Privacy Policy

EngCPD is a product of Kingstone Consultancy Ltd, a company registered in England and Wales. Kingstone Consultancy Ltd is the data controller for personal data processed through EngCPD. Registered address: No1 Parkside Court, Greenhough Road, Lichfield, Staffordshire, United Kingdom, WS13 7FE. Contact: wn@kingstone-consultancy.com.

This policy explains what personal data we collect, why, how long we keep it, who we share it with, and the rights you have over it under UK GDPR.

• Identity. Your email address and account identifier, both held by KC Secure, our own authentication service (see §5). We never see or store your password.
• CPD entries. Everything you log: title, type (conference, course, webinar, etc.), date, duration, category, and any reflection text you write (“what I did”, “how it applies”, “outcome / follow-up”).
• Pasted links. When you add an entry from a link, the URL you paste is stored on that entry. We fetch the page once, server-side, to read its title, date and description; we do not store the page’s contents beyond what we extract into the entry.
• Calendar subscription URLs. If you connect a calendar, we store the ICS/webcal URL you give us so we can periodically re-fetch it. Depending on your calendar provider, this URL can itself act as a secret credential to your calendar. We store it as any other credential and use it only to look for events that look like CPD; you can remove a connected calendar at any time from the Calendar page, which deletes the stored URL immediately.
• Reports you generate. The period, template, optional recipient name (e.g. “IET” or an employer’s name), and total hours of each report you generate. Report documents themselves (the printable page, the CSV) are generated on the fly and are not stored as files.
• Your consent choice. Whether you have agreed to Kingstone Consultancy contacting you about work (§4), and when you last set that choice.

EngCPD itself sets no cookies. The only cookie involved is KC Secure’s session cookie (__Host-kc_session), which keeps you signed in. It is strictly necessary for the service to work and is essential under UK law (PECR), so it is set without a consent banner. We do not use analytics, advertising, or tracking cookies.

We use your data to provide the service: storing and displaying your CPD log, fetching details from a link or calendar you’ve connected, and generating reports on request.

If you opt in on the welcome screen or in Account settings, we share your email address with Kingstone Consultancy’s internal team so they can get in touch if they have relevant work. This is entirely optional, off by default, and has no effect on your use of EngCPD either way. You can change this choice at any time from the Account page.

We do not sell your personal data. It is shared only with:

• KC Secure: Kingstone Consultancy’s own self-hosted authentication service. It holds your email and password (as a salted hash it can verify but not reverse) and issues the session that keeps you signed in. It uses Resend to deliver verification, one-time-code, and password-reset emails.
• Cloudflare: hosts EngCPD (Workers) and its database (D1). Cloudflare processes data in the course of serving requests but does not use it for its own purposes.
• Whatever page or calendar feed you point us at. Fetching a pasted link or a calendar subscription URL means our server makes an HTTP request to that third-party service, which will see that request came from EngCPD. We don’t control what that third party does with it.
• Kingstone Consultancy’s internal team: only if you’ve opted in, per §4.

We disclose data beyond this only where required by law.

• Providing the service (your account, CPD entries, reports): performance of our contract with you (Article 6(1)(b)).
• Sharing your details with Kingstone Consultancy: your consent (Article 6(1)(a)), off by default, withdrawable at any time from Account settings.
• Keeping the service secure and working (rate limiting, error diagnosis, audit logging in KC Secure): our legitimate interests (Article 6(1)(f)).

We retain your account and CPD data for as long as your account is active. You can delete your account at any time from the Account page: this immediately and permanently deletes your CPD entries, connected calendars, reports, custom categories, and your identity at KC Secure. KC Secure’s own audit log records that an account existed and was deleted, in anonymised form, for security accountability. See its published security documentation for detail.

Subject to applicable law, you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion of your data, request a portable export, object to or restrict certain processing, and withdraw consent where processing is based on it. Most of these you can already exercise directly: your CPD log is visible and editable in the app, and account deletion is self-serve from the Account page. For anything else, contact wn@kingstone-consultancy.com. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

EngCPD is a professional tool aimed at working engineers and is not directed at children. We don’t knowingly collect data from anyone under 18.

Traffic to EngCPD is encrypted in transit. We never hold your password: KC Secure stores only a salted hash and checks every session against a live, revocable record on each request, so signing out or deleting your account takes effect immediately. No system is perfectly secure, and we can’t guarantee the security of a third-party page or calendar feed you choose to connect.

Cloudflare and Resend are US-headquartered providers, so data may be processed outside the UK/EU as part of running the service. Where that happens, we rely on standard contractual clauses and other UK data protection law safeguards.

We may update this policy from time to time. If we make material changes, we’ll take reasonable steps to notify active users. The “last updated” date at the top reflects the most recent revision.

Questions and data requests: wn@kingstone-consultancy.com, or by post to Kingstone Consultancy Ltd, No1 Parkside Court, Greenhough Road, Lichfield, Staffordshire, United Kingdom, WS13 7FE.