Privacy
Who we are, what we hold, who else sees it, how long we keep it, and what you can ask us to do about it.
MS-LEG-004 · First Edition · 24 September 2026 · Download the notice (PDF)
This notice explains what Module Six Ltd does with personal data. It covers Activate, Calibrate, Educate, Validate and Candidate, and membership of the Institute of Project Professionals, whether you are an individual using one of them, a member, an employee of a customer, a worker recorded on an employer's register, or a recruiter.
It is the only privacy notice Module Six Ltd publishes. It is served at modulesix.co.uk/privacy and at ipp.pro/privacy, and both pages are generated from this document so they cannot disagree.
Module Six Ltd is the data controller, except where section 2 says otherwise. We are registered in England and Wales under company number 17311940. Our registered office is c/o KRW Accountants Ltd, Henge Barn, Pury Hill Business Park, Alderton Road, Towcester, Northamptonshire, NN12 7LS. We are registered with the Information Commissioner's Office under reference ZC198668.
The Institute of Project Professionals is a professional body we operate. It is not a separate legal entity. Where an Institute document says the Institute decides something, it means Module Six Ltd acting as the Institute, and Module Six Ltd is answerable for it. There is one controller behind everything described here, and it is us.
For anything in this notice, write to data@modulesix.co.uk. It reaches a person.
Validate is different, and it is the only exception. An employer uses Validate to hold an Authority to Work register: a record of which of their workers hold which competencies, what each is cleared to do, and the evidence behind it. Those are the employer's records about the employer's workforce, gathered for the employer's purposes.
For those records the employer is the controller and Module Six Ltd is the processor. We act on the employer's written instructions and not on our own judgement. The terms are in MS-LEG-003, published at modulesix.co.uk/dpa.
Two consequences follow. Most individuals on a register hold no account with us and have never dealt with us, and telling them their data is held is the employer's duty. And if you want your register record changed or removed you ask your employer, not us: we will show you everything we hold and pass your request on, but we will not delete an employer's evidence that its people were qualified to do the work they did, on the instruction of somebody who is not their controller.
| What | Why we hold it | Our lawful basis |
|---|---|---|
| Account and identity: name, email address, sign-in credentials | So you can have an account and we know who you are | Contract |
| Membership records: grade, member number, applications, conduct and governance matters | To operate a professional body and its register | Contract, and legitimate interests for conduct matters |
| Assessment records: examinations, sittings, results, competence assessments, reviews, CPD | To award and maintain a credential that means something | Contract |
| Course records: enrolments, progress, module attempts, certificates | To deliver Educate and to certify what you completed | Contract |
| Commercial records: orders, invoices, billing address, consents to terms | To take payment and to show what was agreed | Contract, and legal obligation for accounting records |
| Authority to Work registers | Held for an employer, on that employer's instructions | The employer decides. See section 2 |
| Published record: register entry, profile, Passport, talent window availability | So that a credential can be checked, and so that a member who wants to be found can be | Legitimate interests for the register entry; consent for the profile, the Passport and the talent window. See section 4 |
| Outcome claims, including any organisation or project you name, and their confirmations | So that a claim about work somebody did can be verified rather than taken on trust | Contract with the member; legitimate interests as regards the person confirming it |
| Accountability records: audit log, consent records, requests you make of us | To show that we did what this notice says | Legal obligation and legitimate interests |
| Sanctions screening: your name and the name on any payment, checked against the UK Sanctions List, and the record of any possible match and what we decided about it | Because we must not deal with a person designated under UK sanctions | Legal obligation |
| The country your connection comes from and the country of your billing address | To refuse service in the places listed in our terms. Used at the moment of the request or payment and not stored | Legal obligation and legitimate interests |
Where the basis is consent it means a choice you actually made and can take back, not an inference from your continuing to use the service.
The full Article 30 record of processing activities is MS-LEG-005. It is an internal control record and is available to a supervisory authority on request.
Most of what we hold is private to you and to the people you work with. Four things are published, because their whole purpose is to be seen. This section says exactly what appears on each, what you control, and what a reader may and may not conclude.
| Surface | Who can reach it | What it is for | Default |
|---|---|---|---|
| Public register | Anyone, at ipp.pro | Confirming that a named person holds the grade they claim | Off |
| Passport | Anyone holding the link | The member showing their own professional record to somebody | Off |
| Certificate check | Anyone holding the reference | Confirming a named qualification result is genuine | Public |
| Talent window | An agency signed in and recorded as one | A member offering themselves for work | Off |
The register holds paid grades only, and you choose whether to appear on it. Affiliate, Associate, Member and Fellow may be listed; Student membership is free and is never listed, because a registration anybody can complete in seconds supports no conclusion about a credential. Listing is off until you switch it on from your profile, and so is the Passport.
The certificate check is keyed on the reference number printed on the certificate. Holding the certificate, or a scan of it, is what grants access. There is no other gate.
| Field | Published on | Shown when |
|---|---|---|
| Name | Legitimate interests | Always, for a listed member |
| Grade and post-nominal | Legitimate interests | Always, for a listed member |
| Membership status | Legitimate interests | Always. Only members in good standing are listed |
| Founding member | Legitimate interests | Where it applies |
| Job title, employer, location | Consent | Only where the profile is switched on |
| Biography, LinkedIn address | Consent | Only where the profile is switched on |
Searching the register matches the name only. It does not match employer, so a member cannot be found by who they work for.
| Field | Published on | Shown when |
|---|---|---|
| Name, grade, post-nominal, member number | Your choice to publish | Passport on |
| Membership status and validity date | Your choice to publish | Passport on |
| Competency profile, by area, with its verification label | Your choice to publish | Passport on |
| Qualifications held, with the date each was awarded | Your choice to publish | Passport on |
| CPD or contribution against the annual requirement | Your choice to publish | Passport on |
| Job title and employer | Consent, the same switch as the register | Passport on AND profile on |
Never on a Passport: your email address or any contact detail, your CPD entries themselves, your reflections, your evidence, the identity of anybody who reviewed you, your employment history, your examination marks, and anything a reviewer wrote about you.
A Passport is read live. It shows the record as it stands when it is opened, not a snapshot from when the link was shared. Turning it off makes the link stop working immediately.
To anybody holding the reference number, the check shows whether the reference is genuine, the holder's name, the qualification and its full title, the date awarded, the issuing body, and the examination mark as a percentage.
The mark is published because it is printed on the certificate itself, so a check that withheld it could not confirm the certificate in front of the reader. A holder who does not want their mark seen controls that by not handing over the certificate or its reference.
An agency sees two things, kept apart and labelled: what the Institute has verified, being your grade, your post-nominal and how many delivery claims have been independently confirmed; and what you have stated about yourself, being your headline, location, availability, rates, sectors, and your outcome claims.
Your outcome claims include any organisation, project and role you named in them. If you wrote that you delivered a programme for a named client, an agency reading your profile sees that name. You choose what to claim, and MS-LEG-001 section 11 sets out what you warrant when you name somebody.
Contact details are not published to an agency, and no CPD, evidence, competency detail or review reaches the talent window.
| Status | Public register | Passport | Post-nominal |
|---|---|---|---|
| In good standing | Listed | Available if on | Shown |
| In the renewal grace period | Listed | Available if on | Shown |
| Lapsed | Removed | Available if on, showing Lapsed | Withheld |
| Suspended | Removed | Available if on, showing Suspended | Withheld |
| Revoked | Removed | Available if on, showing Revoked | Withheld |
| Resigned | Removed | Available if on, showing Resigned | Withheld |
Listed here means listed IF you have switched your listing on and hold a paid grade. Standing can only remove you from the register; it never puts you on it. A Student is not listed in any row of this table.
A Passport that is switched on keeps working when a membership is not current, and shows that status in words on the page. It is your own professional record and not only your membership, and a reader is better served by the status than by a missing page. The post-nominal and the Institute's mark of standing are withheld, because both are statements about today.
Every competency level on a Passport carries one of three labels and there is no fourth: Validated, meaning a reviewer confirmed it against evidence and recorded a rationale; Self-assessed, meaning it is your own assessment and nobody has confirmed it; and Not assessed. Every level shown carries its label in the same view. Reviewer identity is never published.
Turning a public surface off removes it from view. It does not delete your record and it is not the same request as erasure, which is section 9.
What it establishes. That the named person holds the grade shown and whether it is current; that a qualification shown was awarded by the Institute after an examination; and that a level marked Validated was confirmed by somebody other than the member.
What it does not establish. Suitability for a role, current employment, a statutory licence, chartered status, regulatory approval, or a guarantee of competence. Institute qualifications are the Institute's own and are not regulated by Ofqual or another statutory regulator. A self-assessed level is not a verified one, and absence proves nothing: a person not in the register may hold no membership, may hold one that is not current, or may simply not be listed.
If you are a member of the Institute we hold, in addition to section 3: your application and the evidence submitted with it; your grade and member number, and the history of both; your examination entries, sittings, results and any reasonable adjustment agreed; your competence assessments, the evidence behind them and what a reviewer recorded; your CPD entries and reflections; and any complaint, appeal or conduct matter involving you.
Your reflections, your evidence and what a reviewer wrote about you are never published, on any surface, under any setting.
A conduct or governance matter is held on our legitimate interest in operating a credible professional body, is dealt with under IPP-GOV-001, and may be appealed under IPP-GOV-006. Its outcome may affect what section 4.6 publishes about your standing.
Where you join an organisation's account, that organisation's reviewers and administrators can see your competency record, CPD log and evidence, for professional development oversight and nothing beyond it. You can leave at any time and their access ends immediately.
Four suppliers process personal data on our behalf. Each processes under its own published data processing terms, which form part of our contract with it: we have not negotiated a bespoke agreement with any of them and we do not hold a separately signed one. Those terms bind each supplier to act only on our instructions and not to use your data for its own purposes. Each is listed here with the safeguard we rely on where data leaves the United Kingdom. No other party processes personal data on our behalf. We sell nothing, share nothing with advertisers or data brokers, and run no tracking service.
| Supplier | What they do | Transfer safeguard |
|---|---|---|
| Cloudflare, Inc. | Hosting, application platform, database and file storage. Receives everything | Standard Contractual Clauses with the UK Addendum |
| Clerk, Inc. | Accounts and sign-in. Receives identity | UK Addendum at Schedule 5 of their data processing agreement, alongside Standard Contractual Clauses |
| Plus Five Five, Inc., trading as Resend | Sending our email. Receives recipient addresses and message content | UK Extension and Standard Contractual Clauses under their data processing agreement |
| Stripe, Inc. | Taking payment. Receives billing identity and payment records | Standard Contractual Clauses with the UK Addendum |
No artificial intelligence provider processes your personal data, and nothing you record is used to train any model. If we introduce automated or artificial intelligence analysis we will name the provider here before it begins, and for an employer's register we will give notice under MS-LEG-003 first.
Stripe has two roles and it matters which is which. When it takes a payment on our instruction it is our processor and this notice governs it. When it decides how to detect fraud, how to meet its own anti-money-laundering and identity obligations, and how to manage its own relationship with you, it is a controller in its own right. For that part Stripe's own privacy policy applies alongside this one and you exercise your rights against Stripe. We cannot instruct them out of obligations they carry directly.
Who processes for us is a different question from who your information reaches. Where you publish a Passport, appear in the public register, make yourself visible to recruiters, or where your employer holds a register you are on, your information reaches people who are not our suppliers and are not acting on our instructions. They answer for what they do with it on their own account. Section 4 sets out what is published and what you control.
If a sanctions match is confirmed, we must report it to HM Treasury's Office of Financial Sanctions Implementation. A possible match that turns out to be somebody else with the same name is not reported to anybody.
The agreements in force with each supplier, their versions and the evidence for each safeguard are recorded in MS-LEG-005.
| Record | How long |
|---|---|
| Accountability records: audit log, consent records, requests you make of us | Six years |
| Commercial records: orders, invoices, payments | Six years from the end of the financial year they fall in |
| Conduct and governance matters | Six years from the date the matter is closed |
| Sanctions screening matches and what we decided about them | Six years. Kept through an erasure request, because the check is one the law requires us to be able to show we made |
| Membership, assessment, course and competence records | For as long as the account exists. These are the record of a credential and are not deleted while you hold it |
| Authority to Work register data | The employer decides. We publish no period of our own. See section 2 |
We hold encrypted backups so that we can recover from a failure. Daily backups are deleted after 30 days and weekly backups after 365 days. An erasure does not reach into a backup, so for a short period after we erase you a copy may remain in one until it expires on that schedule. We do not restore a backup in order to bring erased data back.
If we ever have to restore one after a failure, your erasure is applied again before the system is returned to service. We keep a record of every erasure we have carried out, and that record is held apart from the data erased, so a restore is followed by re-applying every erasure recorded since the backup was taken. The procedure is in MS-LEG-006.
MS-LEG-005 is the full retention schedule and this table is drawn from it.
We use only the cookies needed to sign you in and keep you signed in. No advertising cookies, no analytics, no tracking of any kind, and no third-party marketing cookies. We run no analytics service and no tag manager.
Sign-in cookies are set by Clerk and are shared across ipp.pro and the modulesix.io platforms, which is what lets one sign-in work across all of them. Cloudflare may set technical cookies as part of normal hosting, for example to tell human traffic from automated. Stripe sets its own during a payment, described in Stripe's privacy policy. None of them tracks you across other websites.
Because everything we set is strictly necessary, the Privacy and Electronic Communications Regulations do not require your consent and there is nothing for us to ask you for. The notice on your first visit tells you what we set; dismissing it is not consent to anything. If we ever introduce an optional cookie we will add a consent mechanism that governs it, and update this notice first.
You can block or delete cookies in your browser settings. Blocking ours will sign you out and you will not be able to reach your account until you sign in again.
You can ask us to do any of the following, and it is free:
We answer within one month. If a request is complex we may take longer, and if we do we will tell you inside that month, why, and when to expect an answer. How a request is handled is recorded in MS-LEG-006.
Three limits apply:
Anything published about you that is wrong is corrected on request. A validated competency level is corrected through the reviewer who validated it, because the record has to show who confirmed what.
For anything in this notice, including a request under section 9, write to data@modulesix.co.uk.
If you are unhappy with how we have handled your personal data you can complain to us, and we would rather you did because we can usually fix it. You can also complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113, and you do not have to come to us first.
A complaint about the Institute, its decisions or its members is a different route and is set out in IPP-GOV-006.
This notice carries an edition, a revision and a date. When it changes materially we issue a new edition and, where the change affects an agreement you have with us, we tell you. Superseded editions are kept, so it is always possible to establish what this notice said on a given date.
Former references. This notice replaces MS-DAT-001, IPP-DAT-001 and IPP-DAT-002. Where any document or page refers to one of those, the reference is to this notice.
