1. Who We Are
CREA Certification is a trading name of Zakeli Technologies Limited (Company No. 17156553), registered in England and Wales. Our registered address is in England. We operate the website at creacertification.org and the learning platform at app.creacertification.org.
For data protection purposes, Zakeli Technologies Limited is the data controller. You can contact us at support@creacertification.org.
2. What Data We Collect
We collect the following categories of personal data:
- Registration data: Your name and email address when you register interest in a certification.
- Examination data: Your exam attempts, scores, and pass/fail status.
- Payment data: Payment is processed by Stripe. We do not store your card details.
- Technical data: IP address, browser type, pages visited, and session data collected automatically when you use our website.
- Communications: Records of emails and messages between you and our support team.
3. How We Use Your Data
We use your personal data for the following purposes:
- To process your certification registration and examination
- To issue and verify your digital certificate
- To send you information about your chosen certification and related CREA credentials
- To respond to your enquiries and provide customer support
- To improve our website and platform based on usage patterns
- To comply with legal obligations
4. Legal Basis for Processing
We process your data on the following legal bases under UK GDPR:
- Contract performance: Processing necessary to deliver the certification services you have engaged us for.
- Legitimate interests: Improving our platform, preventing fraud, and communicating about related certifications.
- Consent: Where you have opted in to receive marketing communications.
- Legal obligation: Where we are required to retain data to meet regulatory requirements.
5. Data Sharing
We share your data only in the following circumstances:
- Service providers: Stripe (payment processing), Base44 (platform hosting), n8n (workflow automation), Resend (transactional email). All are subject to data processing agreements.
- LinkedIn integration: If you choose to add your certificate to LinkedIn, your credential data is shared with LinkedIn for that purpose.
- Legal requirements: Where required by law, regulation, or court order.
We do not sell your personal data to third parties.
6. Data Retention
We retain your personal data for as long as necessary to provide our services and comply with our legal obligations. Specifically:
- Registration interest data: 24 months from last contact
- Exam and certification records: 7 years (for certificate verification purposes)
- Payment records: 7 years (for financial reporting obligations)
7. Your Rights
Under UK GDPR, you have the following rights:
- The right to access your personal data
- The right to rectification of inaccurate data
- The right to erasure ("right to be forgotten"), subject to legal retention requirements
- The right to restrict processing
- The right to data portability
- The right to object to processing based on legitimate interests
- The right to withdraw consent where processing is consent-based
To exercise any of these rights, contact us at support@creacertification.org. We will respond within 30 days.
8. Cookies
Our website uses essential cookies required for the site to function. We do not use advertising or tracking cookies. Session data is stored locally in your browser and is not sent to third parties.
9. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our platform uses HTTPS encryption and access controls for all personal data.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. Continued use of our services after changes constitutes acceptance of the updated policy.
11. Contact and Complaints
For any privacy-related questions or concerns, contact us at support@creacertification.org.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.