Privacy Policy

EngCPD is a product of Kingstone Consultancy Ltd, a company registered in England and Wales. Kingstone Consultancy Ltd is the data controller for personal data processed through EngCPD. Registered address: No1 Parkside Court, Greenhough Road, Lichfield, Staffordshire, United Kingdom, WS13 7FE. Contact: wn@kingstone-consultancy.com.

This policy explains what personal data we collect, why, how long we keep it, who we share it with, and the rights you have over it under UK GDPR.

• Identity. Your email address and account identifier, both held by KC Secure, our own authentication service (see §5). We never see or store your password.
• Legal and preferred name. Set once, early on, and editable any time from Account settings. Your legal name is private, shown only back to you, for anything formal like a registration application. Your preferred name is shown wherever EngCPD shows your own identity to you, and to other members if you join the mentoring directory (§4) - your real email address is never shown to them either way.
• CPD entries. Everything you log: title, type (conference, course, webinar, etc.), date, duration, category, and any reflection text you write (“what I did”, “how it applies”, “outcome / follow-up”).
• Pasted links. When you add an entry from a link, the URL you paste is stored on that entry. We fetch the page once, server-side, to read its title, date and description; we do not store the page’s contents beyond what we extract into the entry.
• Calendar subscription URLs. If you connect a calendar, we store the ICS/webcal URL you give us so we can periodically re-fetch it. Depending on your calendar provider, this URL can itself act as a secret credential to your calendar. We store it as any other credential and use it only to look for events that look like CPD; you can remove a connected calendar at any time from the Calendar page, which deletes the stored URL immediately.
• Reports you generate. The period, template, optional recipient name (e.g. “IET” or an employer’s name), and total hours of each report you generate. Report documents themselves (the printable page, the CSV) are generated on the fly and are not stored as files.
• Documents you upload. Your CV and any prior years’ CPD records you choose to add from the Documents page, stored in our file storage (Cloudflare R2). Only you can view or download these unless you’ve opted in per §4, in which case Kingstone Consultancy’s internal team can too.
• Professional memberships. Any institutions you tell us you belong to from the Account page, your accreditation level with each (e.g. CEng), and an optional membership number. Used to prefill a report’s recipient, and to show an aggregate, anonymous count of how many EngCPD users hold each institution on the Institutions page; never shared in a way that identifies you.
• Your consent choice. Whether you have agreed to Kingstone Consultancy contacting you about work (§4), and when you last set that choice.
• Reminder email preference. Whether you’ve turned off progress reminder emails (CPD hours and overdue goal target dates, §4), and when we last sent you one.
• Career history and qualifications. Any past roles, employers, dates, and degrees or certifications you add on the Account page. Used to compose the CV builder’s output, and shown on your mentoring profile page (§4) if you’ve joined the directory.
• Languages, skills, and interests. Whatever you add on the Account page. Used to compose the CV builder’s output, and shown on your mentoring profile page (§4) if you’ve joined the directory.
• Goals and their steps. Any goal you add on the Goals page, its steps, target date, and any of your own CPD entries you cite as evidence toward it. Private by default; visible to anyone else only if you explicitly share a specific goal with a specific accepted mentor connection (§4).
• Mentoring directory profile. If you join the mentoring directory (§4): whether you’re there as a mentor, mentee, or both; which UK-SPEC areas you’re interested in; an optional bio, photo, town, and country; an optional LinkedIn URL; and an optional Spotify playlist link, shown as an embedded player on your profile page.
• Mentoring messages. The content and timestamp of messages you send or receive through the mentoring directory (§4).
• Connections. Who you’ve requested, or accepted, a mentor, mentee, or peer connection with through the mentoring directory, and when (§4).
• Registration evidence drafts. If you start one on the Registration page: your target accreditation level, your written evidence for each UK-SPEC competency area, any of your own CPD entries cited as supporting evidence, and, if you request a review, the reviewer’s comments (§4).

EngCPD itself sets no cookies. The only cookie involved is KC Secure’s session cookie (__Host-kc_session), which keeps you signed in. It is strictly necessary for the service to work and is essential under UK law (PECR), so it is set without a consent banner. We do not use analytics, advertising, or tracking cookies.

We use your data to provide the service: storing and displaying your CPD log, fetching details from a link or calendar you’ve connected, and generating reports on request.

If you opt in on the welcome screen or in Account settings, we share your email address, a summary of your logged CPD (hours and, where you use the UK-SPEC framework, the competency areas they fall under), and any CV or prior CPD record you’ve uploaded, with Kingstone Consultancy’s internal team, so they can review it and get in touch if they have relevant work. We don’t share your reflection text, pasted links, or connected calendar details. This is entirely optional, off by default, and has no effect on your use of EngCPD either way. You can change this choice at any time from the Account page, and it takes effect immediately.

Separately, if you’re still short of your annual CPD target a month into your CPD year, we may email you a reminder of your progress, at most roughly once a month. This is a service email about your own account, not marketing, so it’s on by default; you can turn it off at any time from the Account page.

If you join the mentoring directory, this is different from the sharing above: it shows your full profile (role, UK-SPEC areas of interest, bio, photo, location, LinkedIn link, career history, qualifications, professional memberships, languages, skills, interests, and Spotify playlist if you’ve added one) to other EngCPD users who have also joined, not just to Kingstone Consultancy. Messaging another member never reveals either of your real email addresses to each other: a message is relayed to the real recipient by email so they don’t have to be actively browsing to see it, identified only by their own directory information. Joining is the opt-in; leaving the directory from the mentoring page removes your listing immediately, though it doesn’t delete messages already exchanged, which stay visible to the other party as a record of that conversation.

If you add a Spotify playlist link to your profile, it’s shown to other directory members as an embedded player. Unlike the rest of your profile, which we serve directly, loading that embed means another member’s browser makes a direct request to Spotify at the moment they view your profile, so Spotify sees that request came from their browser. This is different from §5’s “whatever page or calendar feed you point us at” bullet, where the request is our server’s, triggered by your own action: here it’s another user’s browser, triggered by your choice to add the link.

You can also request, or accept, a specific mentor, mentee, or peer connection with another directory member. This is a separate, explicit step from just messaging someone; only an accepted connection unlocks goal-sharing and registration-review requests below. Declining or never responding to a request means nothing further happens.

Goals are private by default. You can choose to share a specific goal with a specific accepted mentor connection; only that person, not the whole directory, then sees it. Stopping the share removes their access immediately.

A registration evidence draft is visible only to you until you request a review from an accepted mentor connection, at which point that specific reviewer can see the draft and leave comments, which you can then see. You can request a review from more than one mentor over time, but each is a separate, explicit request.

We do not sell your personal data. It is shared only with:

• KC Secure: Kingstone Consultancy’s own self-hosted authentication service. It holds your email and password (as a salted hash it can verify but not reverse) and issues the session that keeps you signed in. It uses Resend to deliver verification, one-time-code, and password-reset emails.
• Cloudflare: hosts EngCPD (Workers) and its database (D1). Cloudflare processes data in the course of serving requests but does not use it for its own purposes.
• Resend: EngCPD (separately from KC Secure’s own use above) uses Resend to deliver your CPD progress reminder emails, if enabled, and to relay mentoring directory message notifications (§4).
• Whatever page or calendar feed you point us at. Fetching a pasted link or a calendar subscription URL means our server makes an HTTP request to that third-party service, which will see that request came from EngCPD. We don’t control what that third party does with it.
• Kingstone Consultancy’s internal team: only if you’ve opted in, per §4. What’s shared is your email, CPD summary, and any uploaded CV or prior CPD record; never your reflection text, pasted links, or connected calendar details.
• Other EngCPD users who’ve joined the mentoring directory: only if you’ve joined it too, per §4. This is a different, separate opt-in from the Kingstone Consultancy sharing above; your real email address is never part of what’s shared here.
• A specific accepted mentor connection: only for a goal you’ve explicitly shared with them, or a registration draft you’ve explicitly requested their review on (§4). Never the whole directory, and never anyone you haven’t connected with.
• Spotify: only if you add a playlist link to your mentoring profile. The request is made by another directory member’s browser when they view your profile, triggered by your choice to add the link, not by our servers (§4).

We disclose data beyond this only where required by law.

• Providing the service (your account, CPD entries, reports): performance of our contract with you (Article 6(1)(b)).
• Sharing your details with Kingstone Consultancy: your consent (Article 6(1)(a)), off by default, withdrawable at any time from Account settings.
• The mentoring directory (your listing and messages, visible to other members): your consent (Article 6(1)(a)). Joining is the consent, and leaving withdraws it.
• Connections, sharing a goal, and requesting a registration review: your consent (Article 6(1)(a)) in each case. Requesting or accepting a connection, sharing a goal, or requesting a review is the consent; stopping any of them withdraws it.
• Keeping the service secure and working (rate limiting, error diagnosis, audit logging in KC Secure): our legitimate interests (Article 6(1)(f)).
• Sending CPD progress reminder emails: our legitimate interest in helping you actually meet your CPD target (Article 6(1)(f)), balanced by the easy opt-out in Account settings.

We retain your account and CPD data for as long as your account is active. You can delete your account at any time from the Account page: this immediately and permanently deletes your CPD entries, connected calendars, reports, custom categories, professional memberships, career history, qualifications, languages, uploaded documents, mentoring directory profile and messages, connections, goals, registration drafts (and any reviews on them), and your identity at KC Secure. KC Secure’s own audit log records that an account existed and was deleted, in anonymised form, for security accountability. See its published security documentation for detail.

Subject to applicable law, you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion of your data, request a portable export, object to or restrict certain processing, and withdraw consent where processing is based on it. Most of these you can already exercise directly: your CPD log is visible and editable in the app, and account deletion is self-serve from the Account page. For anything else, contact wn@kingstone-consultancy.com. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

EngCPD is a professional tool aimed at working engineers and is not directed at children. We don’t knowingly collect data from anyone under 18.

Traffic to EngCPD is encrypted in transit. We never hold your password: KC Secure stores only a salted hash and checks every session against a live, revocable record on each request, so signing out or deleting your account takes effect immediately. No system is perfectly secure, and we can’t guarantee the security of a third-party page or calendar feed you choose to connect.

Cloudflare and Resend are US-headquartered providers, so data may be processed outside the UK/EU as part of running the service. Where that happens, we rely on standard contractual clauses and other UK data protection law safeguards.

We may update this policy from time to time. If we make material changes, we’ll take reasonable steps to notify active users. The “last updated” date at the top reflects the most recent revision.

Questions and data requests: wn@kingstone-consultancy.com, or by post to Kingstone Consultancy Ltd, No1 Parkside Court, Greenhough Road, Lichfield, Staffordshire, United Kingdom, WS13 7FE.