Privacy Policy.

Who we are

Karv Web Education Solutions Ltd, trading as Karv Training, operates karvtraining.com. We are the data controller for personal data collected through this site and in the course of our own business, such as enquiries, bookings and invoicing. Where we process the personal data of your staff to deliver training and produce your training record, we act as your processor, and Part C of our Terms and Conditions applies to that processing. For the public certificate verification service at karvtraining.com/verify, which we run for our own purposes, we act as controller.

What we collect

When you email us, use the contact form, register interest in a course or book a call, we receive your name, your email address, your organisation and whatever you choose to tell us, including your answers to the form's questions about the AI tools you use and the course, group size, timing and delivery you register interest in. When you engage us, we collect the details needed to deliver and invoice the work.

When you visit the site we collect no personal data. Our analytics record aggregate page views and approximate location at country level without cookies. They do not identify you and we do not combine them with anything else.

Cookies

This site sets no cookies of its own and our analytics are cookie-free. On Insights posts you can choose to load Google's "preferred source" button. If you do, Google may set its own cookies. You can undo that choice with the Cookie preferences link in the footer.

Why we process it and on what basis

To respond to your enquiry, to arrange and hold a call, to deliver the training you have booked, and to invoice for it. The legal basis is the steps needed before and during a contract with you, and our legitimate interest in running the business.

To understand how the site is used in aggregate, without identifying anyone. The legal basis is our legitimate interest in running the site.

To keep records we are required to keep, such as invoices. The legal basis is our legal obligations.

Who we share it with

We do not sell or rent personal data. We share it only with the providers who host and run our systems: Vercel, which hosts the site; Resend, which delivers contact form and course interest emails; Supabase, where course interest registrations are stored in the EU; Cal.com, which handles call bookings and collects the name, email address and time you choose; and Google Workspace, where our email and documents live. Beyond that, only professional advisers and authorities where the law requires it.

International transfers

Our systems are hosted in the European Union where the provider offers it. Where a provider processes data outside the EEA, for example for support operations, the transfer is covered by an adequacy decision or the European Commission's Standard Contractual Clauses.

How long we keep it

Enquiry correspondence, including course interest registrations, is kept for as long as needed to deal with it and for twelve months afterwards. Records of training delivered, including attendance and certificates, are kept for three years after the session unless your contract with us says otherwise; see the Training records section below. Invoices are kept for the period required by Irish tax law.

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct or delete it, restrict or object to our processing, or ask for it in a portable format. Email danny@karvtraining.com and we will respond within one month. You can also complain to the Data Protection Commission in Ireland.

Training records

This section explains how we handle the personal data of people who attend our training. If you attended a session, your employer or the organisation that booked it is the controller of this data and we process it on their behalf, under the Data Processing Schedule in Part C of our Terms and Conditions. Direct any request about your data to that organisation in the first instance; if you contact us we will pass it on and help them answer it.

What we collect: your name, your work email address, your job role, whether you are an employee or a contractor or agency worker, and your attendance. For live online sessions the meeting platform records when you joined and left, and we use that to calculate the time you attended. We do not collect test scores, personal email addresses, recordings, or anything the GDPR treats as special category data.

Why: to deliver the session, to produce the organisation's Article 4 training record listing who attended and for how long, to issue you an individual Certificate of Attendance, and to email that certificate to your work address. The lawful basis for the organisation is its legitimate interest in evidencing the measures it has taken under Article 4 of the EU AI Act; for our own limited processing it is the performance of our contract with the organisation.

Who receives it: the organisation that booked the training receives the record listing every attendee. You receive your own certificate. Nobody else receives attendee data, apart from the sub-processors that host our systems, listed below.

How long: the raw join and leave times from the meeting platform are deleted 30 days after the record is issued, and only the total minutes attended is kept. Attendance, certificates and records are deleted three years after the session unless the organisation's contract with us says otherwise. Deletion runs automatically and is logged.

Your rights: you can ask for a copy of what we hold about you, ask for it to be corrected (and your certificate reissued), or ask for it to be erased. Erasure removes your name, email and role, withdraws your certificate so it can no longer be verified, and deletes the certificate file. Because the organisation is the controller, we act on its instruction where an erasure request conflicts with a retention period it is bound by. We respond within one month.

Certificate verification

Each Certificate of Attendance carries a random verification code and a QR code linking to karvtraining.com/verify. Anyone with the code can confirm that the certificate is genuine. The check shows only the certificate's status, the holder's first name and last initial, the course title, the date and the issuer. It never shows an email address, job role, organisation, attendance time or record reference. Certificates whose holder has asked for erasure return "No certificate found".

We run this service as controller. The lawful basis is our legitimate interest in preventing forged certificates and in letting holders and their organisations demonstrate attendance. Verification pages load no analytics or third-party scripts. To limit guessing, we record failed lookups with a salted, daily-rotating hash of the connection's IP address, which we cannot reverse, and delete those records after 30 days.

Sub-processors for training records

Supabase (database, authentication and file storage for records and certificates; hosted in the EU, Ireland region). Zoom (live online delivery and the participant report, where the session is run on our account; Zoom is US-based and relies on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework). Resend (delivery of certificate and record emails; US-based, Standard Contractual Clauses). Vercel (hosting of this site and the admin tools; functions run in Frankfurt, with Standard Contractual Clauses for any US processing). Google Workspace (our email and file storage; EU data region, Standard Contractual Clauses). Cal.com (call bookings only; no attendee data).

Changes to this policy

We may update this policy from time to time. Changes are posted here with a new effective date.

Contact

Karv Web Education Solutions Ltd, trading as Karv Training. danny@karvtraining.com.