Privacy Notice

Delibra is a trading name of Aver Consultancy Ltd, a company registered in England and Wales (company number 16727805), with its registered office at 128 City Road, London, England, EC1V 2NX. Aver Consultancy Ltd is generally the controller of personal information it collects to operate the Delibra website, administer memberships, provide learning services and manage its own customer relationships.

Where an organisation purchases membership for staff, the organisation may also be an independent controller of information it supplies to us or receives under agreed reporting arrangements. Any distinct processor arrangement must be established and documented where applicable. This Notice does not claim that employers automatically receive access to individual exercise answers.

This Notice applies to website visitors, individual purchasers, learners, employer and organisational contacts, prospective customers, subscribers and people who contact Delibra. It covers relevant personal information used for Delibra ER, its website, account administration, learning activities and associated business communications.

It does not replace an employer’s own employee privacy notice, or the separate notice of any third party that independently determines how it uses your information.

Identity and contact details: names, email addresses, job titles, employer or organisation names, business contact details and other information supplied when registering, enquiring or purchasing.

Account and membership information: account identifiers, sign-in records, membership assignments, subscription and renewal status, activation and expiry dates, customer support history and relevant account preferences.

Learning information: lessons opened, course and subject progress, completion status, timestamps and, where a particular learning feature saves them, responses to interactive exercises or simulations. Not every exercise necessarily records every answer.

Purchase and billing information: purchaser and billing contact details, invoice or purchase-order references, amount charged, payment status and transaction references. If online payments are introduced, payment-card processing will be handled through the applicable payment provider rather than represented here as storage of full card numbers by Delibra.

Communications and outreach: enquiries, messages, support requests, email preferences, unsubscribe or suppression status, and records of relevant business communications and marketing interactions.

Technical and usage information: IP addresses, browser and device information, session information, security logs and website usage information where collected by our hosting, authentication, security and analytics arrangements.

We do not ask learners to upload identifiable workplace case files, medical records or sensitive employee information into exercises. Please do not provide such information unless a separately authorised and appropriately safeguarded feature is expressly made available.

We obtain information directly when you register, buy a membership, complete a form, contact us, change preferences or use the learning platform.

We may receive details from your employer or another organisation arranging or paying for a membership, including your name, work email and licence allocation.

We may receive limited technical, authentication, payment-status or communication data from service providers supporting the platform, and relevant business-contact information from lawful professional sources where appropriate. If information was not obtained directly from you, we will provide the required privacy information within the applicable statutory timeframe.

To create accounts, allocate membership licences, authenticate users, provide lessons and store necessary progress: performance of a contract where you are the customer; otherwise legitimate interests in supplying the purchased service to the relevant organisation, subject to your rights.

To process purchases, invoices, payments, refunds and renewals: performance of a contract, legitimate interests in administering organisational arrangements, and compliance with applicable accounting, tax and consumer-law duties.

To respond to enquiries, provide support, prevent misuse, secure systems and maintain an audit trail: legitimate interests in operating and protecting the service, and legal obligation where the law requires particular records or responses.

To improve reliability, accessibility and the usefulness of lessons using appropriate usage information: legitimate interests in maintaining and improving the service, with consent where required for non-essential cookies or similar technologies.

To send necessary account, security, payment and service communications: contract performance, legitimate interests or legal obligation depending on the particular communication. These are different from promotional marketing.

To send product news, offers or relevant professional-development marketing: consent where required, or legitimate interests with an applicable Privacy and Electronic Communications Regulations route where legally permissible. Marketing is always subject to applicable opt-out rights.

To comply with legal requirements, respond to rights requests, resolve complaints and establish or defend legal claims: legal obligation and, where appropriate, legitimate interests.

If your employer arranges a membership, it may give us identifying and work contact information and receive information necessary for billing, assigning licences and administering access.

Individual learner progress, completion status or assessment information should not be assumed to be shared with employers merely because they purchased the membership. Where an employer-reporting service is introduced or expressly agreed, we will explain what is shared, with whom, for what purpose and on what lawful basis before doing so.

We do not promise that information entered through an employer-funded account is confidential from the employer in all circumstances. The applicable arrangements depend on the services actually provided, lawful disclosures and the employer’s own policies.

Learning activities may involve fictional workplace scenarios, judgement selections, feedback and progress records. Information stored depends on the particular feature; some interactions may be processed only temporarily in your browser.

Delibra's purpose is educational. We do not use an interactive learning score to make an automated decision about your employment or legal rights. If materially different automated decision-making is introduced, we will provide the legally required information and safeguards.

Please avoid including real employee names, grievance documents, health information, tribunal material or other confidential details in free-text fields.

We may contact professional or organisational prospects about Delibra where this is lawful, keeping appropriate records of contact and objections. Publicly available business contact information is still personal information when it identifies an individual.

The rules for corporate subscribers differ from those for individual subscribers, including sole traders and certain partnerships. We will obtain consent where required, or rely on a permitted exception only where its conditions are met.

Where the existing-customer soft opt-in applies, it is limited to relevant similar products or services and requires an appropriate opportunity to opt out when details are collected and in each later message.

Each marketing message will provide an appropriate means to unsubscribe or object. We maintain suppression records as necessary to respect requests not to be contacted again.

You can manage available marketing preferences from the account settings or use the unsubscribe method provided in a message. Disabling promotional communications will not stop essential service notices.

We may share relevant information with service providers engaged to operate the platform, including website hosting and deployment, database and authentication, email and productivity services, payment processing when enabled, security, IT support and customer-relationship management.

The current Delibra code includes integrations or planned integrations involving Netlify hosting, Supabase authentication and database services, and Microsoft 365 / Outlook-based email processes. Naming a service here does not mean every optional integration or data flow is active for every customer.

We may share necessary information with an organisational purchaser under the arrangements described above, professional advisers under appropriate confidentiality obligations, regulators and public authorities where required, and parties involved in a lawful business reorganisation subject to appropriate safeguards.

We do not sell learner personal information to advertisers. Before launch, our actual service-provider inventory, contractual roles and subprocessors must be checked against live configurations.

Some providers or their authorised personnel may process information outside the UK. Where a transfer is restricted by UK data-protection law, we will use an applicable UK adequacy regulation or suitable safeguards, such as the UK International Data Transfer Agreement, UK Addendum or another lawful mechanism, as required.

Where relevant, we will assess transfer risks and make information about applicable safeguards available on request. The precise destinations and transfer mechanisms depend on the confirmed hosting regions and provider agreements.

We retain information only for as long as necessary for the purposes described, considering the membership period, support needs, security, accounting obligations, applicable limitation periods, legal requirements and requests to erase information.

Account and learning records may be retained while access remains active and for an appropriate subsequent period where needed for administration, disputes or legal compliance. Financial records may need to be retained for statutory tax and accounting periods. Marketing suppression records may be kept as necessary to honour opt-outs.

We do not apply one blanket retention period to every record. Detailed retention schedules and deletion processes must be confirmed before launch, and relevant periods or criteria will be available on request.

We use or plan to use reasonable technical and organisational measures appropriate to the risks, including authenticated access, permissions, service-provider security controls and investigation of suspected incidents.

No internet service can guarantee absolute security. If a personal data breach triggers a statutory notification duty, we will make the relevant notifications within applicable legal timeframes.

Cookies and comparable technologies may support essential sign-in, security and website functionality. Optional analytics, advertising or other non-essential technologies will be subject to the applicable transparency and consent or exemption requirements.

Please see the separate Cookie Notice for the technologies actually in use, their purposes, duration and your choices. That inventory must be confirmed against the live site before publication.

Depending on the circumstances, you may have rights to be informed, access personal information, rectify inaccuracies, obtain erasure, restrict processing, receive portable data and object to certain processing, including direct marketing.

Where processing relies on consent, you can withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Rights are subject to applicable qualifications and exemptions.

We may need to verify identity before acting on a request. We will respond within the applicable statutory deadline, normally one month, subject to any lawful extension. You will not ordinarily be charged for exercising your rights.

To exercise a right, contact Delibra using the published contact details and describe the request. We will direct it to the appropriate person or team.

You may raise a complaint directly with Delibra if you are concerned about our handling of personal information. We will provide an accessible way to complain, acknowledge a data-protection complaint within 30 days, investigate it appropriately and communicate the outcome in accordance with the requirements now in force.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data-protection regulator, at ico.org.uk. We encourage you to contact us first where you are comfortable doing so, but you do not have to surrender statutory rights.

Where relevant, we will explain how to challenge our response or seek further review.

Delibra ER is designed for professional users and is not directed at children. We do not intentionally offer child-directed services through this membership.

We do not seek special-category information as part of ordinary learning membership. If such information is unexpectedly supplied, we will consider whether it is necessary to keep, whether an additional condition is required and whether it should be securely deleted.

We may update this Notice to reflect changes in legislation, suppliers, platform functions or data practices. We will display a revised date and bring material new uses of information to your attention before beginning those uses where required.

This Notice should be reviewed against actual production systems and supplier contracts before accepting customers.

Data controller: Aver Consultancy Ltd, trading as Delibra. Company number: 16727805. Registered office: 128 City Road, London, England, EC1V 2NX. Website: delibrahr.com.

For privacy requests or complaints, use the privacy contact channel published on the Delibra website. The intended privacy@delibrahr.com address must be confirmed operational before it is represented as an active contact method.

Related documents: Terms & Conditions, Cookie Notice and Legal & Educational Notice.