Your data, handled with care.

KurdCPD ("we", "us") is the data controller for personal data processed through this platform, except where an organisation customer has contracted us as a processor (see our DPA).

Contact: privacy@kurdcpd.com

• Account data: name, email, password hash, role.
• Professional identifiers: regulator (HCPC, GMC, NMC), PIN/registration number.
• CPD content you submit: activities, hours, reflective notes, uploaded evidence.
• Organisation links: employer, team, line manager, confirmer.
• Technical data: IP address, device, browser, log data.

• Contract — to provide the CPD platform you signed up for.
• Legitimate interests — service security, product improvement.
• Legal obligation — tax, accounting, regulatory cooperation.
• Consent — optional analytics and marketing (where applicable).

To operate your account, generate CPD records and exports, share data with your organisation where you have linked your account, provide support, and meet legal obligations.

We share data with vetted sub-processors (hosting, email, analytics). See the sub-processors list.

Where data is transferred outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Addendum to the EU SCCs.

See our Retention Policy. In summary, CPD records are kept for the life of your account plus a short grace period; logs are retained for security purposes for up to 12 months.

You may access, correct, delete or port your data, restrict or object to processing, and withdraw consent. Submit requests via our data requests page. You can complain to the Information Commissioner's Office (ico.org.uk).

We may update this notice. Material changes will be communicated by email or in-app notice.