Privacy Policy
Last updated: 30 September 2026
Alpha Hygiene Centre ("we", "us", "our") provides online food hygiene and allergen awareness training and certification. This policy explains what personal data we collect, why we collect it, how long we keep it, and who we share it with, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Alpha Hygiene Centre, 45 Circus Road, St John's Wood, London, NW8 9JH. You can contact us about any privacy question at info@alphahygienecentre.co.uk or by phone on 020 3846 2809.
2. What personal data we collect
When you create an account, enrol on a course, or contact us, we collect:
- Identity data: first name, last name — collected to help identify learners and reduce the risk of certificate misuse or duplicate learner records.
- Contact data: email address, phone number.
- Account data: a securely hashed password (we never store your password in plain text).
- Course & certification data: the courses you enrol on, your progress, quiz and exam results, and any certificates issued to you.
- Payment data: your course payments are processed directly by Stripe, our payment provider. We do not receive or store your card details — we only receive confirmation that a payment was successful, and a Stripe reference for that transaction.
- Consent records: when you tick the digital-content consent checkbox at checkout, we record the date and time, and separately record the date and time you first open the course, so we have accurate evidence for refund/cancellation queries. See our Refund & Cancellation Policy.
- Profile data (optional): a profile picture, if you choose to upload one.
- Technical data: your IP address and browser session information, used only to keep you securely signed in, to support the consent record above, and to protect the site against abuse (e.g. limiting repeated failed login attempts).
3. Why we process your data (our legal basis)
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account | Name, email, phone, password | Contract |
| Provide course access | Account data, course progress | Contract |
| Issue a certificate | Learner name, course result, certificate number | Contract / legitimate interests |
| Process payment | Payment confirmation and transaction reference | Contract |
| Keep a consent/audit record for refund queries | Consent timestamp, first-access timestamp, IP address | Legal obligation / legitimate interests |
| Keep certificate verification records | Certificate details | Legitimate interests |
| Site security | IP address, session data, login attempts | Legitimate interests |
| Respond to enquiries | Name, email, message | Legitimate interests / contract |
We do not use your personal data for marketing without your separate consent, and we do not sell your personal data to any third party.
4. How long we keep your data
| Data | Retention |
|---|---|
| Account data | While your account is active, then for 24 months after your last activity. |
| Course progress, assessment, certificate, consent and audit records | 6 years from the date of completion or purchase. |
| Accounting and payment records | 6 years from the end of the financial year, per UK HMRC requirements. |
| Contact and support enquiries | 12 months from your last contact with us. |
| Security and session logs | 90 days, or until the end of any active investigation if longer. |
| Profile photo | Until you remove it or your account is deleted. |
| Deleted data in backups | Backups are retained for our actual backup cycle; deleted data may persist in a backup until it is overwritten, per our backup schedule. |
If you ask us to delete your account, we will delete your personal data except where we are required to keep certain records (such as certificate issuance or payment records) for legal or regulatory reasons.
5. Who we share your data with
We only share personal data with the following categories of recipient, and only as far as necessary to run the service:
- Stripe (payment processing) — to take payment for course enrolment. Payment data is processed by Stripe; we do not receive or store your card details, only payment confirmation and a transaction reference.
- Our hosting provider — to store the platform's database and files securely.
- Our email hosting provider — used to send account, course, and certificate emails from our own alphahygienecentre.co.uk mailbox.
- Google Analytics (website usage analytics) — only if you accept analytics cookies via the cookie banner (see our Cookie Policy). We do not send your name, email address or certificate details to Google; if you reject or ignore the banner, no data is sent to Google Analytics at all.
We do not share your personal data with any other third party for their own marketing purposes.
6. International data transfers
Some of our service providers (for example, our payment provider, hosting provider, or email provider) may process data outside the UK. Where this happens, we rely on appropriate safeguards required under UK data protection law, such as standard contractual clauses or an equivalent adequacy decision.
7. Service emails vs. marketing emails
We may send service emails about your account, course access, assessment results, certificates, and recommended renewal reminders — these are necessary to provide the service you purchased. We will only send promotional or marketing emails where we have your separate consent or another lawful basis to do so.
8. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Ask us to correct inaccurate data.
- Ask us to delete your data ("right to be forgotten"), subject to the legal record-keeping exception above.
- Object to or restrict certain processing.
- Request a copy of your data in a portable format.
To exercise any of these rights, contact us at info@alphahygienecentre.co.uk. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), if you believe we have not handled your data properly.
9. How we protect your data
Passwords are stored using industry-standard one-way hashing (bcrypt) and are never visible to us in plain text. Your session is protected with secure, HTTP-only cookies. Access to admin functions is restricted to authorised staff accounts only.
10. Cookies
We use one strictly necessary cookie to keep you securely signed in. See our Cookie Policy for details.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page will always reflect the latest version.