1. Data controller
1.1 SIMFX runs this site to deliver its own training and is the data controller for the personal data held on it.
1.2 Questions about this notice, and requests to use your rights, go to SIMFX using the details in Section 12.
2. Information held
2.1 The site holds the smallest set of personal data that still lets you take a course and keeps a named record of its completion.
| Category | Data held |
|---|---|
| Identity | Your email address, which is how you sign in, and your name if you or an administrator adds it. |
| Enrolment | The courses you are enrolled on, the date you enrolled on each, and any due or renewal date. |
| Progress | Your place in each course and the time you have spent in it. Your score and completion date once you finish. |
| Assessment | Your results in any knowledge check a course sets, including which questions you have answered correctly. |
| Certificates | The serial number of each certificate issued to you, which links the certificate to the record it came from. |
| Policy acknowledgements | The date you confirmed you had read a policy that a course requires. |
| Groups and roles | The groups you belong to, and whether you manage, train or administer any of them. |
| Course reviews | Feedback notes a manager leaves when reviewing a course for their group, with the manager's email address. |
| Administrator accounts | For administrators only, a password hash and a two-factor authentication secret. The site holds no learner passwords. |
| Audit log | A dated entry for each significant event, such as signing in, completing a course or issuing a certificate, with the email address involved. |
2.2 The site does not ask for special category data, such as health information, and does not need any.
2.3 The site does not store your IP address. It holds the address in memory for a few minutes to limit repeated sign-in and enrolment attempts, and then discards it. The web server keeps no access log.
2.4 The server's system log records an email address when a message to it fails to send. The system log is kept for 7 days.
2.5 When you open a course, the site passes it your learner number and your name. Where no name is held, it passes your email address instead. Courses run on this site's own server.
3. Uses and lawful basis
3.1 Your data is used to:
- sign you in and keep your account secure;
- deliver your courses and record your progress, results and completion;
- issue certificates and let others check that a certificate is genuine;
- show your progress to the administrators and managers described in Section 4;
- send the emails the site needs to work, which are sign-in links, invitations, completion confirmations with the certificate attached, and reminders;
- keep an audit log that shows the records have not been altered.
3.2 SIMFX relies on contract (UK GDPR Article 6(1)(b)) to deliver the training you or your organisation booked and to issue its completion record, and on legitimate interests (Article 6(1)(f)) for administration and reporting.
3.3 Your data is not used for marketing or profiling, and it is not sold.
4. Sharing your data
4.1 Within SIMFX, the people who can see your data are:
- administrators, who can see every record on the site;
- managers, who can see the course progress and completion records of the groups they manage;
4.2 Managers and trainers can see the email address of each learner in their groups.
4.3 The site lets your manager or trainer send you a short message about your training. The site delivers each message by email without giving either person the other's address, and it keeps only a record that a message was sent, never its content.
4.4 SIMFX uses the following service providers to run the site. Each processes data only to provide its service.
| Provider | Service | Where |
|---|---|---|
| Hostinger | Hosts the server that runs the site and holds its database and backups. | United Kingdom |
| Resend | Delivers the site's emails, and stores their content and delivery records. | United States |
| Amazon Web Services (Amazon SES) | Delivers the site's emails if Resend is unavailable. | London |
| Cloudflare | Resolves the site's web address. The site's traffic does not pass through Cloudflare. | Not applicable |
4.5 SIMFX staff can reach the server to maintain and back up the site, and do so only for that purpose. Your data is shared with no one else unless the law requires it.
5. International transfers
5.1 The server that holds this site's data is in the United Kingdom.
5.2 Resend stores the content and delivery records of the site's emails in the United States. The UK Addendum to the EU Standard Contractual Clauses, part of Resend's data processing agreement, covers that transfer. Resend also relies on the EU-U.S. Data Privacy Framework and its UK Extension.
5.3 Amazon SES, used only if Resend is unavailable, processes email in London.
6. Data retention
6.1 SIMFX sets these periods for this site.
| Record | Kept for |
|---|---|
| Completion records (completion, score, certificate serial) | 5 years from completion |
| Courses started and not completed, with their progress | 3 years from your last activity |
| Audit log entries | 5 years |
| Group membership, knowledge check results and policy acknowledgements | Until your record is erased |
| Backups of the whole site | Each nightly backup is deleted after 14 days |
6.2 An administrator runs the site's retention purge, which deletes records that have passed these periods.
6.3 If you ask for your data to be erased, it is deleted at once, with one exception. SIMFX can mark a course as regulated, and the completion record for a regulated course is kept, with your name, until its retention period ends, under UK GDPR Article 17(3)(b) (compliance with a legal obligation). The site records the part of the request that was refused.
7. Security
7.1 The measures that protect your data are:
- this site has its own application and database, separate from every other organisation's;
- you sign in with a single-use link sent to your email address, and no learner password is held;
- administrators sign in with a password and two-factor authentication;
- every connection to the site is encrypted;
- course content is served from a separate web address that cannot read your sign-in session;
- each audit log entry is chained to the one before it, and a change to any past entry breaks the chain;
- backups are encrypted.
8. Your rights
8.1 UK GDPR gives you these rights over your personal data:
| Right | On this site |
|---|---|
| Access | A copy of the personal data held about you. An administrator can export your full training record. |
| Rectification | Correction of inaccurate data. You can change your name on your account page, and an administrator can correct your name or email address. |
| Erasure | Deletion of your data, subject to the exception for regulated courses in Section 6. |
| Restriction | A limit on how your data is used while a concern about it is resolved. |
| Portability | Your training record in a structured, machine-readable form. |
| Objection | An objection to processing that relies on legitimate interests. |
8.2 To use any of these rights, contact SIMFX using the details in Section 12. A request is answered within one calendar month, and there is no fee unless a request is manifestly unfounded or excessive.
8.3 If you are unhappy with how your personal data has been handled, tell SIMFX first using the details in Section 12. A complaint is acknowledged within 30 days and answered without undue delay, following the complaints process in the Data (Use and Access) Act 2025.
8.4 If you are still not satisfied, you can complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The ICO may ask you to raise the complaint with SIMFX first.
9. Cookies
9.1 The site sets only the cookies it needs to sign you in and to load your courses. It uses no analytics or advertising cookies. The Cookie Policy lists each one.
10. Course content and links
10.1 Courses and the documents they cite can link to other websites, such as a regulator's guidance. Those websites have their own privacy notices, which apply when you visit them.
11. Changes to this notice
11.1 This notice is updated when the site, or the way it uses personal data, changes. The date at the top of the page shows when it last changed.
12. Contact
12.1 For questions about this notice, to use your rights, or to raise a concern about how your data is handled, contact SIMFX.
- Online, through the contact form at airbrain.cloud.