Operam Academy Privacy Notice

This Privacy Notice explains how Operam Limited (trading as Operam Academy) collects, uses, stores and shares personal data when you visit our website, use our Learning Platform, use our Community Platform, contact us about Operam Academy services, or otherwise interact with us in connection with those services.

It describes:

• what personal data we collect
• how and why we use it
• who we share it with
• how long we keep it
• the rights you have under UK data protection law

Your personal data will be processed in accordance with this Privacy Notice and applicable data protection laws.

Where consent is required by law (for example for certain cookies or marketing communications), we will request it separately.

We may update this Privacy Notice from time to time to reflect changes to our services or legal requirements. Any updates will be published on the website and the “last updated” date will be updated accordingly.

1. Scope and Definitions

In this Privacy Notice:

• “Website” means the Operam Academy website at operamacademy.com.
• “Learning Platform” means the online learning environment through which users access Operam Academy courses, learning materials, assessments, certificates and related learning services. It is currently accessed via login.operamacademy.com and, for some corporate customers, via a customer-specific Operam Academy subdomain such as [customername].operamacademy.com. The Learning Platform is provided through eFront, a learning management system made available to us by Epignosis UK Ltd.
• “Community Platform” means the online community environment through which eligible members access discussions, events, recordings, member content and related community features. It is currently accessed via alumni.operamacademy.com.
• “Certification Platform” means a third-party digital credential service we use to issue, manage or verify digital badges, certificates or other credentials, currently Credly.
• “Platforms” means the Website, the Learning Platform and the Community Platform, together with any related online services that we make available under the Operam Academy brand. The Certification Platform is not operated by Operam and is treated separately in this Privacy Notice.

The way we process personal data may differ depending on which Platform you use and whether we act as a data controller or as a data processor on behalf of a customer organisation.

2. Who We Are

Operam Limited (“Operam”, “we”, “us” or “our”) provides advisory services and educational products to organisations within the construction industry. Operam Academy is the training arm of Operam and provides specialist training relating to information management and the collaborative production of information, including BIM. Operam Limited is located at Devonshire Business Centre, Works Road, Letchworth, Hertfordshire, SG6 1GJ, United Kingdom.

Our role under data protection law depends on the personal data in question, and we may act in more than one role in the same customer relationship.

We are the data controller for personal data collected through the Website, the Community Platform, and our own customer, sales and marketing activities; for the personal data of an individual who buys from us for themselves; and for our own certification function — deciding who meets an assessment standard, and awarding, verifying and retaining certifications. Where we are the controller, this Privacy Notice governs and you can exercise your rights with us directly (see Section 9).

We are a data processor where a business supplies us with other people’s personal data so that we can provide access or enrol them — in particular the account, enrolment and learning-activity data of learners on a TEAM or ACADEMY Licence, and of delegates on a closed cohort. In those cases the organisation is the data controller and decides how the data is used; we process it on that organisation’s instructions under our UK Data Processing Agreement (UK DPA). This Privacy Notice is provided for transparency, and you should raise questions or requests with that organisation in the first instance (see Section 9).

A single business arrangement can involve both roles: we act as the organisation’s processor for the enrolment and account data under the UK DPA, and as an independent controller for the certification outcome we award and report back to the organisation as sponsor, under our Controller-to-Controller Certification Terms. Section 6 explains what is shared, and with whom.

We comply with applicable data protection laws including:

• the UK General Data Protection Regulation (UK GDPR)
• the Data Protection Act 2018
• the Privacy and Electronic Communications Regulations 2003 (PECR), where applicable.

3. The Personal Data We Collect

Users

When you create an account or use the Platforms, we may collect personal data such as:

• name
• username
• email address
• organisation or employer
• account login details
• other information your employer or administrator provides to set up your access.

Learning and Certification Records

When you use the Learning Platform, we may collect and process learning records, including course enrolments, course progress, module completion, assessment attempts, assessment scores, pass/fail status, completion dates, certificates issued, certification status and related records needed to manage, evidence or verify training completion.

Technical and Usage Information

When you visit the Platforms, our servers may automatically collect certain technical information, including:

• IP address
• browser type and version
• device information
• operating system
• pages visited and navigation behaviour within the Platforms.

This information helps us maintain the security, performance and usability of the Platforms.

Cookies and Similar Technologies

We use cookies and similar technologies to support the operation of the Platforms and, where enabled, to understand how they are used. The cookies and similar technologies used may vary depending on whether you are visiting the Website, using the Learning Platform or using the Community Platform. This may include:

• essential cookies required for login and the functionality of the Platforms
• session cookies used to maintain secure user sessions
• analytics cookies (such as Google Analytics where enabled) to understand how the Platforms are used.

You can manage cookies through your browser settings and, where available, through our cookie preference tools. Where required by law, we will ask for your consent before using non-essential cookies.

Further information about our use of cookies is set out in our separate Cookie Notice at operamacademy.com/cookies.

Customer Information

Where organisations purchase or subscribe to Operam Academy services, we may collect additional information necessary to manage the customer relationship, such as:

• organisation name
• billing and invoicing information
• service usage information, such as licence allocation, course enrolment, course progress, completion status, assessment outcomes, login activity and usage reports, where applicable
• licensing and subscription details
• records of purchases, subscriptions, invoices and related transaction history, including records collated across online sales and invoiced purchases
• payment and transaction details for purchases and subscriptions, including payment status, transaction reference, amount, currency, billing details and limited card information such as card brand and last four digits. Online card payments are processed by Stripe or another payment provider. We do not store full card numbers, CVV codes or full payment credentials.

Content

We collect and store information you create, upload, submit, transmit, store or display when using the Platforms (“Content”).

Content may contain personal data or other information provided by you or your organisation.

We do not control the personal data that a customer organisation or user chooses to include in Content.

Where we process Content on behalf of a customer organisation, that organisation remains responsible for determining the purposes for which personal data contained in that Content is processed, subject to the relevant customer agreement.

Other Submissions

We may also collect information when you:

• contact customer support
• respond to surveys
• register for events
• communicate with us directly
• enquire about, request information about, or express interest in our products or services, including by completing website forms or signing up to receive updates from us.

Community Membership

Where you join our community, Operam Limited is the data controller for the personal data described in this section, and you can exercise your rights under this Privacy Notice directly with us. In addition to the data described above, we collect:

• membership account details, such as your name, email address, and any profile information you choose to provide;
• information we use to confirm your eligibility to join the community, which is open to holders of the Operam Academy IM Practitioner Certification. We keep a record of those eligible to join, compiled from our Learning Platform, Certification Platform and internal operational records, and check your application against it;
• where we use Credly or another Certification Platform to confirm eligibility, we process only the information necessary to verify the relevant credential or certification status;
• content you post in community spaces, such as discussion forums and member showcases, which is visible to other members and to our moderators;
• where you take part in our community events, any personal data contained in the recordings we make of those events and share with members. Recordings may include the audio, video, name, chat, Q&A or other contributions of hosts, speakers and members who choose to take part. Our Event Recording and Consent Policy explains how those recordings are made, stored, and used. We tell attendees in advance when an event will be recorded, and you can choose not to be captured in the recording, for example by keeping your camera and microphone off and not contributing to the chat or Q&A.

Our lawful basis for operating the community and verifying eligibility is our legitimate interests in running the community for eligible members. Our lawful basis for recording and sharing community events with members is our legitimate interests in providing learning and community content to members. Where you actively take part in an event, your contribution may be included in the recording. We keep your membership data for as long as you remain a member, and we keep eligibility records for as long as necessary to operate and manage eligibility for the community. We review those records periodically.

Pathway Delegates and Closed-Cohort Session Recordings

Where you take part in a Pathway as a delegate — for example the IM Professional Pathway — we process the personal data needed to enrol you, deliver the programme, and assess and certify your work. Where a sponsoring organisation enrols you, the sharing of your certification outcome with that organisation is described in Section 6.

For closed cohorts, we record the plenary part of each live session — the facilitator-led, whole-cohort segment. Team breakout discussions are not recorded. A recording captures the audio, video and on-screen content of the plenary, including any contribution you make during it. Live sessions are delivered and recorded through Microsoft Teams.

We record plenary sessions so that you and your cohort can review sessions, or catch up on any you miss, as part of delivering the Pathway to you; and, separately, we use these recordings internally to help our facilitators develop and to improve the Pathway, relying on our legitimate interests in maintaining the quality of what we deliver. We do not share the internal-use recording outside Operam.

A plenary recording is made available to your cohort as learning content for as long as anyone from your cohort retains access to the Learning Platform — for example through an active Licence or Operam Academy NETWORK membership. This can continue even if the organisation that originally enrolled you is no longer an Operam Academy customer. We tell delegates how sessions are recorded and used in the joining instructions, before a cohort place is confirmed.

Our Event Recording and Consent Policy explains what we record, how we use and share recordings, how long we keep them, and how to ask us about your own contribution.

4. How We Use Personal Data

We process personal data for the following purposes. Our lawful basis for processing may include contract, legitimate interests, legal obligation, or consent, depending on the circumstances.

• provide and operate the Platforms. Lawful basis: contract and/or legitimate interests.
• administer accounts and authenticate users. Lawful basis: contract and/or legitimate interests.
• deliver courses, track learning progress, administer assessments, record results, issue certificates, verify credentials and provide relevant learning records or reports to customer organisations where applicable. Lawful basis: contract and/or legitimate interests.
• provide customer support and respond to enquiries. Lawful basis: contract and/or legitimate interests.
• communicate service messages, updates and product announcements. Lawful basis: contract and/or legitimate interests.
• improve the Platforms, analyse usage and enhance user experience. Lawful basis: legitimate interests (and consent where required for non-essential cookies).
• maintain the security of the Platforms and prevent fraud or misuse. Lawful basis: legitimate interests and legal obligation.
• manage billing, invoicing, online payments, refunds, disputes and contractual obligations. Lawful basis: contract and legal obligation.
• send marketing communications where permitted by law, including by email where we have your consent or are otherwise permitted to do so under applicable law. You can opt out of marketing communications at any time. Lawful basis: for electronic marketing to individuals (such as consumers and sole traders), consent or the “soft opt-in” permitted under PECR; for marketing to corporate contacts, legitimate interests where permitted.

Our legitimate interests include operating and improving the Platforms, ensuring security, preventing fraud, responding to business enquiries, and promoting our services to relevant business contacts in a proportionate and responsible manner.

Where we rely on legitimate interests as our lawful basis, we ensure those interests are balanced against your rights and freedoms.

Some assessments are scored automatically against a fixed pass mark, and where you complete all required courses the corresponding certification may be issued automatically. Other assessments, such as the final project on certain Pathways, are evaluated and graded by us. In all cases, you have the right to request human review of an assessment outcome, to express your point of view and to contest the result. Apart from this, we do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

5. How Long We Keep Personal Data

We retain personal data only for as long as necessary for the purposes described in this Privacy Notice.

Account information is retained for the duration of a customer subscription. For community members, we retain account information for as long as you remain a member of the community.

Free-trial accounts are kept only for the trial. Where a free trial does not convert to a paid Licence, the trial account is deactivated at the end of the trial, and the associated trial data is then deleted when we purge trial accounts at the end of that calendar month — so trial data is held for up to one month. Where a free trial converts to a paid Licence, the same account continues and the retention periods for account information and learning records set out in this section apply.

Following account closure, data may be retained for a limited period where necessary for account recovery, service continuity, record-keeping, or to establish, exercise, or defend legal claims.

Learning and certification records, including course progress, assessment scores, completion records, certificates issued and certification status, are retained for as long as we maintain certification records. Because our certifications do not expire, we keep a core record of the courses you have completed so that we can confirm your certification details and recognise your prior learning on an ongoing basis. We retain this information to evidence training completion, manage and verify historic certification status, support customer reporting, and establish, exercise or defend legal claims. We hold these records as controller, independently of any customer relationship, so they remain even after an organisation’s licence with us ends.

Certain information (such as billing and financial records) may be retained for up to 6 years to comply with legal and regulatory requirements.

Technical and usage information, such as server logs, IP addresses and navigation data, is generally retained for up to 12 months, after which it is deleted or anonymised, unless we need to retain it for longer to investigate a security incident or to establish, exercise or defend legal claims.

Content is retained for the duration of the relevant account or customer relationship. Following its end, Content is deleted or returned within a reasonable period, except where we are required to retain it to comply with a legal obligation or to establish, exercise or defend legal claims. Where we hold Content on behalf of a customer organisation, we delete or return it in accordance with that organisation’s instructions and the relevant customer agreement.

Community event recordings are retained while they remain relevant as learning content for members. We review these recordings periodically and remove them when they are superseded or no longer useful.

Closed-cohort Pathway session recordings are retained as learning content for your cohort while anyone from the cohort keeps access to the Learning Platform (see Section 3.9), and are removed when no one retains access or on a valid request. They are not subject to the 30-day processor deletion described below.

Where we process personal data as a customer organisation’s processor — for example the account, enrolment and learning-activity data of learners on a TEAM or ACADEMY Licence, or delegates on a closed cohort — we return or delete that data within 30 days of the end of that organisation’s licensed relationship with us, unless we are required to keep it to meet a legal obligation. This is set out in our UK Data Processing Agreement. It does not apply to the certification and completion records we hold as controller, which survive the end of the customer relationship and are retained as described above.

6. Information Sharing and Disclosure

We do not sell personal data and we do not share it with third parties for their own direct marketing purposes.

We may share personal data with trusted service providers who process personal data on our behalf in order to operate the Platforms and deliver services. These providers may include organisations providing:

• learning management system services;
• website hosting, content management, membership management, security and website administration services;
• cloud hosting and infrastructure;
• operational database, workflow and record management services;
• analytics services;
• email distribution and delivery services;
• customer support tools;
• event platform, webinar, video-conferencing and recording services;
• payment processing;
• digital credentialing and certification services, including Certification Platforms;
• customer relationship management (CRM) systems; and
• marketing services.

Key Third-Party Providers

The following third-party providers are particularly relevant to the operation of the Platforms and related services:

This table identifies key providers for transparency. It is not an exhaustive list and does not replace any separate service provider or sub-processor list made available on request.

Where these providers act as our processors, they are required to process personal data only on our instructions and to implement appropriate security measures. Some providers, such as payment processors, act as independent data controllers for certain processing. Where a provider acts as an independent controller, it determines how it uses personal data and processes it under its own privacy terms rather than on our instructions.

Where your employer or organisation holds an ACADEMY Licence, or a TEAM Licence with the L&D Pack or L&D Pack Lite, their nominated administrators can view the account and learning-activity data of the learners on their licence through their administrator access to the Learning Platform — including course enrolment, progress, module and course completion, and course assessment results — for as long as those accounts remain active under the licence. For this activity we act as that organisation’s processor under our UK Data Processing Agreement (UK DPA); the organisation is the controller and decides how the data is used.

If your account is later deactivated, you lose access to the Learning Platform, but your account record is retained — dormant — while your organisation still holds an active licence with us. Deactivation removes access; it does not, by itself, delete your record.

When your organisation’s licensed relationship with us ends — that is, when it no longer holds any active licence with us — we export the core certification and completion record to our own records, which we hold as controller (see Section 5), and the associated Learning Platform accounts are deleted. After that point, the organisation no longer has administrator visibility of that learning-activity data through the Learning Platform.

Separately, where an organisation sponsors a delegate on a Pathway — for example the IM Professional Pathway — we report that delegate’s final certification outcome to the sponsor: their certification status (certified, not yet certified, or not certified) and the grade achieved (for example Pass, Merit or Distinction). We act as an independent controller for this reporting, under our Controller-to-Controller Certification Terms. We do not share progress, participation or “at-risk” information with the sponsor during the programme — that is handled with the delegate. The detailed assessment scores and the graded evaluation of the Pathway Project are provided to the delegate only and are not disclosed to the sponsor. Delegates are told, at or before enrolment, that their sponsor will be informed of their final certification status and grade.

Where users claim, manage, display or share digital credentials, Certification Platforms may process personal data in accordance with their own privacy terms.

Some of these service providers act as processors on our behalf. Where we process personal data on behalf of a customer organisation and use another provider to support that processing, that provider may act as a sub-processor. We require processors and sub-processors to process personal data only in accordance with appropriate contractual terms and to implement suitable security measures. A current list of key service providers and sub-processors is available on request.

We may also disclose personal data where necessary to:

• comply with legal obligations or lawful requests
• protect the rights, property or safety of Operam, our customers, users or others
• investigate fraud or misuse of the Platforms
• support corporate transactions such as mergers, acquisitions or asset transfers.

Where personal data is transferred as part of such a transaction, it will remain protected under this Privacy Notice, and we will inform you of any material change to how your personal data is handled.

7. International Transfers

Some of our service providers may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK data protection law. These safeguards may include:

• UK adequacy regulations
• the UK International Data Transfer Agreement (IDTA)
• the UK Addendum to the EU Standard Contractual Clauses
• other lawful transfer mechanisms recognised under UK GDPR.

In particular, some key third-party providers, including the Learning Platform provider, payment processing providers, CRM providers, email distribution providers, and their group companies or sub-processors, may process personal data outside the UK, including in the United States. Where this occurs, we rely on appropriate contractual and transfer safeguards required by UK data protection law. The specific safeguard depends on the provider. For transfers to the United States, this may include the UK-US data bridge where the provider is certified under the UK Extension to the EU-US Data Privacy Framework; where a provider is not so certified, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any further measures required.

You may contact us if you would like further information about the safeguards we use.

8. Children

Our services are intended for use by professionals and organisations and are not directed at children.

We do not knowingly collect personal data from children.

If we become aware that personal data relating to a child has been provided to us, we will take steps to delete such information.

If you believe that a child has provided us with personal data, please contact us.

9. Your Rights

Under UK GDPR you have certain rights regarding your personal data.

These include the right to:

• access the personal data we hold about you
• request correction of inaccurate data
• request deletion of personal data
• restrict certain types of processing
• request transfer of your data to another organisation (data portability)
• object to certain processing activities.
• object to the use of your personal data for direct marketing at any time, which we will always action.

Where processing is based on consent, you may withdraw your consent at any time. We will respond to requests without undue delay and normally within one month, as required by UK data protection law. Where a request is complex or where we receive a number of requests, we may extend this period by up to two further months. If we do, we will let you know within one month of receiving your request and explain why. If your personal data is processed by Operam on behalf of your employer or organisation, you should normally contact your organisation’s administrator first. We will assist them where required. If you are a community member, you can contact us directly using the details in this Privacy Notice.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO). More information is available at: https://ico.org.uk

10. Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

However, no internet-based service can be completely secure, and we encourage users to take appropriate precautions when using online services. We have procedures in place to detect, manage and respond to personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office and, where required by law, the individuals affected.

11. Data Ownership

Operam owns or is licensed to use the Platforms and their underlying technology.

This does not affect any rights that users or customer organisations may have in Content or personal data submitted through the Platforms. Where Operam processes personal data submitted through the Platforms on behalf of a customer organisation, the parties’ respective rights and responsibilities are governed by the relevant customer agreement.

12. Contacting Us

If you have any questions about this Privacy Notice or how we process personal data, please contact:

OPERAM LIMITED, trading as Operam Academy
Registered in England and Wales, company number 07958404
Registered office: Devonshire Business Centre, Works Road, Letchworth SG6 1GJ
Email: privacy@operamacademy.com