• trainers, consultants, suppliers and professional partners;
• job applicants, contractors and prospective workers; and
• people who exercise their data protection rights or make a complaint.

It applies to our consultancy, project and programme management, Agile, Waterfall and Scrum services, business analysis, process-improvement services, professional training, PMP and CAPM-related training, Certified Sustainable Project Professional training and other courses delivered by or through NProject.

New programmes and online services

This policy also applies to applications for the NProject free-training initiative; learner referral and PMP affiliate programmes; reward and commission administration; testimonial-video submissions; online course purchases; and Cal.com consultation bookings.

NProject delivers live virtual instructor-led training and may offer in-person corporate training for PMP, CAPM and Certified Sustainable Project Professional (CSPP) courses, including the relevant CSPP pathways, by arrangement. In-person delivery depends on client requirements, location, instructor and venue availability, and applicable PMI/GPM training-partner permissions. We may also introduce self-paced, on-demand digital courses in the future. Processing relating specifically to those future courses will apply only when those services become available; we will provide any additional privacy information needed at that time.

Depending on your relationship with us, we may collect the following categories of personal information.

Identity and contact information

This may include your name, title, employer, job title, business or home address, email address, telephone number, signature and professional contact details.

Enquiry and communication information

This includes information contained in website forms, emails, telephone calls, discovery-call bookings, proposals, feedback, surveys, complaints and other correspondence.

Client and consultancy information

This may include project roles, stakeholder information, meeting details, project documentation, access permissions, professional opinions, work products and other information needed to provide consultancy or project services.

You should not send us personal information about other people unless you are authorised to do so.

Training and professional-development information

This may include:

• course registrations and bookings;
• employer or sponsoring-organisation details;
• attendance and participation records;
• learning requirements;
• assessment results and submitted work;
• course feedback;
• certificates and certificate identifiers;
• professional membership or credential details;
• continuing professional development or professional development unit information; and
• information required by an accreditation, certification or training partner.

For in-person corporate training, including eligible PMP, CAPM and CSPP corporate courses, we may collect the training location, attendance and venue-access arrangements, and information you voluntarily provide about reasonable adjustments. If self-paced courses become available, we may collect learning-platform account identifiers, course access and platform-activity records, module progress, assessment results, completion records and learning-support communications as needed to deliver the course.

Payment and transaction information

This may include billing addresses, purchase orders, invoice details, payment status and transaction references.

Where payment-card information is collected through a payment provider, the card information is normally submitted directly to that provider. We do not normally receive or retain complete payment-card numbers or card security codes.

Marketing information

This includes newsletter subscriptions, marketing preferences, consent records, event interests and records of whether you opened or interacted with a communication, where applicable.

Website and technical information

This may include your IP address, browser and device information, approximate location, pages visited, referring website, dates and times of access, cookie identifiers, security logs and information about how you use our website.

Recruitment and employment information

This may include CVs, employment history, education, professional qualifications, references, interview notes, right-to-work information, remuneration expectations and information supplied by recruiters or job boards.

Successful applicants and workers will receive further privacy information where appropriate.

Additional information for NProject programmes

For free-training applications, we may collect the course sought, student or professional status, a description of financial need, declarations about course prerequisites and, from shortlisted applicants where needed, proportionate evidence supporting eligibility. We ask applicants to redact unrelated information. We do not routinely require full bank statements, identity documents or medical records as evidence of financial need.

For learner referrals, we may collect application details, evidence of prior NProject learning and completion, referral codes, the referred learner's order reference and eligibility status, reward amounts, bank-payment details where a payment is approved, and audit records for consent and approval.

For affiliates, we may collect contact and business information, signed-agreement records, affiliate codes, associated eligible purchases, commission calculations, payment and tax administration records, and information required to investigate suspected misuse.

For submitted testimonials, we may process video and audio recordings, associated names or likenesses, upload references, consent choices and publication permissions. Applying for a referral code and permitting public use of a testimonial are distinct activities.

Our checkout and course-booking processes may generate Stripe payment identifiers, receipts, refund and dispute status, course and cohort details, training-order records, seat allocations and training enrolments. Consultation bookings may include selected appointment time, contact information, calendar invitations and information provided in connection with the meeting.

We do not routinely request special-category information from customers or learners.

However, we may need to process limited health, disability, accessibility, dietary or similar information where this is necessary to provide reasonable adjustments, protect someone's wellbeing or safely deliver a course or event.

We may also process special-category information in connection with employment, equality monitoring, legal claims or legal obligations.

Where we process special-category information, we will identify an appropriate lawful basis and an additional condition under applicable data protection law. Depending on the circumstances, this may include explicit consent, employment and social-protection obligations, substantial public interest, protection of vital interests or the establishment, exercise or defence of legal claims.

Information about criminal convictions or offences will only be processed where necessary and where an appropriate legal condition applies, for example for a role or client assignment requiring lawful vetting.

Information supplied in support of financial need

Financial hardship information will be reviewed only by people with an operational need to assess applications. It will not be used for public storytelling, marketing or testimonial content. Applicants should not include medical or other especially sensitive details unless NProject specifically and lawfully requests them for an identified purpose. Where evidence does reveal special-category information, we will assess whether an additional legal condition is available and will avoid retaining unnecessary details.

We may obtain information:

• directly from you;
• from your employer, client or sponsoring organisation;
• from a training, certification or accreditation partner;
• from trainers, consultants, subcontractors or referral partners;
• from publicly available professional sources, such as a business website or professional networking profile;
• from recruitment agencies, job boards and referees;
• through our website, booking tools, email systems and course platforms; or
• from one of our consultancy clients where we are providing services on the client's behalf.

Where another organisation gives us your information, that organisation is responsible for ensuring it has an appropriate basis for doing so.

We use personal information only where we have a lawful basis for doing so.

Responding to enquiries and preparing proposals

We use contact and enquiry information to respond to questions, arrange discovery calls, understand requirements and prepare proposals or quotations.

Our lawful bases are:

• taking steps at your request before entering into a contract; and
• our legitimate interests in responding to enquiries and developing appropriate business relationships.

Providing consultancy and professional services

We use information to plan, manage and deliver consultancy, project management, programme management, business analysis, process-improvement and related services.

Our lawful bases are:

• performance of a contract with you;
• our legitimate interests and those of our corporate clients in administering and delivering agreed services; and
• compliance with legal obligations.

Administering and delivering training

We use learner and delegate information to:

• register participants;
• communicate course arrangements;
• provide course materials;
• deliver classroom, virtual or blended training;
• monitor attendance and participation;
• conduct assessments;
• issue certificates;
• answer learner questions;
• provide reasonable adjustments;
• collect feedback; and
• maintain appropriate training and verification records.

For in-person corporate sessions, we may use necessary learner and logistical information to arrange venue access, manage attendance, communicate joining instructions and make reasonable adjustments. We may share limited practical details with the client, venue or trainer where necessary and appropriate. We do not routinely share sensitive adjustment or health information with venues or employers unless the disclosure is necessary, lawful and appropriately explained.

When self-paced or on-demand courses are introduced, we may use learning-platform account, access, activity, progress and assessment information to provide course content, learner support, completion records and technical assistance. The usual lawful bases will be performance of a contract, our legitimate interests in maintaining and improving course delivery, and consent where legally required for optional features or non-essential tracking. Specific platform providers, cookies and any additional data uses will be explained before those courses launch.

Our lawful bases are:

• performance of a contract or taking steps before entering into a contract;
• our legitimate interests in properly administering and improving our training services;
• compliance with legal obligations; and
• consent where a particular optional activity requires it.

Certification, accreditation and professional-development reporting

Where applicable, we may use or share learner information to:

• confirm attendance or successful completion;
• verify certificates;
• administer professional development units or equivalent credits;
• satisfy accreditation or quality-assurance requirements; and
• support applications or records connected with PMI, GPM or another relevant professional body.

The lawful basis will normally be performance of a contract, our legitimate interests in providing accredited or professionally recognised training, or consent where the sharing is optional.

PMI, GPM and other professional or certification bodies may process information as independent controllers for their own credentialing, accreditation, quality-assurance or membership purposes. Their own privacy notices will apply to that processing.

Employer-sponsored and corporate training

Where an employer, client or other organisation books or pays for training, we may provide that organisation with information reasonably necessary to administer the booking. This may include registration, attendance, completion status, assessment outcomes or certificate information.

We will not normally disclose detailed assessment responses, health information or confidential learner communications unless this has been clearly explained, is necessary for the service, is required by law or the learner has agreed.

The sponsoring organisation may be a separate controller of the information it receives.

Payments, accounting and business administration

We use transaction and contact information to take payments, issue invoices, manage accounts, recover debts, maintain business records and meet tax, accounting and regulatory obligations.

Our lawful bases are performance of a contract, compliance with legal obligations and our legitimate interests in managing our business and recovering amounts owed.

Managing suppliers, trainers and partners

We use business contact, contract, qualification and payment information to select, engage, manage and pay trainers, consultants, subcontractors, suppliers and professional partners.

Our lawful bases are performance of a contract, compliance with legal obligations and our legitimate interests in managing our supply chain and maintaining service quality.

Marketing and professional communications

We may send newsletters, course announcements, event information, professional insights and information about services that may be relevant to you.

For individual subscribers, we will normally rely on consent where PECR requires it.

For certain business-to-business communications, we may rely on our legitimate interests where the communication is lawful under PECR and is relevant to the recipient's professional role.

Every electronic marketing message will provide an appropriate unsubscribe or opt-out method.

You have an absolute right to object to the use of your personal information for direct marketing at any time.

We may retain a minimal suppression record after you unsubscribe so that we can ensure that we do not add you back to marketing lists.

Website operation, analytics and security

We use technical information to operate and secure the website, detect abuse, troubleshoot problems, understand website performance and improve the experience provided to visitors.

Our lawful bases are our legitimate interests in maintaining a secure and effective website and consent where consent is required for a particular cookie or similar technology.

Recruitment

We use applicant information to assess suitability, communicate with candidates, arrange interviews, verify information and make recruitment decisions.

Our lawful bases may include taking steps at the applicant's request before entering into a contract, our legitimate interests in recruiting suitable personnel and compliance with employment and immigration obligations.

We will not rely on an assumption that submitting a CV constitutes consent for every possible use of the information.

Legal obligations, complaints, security and claims

We may use information to:

• respond to data protection requests and complaints;
• protect our systems, personnel, learners and clients;
• prevent or investigate fraud and misuse;
• comply with a court order or legal obligation;
• obtain legal advice;
• establish, exercise or defend legal claims; and
• cooperate with regulators and law-enforcement authorities.

Our lawful bases may include legal obligation, legitimate interests and, where applicable, a recognised legitimate interest provided by UK data protection law.

Free-training initiative and eligibility review

We process applications to assess published eligibility criteria, verify financial need and professional prerequisites, select recipients, communicate outcomes, allocate available training places and investigate material misrepresentations. Depending on the activity, our lawful bases are steps requested before entering into a training arrangement and our legitimate interests in administering limited supported places fairly, preventing misuse and keeping adequate decision records. Where a separate legal obligation applies, we may also rely on that obligation. A financial-hardship declaration does not, by itself, authorise us to use details for marketing.

We may receive an eligibility referral or verification from a university, charity or other supporting organisation only where the information has been shared lawfully. We do not make solely automated decisions producing legal or similarly significant effects; eligibility decisions involve human review.

Referral programme administration

We process referrer eligibility and prior-course-completion records, codes, referred purchases, reward status and bank-payment details to administer the referral programme, avoid duplicate or self-referrals, investigate misuse and pay approved rewards. Our lawful bases are performance of the programme agreement or steps requested before entering it; legitimate interests in accurate records and fraud prevention; and legal obligation for applicable financial recordkeeping. Referral participation does not automatically subscribe anyone to marketing.

Returning Learner Loyalty Discount

NProject may use existing customer records, previous course purchases, payment status and relevant refund or cancellation information to determine eligibility for our 10% returning-learner loyalty discount on second and subsequent qualifying purchases.

We process this information to administer the loyalty offer accurately, verify eligibility and prevent duplicate or fraudulent discount claims.

Our lawful bases are performance of a contract or taking steps before entering into a contract, and our legitimate interests in administering promotional offers fairly and preventing misuse.

The loyalty discount cannot be combined with referral or affiliate discounts, as explained in our Training Terms & Conditions.

PMP affiliate programme administration

We process affiliate applications, contracts, eligible order attribution, commission records, communications and payment details to assess applications, fulfil agreements, determine commissions and meet accounting obligations. Our lawful bases are performance of a contract or pre-contract steps, legal obligations and legitimate interests in programme integrity and fraud prevention. We do not assume that participation authorises unrelated marketing.

Testimonials, recordings and optional publication

We process submitted videos to review applications and administer the relevant programme. Referrers may separately choose to give NProject specific consent to publish their testimonial video, name, image, voice and words on our website or other identified promotional channels. Where that consent is given, NProject may review and select the testimonial for public publication; submitting a video or giving permission does not mean it will be published automatically. Refusing optional publication permission does not prevent us from assessing the application under the programme rules. Once published, the testimonial may be viewed, shared or copied by others, including on third-party platforms. Publication consent may be withdrawn at any time by contacting hello@nproject.co.uk. We will stop future publication and take reasonable steps to remove the testimonial from channels under our control; withdrawal does not retrospectively make earlier lawful use unlawful, and copies made independently by others may remain available.

Website payments and consultation bookings

We use Stripe-hosted payment services to take payments and handle transaction outcomes; GoHighLevel to manage relevant customer records, course orders, seat allocations, enrolments, application workflows and messages; and Cal.com for optional consultation scheduling. Processing for a requested purchase or meeting generally relies on contract or pre-contract steps. Security, auditing and fraud prevention may rely on legitimate interests; applicable accounting or regulatory processing relies on legal obligation. These third parties may handle information under their respective contractual roles and privacy notices.

Where we rely on legitimate interests, those interests may include:

• operating and developing our consultancy and training business;
• responding to business enquiries;
• managing professional and corporate relationships;
• administering contracts and services;
• improving service quality;
• maintaining accurate training and certification records;
• protecting systems and confidential information;
• preventing fraud and misuse;
• recovering debts; and
• establishing, exercising or defending legal claims.

We consider whether the proposed processing is necessary and proportionate and balance our interests against the rights and reasonable expectations of the people concerned.

Certain information is necessary for us to enter into or perform a contract, administer a course, meet an accreditation requirement or comply with the law.

Where required information is not provided, we may be unable to:

• respond fully to an enquiry;
• provide a quotation;
• enter into or perform a contract;
• register you for training;
• provide an adjustment;
• process payment;
• issue or verify a certificate; or
• report professional-development activity.

We will explain where particular information is mandatory.

We will tell participants in advance where a training session, webinar or event may be recorded or photographed.

Where appropriate, we will provide a non-recorded participation option or obtain consent. We will not use a learner's image, recorded contribution or testimonial for promotional purposes without an appropriate lawful basis and any consent required by law.

Consent may be withdrawn for future use, although withdrawal will not affect processing that was lawful before consent was withdrawn.

Referral testimonial-video safeguards

Videos submitted with a referral application are intended for restricted review until NProject has confirmed the applicant's separate publication consent and decided to publish them. Permission to publish is not permission for an uploaded file to be exposed publicly before that decision. Some media-storage links may be accessible to anyone who knows the URL unless suitable access controls are configured. NProject will assess and restrict access to unpublished uploads, limit circulation to authorised reviewers and correct any storage configuration that exposes unpublished material inappropriately. A publication-consent checkbox alone is not an adequate substitute for technical access controls.

Our website uses cookies and similar storage or access technologies.

Some technologies are necessary for security, network communication or a service requested by the visitor. Other technologies may be used for analytics, functionality or marketing.

Where consent is legally required, a non-essential technology will not be activated until the visitor has made an appropriate choice.

Further information about the technologies used, their providers, purposes and duration should be provided in our separate Cookie Policy and cookie-preference tool.

Embedded calendar, forms and payment tools

Third-party scheduling widgets, forms, payment flows, analytics or embedded media may set or access browser information. Before enabling a technology that requires consent, we will present an appropriate choice. Our Cookie Policy and preference mechanism should identify the technologies actually deployed, their purposes and retention durations rather than assuming every embedded service is strictly necessary.

We may share personal information with the following categories of recipient where necessary:

• corporate clients, employers and organisations sponsoring training;
• trainers, consultants, associates and subcontractors involved in service delivery;
• professional, certification and accreditation organisations, including PMI and GPM where applicable;
• website-hosting, form-management, email, cloud-storage, booking, learning-management, video-conferencing and IT-support providers;
• payment processors, banks and fraud-prevention providers;
• accountants, auditors, insurers, solicitors and other professional advisers;
• recruitment providers, referees and background-check providers;
• regulators, courts, government bodies and law-enforcement authorities;
• parties involved in a proposed or completed business sale, merger, restructuring or investment; and
• other recipients where you have asked us to make a disclosure or have consented to it.

Specific services used by the current website

Our online services currently include Stripe (payment processing), GoHighLevel (customer relationship management, forms, training administration and communications), and Cal.com (consultation scheduling). Appropriate additional hosting, analytics, video-storage, cloud and email providers may be involved. Provider availability, role, processing location and any non-essential trackers must be checked against the deployed website and supplier agreements. We do not claim that every supplier always acts solely as a processor; some may act as an independent controller for particular services.

Service providers acting on our behalf are required to process information only for authorised purposes and to protect it appropriately.

We do not sell personal information.

Some of our service providers, professional partners, certification bodies, trainers or clients may be located outside the United Kingdom. Personal information may therefore be accessed or processed in another country.

Where UK data protection rules on international transfers apply, we will use an appropriate transfer mechanism. Depending on the destination and circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission's Standard Contractual Clauses; or
• another transfer mechanism permitted by UK law.

Where required, we will assess whether the transfer provides a standard of protection that is not materially lower than the protection provided under UK data protection law and implement additional safeguards where appropriate.

You may contact us for further information about the safeguards relevant to your information.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, contractual, accreditation, accounting and dispute-resolution requirements.

Our usual retention periods are:

• Enquiries and prospective-client information: up to 24 months after the last meaningful contact, unless a relationship continues or a longer period is justified.
• Client contracts, consultancy records and important correspondence: normally six years after the end of the client relationship or completion of the relevant service.
• Training registration, attendance, assessment, completion and certificate records: normally six years after the course, or longer where required by an accreditation, verification or professional-development scheme.
• Financial, invoice and tax records: normally six years from the end of the relevant company financial year, or longer where required by law or an ongoing enquiry.
• Marketing information: until you unsubscribe, withdraw consent or object, subject to periodic review. Minimal suppression information may be retained for as long as necessary to respect an opt-out.
• Website security logs: normally no longer than 12 months unless needed to investigate a security incident.
• Cookie and analytics information: for the periods stated in our Cookie Policy or cookie-preference tool.
• Unsuccessful job applicants: normally six months after the recruitment process. With the applicant's agreement, limited information may be retained for up to 12 months for suitable future roles.
• Data protection requests and complaints: normally three years after closure, or longer where needed for an actual or anticipated legal claim.
• Employee and contractor records: in accordance with our internal employment-record retention schedule and any separate workforce privacy notice.

Additional programme retention

Free-training applications and supporting financial evidence: for unsuccessful applicants, supporting financial documents will normally be securely deleted within 90 days after the application decision. If an active complaint, appeal, suspected fraud investigation or legal obligation requires longer retention, we will retain only what is necessary for that purpose and delete it once the reason ends. We may keep a minimal application and decision record for an appropriate, separately documented period to administer the initiative and evidence fair selection. For successful applicants, supporting evidence will be held only for the period needed to verify eligibility and administer the award, subject to a documented retention schedule and any applicable legal or dispute-related requirement.

Referrals, affiliates, transactions and commission or reward payments: records relevant to agreements, payments, disputes and tax/accounting obligations are retained for the applicable contractual and financial-record periods, normally up to six years where appropriate. Information that is not needed for those purposes is removed sooner.

Unpublished testimonial videos: retained only for a documented review and follow-up period, with a separate retention decision for content authorised and selected for publication. NProject will document the exact period before accepting production submissions. Consent and withdrawal audit records may need to be retained longer to demonstrate compliance.

We may retain information for longer where litigation, a regulatory investigation, a tax enquiry or another legal requirement makes this necessary.

At the end of the applicable period, information will be securely deleted, anonymised or placed beyond routine use.

We use appropriate technical and organisational measures designed to protect personal information from accidental or unlawful loss, alteration, destruction, unauthorised access or disclosure.

Measures may include:

• access restrictions based on job responsibilities;
• password and account-security controls;
• multi-factor authentication where available;
• secure cloud and storage services;
• encryption where appropriate;
• backups and business-continuity measures;
• confidentiality obligations;
• supplier due diligence and contracts;
• data-minimisation practices; and
• procedures for identifying and responding to personal-data breaches.

No electronic system can be guaranteed to be completely secure. We regularly review the measures appropriate to the nature and risk of our processing.

We do not currently make decisions about customers, learners or applicants solely by automated means where the decision would have a legal or similarly significant effect on the person.

If this changes, we will provide appropriate information about the logic involved, the significance and expected consequences of the processing, and the available safeguards and rights.

Our website and services are generally intended for business professionals and adult learners.

Where we knowingly provide training or another service to a person under 18, we will take appropriate steps to provide suitable privacy information, minimise the information collected and obtain parental, guardian or organisational authorisation where required.

Depending on the circumstances and the lawful basis used, you may have the right to:

• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request erasure of your information;
• request restriction of processing;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• receive information you provided in a structured, commonly used and machine-readable format and have it transmitted to another controller where the right to data portability applies;
• withdraw consent at any time where processing is based on consent; and
• challenge certain decisions made solely through automated processing.

These rights are not absolute, and an exemption or another legal requirement may sometimes apply.

To exercise a right, contact hello@nproject.co.uk. You may make a request verbally or in writing, although written requests can help us understand what you require.

We may request information reasonably necessary to verify your identity or clarify the information covered by your request.

We will normally respond without undue delay and within one calendar month. The response period may be paused where legally permitted while we await information reasonably required to identify you or clarify the request. Where a request is complex or you have submitted multiple requests, the period may be extended by up to a further two months. We will tell you if an extension applies.

We will not normally charge a fee. A reasonable fee may be charged, or a request may be refused, only where permitted by law, including where a request is manifestly unfounded or excessive.

Withdrawing consent will not affect the lawfulness of processing carried out before the withdrawal.

You have the right to complain to us if you believe that we have not handled your personal information in accordance with data protection law.

Please send your complaint to:

Email: hello@nproject.co.uk

Suggested subject line: Data Protection Complaint

Please include enough information for us to understand:

• who you are;
• what processing or information concerns you;
• what you believe went wrong; and
• what outcome you are seeking.

We will acknowledge a data protection complaint within 30 days of receiving it.

We will take appropriate steps to investigate and respond, keep you reasonably informed where an investigation remains ongoing and communicate the outcome without undue delay.

You also have the right to make a complaint to the UK supervisory authority:

You do not have to pay to make a complaint to the Information Commissioner's Office.

We would appreciate the opportunity to address your concern directly, but your right to contact the Information Commissioner's Office is not affected.

Our website may contain links to websites and services operated by other organisations, including booking, mapping, professional-body and social-media services.

Those organisations may collect personal information as independent controllers. Their own privacy notices and terms will apply. We are not responsible for the privacy practices of an external website or service that we do not control.

We may update this Privacy Policy where our services, systems, suppliers or legal obligations change.

The current version will be published on our website with the date of the latest update. Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected people.

For questions about this Privacy Policy, our use of personal information, your data protection rights or a data protection complaint, contact:

Email: hello@nproject.co.uk