CPOMS Privacy Notice

Last Updated: June 2026

This Privacy Notice describes the personal data that CPOMS Systems Limited (“CPOMS,” “we,” or “us“) collect when you visit our websites or interact with our business representatives (collectively, the “Services“). This Privacy Notice also describes how we use and share that information, the choices you have, and how you can contact us if you have questions or concerns. This Privacy Notice does not apply to any personal data we collect pursuant to agreements to provide services to our customers, including schools, school districts and other educational institutions. This information may include data about our customers’ employees, customers and other users (such as students and parents of school customers) collected through the software, professional services, or applications that we make available to our customers. To learn more about how we handle information in these contexts, please refer to our Data Processing Agreement within our Standard Terms and Conditions, available here.

Personal Data We Collect

Personal Data you provide to us may include:

• Contact details, such as your company’s name, your first and last name, email address, company address, and phone number.
• Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise.
• Marketing information, such as your preferences for receiving communications about our services, and details about how you engage with our communications.

Automatic data collection. We and our service providers may automatically log information about you, your computer or mobile device, and your interaction over time with our Services, such as:

• Device data, such as your computer’s or mobile device’s operating system, manufacturer and model, browser type, IP address, unique identifiers, language settings, mobile device carrier, and general location information such as city, or geographic area; and
• Usage data, such as pages or screens you viewed, how long you spent on a page, browsing history, and access times.

We may collect this personal data using cookies, pixels, tags, and other similar technologies. For more information, please visit our Cookie Policy by clicking on the cookie icon in the lower left hand corner.

Information we collect from third parties. We may maintain third-party social media pages, such as pages on LinkedIn, X, Facebook, and YouTube. If you interact with us via these pages, we may receive your communications and other information about your interactions with us. Any personal data collected by the social media companies that maintain our pages is governed by the privacy policies of the providers and is not within our control. We may also obtain personal data about you from publicly available sources, such as your organisation’s website, professional directories, industry publications, and our advertising and marketing partners.

How We Use Personal Information

We use your personal data for the following purposes and under each lawful basis specified below (in parentheses):

To provide the Services and respond to your inquiries. Collection and use of your personal data may be necessary to provide the Services to you. This includes administering, hosting, and operating the Services, and communicating with you and responding to any inquiries you may have. (Contract necessity)

To improve, monitor and personalise the Services. To analyse your use of the Services, to allow us to evaluate and improve the Services and its features, and to create aggregated, de-identified or anonymous statistics, which we may use for lawful business purposes, including for Services analytics and strategic planning. (Legitimate interests)

Business promotion. We may use personal data to promote our business, including:

• Direct marketing. We may send you marketing communications, including, but not limited to, newsletters and notifications about special promotions, offers, and events that we think may be of interest to you, including by email and SMS. (Consent)
• Interest-based advertising. We may also use personal data and engage advertising partners, including third party advertising companies and social media companies, to help us advertise our services, including by displaying advertising about our services on third-party websites and platforms. (Legitimate interests)

For compliance and protection. We use personal data to comply with our legal obligations and where it is in our legitimate interests to enforce any applicable terms and conditions, comply with legal obligations, defend against legal claims or disputes, protect the security and integrity of the Services, and identify and investigate fraudulent, harmful, unauthorised, unethical or illegal activity.

Where we rely on the lawful basis of legal obligation or contractual necessity, if this personal data is not provided, we may not be able to provide our services to you.

How We Share Personal Data

When we share your personal data with third parties, we only permit them to process your personal data for specified purposes in accordance with our instructions. We require all third parties to respect the security of your personal data and to treat it in accordance with data protection laws and the recipient of the personal data will be bound by confidentiality obligations.

We may share your personal data with:

Affiliates, including any commonly owned and commonly branded companies, for purposes consistent with this Privacy Notice.

Service providers, including companies and individuals that provide services on our behalf or help us operate our Services or our business. These services include hosting, information technology, support, email delivery, advertising and marketing, and website analytics. We may also engage third-party artificial intelligence service providers to assist us with the operation of our business.

Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.

Advertising partners, including third-party advertising companies, social media and other platforms, for the business promotion purposes described above. These advertising partners may assist us with advertising our services on other third-party websites and platforms, including by identifying candidates for our advertising based on information about our existing customers and prospects.

Authorities and others, such as law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate to comply with applicable laws or protect our rights and interests.

Business transferees, including acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganisation, sale or other disposition of all or any portion of the business or assets of, or equity interests in, us or our affiliates (including, in connection with a bankruptcy or similar proceedings).

Your Data Subject Rights Under Data Protection Laws

Unsubscribe from marketing communications. You may opt out of our marketing-related communications by following the opt out or unsubscribe instructions contained in the marketing communication we send you. We may continue to send you administrative communications that are necessary for our relationship with you, such as relevant updates to our policies.

Privacy choices. Depending on where you reside, you may have the following rights:

• Information. You may have the right to obtain information about how we collect, use, and share your personal information. We provide this information within this Privacy Notice.
• Access to a copy of the personal information that we have collected about you. Where applicable, we will provide the information in a portable, machine-readable, readily usable format.
• Correction of personal information that is inaccurate, incomplete or otherwise out of date.
• Deletion of personal information that we no longer need to provide the Services or for other lawful purposes.
• Request we restrict our handling of your personal information.
• Object to how we are using your personal information.
• Withdraw your consent to us handling your personal information, where we are relying on your consent to process such personal information.

Where applicable, you can exercise privacy rights by contacting us as provided in the How to Contact Us section below. We may ask for specific information from you to help us confirm your identity.

In most cases we will deal with your request as soon as possible and at the latest within one calendar month of the date the request was received. If we need to extend the time period for responding to your request, we will let you know within the one-month period. We do not charge a fee for any such requests unless there are exceptional circumstances.

In some instances, your choices may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations and enforce our legal rights. If you are not satisfied with how we address your request, you may submit a complaint by contacting us as provided in the How to Contact Us section below.

Data Security

We employ a number of technical, organisational and physical safeguards designed to protect the personal information we collect. However, no security measures are failsafe and we cannot absolutely guarantee the security of your personal information.

Data Retention

The length of time we retain personal information will be determined based upon the following criteria: the length of time your personal information remains relevant; the length of time it is reasonable to keep records to demonstrate that we have fulfilled our duties and obligations; any limitation periods within which claims might be made; any retention periods prescribed by law or recommended by regulators, professional bodies or associations; the type of contract we have with you, and our business interest in keeping such information as stated in this Privacy Notice.

Children

The Services are not intended for use by children. If we learn that we have collected personal data through our Services without the consent of the child’s parent or guardian as required by law, we will delete it. If you believe that we might have any information from or about a child under 13 (other than through the provision of services to our school customers), please contact us as provided below.

Job Applicants

When you apply for a job with us, we collect personal data that you provide to us in connection with your job application. This includes but is not limited to business and personal contact information, professional credentials and skills, educational and work history and other information of the type that may be included in a resume. This may also include diversity information that you voluntarily provide.

We use this information where necessary to facilitate our recruitment activities and process employment applications, such as by evaluating a job candidate for an employment activity, and in our legitimate interests to monitor recruitment statistics and to respond to surveys.

We may also use this information in our legitimate interests to provide improved administration of the Services and as otherwise necessary (i) to comply with relevant laws or to respond to subpoenas or warrants served on us, (ii) to protect and defend our or others’ rights or property, (iii) in connection with a legal investigation and (iv) to investigate or assist in preventing any violation or potential violation of the law, this Privacy Notice or our terms of use.

International Data Transfers

In the context of providing you with our Services, we may transfer your personal information to our affiliates and service providers in the United States and other jurisdictions. Please note that such jurisdictions may not provide the same protections as the data protection laws in your home country.

When we engage in cross-border data transfers, we will ensure that relevant safeguards are in place to afford adequate protection for personal information and we will comply with applicable data protection laws, in particular by relying on an EU Commission or UK government adequacy decision or on contractual protections for the transfer of personal information. For more information about how we transfer personal information internationally, please contact us as set out in the How to Contact Us section below.

Changes to This Privacy Notice

We reserve the right to modify this Privacy Notice at any time. If we make material changes to this Privacy Notice, we will notify you by updating the date of this Privacy Notice and posting it on the Services and/or by providing you with an electronic communication.

How to Contact Us & Complaint Procedure

We — CPOMS Systems Limited — are the “Controller” of your personal information and are responsible for collecting your information in compliance with applicable laws.

To exercise your Privacy Rights, contact our Data Protection Officer (DPO) by email or post (details below) or by following our Data Protection Complaint Procedure, which can be found below.

By email at: [email protected] writing “Data Protection Officer” or “DPO” in the subject line

By post to:
Data Protection Officer
CPOMS Systems Limited
CPOMS House
Acorn Business Park
Skipton
BD23 2UE

We hope that we can resolve any query or concern you raise about our use of your personal data. If not, you can contact the UK Information Commissioner’s Office at ico.org.uk or via telephone on 0303 123 1113 for further information about your rights and how to make a formal complaint.

Data Protection Complaints Procedure

By email at: [email protected]   Please include “Data Protection Officer” or “DPO” in the subject line to ensure your complaint reaches the correct department without delay.

By post to:
Data Protection Officer
CPOMS Systems Limited
CPOMS House
Acorn Business Park
Skipton
BD23 2UE

Please ensure you include all relevant information to enable us to investigate your complaint, such as:

• Your contact details, including name, entity (school, company, etc.), email, title, postal address
• Description of your complaint and the basis for your complaint
• Additional details of your complaint, including the date(s), any other person or entity involved and any other relevant information
• Summary of the desired outcome