Effective: June 12, 2026
In the following, we provide information about our processing of your personal data and the rights and entitlements you have under applicable data protection regulations.
This privacy notice applies to trainers, contact persons, and other employees of WPI Authorized Training Partners (ATPs), as well as to learners (course participants) who use the WPI platforms (collectively referred to as “users”). It describes how we process personal data within the WPI platforms across all domains, devices, and access methods (desktop, mobile, etc.).
When this Privacy Policy refers to “we” or “us,” it means WPI and ATP as joint controllers, unless one of the two parties is explicitly named.
Personal data is any information relating to an identified or identifiable natural person (“data subject”), such as name, address, email, and exam participation. In this Privacy Notice, we explain how we handle your personal data and what rights you have.
Joint controllers within the meaning of Art. 26 GDPR for processing within the scope of the WPI training and certification program are:
a) WPI – Web Professional Institute GmbH ("WPI"), Edisonstraße 63, Haus A, 12459 Berlin, Germany — Data protection inquiries: privacy@wpicert.org
b) Di Carlo Academy, Vohwinkeler Str. 58, 42329 Wuppertal, Germany
WPI provides the digital platforms, the WPI curriculum, and the certification exams. ATP supports learners outside the WPI platforms through its own trainers.
Data processing is subject to the GDPR and the BDSG. For users in the United Kingdom, the UK Data Protection Act 2018 and the UK GDPR also apply; for users in Switzerland, the revised Swiss Data Protection Act (nDSG) applies.
In summary: WPI is responsible for the platform and the certification exams. ATP supports you as a learner and can view your learning data. Both organizations collaborate on data protection matters. You can exercise your data protection rights with both WPI and ATP. The following table shows the details of the division of responsibilities:
Obligations under the GDPR |
WPI |
ATP |
|---|---|---|
Art. 26(2) GDPR: Informing data subjects of the essential contents of this agreement; Art. 14 GDPR: Duty to provide information when data was not collected from the data subject; Art. 24, 32, 35, 36 GDPR: Specification/documentation of technical and organizational measures, risk assessment, data protection impact assessment if applicable, and consultation with a supervisory authority; Art. 28 GDPR: Engagement of processors or subprocessors and their review |
X |
|
Art. 13 GDPR: Duty to provide information when collecting personal data |
X |
X (when registering via the ATP SaaS software) |
Art. 15 GDPR: Processing of requests for information; Art. 16 GDPR: Processing of requests for rectification; Art. 17, 18, 19 GDPR: Processing of requests for erasure, restriction of processing, notification obligation; Art. 20 GDPR: Processing of requests for data portability; Art. 21 GDPR: Processing of objections; Art. 30 GDPR: Maintenance of the record of processing activities; Art. 33, 34 GDPR: Notification of data breaches |
X |
X |
For all other data processing activities, WPI and ATP are independent controllers within the meaning of Art. 4(7) GDPR.
If and as long as necessary, WPI appoints representatives pursuant to Art. 27 UK GDPR (for users in the United Kingdom) and Art. 14 nDSG (for users in Switzerland); in this case, the contact details will be published here.
We generally collect data directly from you—either through your entries on the WPI platforms or through your participation in exams. For trainers, contact persons, and other ATP staff, we additionally collect data from the business relationship with ATP and, to the extent necessary and legally permissible, from publicly available sources.
The type of data collected depends on your specific use of our services:
Category |
Description |
|---|---|
User Account Data |
To use certain services (e.g., to take a course), you need a user account. To create a user account, we need your first and last name as well as your email address. When you update your user profile, we may collect and store the data you provide, such as: username, academic title, time zone, company name and address, position, phone number, and financial information for payment processing. As a trainer, contact person, or other ATP staff member, WPI may additionally collect the following information from you: affiliation with ATP, proof of qualifications, and letters of recommendation. |
Course and Exam Data |
When you use WPI platforms and/or take WPI certification exams, we collect certain data regarding your usage and participation (e.g., completed exercises, tests, and exams; scores achieved; completion times; certificates of participation; and certificates). We also store the role with which you are authorized. Certain usage data—such as performance in exercises or preparatory materials—may be made available to the ATP to which you are assigned as part of its support mandate. The specific data transmitted is determined by the current service description. |
Usage Data / Log File Data |
For platform security and troubleshooting purposes, the system logs technical data for each action (session ID, user ID, user agent, IP address, date and time of access, actions performed, and course involved). In addition, your user history stores the time of your first login, the last time you accessed the system and a course, and the last IP address used. |
Content Data |
Within the WPI platforms, you can add additional data—in particular profile and address data—to your user account. Providing this data is voluntary and is based on your consent. |
Communication and Support Data |
We process your data to facilitate communication and collaboration between users and us, in particular to support exam preparation, organize exam registrations, and issue certificates. Usage data is also processed for system administration and maintenance, technical monitoring, troubleshooting, and the investigation of security incidents. |
We process personal data on the following legal bases:
1) Consent (Art. 6(1)(a) GDPR): To the extent that you have given your consent, in particular to contact us via our web forms or by email. You may withdraw your consent at any time with future effect.
2) Performance of a contract (Art. 6(1)(b) GDPR):
Coaches, contact persons, and other ATP staff:
Administration of the ATP agreement
Invoicing and payment processing
Sending information in connection with the ATP agreement and certification offerings
Learners:
Provision of learning, practice, and exam preparation resources
Conducting WPI certification exams and issuing certificates
Sending information related to training, exam preparation, and certification
3) Legal obligations (Art. 6(1)(c) GDPR): tax reporting obligations and retention periods.
4) Legitimate interests (Art. 6(1)(f) GDPR):
Trainers, contact persons, and other ATP staff:
Optimization of ATP support and relationship management
Learners:
Optimization of WPI platforms and tools
Optimizing the learning content of the WPI curriculum
Development of new certifications
General:
Assertion, exercise, or defense of legal claims
Anonymized market research for the further development of our offerings
Use of technically necessary cookies (see Section 10)
We disclose your personal data to:
1) Data processors pursuant to Art. 28 GDPR — carefully selected service providers for IT infrastructure (in particular hosting), payment processing, and billing. They are contractually bound by our instructions and may only process data to fulfill the tasks assigned to them.
2) Third parties, if this is necessary for contractual purposes (Art. 6(1)(b) GDPR), justified by legitimate business interests (Art. 6(1)(f) GDPR), or done with your consent.
3) Government authorities and legal advisors, if required by law or necessary to investigate illegal or abusive conduct. In the latter case, data may also be disclosed to the injured parties, complainants, or holders of infringed rights.
We store your personal data only for as long as necessary:
Learners: Course data and certificate data (name, date, certificate code, assessed competencies) are stored for up to 30 years after the certificate is issued so that you and third parties (e.g., employers) can verify its validity via the certificate code over the long term. This period corresponds to the typical professional validity period of a qualification certificate. You may request early deletion in accordance with legal provisions (see Section 7); in this case, subsequent verification of your certificate by WPI will no longer be possible.
Trainers, contact persons, and other ATP staff: for the duration of the contractual relationship between WPI and the ATP and for as long thereafter as necessary.
Log file data: a maximum of 4 weeks for security reasons; data retained for evidentiary purposes remains until the incident is resolved.
In addition, we store data to the extent required by law (in particular commercial and tax law retention obligations pursuant to Art. 6(1)(c) GDPR) or as necessary for the preservation of evidence within the framework of the statute of limitations (Art. 6(1)(f) GDPR).
The processing of your personal data takes place exclusively on servers within the EU. The WPI platforms are hosted by carefully selected service providers in data centers within the EU.
Data is generally not transferred to third countries. Should this become necessary in exceptional cases (e.g., if the ATP is based in a third country), it will be done exclusively on the basis of appropriate safeguards in accordance with Chapter V of the GDPR (in particular EU Standard Data Protection Clauses). Upon request, we will provide you with a copy of the safeguards.
For users in the United Kingdom, the following rights apply in accordance with the UK GDPR; for users in Switzerland, in accordance with the revised Swiss Data Protection Act (nDSG).
You have the following rights with respect to us:
Access (Art. 15 GDPR) to the stored personal data concerning you;
Rectification (Art. 16 GDPR) of inaccurate or incomplete personal data;
Erasure (Art. 17 GDPR) of your personal data—unless we are required to continue processing it for the performance of a contract, to comply with legal obligations, or to assert legal claims;
Restriction of processing (Art. 18 GDPR) under the conditions specified therein;
Data portability (Art. 20 GDPR): Receipt of the data you have provided in a structured, commonly used, and machine-readable format.
Information regarding your right to object under Art. 21 GDPR:
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing or the processing is necessary for the establishment, exercise, or defense of legal claims.
To the extent that we send you information about new WPI certifications or related offers with your consent (direct marketing), you may object to this processing at any time, e.g., via the unsubscribe link in every email.
Requests and objections do not require any specific form. Please direct them to the controllers listed in Section 1, e.g., by email to privacy@wpicert.org. You will not incur any costs other than the transmission costs according to standard rates.
In addition, you have the right to lodge a complaint with a competent data protection supervisory authority:
For Germany in particular: Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) or the state data protection authority responsible for you
For the EU/EEA: to the respective national data protection authority
For the United Kingdom: to the Information Commissioner’s Office (ICO)
For Switzerland: to the Federal Data Protection and Information Commissioner (FDPIC)
We would appreciate it if you would first contact us with your complaint so that we can address your concerns.
Fully automated decision-making within the meaning of Article 22 of the GDPR or profiling does not take place. Should we use such procedures in individual cases, we will inform you separately, provided this is required by law.
To create your user account and use the WPI platforms, we require certain mandatory information (specifically your first and last name as well as your email address). Without this information, we cannot set up an account for you. All other information is voluntary.
Our website uses only technically necessary cookies that are essential for basic functions such as navigation and access to secure areas. The legal basis is Section 25(2)(2) TDDDG in conjunction with Article 6(1)(f) GDPR (legitimate interest in the functionality and security of the website); separate consent is not required.
For users residing outside the EU/EEA, the UK, and Switzerland, the local data protection regulations of their country of residence also apply. Please direct any questions regarding this to privacy@wpicert.org.
We update our Privacy Policy regularly to reflect changes in our business practices and legal requirements. We will notify you of any material changes.