Compval Privacy Policy
Effective date: 3 November 2026
Last updated: 3 November 2026
1. Introduction
This Privacy Policy explains what personal data Compval collects when you use www.compval.com, why we collect it, how we protect it, and the choices and rights you have. It applies to visitors, registered Members, Team Managers and Team members, newsletter subscribers, and anyone who uses our contact form, the GxP Readiness Planner or the Ask Iain service.
The data controller is Compval Trading & Services Ltd, company number NI614155, registered office Unit 271, Moat House, 54 Bloomfield Avenue, Belfast, BT5 5AD ("Compval", "we", "us"). We are registered with the Information Commissioner's Office (ICO) under registration number ZC289630. You can contact us at admin@compval.com.
2. Information we collect
Account and membership. Your username, full name, email address and a password (stored only as a salted hash, never in plain text), together with your membership dates, payment status, the currency you pay in and whether you hold a founding rate.
Payments. Payments are taken by Stripe. We pass Stripe your email address and a user reference. We receive and keep a payment record containing a Stripe reference, the amount, the currency and the date. We do not receive or store your full card number.
Course activity. Which modules you have completed, your quiz scores and answers, and any certificate issued to you, including its reference code and issue date.
Ask Iain. The questions you submit, their category and subject, our answers, the date, and the IP address from which you submitted the question.
Contact form. Your name, email address, message, your consent, and your IP address.
Newsletter. Your email address and name, the date and time you consented, your IP address and the page you signed up from, and the dates you confirmed or unsubscribed. We keep the IP addresses of sign-up attempts for about one day to prevent misuse of the form.
GxP Readiness Planner. If you ask for your results by email, we collect your email address, name, the system name and target date you enter, the answers you give, your readiness score and the report generated, and your IP address.
Team memberships. For a Team: the organisation name, the Team Manager's name and email address, the billing address and any purchase order reference, the seat count and plan, and the names and email addresses of Team members.
Security and technical data. Failed and successful login attempts (the IP address and the email used), password-reset requests, and standard server logs, so that we can protect accounts, investigate problems and keep the Service secure.
Certificate verification. Anyone who holds a certificate's reference code can use our public verification page to see the holder's name, the course title and the issue date.
3. How we use your information and our legal basis
| Purpose | Information | Legal basis |
|---|---|---|
| Provide your account, the course, quizzes and certificates | Account, course activity | Contract |
| Take payment and keep payment records | Payment data, team billing data | Contract and legal obligation (accounting and tax) |
| Provide Team administration and training records | Team data, course activity | Contract |
| Answer your questions through Ask Iain and the contact form | Questions, contact details | Contract, or our legitimate interest in responding to enquiries |
| Publish a question and answer, with your name and identifying detail removed, in our FAQ | Ask Iain question and answer | Your agreement when you submit the question (you can ask us to remove it at any time) |
| Verify a certificate you have chosen to share | Name, course, issue date | Contract and our legitimate interest in letting employers confirm that a certificate is genuine |
| Send the newsletter | Newsletter data | Consent |
| Send you your Readiness Planner results | Planner data | Providing what you have asked for (contract) |
| Contact you by email about CSV training and services after you use the Readiness Planner, only if you have ticked the box to agree | Planner data | Consent, which you can withdraw at any time; every email contains an unsubscribe link |
| Keep the Service secure and prevent abuse | Security data, IP addresses | Legitimate interest |
| Send service messages (renewal reminders, receipts, password resets) | Account data | Contract |
We do not sell your personal data. We do not use it for automated decisions that have legal or similarly significant effects on you.
4. Cookies and similar technologies
We use one cookie, a session cookie that keeps you logged in and protects forms. It is strictly necessary for the Service to work, is set only when you use a feature that needs it, and is deleted when you close your browser. We do not use analytics, advertising or tracking cookies, and we do not load fonts, scripts or other resources from third-party servers when you view our pages.
We display advertising banners on some pages. These are served by Compval, not by an outside advertising network, and we record only the total number of times a banner is shown and clicked, not who saw or clicked it.
5. How we store and protect your information
Our systems are hosted on servers in Germany (see Section 8). We protect personal data using measures that include encrypted connections (HTTPS), hashed passwords, access controls that limit staff access to what is strictly necessary, rate limiting on login attempts, and regular security reviews. No system is completely secure, and we encourage you to use a strong, unique password.
6. How long we keep your information
| Information | How long we keep it |
|---|---|
| Account, course progress and quiz results | While your account exists, then deleted 12 months after your Membership ends, or earlier if you ask us to delete your account |
| Certificate records and the verification record (holder's name, course title, issue date and reference code) | 3 years from the date of issue, even if your account has been deleted in the meantime, so that the certificate can still be verified. After that the record is deleted and the verification page will no longer find it. You can ask us to delete it sooner |
| Payment records and Team invoicing records | 6 years, to meet UK tax and accounting requirements and to deal with any claims |
| Ask Iain questions and answers | While your account exists. Where an answer is published in our FAQ, your name and identifying details are removed |
| Contact form messages | 12 months |
| Readiness Planner data | 12 months, unless you become a Member or newsletter subscriber. If you did not agree to be contacted, we do not use it to contact you |
| Login attempts and security logs | 30 days |
| Newsletter subscription records | While you are subscribed, and for up to two years afterwards as proof of consent. After you unsubscribe we keep your email address on a suppression list so you are not added again by mistake |
When the retention period ends we delete the information or anonymise it. We may keep information for longer where the law requires it or where it is needed to establish, exercise or defend a legal claim.
7. Sharing your information
We do not sell your personal data. We share it only with the following categories of service providers, who act on our instructions:
- Stripe, to process payments securely.
- Our hosting provider, an EEA-based provider, which stores and runs the Service and sends our email.
- Artificial intelligence tool providers, only in connection with Ask Iain, to help draft answers. We do not enter your name or contact details. Please do not include confidential or client-identifying information in a question.
- Your Team Manager, if you are a member of a Team, who can see your course progress and results so that training can be documented.
We may also disclose information where the law requires it, to protect our rights, or in connection with a sale or reorganisation of the business, in which case we will tell you if your data is affected.
8. International data transfers
Our systems are located in Germany, within the European Economic Area. Where any provider we use processes personal data outside the UK or EEA (for example Stripe, which operates internationally), we ensure an appropriate safeguard is in place, such as the UK International Data Transfer Addendum, the EU Standard Contractual Clauses or an applicable adequacy decision.
9. Your rights
Under the UK GDPR and, where it applies, the EU GDPR, you have the right to:
- access the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- ask us to delete your data (including your account);
- object to, or ask us to restrict, certain processing;
- receive your data in a portable format;
- withdraw consent at any time where we rely on consent (for example, for the newsletter); and
- lodge a complaint with the Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
To exercise any of these rights, email admin@compval.com. We aim to respond within one month. We may need to verify your identity first.
10. Marketing communications
We send the Compval newsletter only if you have subscribed and confirmed your address. You can unsubscribe at any time using the link in every newsletter or by contacting us. We send service messages (such as renewal reminders, receipts and password resets) to Members regardless of newsletter choices, because they are part of the Service.
11. Children
The Service is intended for adults and professionals. You must be at least 18 to register. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy from time to time, for example when we change how the Service works or as the law changes. We will update the "Last updated" date at the top and, where a change is material, tell Members by email or on the website before it takes effect.
13. Contact us
Compval Trading & Services Ltd
Unit 271, Moat House, 54 Bloomfield Avenue, Belfast, BT5 5AD
Email: admin@compval.com