Privacy Policy

1. Data Controller

The data controller responsible for your personal information is:

This policy explains how we collect, use, store, and disclose personal information when you visit our website, submit forms, or communicate with us. It applies to all visitors regardless of location. We comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the UK and EU General Data Protection Regulation (UK GDPR / EU GDPR) for individuals located in the United Kingdom or the European Economic Area.

2. Personal Data We Collect

We only collect data that is directly relevant to providing our training services and responding to your enquiries. When you fill out a form on our website — such as the demo booking form or newsletter subscription — we may collect the following:

• Full name — to identify you and address correspondence.
• Email address — to respond to your request, schedule demos, and send course-related communications.
• Company name — to understand your organisational context and tailor proposals.
• Phone number — to contact you if you provide it as a preferred method of communication.
• Team size — to recommend the right course track and provide accurate pricing.
• Preferred date — to schedule your demo call at a convenient time.
• Message / free-text notes — to capture additional context you choose to share, such as time zone, areas of interest, or specific questions.

We do not collect sensitive personal information such as financial data, government-issued identifiers, health records, or biometric data through this website. Payment information for course enrolment is collected separately through our payment processor and is never stored on our servers.

3. Purpose and Legal Basis for Processing

Under PIPEDA, we process your personal information based on your meaningful consent, which you provide when you voluntarily submit a form on our website. You may withdraw consent at any time by contacting us at privacy@ironbarktraining.ca.

For individuals in the UK or EEA, we rely on the following legal bases under the GDPR:

• Consent (Article 6(1)(a)) — for newsletter subscriptions, marketing cookies, and analytics cookies. You may withdraw consent at any time.
• Legitimate interest (Article 6(1)(f)) — for responding to demo requests, managing business enquiries, and maintaining the security of our website. Our legitimate interest does not override your fundamental rights and freedoms.
• Contractual necessity (Article 6(1)(b)) — where processing is needed to take pre-contractual steps at your request, such as preparing a course proposal for your team.

4. How We Use Your Data

We use the personal information we collect for the following specific purposes:

• Scheduling and conducting live demo calls as you request.
• Following up on your enquiry with course details, pricing, and cohort availability.
• Sending our monthly “Ops Dispatches” newsletter, but only if you subscribe. Each email includes an unsubscribe link.
• Preparing enrolment documentation and invoices when you proceed with a course booking.
• Analysing aggregated, non-identifying website traffic patterns to understand how visitors use our site (only when you consent to analytics cookies).
• Measuring the effectiveness of our advertising campaigns through conversion tracking (only when you consent to marketing cookies).
• Maintaining the security and proper functioning of our website.

We do not sell, rent, or trade your personal information to any third party. We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

5. Third-Party Services

We use a limited number of third-party tools to measure website performance and advertising effectiveness. These services are loaded only after you provide cookie consent through the banner displayed on your first visit. If you click “Necessary Only,” these scripts are never loaded.

• Google Analytics — We use this service to collect aggregated, anonymised data about website traffic, such as pages visited, session duration, and referring sources. IP anonymisation is enabled, which means your full IP address is never stored. Data is used solely to understand site usage patterns and is not combined with any other data set.
• Google Ads conversion tracking — When you arrive at our site through a paid advertisement, a conversion tag may record that the ad led to a visit or form submission. No personal details are transmitted — only the fact that a conversion event occurred. This helps us evaluate whether our advertising spending is effective.

Both services are governed by their respective provider’s privacy policies. We have configured both tools to minimise data collection and to respect your consent preferences.

6. Cookies

Cookies are small text files placed on your device when you visit a website. We use three categories of cookies:

You can change your cookie preferences at any time by clearing your browser’s cookies for this site and revisiting. The consent banner will reappear, allowing you to make a new selection. Most browsers also allow you to block or delete cookies through their settings.

7. Data Retention

We retain your personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected:

• Demo and enquiry data — retained for up to 24 months after your last interaction. If you do not proceed with enrolment, we delete your data at the end of this period.
• Enrolled student records — retained for up to 7 years after course completion, as required for tax, invoicing, and credential verification.
• Newsletter subscribers — retained until you unsubscribe. Upon unsubscription, your email address is removed from our mailing list within 30 days.
• Analytics data — automatically aggregated and anonymised. Raw event data is deleted after 14 months.

When personal data is no longer needed, it is securely deleted or irreversibly anonymised.

8. Your Rights

Under PIPEDA (all individuals)

Canada’s PIPEDA grants you the following rights with respect to your personal information held by Ironbark Training Co.:

• Access — You may request a copy of all personal information we hold about you.
• Correction — You may request that we correct any inaccurate or incomplete data.
• Withdrawal of consent — You may withdraw consent for any non-essential processing at any time. This will not affect the lawfulness of processing carried out prior to withdrawal.
• Challenge compliance — You may challenge our compliance with PIPEDA by contacting us or by filing a complaint with the Office of the Privacy Commissioner of Canada.

Under UK GDPR / EU GDPR (UK and EEA residents)

If you are located in the United Kingdom or the European Economic Area, you have additional rights under the GDPR:

• Right of access (Article 15) — Obtain confirmation of whether we process your data and receive a copy.
• Right to rectification (Article 16) — Have inaccurate personal data corrected without undue delay.
• Right to erasure (Article 17) — Request deletion of your personal data where there is no compelling reason for continued processing.
• Right to restrict processing (Article 18) — Request that we limit how we use your data in certain circumstances.
• Right to data portability (Article 20) — Receive your personal data in a structured, commonly used, machine-readable format.
• Right to object (Article 21) — Object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent (Article 7(3)) — Where processing is based on consent, withdraw that consent at any time.

To exercise any of these rights, please email privacy@ironbarktraining.ca. We will respond within 30 days. If we need additional time (up to 60 further days for complex requests), we will notify you within the initial 30-day period.

9. Data Security

We take the security of your personal information seriously and apply appropriate technical and organisational safeguards, including:

• Encryption in transit using TLS (HTTPS) for all pages on our website.
• Access controls that limit who within our organisation can view personal data, restricted to staff who require it for their role.
• Regular review of our data handling practices and the third-party services we use.
• Secure deletion procedures when data reaches the end of its retention period.

While we take reasonable measures to protect your data, no method of electronic transmission or storage is entirely without risk. If you become aware of any security concern, please contact us immediately at privacy@ironbarktraining.ca.

10. International Data Transfers

Ironbark Training Co. is based in Canada. The European Commission has recognised Canada as providing an adequate level of data protection under its PIPEDA framework, which means personal data may be transferred from the EEA to Canada without additional safeguards under Article 45 of the GDPR.

Some of our third-party service providers may process data in the United States or other jurisdictions. Where this occurs, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or reliance on the service provider’s participation in recognised data protection frameworks. We regularly assess the data protection laws of any country where your data may be processed to confirm that your rights remain protected.

11. Complaints

If you are dissatisfied with how we handle your personal information, we encourage you to contact us first at privacy@ironbarktraining.ca so that we can attempt to resolve the matter directly.

If you are not satisfied with our response, you have the right to file a complaint with the relevant supervisory authority:

• Canada — Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca
• United Kingdom — Information Commissioner’s Office (ICO) at ico.org.uk
• European Union — Your local Data Protection Authority in your country of residence.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will update the “Last updated” date at the top of this page. For significant changes that affect how we process your data, we will make reasonable efforts to notify you — for example, by displaying a notice on our website or sending an email to subscribers.

We encourage you to review this page periodically to stay informed about how we protect your data. Continued use of our website after a revision constitutes your acknowledgement of the updated terms.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please reach out to us using any of the following methods:

We aim to acknowledge all privacy-related enquiries within 5 business days and to provide a full response within 30 days.