Legal
Privacy & Cookie Policy
This policy explains how Comera Movement Science Ltd ("we", "us", "our") collects, processes, uses, shares and protects personal data when you visit the Comera store at store.comeragroup.co.uk (the "store"), buy from it, are booked on a course through it, hold a certificate issued through it, or run courses through it, and your rights under UK data protection law.
Comera Movement Science runs the store for itself and on behalf of the other companies of Comera Group. Comera Group's own website has its own privacy policy. Each of the Group's companies is a legally separate entity.
It provides details of the nature of the personal data collected by us, together with the purposes of the processing. It also indicates your rights in relation to the data processed and who to contact for further information or requests. In this privacy notice your "personal data" is sometimes referred to as your "information."
Who we are
Data controller: Comera Movement Science Ltd, a company registered in England and Wales (company number 03854711).
Registered office: Origin Workspace, 40 Berkeley Square, Bristol, BS8 1HP.
ICO registration number: Z1241279.
Data protection contact: privacy@comeragroup.co.uk.
Having assessed our processing, we are not required to appoint a statutory Data Protection Officer; the contact above handles all data protection matters. This policy is governed by UK data protection law, principally the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR) for cookies (small text files stored in a user's browser) and marketing.
What data we collect
| Who | What we hold |
|---|---|
| Buyers (booking, buying eLearning or a product, subscribing) | First name and surname, email address, whether you are buying for yourself or an organisation, organisation name, VAT number and purchase order reference (if given), country, what you bought and paid, refunds, the consents you gave at checkout (with the wording and time), and whether you asked for marketing. We do not collect your phone number at checkout, and we never see card details. Your billing address is given on Stripe's payment page and held by Stripe; we read it only to send you a VAT invoice when you ask for one, and don't keep a copy in the store. |
| Attendees and learners booked by someone else | First name, surname and email address given by the person who booked you; your course place; for courses, the register (attended, passed); for eLearning, your enrolment and your progress as reported by the learning platform. |
| Certificate holders | Name, email address, course, dates, course provider, tutor names, certificate number, expiry date, and when the certificate was issued, emailed and downloaded. Certificates issued before the store existed (from our previous system) are imported with the same details. |
| Account holders | Email address, name, password (stored only as a secure hash), sign-in security (authenticator app or passkey records), your preferences (including marketing), the devices and IP addresses of your current sign-ins, and changes of email address. |
| Enquirers | Name, email address, and anything you choose to give: phone number, organisation, location, preferred dates and your message. |
| Course alert sign-ups | Email address, the course, an optional country, whether online dates suit you, an optional note, and your confirmation of the sign-up. |
| Tutors, course organisers and franchise partners | Name, email address, organisation, country, VAT number, accreditations, the course dates you run, the people you invite to teach with you, registers and results you record, certificate fees, your logo, and your balance and payouts from store sales (payment details for payouts are handled by our accounts team). |
| Everyone using the store | Security records: IP address, browser type, the page requested and the time, sign-in attempts, and security events (such as a failed sign-in or a refund). |
Technical & usage data: IP address, device and browser type, pages visited and referring pages - collected through cookies and analytics, and only with your consent for non-essential cookies (see Cookies below).
Please don't include sensitive personal information (such as health details) in a form message - the store is not intended to collect special category data and no responsibility will be taken for any such information sent by you using the store.
How we use your data and our lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Taking and managing your order: payment, invoices, confirmation emails, course places, eLearning access, subscriptions and partner products | Contract (Art. 6(1)(b)) |
| Contacting people booked or enrolled by someone else, to send joining or sign-in details and run the course | Legitimate interests (Art. 6(1)(f)) - delivering the booking the buyer made for them |
| Issuing certificates, emailing them when ready, reminding holders who haven't downloaded them, and letting anyone check a certificate is genuine using its number and the holder's surname | Contract with the person who booked; legitimate interests in reliable, verifiable certificates and preventing fraud |
| Refresher reminders before a certificate expires (you can stop them with one click) | Legitimate interests - helping holders keep their qualification current |
| Course alerts and waiting lists: telling you when dates you asked about are listed | Consent (Art. 6(1)(a)) - you confirm by email, and can stop at any time |
| Send you marketing (occasional updates about courses and products) | Consent (Art. 6(1)(a)) - only if you opt in; you can withdraw at any time |
| Keeping customer records in our customer relationship system so we can answer questions, follow up enquiries and manage business accounts | Legitimate interests - managing our customer relationships |
| Answering enquiries | Taking steps at your request before entering a contract (Art. 6(1)(b)), and our legitimate interests in responding to enquiries (Art. 6(1)(f)) |
| Running courses with tutors, organisers and franchise partners: accounts, course dates, registers, logos on certificates, certificate fees, balances and payouts | Contract with the provider |
| Accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Not selling to countries under trade sanctions, and asking providers to check attendees where sanctions screening applies | Legal obligation |
| Keeping the store and your account secure: sign-in codes, lockouts after repeated failures, limits on repeated requests, security logs and monitoring, and backups | Legitimate interests - security and fraud prevention; for some records, legal obligation |
| Measure, manage, improve and enable navigation of the store | Consent (for non-essential analytics cookies) |
We will only send you marketing communications if you have opted in, and every marketing email includes an unsubscribe link. We do not sell your data or share it with third parties for their own marketing.
If someone else booked you
When an organisation or another person books you on a course or enrols you on eLearning, they give us your name and email address. We use these only to send your joining or sign-in details, run the course, record the register and issue your certificate - never for marketing, unless you sign up yourself. Your joining email provides a link to this policy.
Automated decisions
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Some checks are automatic: the store doesn't sell to countries under trade sanctions; it offers some payment methods only when a course is far enough ahead; and it temporarily locks an account after repeated failed sign-ins. A certificate is confirmed or withdrawn when the course provider records the register. If you think a check has got something wrong, contact us and a person will look at it.
Cookies and similar technologies
When you first visit our site we show a cookie banner that lets you accept or reject non-essential cookies. Non-essential cookies are not set until you consent, and you can change or withdraw your choice at any time using the Cookie settings control in the footer of every page - withdrawing consent also removes the analytics cookies already set. We use the following categories:
| Category | Cookie | Purpose | How long | Consent needed? |
|---|---|---|---|---|
| Strictly necessary | A record of your cookie choice | Remembers your consent decision so we don't ask again | 12 months | No |
| Strictly necessary | __Host-sessionid | Keeps you signed in and remembers your progress through checkout (a random identifier; the details stay on our server) | Until you close your browser; signed out after 15 minutes without activity, 8 hours at most | No |
| Strictly necessary | __Host-csrftoken | Security: proves a form you send really came from the store | 1 year | No |
| Strictly necessary | basket | Remembers your basket (a random identifier) | 30 days | No |
| Strictly necessary | price_view | Set only if you choose to see prices without VAT; remembers that choice | Until you close your browser | No - you set it |
| Strictly necessary | messages | Shows a one-off message after an action | Removed once shown | No |
| Analytics / performance | Google Analytics (_ga, _ga_*) | Measures how the store is used so we can improve it | Up to 2 years | Yes |
Google Analytics loads only after you accept analytics cookies, and never on the checkout, payment or sign-in pages. Google Analytics truncates IP addresses before storing them (meaning it does not show us your full IP address), and we do not use it for advertising. Google Analytics cookies last up to 2 years; we retain the analytics data for up to 14 months. If you withdraw consent via Cookie settings, analytics is switched off and those cookies are deleted. You can also block or delete cookies through your browser settings, though the store won't work properly without strictly necessary cookies: you won't be able to sign in, keep a basket or check out.
When you pay, you go to Stripe's secure payment page, which sets its own cookies to process the payment and prevent fraud; Stripe's cookie policy applies there.
Who we share your data with
We do not sell your data. We share it only as follows:
- Comera Group companies and course providers (the company named on the course, and its accredited tutors, course organisers and franchise partners) - attendee names and email addresses, registers and results, to run the course and issue certificates.
- Partners whose products you buy - for subscriptions (such as Wibbi exercise software), your name, email address, organisation, VAT number, country and order details, so they can set up and support your account; for books (such as an eBook from its publisher), what the publisher needs to supply your access.
- Stripe - takes card and other payments on its own secure page, holds the billing address you give for invoicing, and sends our invoices and subscription payments. Stripe also processes payment data for its own fraud prevention and legal obligations, under its own privacy notice.
- TalentLMS (Epignosis) - our eLearning platform: learner name, email address and enrolments.
- UpCloud (UK) - hosts the store on servers in London.
- Amazon Web Services (UK) - stores our backups in London, encrypted on our server before they are sent, so AWS cannot read them.
- Zoho Corporation - ZeptoMail (EU) - sends the store's emails.
- Zoho Corporation - Zoho CRM & Zoho Campaigns - holds customer records and, if you opt in, sends our marketing; Zoho's security monitoring service receives security logs.
- Google - Google Analytics, used only with your consent.
Our service providers act under contracts that require them to protect your data and use it only on our instructions. We may also disclose data where required by law, by a regulator, or to establish, exercise or defend legal claims.
International transfers
Some of our providers process data outside the UK. Where they do, an appropriate safeguard is in place.
| Provider | Role | Location | Safeguard |
|---|---|---|---|
| UpCloud | Hosting | United Kingdom (London) | No overseas transfer |
| Amazon Web Services | Encrypted backups | United Kingdom (London) | No overseas transfer |
| Zoho (ZeptoMail) | Transactional email | European Union | UK adequacy regulations for the EEA |
| Zoho (CRM / Campaigns / security monitoring) | CRM, marketing, security logs | International | International Data Transfer Agreement (IDTA) / UK Addendum to the EU Standard Contractual Clauses |
| Analytics | United States / global | UK Extension to the EU-US Data Privacy Framework and/or the IDTA | |
| Stripe | Payments | EU / United States | UK adequacy (EEA); UK Extension to the EU-US Data Privacy Framework and/or the IDTA |
| TalentLMS (Epignosis) | eLearning | EU / United States | UK adequacy (EEA); UK Extension to the EU-US Data Privacy Framework and/or the IDTA |
| Wibbi | Subscription partner | Canada | UK adequacy regulations (Canada) |
Details of the specific safeguards are available on request from our data protection contact.
How long we keep your data
| Record | How long |
|---|---|
| Orders and bookings, with their payments, refunds and eLearning enrolments | Seven years after the order (six years plus the current year, for our accounts) |
| Subscriptions | Seven years after they end |
| Unfinished checkouts and baskets | 30 days |
| Your account | Erased if you don't sign in for six years: your name and email address are removed for good |
| Enquiries | One year |
| Certificates and course registers | Kept, so certificates can always be checked; a withdrawn certificate is kept and shown as withdrawn |
| Course alert sign-ups | Until you stop them or book the course, and at most 12 months |
| Marketing contacts | Until you unsubscribe or withdraw consent (we also review our list periodically) |
| A request to stop reminders | Kept, so we don't email you again |
| Records of email address changes | One year |
| Security records | Sign-in lockout records 180 days; audit records 400 days; security logs at our monitoring service 12 months |
| Website analytics | Up to 14 months |
| Backups | Encrypted; daily for a week, weekly for a month and monthly for a year, then deleted. Something deleted from the store stays in older backups until they expire. |
We keep personal data no longer than necessary for the purpose it was collected, unless the law requires us to keep it for longer.
How we protect your data
We use technical and organisational measures proportionate to the data we hold: encryption in transit (HTTPS/TLS), an encrypted database at a UK data centre, encrypted backups held with a different company, two-step sign-in for everyone who runs courses or works on the store, reputable service providers, access limited to those who need it, education and training to relevant staff to ensure they are aware of our data protection obligations when processing personal data, physical security measures (such as staff security passes to access our premises), and protections on our forms against spam and abuse. We never see or store card details. The transmission of data over the internet (including by e-mail) is never completely secure. We endeavour to protect personal data, but we cannot guarantee the security of data transmitted to us or by us. We take reasonable steps to safeguard your information.
Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict, object to and be informed about our collection/processing of your personal data, to data portability, and to withdraw consent at any time where processing is based on consent. You also have rights in relation to automated decision making and profiling. To exercise any of these rights, email privacy@comeragroup.co.uk. We will respond within one month, and there is normally no charge.
You can also update your details in your account, stop refresher reminders and course alerts using the link in any of those emails, and unsubscribe from marketing using the link in any marketing email or in your account.
Children
The store is for adults and professionals, no one under the age of 18 may use it. We do not knowingly collect data from anyone under 18.
Complaints
If you have concerns about how we handle your data, please contact us first so we can try to put things right. If you remain dissatisfied or feel the matter was not resolved by us, you also have the right to complain to the UK supervisory authority: the Information Commissioner's Office (ICO) - ico.org.uk/make-a-complaint, helpline 0303 123 1113, address The Office of the Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Changes to this policy
We may update this policy from time to time. We will post the updated version here and change the "last updated" date above. Where changes are significant, we will take reasonable steps to highlight them.
Third party requests
If you are submitting a personal data request on behalf of someone other than yourself, please contact us by using the contact details in this Privacy Notice and include proof that you are authorised to make the request. This may be in the form of a written authorisation signed by the person whom you are acting on behalf of or a valid power of attorney.
Contact us
Comera Movement Science Ltd
Origin Workspace, 40 Berkeley Square, Bristol, BS8 1HP
Data protection: privacy@comeragroup.co.uk
See also: Terms of Sale · Website Terms of Use