Privacy Notice
Last updated: 28 September 2026
Version 2.0 · effective 28 September 2026 · supersedes the version dated 2 January 2026
Controller
The controller of your personal data is Meaningful Governance Advisory OÜ, trading as Standards Academy. Registry code 17299629. Registered address Tornimäe tn 5, 10145 Tallinn, Estonia. Email info@standards.academy.
Standards Academy issues this notice under Articles 13 and 14 of Regulation (EU) 2016/679, the General Data Protection Regulation. It records what Standards Academy collects, the purpose of each use, the basis in law on which each rests, who else receives the data, how long it is held, and what you may require.
1. What Standards Academy collects
| Category | Contents | Source |
|---|---|---|
| Account and contact | Name, electronic mail address, telephone number, position, organization and country | You, on creating an account or making an enquiry |
| Order and payment | The course purchased, the price paid, the billing name, address and country, and the promotion applied | You, and the payment processor. Standards Academy never sees your card number |
| Course | The format selected, the participant named, and the enrolment and completion record | You, and PECB where a credential is awarded |
| Enquiry | The message you send and the address you send it from | You |
| Technical | Internet protocol address, browser and device characteristics, and pages visited | Your browser, on use of the site |
2. Purpose and basis in law
| Purpose | Basis |
|---|---|
| To sell a course, enrol you, provide access and address refunds | Performance of a contract with you |
| To transmit the enrolment to PECB so that a credential may be awarded | Performance of a contract with you |
| To determine the price where a promotion applies to your country | Performance of a contract with you |
| To issue invoices and maintain accounting records | A legal obligation to which Standards Academy is subject |
| To answer your enquiry | The legitimate interest of Standards Academy in responding to those who contact it |
| To keep the site secure and operating | The legitimate interest of Standards Academy in operating the site safely |
| To send you information about similar courses | The legitimate interest of Standards Academy in informing its customers. You may object at any time, and Standards Academy shall then stop. Where the law of your country requires consent, Standards Academy shall obtain it first |
3. Automatic determination of the price displayed
Where a promotion applies to the country recorded on your account, Standards Academy shall determine the price displayed automatically, by a rule it publishes on the discounts page.
That determination is not an assessment of you as an individual and produces no legal effect for you.
Where you consider the price displayed to be wrong, you may require that a person examine it, and Standards Academy shall do so.
4. Recipients
| Recipient | Purpose |
|---|---|
| PECB | Enrolment, examination and award of the credential |
| The payment processor | Taking payment and preventing fraud |
| The invoicing provider | Issuing invoices and credit notes |
| The electronic mail provider | Confirmations, acknowledgements and notices |
| The website and database platform | Hosting the site, your account and your order record |
| Professional advisers | Where advice is required, and where the law requires disclosure |
Standards Academy shall not sell your personal data, and shall not disclose it for the marketing purposes of any other party.
5. Transfers beyond the European Economic Area
PECB is established in Canada. The European Commission has determined that Canada affords an adequate level of protection to personal data transferred to recipients subject to its federal private-sector privacy law, and renewed that determination on 15 January 2024. The transfer rests on that decision and requires no further safeguard.
Where any other recipient is established beyond the European Economic Area, the transfer shall rest on an adequacy decision or on standard contractual clauses adopted by the European Commission. You may require Standards Academy to state which applies to a particular recipient.
6. Retention
| Category | Period for which Standards Academy shall hold it |
|---|---|
| Accounting and invoicing records | Seven years from the end of the financial year, as Estonian accounting law requires |
| Account and order records | For the duration of your account, and thereafter for as long as the accounting record is required |
| Enquiries not resulting in a purchase | Twenty-four months from the last contact |
| Marketing preferences | Until you object or withdraw, and thereafter a record that you did so |
| Withdrawal declarations | Seven years, as part of the accounting record of the refund |
PECB holds the certification record; Standards Academy does not. PECB retains it under its own policy so that a credential may be verified.
7. What you may require of Standards Academy
You may require a copy of the personal data held about you.
You may require correction of anything inaccurate or incomplete.
You may require erasure, where the data is no longer needed and no legal obligation compels its retention.
You may require restriction of processing while a question about the data is resolved.
You may require a copy in a portable form, where the data is held on your consent or on a contract with you.
You may require that processing cease, where it rests on a legitimate interest, and that marketing cease in any event.
You may withdraw consent where consent was sought. Withdrawal shall not affect what preceded it.
Address a requirement under this clause to info@standards.academy. Standards Academy shall answer within one month.
8. Complaint to a supervisory authority
You may complain to the Estonian Data Protection Inspectorate, which supervises Standards Academy, or to the supervisory authority of the country in which you live or work.
Complaining to Standards Academy first is not a condition of either.
9. Security
Standards Academy shall hold personal data on services that encrypt it in transit and at rest, and shall confine access to those who require it. No system is entirely secure.
Where a breach occurs that is likely to present a risk, Standards Academy shall notify the supervisory authority. Where the risk to you is high, it shall notify you.
10. Age
Standards Academy sells courses to adults and shall not knowingly collect personal data from any person under 18.
11. Amendment
Standards Academy shall publish an amended notice on this page with a new effective date, and shall notify account holders where an amendment is material.
12. Contact
Meaningful Governance Advisory OÜ, trading as Standards Academy. Registry code 17299629. Registered address Tornimäe tn 5, 10145 Tallinn, Estonia. Email info@standards.academy.