Privacy policy

Data controller: Auctore Limited

Registered address:
Level 37, 1 Canada Square
Canary Wharf
London
E14 5AA
United Kingdom

Email contact: support@auctore.com

Auctore has not appointed a Data Protection Officer. Data protection matters are handled by our management and security team.

We may process personal data relating to:

• Website visitors
• Prospective customers
• Customer administrators
• Learners/end users accessing training on behalf of their employer
• Individuals who contact us for support or enquiries

Auctore acts as data controller where we determine the purposes and means of processing, including:

• Website analytics and cookies
• Sales, marketing, and enquiry handling
• Account administration for customer contacts
• Compliance and security monitoring

Where an organisation (such as an employer or corporate customer) provides learner data and determines how training is assigned or used, that organisation is the data controller and Auctore acts as a data processor.

In these circumstances:

• We process learner data only on documented customer instructions
• Processing is governed by a Data Processing Agreement (DPA)
• Learners should primarily direct rights requests to their employer, although we assist as required

• Name
• Business contact details (email, organisation)
• Job title or role
• Account login credentials
• Training progress, completion records, and assessment results
• Communications sent to us (support tickets, enquiries)

Where training access is provided by an employer or customer, we may receive:

• Name and business email address
• Organisation and department
• Assigned training records and completion status

This data is typically provided at account creation or enrolment.

When you visit our website:

• IP address
• Browser type and version
• Device and operating system information
• Pages visited and interaction data
• Approximate location derived from IP
• Referral source

This data is collected using cookies and similar technologies (see Section 11).

We process personal data to:

• Provide and administer cyber risk awareness training
• Create and manage user accounts
• Track learner participation and completion
• Communicate with customers and users
• Respond to enquiries and support requests
• Improve our website, platform, and services
• Maintain platform security and prevent misuse
• Comply with legal and regulatory obligations

We rely on the following lawful bases:

• Contractual necessity – to deliver services under customer agreements
• Legitimate interests – for service operation, improvement, and security (balanced against user rights)
• Legal obligation – compliance with applicable laws
• Consent – where required (e.g. non-essential cookies, marketing)

Where consent is used, it may be withdrawn at any time.

We do not sell personal data.

We may share data with:

• Cloud hosting and infrastructure providers
• Analytics and monitoring providers
• Learning management or platform support services
• Professional advisers (legal, accounting, compliance)
• Regulatory or law enforcement bodies where legally required

All third parties are subject to contractual confidentiality and data protection obligations.

Some service providers may process data outside the UK or EEA.

Where this occurs, we ensure appropriate safeguards, including:

• UK adequacy regulations
• EU adequacy decisions
• Standard Contractual Clauses (SCCs)
• UK International Data Transfer Agreements (IDTAs)

We use cookies and similar technologies to:

• Enable essential website functionality
• Analyse website usage
• Improve performance and user experience

In line with ICO guidance:

• Non-essential cookies are not set without consent
• Users are offered equal options to accept or reject non-essential cookies
• Preferences can be changed at any time via our cookie management tool

Further details are available in our Cookie Policy.

We apply appropriate technical and organisational measures aligned with recognised good practice, including:

• Role-based access controls
• Encryption where appropriate
• Secure hosting environments
• Monitoring and logging
• Incident management procedures
• Regular security reviews

No system is entirely secure, and absolute security cannot be guaranteed.

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure (where applicable)
• Restrict processing
• Object to processing (including direct marketing at any time)
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

UK residents may contact the Information Commissioner's Office (ICO).

Where Auctore acts as processor, requests should usually be directed to the relevant customer organisation

Our services are intended for business users. We do not knowingly collect personal data from children.

For privacy or data protection enquiries:

Email: support@auctore.com

Post:
Auctore Limited
Level 37, 1 Canada Square
Canary Wharf
London
E14 5AA
United Kingdom