Certification Privacy Notice

The controller for the data described in this notice is Matrix Codes Method Ltd, company number 17196911, 66 Paul Street, London, England, EC2A 4NA.

For privacy questions, rights requests or a suspected data incident, email privacy@subconsciouscodex.com.

This notice supplements the general Privacy Policy and covers data processed specifically for certification.

It covers candidates, certified practitioners, people taking part in portfolio or recorded-practical sessions, assessors, administrators and people contacting support about the programme.

The programme and practical demonstrations are for adults only. Children’s data must not be submitted.

We process account and contact data including name, email, user identifier, language setting, authentication and security events.

We process purchase and consent data: Stripe references, amounts, currency, discount, tax, payment or refund status, the accepted terms and privacy versions, and the timestamp of the immediate-supply consent.

We process progress and assessment data: lesson completions, exam answers and scores, exam attempts, portfolio, consent declarations, assessor notes and decisions, messages, conflicts, reviews and complaints.

We process credential and fulfilment data: certificate name, practitioner/licence number, issue date, annual declarations, insurance and directory details, dispatch status and—only when needed—an encrypted postal address.

We process support and technical data such as messages, deadlines, email notifications, device or browser identifiers, IP address in security logs, errors and audit trails.

The candidate must give the adult participant clear information before the session and obtain separate written consent before recording or upload. Consent must cover the assessment purpose, access by the assigned assessor and authorised administrators, private storage and the deletion schedule.

We may receive the participant’s image, voice, conduct during the demonstration, limited contextual information and the minimum notes required for assessment. The candidate securely keeps the written consent evidence; we do not normally ask for a copy unless needed to investigate a specific concern.

The candidate acts independently as controller for information collected in their own practice. Matrix Codes Method Ltd is controller of material it receives for its own certification assessment and integrity purposes.

Do not upload full client files, diagnoses, medical or therapy history, identity documents, bank details, passwords, a participant’s full address or third-party details. Use a first name or pseudonym and disclose only what is necessary to demonstrate competence.

We do not require special-category data for assessment. If it arises unexpectedly in conversation, do not expand it, remove it from written materials where possible, and tell support about an accidental upload that needs restriction or deletion.

Contract: creating enrolment, delivering the course and resources, running exams and assessment, providing support, communicating, fulfilling dispatch, and issuing and verifying a credential.

Legal obligation: accounting and tax records, consumer rights, responses to lawful requests, and data-protection duties.

Legitimate interests: security, fraud prevention, exam and credential integrity, complaints, audit, legal claims and safely improving programme operation, after considering the effect on individuals.

Consent: recording and use of a third party’s participation in a demonstration, and other optional processing where consent is appropriate. Consent can be withdrawn for future processing; that may prevent use of the recording and require different competence evidence.

Both objective exams are marked automatically against the published answer key, pass mark. The candidate sees the result and can raise a technical error or request human review.

Certification is not awarded solely by an automated decision: a person assesses the portfolio and recorded practical, and the complete requirement set is checked before issue. We do not use AI to make the final certification decision.

Access is limited to people who need the data for their role: the assigned assessor, authorised administrators, support personnel and professional advisers under confidentiality duties.

We use providers acting for us or as separate controllers where appropriate: Supabase (account, database and private resources), Vercel (hosting), Stripe (payments), Cloudflare R2 (private practical recordings once enabled), our SMTP email provider, Google Drive (library shared only with the account email), and Zoom or the group provider (live support).

We may disclose the minimum necessary data to public authorities, courts, insurers, auditors or advisers where required by law or necessary to protect rights and safety.

We aim to keep private practical recordings in an EU region. Other providers may process data in the UK, EEA, United States or elsewhere. Where a transfer safeguard is required, we use an applicable adequacy decision, recognised contractual mechanism or other lawful safeguard.

A Practical Skills Demonstration recording is scheduled for deletion within 30 days of the final practical decision after any review. Superseded recordings are also queued for deletion. An active complaint, proceeding or legal hold may temporarily pause the deadline; the hold is recorded and reviewed.

The encrypted postal address is automatically erased 45 days after confirmed delivery, return or cancellation. The certificate name and minimum fulfilment record are retained as credential evidence.

Minimum assessment outcomes, decisions, audit trail, consent versions, order, credential and licence number are normally retained for six years after the final decision or enrolment closure to evidence the qualification, handle complaints and meet legal, accounting and tax duties. Detailed material that is no longer needed is deleted or anonymised sooner.

Account, message and support data is kept while needed to operate the programme and resolve issues, then reviewed against the period above. At the end of a standard period, data is deleted or anonymised unless a documented reason requires longer retention.

We use role- and enrolment-based access controls, private resources, short-lived signed download links, separate encryption for address data, audit trails and assessor access limited to assigned cases. Payment takes place in Stripe, so we do not store full card details.

The candidate is responsible for a secure password and device, privacy of the recording location, and secure storage of the participant’s written consent.

Depending on applicable law, you may request access, a copy, correction, erasure, restriction or portability, object to legitimate-interest processing, and withdraw consent. You may also challenge an automated exam result and ask for human intervention.

Some data cannot be erased immediately if needed for payment, credential, fraud, security, legal-obligation or claims records. We will explain the basis and restrict further use where appropriate.

We normally respond within one month after receiving the information reasonably needed to verify identity and the request.

Please contact us first so we can address the issue. You also have the right to complain to the UK Information Commissioner’s Office or, where applicable, the data-protection authority in the country of your habitual residence, work or the alleged infringement.

privacy@subconsciouscodex.com

Purchase and participation terms are in the Certification Terms.

The notice version read at checkout is recorded with the order. We retain historical versions so the information supplied at purchase can be evidenced; this is version 2026-08-31-v2.