Privacy Notice

Effective Date of this Privacy Notice: 8 October 2026

Here at MetaCompliance, your privacy is important, and we are committed to doing everything we can to protect any personal data that you give to us. This Privacy Notice applies when you visit or use our websites, apps, products and other services, including events, which may refer or link to this notice (each, a “Service”). It may be supplemented by additional privacy statements, terms or notices provided to you.

The controller of the personal data referred to in this Privacy Notice is MetaCompliance Limited, Company No. NI049166, 49 St James’s Street, London, SW1A 1JT ; Email: [email protected].

As described below, we receive some personal data directly or indirectly from our Group’s customers (such as your employer or organisation) and may process that personal data either (a) as their processor, acting on their instructions (in which case this Notice would not apply to those usages), or (b) as an independent controller for our own purposes connected with providing our products and services. This Notice applies to scenario (b).

We will indicate within registration processes and other forms what types of personal data are required and those that are optional. You may choose not to submit requested information, but that may limit or prohibit the services we are able to provide to you.

Group Structure and Data Controllers

MetaCompliance operates as a group of companies (“the Group”). The table below identifies the principal entities within the Group, their jurisdiction of incorporation, and their role in the processing of your personal data. References to “MetaCompliance”, “we”, “us” or “our” in this Notice refer to the relevant Group entity (or entities) processing your data, as set out below.

In the future, we may acquire entities that will form part of the wider MetaCompliance Group. Any new Group entity will be added to this notice within 30 days of commencing processing and will be bound by the Group’s Intra-Group Data Sharing Agreement. The register of Group entities party to that agreement is maintained and updated by MetaCompliance Limited.

Where a Group entity acts as a data controller in its own right, it is individually responsible for complying with applicable data protection legislation. Where a Group entity acts solely as a processor on behalf of a controller, its processing activities are governed by a data processing agreement rather than this Notice.

Group entities will share and process personal data necessary to support the provision of services to our clients. All intra-Group sharing and processing of personal data is subject to an Intra-Group Data Sharing Agreement.

Collection of Your Personal Data

We collect personal data about you in three ways: directly from your input, from third-party sources, and through automated technologies.

Data you provide to us

Depending on how you interact with us and the Service, we may collect:

• Contact details, such as your name, business email address and phone number.

• Account login credentials, including usernames, passwords, password hints and similar security information.

• Other account registration and profile information, such as job title.

• Comments, feedback, and other information you provide to us, including search query data and questions you send to customer support.

• Communication preferences, including preferred language.

Data from your organisation

We may obtain personal data about you from the organisation with which you are employed or affiliated in order to activate and manage your access to the Service, including:

• Contact details, such as your name, business email address and phone number.

• Other account registration information such as job title or department.

• Organisational user ID.

Data from other sources

We also may obtain contact details and other information about you from our affiliates and from other third parties, including:

• Service providers that help us determine a location in order to customise certain products to your location.

• Businesses with which we offer co-branded services or engage in joint marketing activities.

• Publicly available sources and data suppliers from which we obtain data to validate or supplement the information we hold.

Data from service use (including Cookies)

The Service may collect information about how you and your device interact with the Service, including:

• Computer, device, and connection information, such as IP address, browser type and version, operating system and other software installed on your device, mobile platform and unique device identifier, error reports and performance data.

• Usage data, such as the features you used, the settings you selected, URL click-stream data (including date and time stamp and referring and exit pages), search terms you used, and pages you visited or searched for on the Service.

• Session replay data: if you use our MyCompliance platform as an administrator user, we reconstruct and review how you interacted with the platform during a session – the elements you clicked, how you scrolled and moved between pages, the order in which you did so, and the technical and usage data described above, together with your user ID and role. This is an after-the-fact visual reconstruction built from those interaction events; it is not a video or a recording of your screen. Session replay applies only to administrator users configuring and managing training campaigns, and not to end-users completing training content.

• For educational Services: the course modules and test questions you view, answer or complete.

• For location-aware Services: the region, city or town where your device is located in order to provide you with more relevant content.

In addition to the above, if you are a customer and using our application, we will process personal information relating to you as set out in the agreed data processing agreement between us and your employer, in our role as “Processor” and where your employer acts as Controller).

In some instances, we collect this data through our servers and the use of cookies and other technologies. Cookies are small text files that can be read by a web server in the domain that placed the cookie on your device. We may use cookies and other technologies to store your preferences and settings, help you with signing in, provide targeted ads and analyse site operations. You can control cookies through your browser’s settings. However, if you block certain cookies, you may not be able to register, log in, or access certain parts or make full use of the Service. For more information, please refer to our Cookie Policy.

Use of Your Personal Data

Depending on how you interact with us and the Service, we use your personal data to:

• Provide, activate, and manage your access to and use of the Service.

• Process and fulfil a request, subscription, or other transaction.

• Provide technical, product and other support and to help keep the Service working, safe and secure.

• Enhance and improve the Service and our other products, events, and services and to develop new products, services, and benefits.

• Understand how administrator users navigate the MyCompliance platform, including by reviewing session replays, in order to identify usability problems, reproduce and diagnose issues that have been reported to us, and decide which improvements to prioritise. We do not use session replay to monitor or evaluate the performance, productivity or conduct of any individual, and it does not involve automated decision-making or profiling producing legal or similarly significant effects.

• Support the operation, maintenance and development of current and future businesses, products and services carried on or offered by us and our Group of companies.

• Offer you customised content and other personalisation to make the Service more relevant to your interests and geography.

• Respond to your requests, enquiries, comments, and concerns.

• Notify you about changes, updates and other announcements related to the Service and our other products and services.

• Deliver targeted advertisements, promotional messages, notices, and other information related to the Service and your interests.

• Provide you with promotional messages and other information about products, events and services of ours, our affiliates and third parties such as sponsors.

• Identify usage trends and develop data analysis, including for purposes of research, audit, reporting and other business operations, and to determine the effectiveness of our promotional campaigns and evaluate our business performance.

• Comply with our legal obligations, resolve disputes, and enforce our agreements.

• Where you or your organisation subscribe to additional security‑related features, we may perform risk scoring or use trusted third‑party cyber‑risk intelligence platforms to help identify potential cyber risks and enhance your security posture.

If you are an administrator of an organisation with a subscription to the Service, we will use your details to communicate with you about your organisation’s subscription and related services. If you supply us with contact information of your colleagues, we may contact those individuals with communications about the Service that may include reference to you.

Use of Artificial Intelligence (AI)

MetaCompliance uses Artificial Intelligence (“AI”) technologies in limited, controlled ways to support the delivery, security and improvement of our Services. We do not use AI to make automated decisions that produce legal or similarly significant effects about you.

How we use AI

We may use AI systems for the following purposes:

• Content optimisation and learning analytics to analyse aggregated usage patterns (e.g., course completion rates, question difficulty, engagement trends) in order to improve training content and user experience. This analysis does not involve profiling that produces significant effects on individuals.

• Security and system performance to detect unusual activity, identify potential security issues, and improve system stability. AI is used as a tool to support human-led security monitoring.

• Product development and quality assurance to help identify defects, improve platform features and support internal testing processes. Personal data used for these purposes is minimised or anonymised wherever possible.

• Customer support efficiency to assist our support teams in categorising queries, identifying common issues and improving response times. AI does not replace human review and support decisions are always made by a human.

• Content creation to develop training materials and content

Sources of data used by AI

AI systems may process the same categories of personal data described in this notice, including usage data, device information and training records. Where feasible, we use anonymised or aggregated data to train or improve AI models.

No automated decision-making with significant effects

MetaCompliance does not use AI to make decisions that have legal or similarly significant effects on you (as defined under UK GDPR Articles 22(1) – (3)). All decisions relating to access, training outcomes, compliance reporting, or account management involve human oversight.

Human oversight and safeguards

We apply appropriate technical and organisational measures to ensure AI systems are used responsibly, including:

• Data minimisation and anonymisation where possible

• Access controls and audit logging

• Regular testing and monitoring for accuracy and fairness

• Human review of outputs before any action is taken

Your rights in relation to AI

You may contact us if you have questions about how AI is used in connection with your personal data, or if you wish to exercise any of your data protection rights. Where AI is used to support decision making, you may request human review or further explanation of how the system contributed to that decision.

Sharing of Your Personal Data

Your organisation

If you access the Service through a subscription administered by your organisation, your personal data and certain usage data gathered through the Service may be accessed by or shared with the administrators authorised by your organisation for the purposes of usage analysis, subscription management and compliance, training course progress, performance and remediation. Session replays are not made available to your organisation and are not used by it or by us to assess any individual. Your organisation can ask us to turn session replay off for all of its users.

Service Providers

We may share information with our service providers, suppliers, agents and representatives, including but not limited to customer support providers, email service providers, event venues and service providers, IT service providers (including software development teams), marketing service providers, product analytics providers, research providers, mailing houses and shipping agents. These service providers will process the information as necessary on our behalf in accordance with our instructions and in compliance with this Notice and any other appropriate confidentiality and security measures.

https://www.bing.com/ck/a?!&&p=0edbdd076c34027ba309d9f4c8fccfb7e0a37734b1193de868081d5e31b5f62cJmltdHM9MTc3NjEyNDgwMA&ptn=3&ver=2&hsh=4&fclid=23a09d36-8823-6922-3ca8-8b6b892d6854&psq=meta+compliance+sub+processors&u=a1aHR0cHM6Ly93d3cubWV0YWNvbXBsaWFuY2UuY29tL3N1YnByb2Nlc3NvcnMIntra-group sharing and inter-group processing

As noted in ‘Group Structure and Data Controllers’ above, we may share your personal data with other members of the MetaCompliance Group for the purposes described in this Notice. Intra-Group sharing may occur for the following purposes:

• Providing and supporting the Services across multiple jurisdictions, including customer account services and customer support.

• Centralised document storage (including SharePoint), IT infrastructure, information security, security monitoring and disaster recovery.

• Group-level finance functions, including accounts payable and receivable, management reporting, tax and audit support.

• Product development, analytics, testing, maintenance and incident remediation, and quality assurance activities.

• Centralised legal, privacy, compliance and information security functions, including legal advice, the handling of claims and governance.

• Centralised marketing operations, including campaign management, CRM administration, lead generation, event and webinar promotion, marketing analytics, and consent and preference management.

• Sales support, and contract renewal management including the monitoring, negotiation, approval and execution of renewals.

All intra-Group sharing and processing of personal data is governed by a binding Intra-Group Data Sharing Agreement (“IGDSA”) that imposes obligations on recipient entities equivalent to those required by UK GDPR. No intra-Group transfers to third countries currently take place. Were that to change, appropriate transfer safeguards would apply as described below.

Where one Group entity processes personal data on the instructions of another, that processing continues for as long as the entities concerned remain members of the Group, or for as long as the relevant service or activity is carried out, unless the instructing entity requires otherwise.

None of the intra-Group data flows recorded in the IGDSA is currently carried out on a joint controller basis. Should joint controllership arise, an arrangement under Article 26 UK GDPR will be put in place to allocate the respective responsibilities of the entities concerned.

For legal reasons

We also will disclose your personal data if we have a good-faith belief that such disclosure is necessary:

• To meet any applicable law, regulation, legal process, or other legal obligation.

• To detect, investigate, and help prevent security, fraud, or technical issues.

• To protect the rights, property, or safety of MetaCompliance, our users, employees, or others.

• As part of an actual or potential corporate transaction, such as a transfer of assets to or an acquisition by or merger with another company.

International Transfers and Transfer Safeguards

Some of our service providers are located outside the United Kingdom (“UK”) and the European Economic Area (“EEA”).

The table below summarises the key transfer scenarios and the safeguard mechanism applied in each case.

Note: The above table reflects the position as at the date shown at the top of this Notice. We will update it promptly if our processing activities or applicable legal framework change.

We review transfer mechanisms and any relevant Transfer Impact Assessments (“TIAs”) at least annually, and whenever there is a material change in the legal or regulatory landscape of a destination country. Where a TIA indicates that a transfer cannot proceed safely, we will take corrective action before the transfer occurs.

Legal Basis for Processing Your Personal Data

Our legal basis for collecting and using the personal data described in this Notice will depend on the personal data concerned and the specific context in which we collect it. We will normally collect and process personal data under one or more of the following bases:

Performance of a contract: Where we have obligations under a contract with you or your organisation, we will use your information to perform those obligations—for example, to activate and manage your access to the Service.

Legitimate interests: We will use your information for our own legitimate interests, for example to provide you with the best suitable content on our website or app, to improve and promote our services, to analyse how the Service is used (including the session replay described above, which we use to keep the MyCompliance platform usable and reliable for the administrators who rely on it), and for administrative purposes including creating and maintaining business records of our relationship with you. Where we rely on this basis, we have carried out a balancing test to ensure our interests do not override your rights and interests.

Legal obligation: In some cases, we have a legal obligation to collect and retain personal data (for example, to comply with tax, employment, or regulatory laws).

Consent: Where we rely on your consent to process personal data (for example, for certain marketing communications or optional cookies), you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to withdrawal.

Vital interests: In exceptional circumstances, we may process personal data where it is necessary to protect your vital interests or those of another person (for example, in an emergency situation).

Retention of your Personal Data

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, regulatory, accounting, or reporting requirements. We consider the following factors when determining appropriate retention periods: the nature and sensitivity of the data; the potential risk of harm from unauthorised use or disclosure; the purposes for which we process the data; whether we can achieve those purposes through other means; and applicable legal or regulatory requirements.

When a retention period expires, personal data will be securely deleted or anonymised. Where immediate deletion is not technically possible (for example, because the data resides in backup archives), we will isolate it from further active processing and delete it at the earliest practical opportunity. Anonymised data (data from which all identifiers have been irreversibly removed) is not personal data and is not subject to this Notice.

If you have any queries in respect of retention please contact [email protected]

Your Rights in Relation to Your Personal Data

Subject to applicable law, you may have the following rights in relation to the personal data we hold about you. We respond to all valid requests within one calendar month of receipt, extendable by a further two months in complex cases, in accordance with UK GDPR Article 12.

• Right of access: You may request a copy of the personal data we hold about you and supplementary information about how we process it.

• Right to rectification: You may ask us to correct inaccurate or incomplete personal data.

• Right to erasure (‘right to be forgotten’): In certain circumstances, you may ask us to delete personal data we hold about you, for example where it is no longer necessary for the purposes for which it was collected.

• Right to restrict processing: You may ask us to restrict the way in which we process your personal data while a complaint is being resolved.

• Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you may ask us to provide your personal data in a structured, commonly used and machine-readable format, or to transmit it directly to another controller.

• Right to object: You may object to processing based on legitimate interests, including for direct marketing purposes. This includes session replay: you can ask us to switch it off for you specifically directly by using the contact details below.

• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time via the ‘unsubscribe’ link in marketing emails or by contacting us.

• Right to lodge a complaint: You have the right to lodge a complaint with the UK data protection supervisory authority. The Information Commission (IC) can be reached at [www.ico.org.uk](https://www.ico.org.uk) or by calling 0303 123 1113.

Please note that some rights are qualified and may be subject to exemptions. We will explain any limitations that apply when we respond to your request.

You may exercise your rights at any time by contacting our Data Protection Office. You also now have a statutory right to raise a data protection complaint with us under Section 164A DPA 2018. See below for details.

To exercise any of the above rights, please contact our Data Protection Office using the details at the end of this Notice.

Data Protection Complaints (Section 164A DPA 2018)

This section explains how you can make a complaint, what you can expect from us, and how you may escalate matters to the Information Commission (IC).

How to Make a Data Protection Complaint

You may raise a complaint with us using any of the contact methods listed in this Notice. Complaints may be submitted by email, post, telephone, or through any channel by which you ordinarily communicate with us.

A complaint may relate to any aspect of our handling of your personal data, including concerns about accuracy, access, security, retention, or compliance with this Privacy Notice.

What We Will Do When We Receive Your Complaint

Upon receiving your complaint, we will:

• Acknowledge your complaint within 30 days of receipt of your communication as required by Section 164A.

• Investigate the issues raised without undue delay which may include reviewing records, contacting relevant teams, or requesting further information from you.

• Keep you informed of the progress of our investigation.

• Provide you with a written outcome explaining our findings and any actions taken.

This process is separate from, and in addition to, your rights under UK GDPR.

Record‑Keeping

We maintain a record of all complaints received, including the nature of the complaint, steps taken during the investigation, and the final outcome. Complaint records are retained in accordance with our retention schedule for customer support correspondence.

Escalation to the IC

If you remain dissatisfied, or if you prefer not to raise your concern with us directly, you have the right to lodge a complaint with the UK’s supervisory authority for data protection, the Information Commission (IC), which is the regulatory authority which oversees data protection compliance in the UK.

We have included details of how to contact them below. This process is in line with your rights under applicable data protection law, including the Data (Use and Access) Act 2025, and does not affect your right to seek a judicial remedy.

Information Commission (IC)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk/make-a-complaint/

Security of Your Personal Data

We implement appropriate technical and organisational measures in line with accepted industry standards to ensure a level of security appropriate to the risk to the personal data we process. These measures are aimed at ensuring the ongoing confidentiality, integrity, availability, and resilience of our processing systems and services.

Our Services may, from time to time, contain links to and from the websites of our partners, advertisers and affiliates. If you follow a link to any of these websites, please note that they have their own privacy policies, and we do not accept any responsibility or liability for those policies. We encourage you to carefully read the privacy notice of any website you visit.

Children’s Privacy

We do not knowingly collect information from children under the age of 16, and none of our Services are directed at children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take prompt steps to delete that information.

Changes to This Privacy Notice

We may update this Privacy Notice from time to time in response to changing legal, technical, or business developments. When we update this Notice, we will act appropriately to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material changes where this is required by applicable data protection laws.

You can see when this Privacy Notice was last updated by checking the ‘Last updated’ date displayed at the top of this Notice.

Contact Us

If you have any questions, comments, complaints, or requests regarding this Privacy Notice or our processing of your personal data, please contact our Data Protection Office:

Data Protection Office

MetaCompliance Limited

49 St James’s Street, London, SW1A 1JT

Email: [email protected]

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws, and in any event within the timescales required by UK GDPR.

Last updated: 8th October 2026

Archived versions of this Policy can be found HERE