FormedPower operates two service lines — safety and isolation consultancy, and leadership assessment and training — and delivers its courses through a LearnDash-based learning platform. This policy explains what personal data we collect when you enquire, book a diagnostic, or enrol on a course, how we use it, and the rights you hold over it.
In short: we collect the data needed to deliver and evidence training, we retain assessment records because certification requires it, we do not sell personal data, and you can contact us at any time to access, correct or erase your information.
Who we are
FormedPower ("we", "us") is the trading name of [legal entity name], a company registered in Ireland under company number [number], with its registered office at [registered address]. We are the data controller for the personal data described in this policy.
We provide two related services: Certified Senior Authorised Person (SAP) and safe-isolation consultancy, and leadership assessment and development including the CPD-certified Dynamic Direct Leadership programme. Course delivery, assessment and certification take place on our learning platform, which is built on WordPress with the LearnDash learning management system.
Scope of this policy
This policy applies to our public websites, our enquiry and booking forms, our learning platform and learner accounts, and any correspondence connected with the delivery of our services. It covers you whether you are a prospective client making an enquiry, an individual learner enrolled on a course, or a manager or administrator enrolling others on behalf of an organisation.
Where we deliver training under contract to an employer, that employer may be a joint or separate controller in respect of learner records shared with them. Section 08 explains what is shared and on what basis.
Personal data we collect
We collect only what is needed to answer your enquiry, take payment, deliver training, and evidence competency. The categories below reflect our actual use of the platform.
How we obtain it
Most of the data above you give us directly — through an enquiry or booking form, when creating a learner account, when completing an assessment, or in correspondence. Some is generated automatically as you use the learning platform, including progress and quiz records created by LearnDash and technical data written to server logs.
Where an employer enrols you on a course, we receive your name, work email address and group assignment from that employer in order to create your account.
Why we use it, and our lawful basis
We rely on one of four lawful bases under the GDPR for each purpose: performance of a contract, legitimate interests, consent, or compliance with a legal obligation.
Assessment, profiling and course placement
The leadership diagnostic produces a behavioural profile that determines which course track we recommend to you. This involves evaluating your responses against defined behavioural dimensions, so it constitutes profiling within the meaning of the GDPR.
The placement recommendation is not made by automated means alone. Scoring is assisted by the platform, but every profile is reviewed by Andrew Dowling and confirmed with you in a live debrief before any placement is made. You may disagree with a placement, ask for the reasoning behind it, and request a different track.
Where an employer has commissioned the diagnostic, section 08 governs what they see. We do not represent diagnostic results as a measure of personal worth, suitability for employment, or clinical or psychological assessment, and they should not be used for those purposes.
How long we keep it
We keep personal data only as long as we need it for the purpose it was collected, or as long as we are required to keep it by law. Certification and assessment records are kept longer than other data because the value of a competency record lies in being able to produce it later.
International transfers
We aim to keep personal data within the European Economic Area. Where a provider processes data outside the EEA, we rely on an adequacy decision or on Standard Contractual Clauses together with any additional safeguards required, and we keep a record of the transfer mechanism used for each provider. Details of current providers and their locations are available on request.
Security
Access to the learning platform is over TLS, passwords are stored only as salted hashes, and administrative access is limited to named accounts with multi-factor authentication. Learner accounts are individual and non-transferable; we monitor for shared credentials because they undermine the integrity of a competency record.
No platform is immune to compromise. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and inform affected individuals without undue delay.
Your rights
Under the GDPR you have the right to be informed, to access a copy of your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent where consent is the basis we rely on. You also have the right not to be subject to a decision based solely on automated processing.
Two limits apply in practice. Where we are required to keep certification and assessment records to evidence training we have certified, we may refuse an erasure request in respect of those records and will explain why. And withdrawing consent to service messages is not possible while you hold an active enrolment, because those messages form part of course delivery.
Children
Our services are intended for working adults. We do not knowingly create learner accounts for anyone under 18, and we do not market to children. Where a course is delivered to an apprentice or trainee under 18, enrolment is arranged through their employer and we process only the data needed to deliver and certify the training.
Changes to this policy
We may update this policy as our services, platform or legal obligations change. The version number and last-updated date at the top of this page always reflect the current version. Where a change materially affects how we use your data, we will notify active learners by email or through a notice on the platform before it takes effect.
Contact and complaints
To exercise any of your rights, or to raise a concern about how your data has been handled, contact us in writing. We respond to rights requests within one month. If you are not satisfied with our response, you may lodge a complaint with the Irish Data Protection Commission.