Privacy Policy Last updated: 5 August 2026 This Privacy Policy describes how we collect, use, and disclose your personal data when you use our services, and explains your privacy rights and how the law protects you. 1. Who we are We are Ajar Group Limited (AGL), incorporated and registered in England and Wales with company […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":"","tve_updated_post":"
___TVE_SHORTCODE_RAW__<h1>Privacy Policy<\/h1>\n<p><em>Last updated: 5 August 2026<\/em><\/p>\n<p>This Privacy Policy describes how we collect, use, and disclose your personal data when you use our services, and explains your privacy rights and how the law protects you.<\/p>\n<h2>1. Who we are<\/h2>\n<p>We are Ajar Group Limited (AGL), incorporated and registered in England and Wales with company number 10432472, whose registered office is at 37 Great Pulteney Street, Bath BA2 4DA, United Kingdom.<\/p>\n<p>This policy applies to AGL operating under the AGL brand or under our other trading names, which include Ajar Publishing, ManagingDigital\u2122, Managing Digital\u2122, and ManagingDigital.com\u2122.<\/p>\n<p>Websites operated by AGL that may collect personal data include <a href=\"https:\/\/ajargroup.com\/\">ajargroup.com<\/a>, <a href=\"https:\/\/managingdigital.com\/\">managingdigital.com<\/a>, danwarfield.io, and <a href=\"https:\/\/jnwarfield.com\/\">jnwarfield.com<\/a>. This policy does not cover any other domains we own that do not host a public-facing website, or that are used only internally.<\/p>\n<p>For the purposes of UK GDPR and EU GDPR, AGL is the Data Controller for the personal data described in this policy. We have appointed a privacy representative in the EU \u2014 see Section 12.<\/p>\n<h2>2. Definitions<\/h2>\n<p><strong>GDPR<\/strong> means the UK General Data Protection Regulation and, where relevant to EU data subjects, the EU General Data Protection Regulation.<\/p>\n<p><strong>Company<\/strong> (\"the Company\", \"We\", \"Us\", \"Our\") refers to Ajar Group Limited.<\/p>\n<p><strong>Service<\/strong> means our websites and any of their parts, including blog posts, comments, data collection forms, and media such as photos and videos.<\/p>\n<p><strong>Data Controller<\/strong> refers to the Company as the legal person which alone, or jointly with others, determines the purposes and means of processing Personal Data.<\/p>\n<p><strong>Data Processor<\/strong> (or Service Provider) means any natural or legal person who processes personal data on behalf of the Company, under our instructions and for our purposes only.<\/p>\n<p><strong>Personal Data<\/strong> is any information relating to an identified or identifiable individual, such as a name, email address, identification number, location data, or online identifier.<\/p>\n<p><strong>Usage Data<\/strong> refers to data collected automatically through use of the Service (for example, the duration of a page visit).<\/p>\n<p><strong>Affiliate<\/strong> means an entity that controls, is controlled by, or is under common control with a party, where \"control\" means ownership of 50% or more of voting shares or equivalent authority.<\/p>\n<p><strong>Cookies<\/strong> are small files placed on your device by a website, used to remember information about your browsing.<\/p>\n<p><strong>Third-party Social Media Service<\/strong> refers to any website or social network through which a user can log in to, or interact with, our Service.<\/p>\n<p><strong>You<\/strong> means the individual using the Service, referred to under GDPR as the Data Subject.<\/p>\n<h2>3. What personal data we collect<\/h2>\n<h3>Enquiries, clients, and training\/certification participants<\/h3>\n<p>When you enquire about, book, or attend our training, consulting, or certification services, we may collect:<\/p>\n<ul>\n<li>Name and contact details (email, phone, postal address)<\/li>\n<li>Company or organisation name<\/li>\n<li>Course, workshop, or certification enrolment details<\/li>\n<li>Correspondence relating to your enquiry or engagement with us<\/li>\n<li>Invoicing and payment reference details (see Section 7 \u2014 we do not collect or store full card numbers, and we do not collect identity documents such as passports, national ID cards, or dates of birth for standard invoicing or bank transfer payments)<\/li>\n<\/ul>\n<p>If you register for a certification exam through The Open Group, we may hold limited details about your exam voucher for our own accreditation reporting purposes. See Section 7 for how this relationship works.<\/p>\n<h3>Newsletter, forms, subscriptions, and accounts<\/h3>\n<p>We also collect personal data (typically your name and email address, and any other details you choose to provide) when you subscribe to our newsletter, submit a contact form, subscribe to a service offering, or create a user account on our website.<\/p>\n<h3>Video recordings<\/h3>\n<p>Video calls and sessions may be recorded, but only with the consent of everyone involved. These fall into two distinct categories, stored and retained differently \u2014 see Section 9 for specifics:<\/p>\n<ul>\n<li><strong>Classroom training recordings<\/strong> \u2014 if you attend an in-person or virtual training session, it may be recorded for classroom purposes, and may show or include your image, voice, or on-screen contributions.<\/li>\n<li><strong>General business calls<\/strong> \u2014 Zoom and Microsoft Teams calls of all kinds (client, consulting, and internal calls) may also be recorded by consent, for reasons including keeping a record of commercial discussions, use as source material for public videos, or as a personal note for participants.<\/li>\n<\/ul>\n<h3>Comments<\/h3>\n<p>When visitors leave comments on our websites, we collect the content of the comment, the visitor's IP address, and browser user agent string, to help with spam detection.<\/p>\n<p>An anonymised string created from your email address (a hash) may be sent to the Gravatar service to check whether you use it. Gravatar's privacy policy is at <a href=\"https:\/\/automattic.com\/privacy\/\">https:\/\/automattic.com\/privacy\/<\/a>. Once your comment is approved, your Gravatar profile picture is visible publicly alongside it.<\/p>\n<h3>Media<\/h3>\n<p>If you upload images to our website, avoid uploading images containing embedded location data (EXIF GPS), as visitors can extract this from images they can view.<\/p>\n<h3>Embedded content<\/h3>\n<p>Pages on our website may include embedded content (for example, videos). Embedded content behaves as if you visited the third-party site directly \u2014 that site may set its own cookies and collect data about your interaction with the embedded content.<\/p>\n<h3>Usage data<\/h3>\n<p>We collect data automatically when you use our Service, such as IP address, browser type and version, pages visited, and time spent on those pages.<\/p>\n<h2>4. Cookies and tracking technologies<\/h2>\n<p>We use Complianz, a cookie consent management tool, to control which cookies are set on your device. Non-essential cookies are blocked by default and only load after you give consent through our cookie banner.<\/p>\n<ul>\n<li><strong>Necessary cookies<\/strong> \u2014 required for the website to function (for example, remembering your cookie consent choice, or keeping you logged in if you have an account). These do not require consent.<\/li>\n<li><strong>Functional cookies<\/strong> \u2014 remember your preferences, such as comment details if you opt in to save them. These last no more than one year.<\/li>\n<li><strong>Analytics cookies<\/strong> \u2014 Google Analytics and Google Site Kit, used to understand how visitors use our website. These only load after you consent through our cookie banner. See Section 7 for details.<\/li>\n<li><strong>Advertising cookies<\/strong> \u2014 we run Google Ads campaigns and use Google's Consent Mode to manage related tags. Before you make a choice on our cookie banner, a reduced version of our Google Ads tag may load and contact Google's servers, but without cookies, without personalisation, and with identifying information redacted. Full advertising cookies and personalised tracking only activate after you consent through our cookie banner; if you decline, they remain in this reduced state.<\/li>\n<\/ul>\n<p>If you do not accept cookies, some parts of the Service may not function as intended.<\/p>\n<h2>5. How we use your personal data<\/h2>\n<p>We use your personal data to:<\/p>\n<ul>\n<li>Respond to your enquiries and manage our relationship with you<\/li>\n<li>Deliver training, consulting, and advisory services you have booked, including facilitating certification exam registration<\/li>\n<li>Invoice and process payment for products and services<\/li>\n<li>Send you service-related communications (for example, course logistics)<\/li>\n<li>Send you marketing communications about our services, where you have consented or where you are an existing customer and have not opted out (in line with the \"soft opt-in\" permitted under the Privacy and Electronic Communications Regulations)<\/li>\n<li>Maintain the security and proper functioning of our website<\/li>\n<li>Comply with our legal and tax obligations<\/li>\n<\/ul>\n<h2>6. Legal basis for processing (UK GDPR)<\/h2>\n<p>We rely on the following legal bases, depending on the activity:<\/p>\n<ul>\n<li><strong>Performance of a contract<\/strong> \u2014 for delivering training, consulting, advisory, and certification facilitation services you have booked, and related invoicing.<\/li>\n<li><strong>Consent<\/strong> \u2014 for marketing communications where consent is the applicable basis, and for non-essential cookies (analytics).<\/li>\n<li><strong>Legitimate interests<\/strong> \u2014 for maintaining website security, preventing spam, and (in limited cases) marketing to existing customers under the PECR soft opt-in.<\/li>\n<li><strong>Legal obligation<\/strong> \u2014 for retaining financial and tax records as required by HMRC and the Companies Act 2006.<\/li>\n<\/ul>\n<h2>7. Who we share your data with<\/h2>\n<p>We share personal data with the following processors, who act only on our instructions:<\/p>\n<ul>\n<li><strong>Microsoft 365<\/strong> \u2014 email (Exchange) and contacts (Entra\/Outlook), for our UK-based tenant. OneDrive\/SharePoint also holds a portion of our local business files, with local sync (see below).<\/li>\n<li><strong>Dropbox<\/strong> \u2014 holds a portion of our local business files, with local sync, and also receives automated backups of our website (via UpdraftPlus, which pushes backups to our own Dropbox account rather than to any storage of its own).<\/li>\n<li><strong>Backblaze<\/strong> \u2014 provides backup of a portion of our local business files that are held locally rather than synced to OneDrive\/SharePoint or Dropbox.<\/li>\n<li><strong>BlogVault<\/strong> \u2014 provides automated backups of our website, stored on their own infrastructure.<\/li>\n<li><strong>inMotion Hosting<\/strong> \u2014 provides the virtual private server infrastructure our websites and self-hosted tools run on. They do not actively use or view this data as part of any service of their own; their role is limited to hosting the infrastructure it resides on. This is now split across two servers:\n<ul>\n<li>An <strong>Amsterdam (EU)<\/strong> server hosting ajargroup.com, managingdigital.com, and danwarfield.io, along with our self-hosted Fluent CRM database.<\/li>\n<li>A <strong>United States<\/strong> server hosting jnwarfield.com, including its own list of visitors who have created an account to access free documents or receive updates. This list is held to the same standards as our other contact data \u2014 we do not sell or pass it on to third parties.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Our local business files \u2014 which may include client records, financial documents, and contact lists \u2014 are split across OneDrive\/SharePoint, Dropbox, and locally-stored files backed up via Backblaze. Which of these holds a given file depends on our internal storage arrangements (cost, usage, and provider preference), not on the type of data it contains; there is no duplication of the same file across more than one of these destinations.<\/p>\n<ul>\n<li><strong>Xero<\/strong> \u2014 accounting and invoicing records.<\/li>\n<li><strong>ThriveCart<\/strong>, and in future <strong>WP EasyCart<\/strong> \u2014 checkout for course and product sales. ThriveCart is a US-based processor (see Section 8 on transfers); WP EasyCart, once adopted, will run on our own inMotion-hosted server.<\/li>\n<li><strong>Stripe<\/strong> and <strong>PayPal<\/strong> \u2014 card payment processing. We do not receive or store your full card details.<\/li>\n<li><strong>Wise<\/strong> and <strong>Barclays<\/strong> \u2014 where you pay us, or we pay you, by bank transfer, these providers process the transaction and the counterparty account details involved.<\/li>\n<li><strong>Amazon Web Services (Amazon SES)<\/strong> \u2014 used to send transactional emails on behalf of managingdigital.com.<\/li>\n<li><strong>Zoom<\/strong> and <strong>Microsoft Teams<\/strong> \u2014 video conferencing for training delivery, consulting and advisory calls, and other business calls. Calls may be recorded, but only with the consent of everyone taking part; see Section 9 for how recordings are retained. Recordings of general business calls are stored on our own local systems or in Microsoft 365 (OneDrive\/SharePoint), not with any other processor listed here.<\/li>\n<li><strong>net<\/strong> \u2014 used only for streaming and hosting classroom training recordings, and other content that does not include third-party personal data. General business call recordings are never stored with bunny.net. bunny.net is an EU-based (Slovenia) provider and we use their EU data storage.<\/li>\n<li><strong>Google Analytics \/ Google Site Kit<\/strong> \u2014 website analytics, only after you consent via our cookie banner.<\/li>\n<li><strong>Google Ads<\/strong> \u2014 used to measure the results of our advertising campaigns. We use Google's Consent Mode to manage this; see Section 4 for how this behaves before and after you make a cookie consent choice.<\/li>\n<\/ul>\n<p><strong>The Open Group.<\/strong> If you enrol on one of our Accredited Training Courses (ATC), delivered under our accreditation from The Open Group, we purchase the relevant exam voucher(s) for you from The Open Group's store. As a condition of our accreditation as an ATC provider, we are required to submit a quarterly report to The Open Group showing the disposition of vouchers purchased, containing your first name, last name, email address, and the order number for your voucher from The Open Group's store.<\/p>\n<p>Once you receive your voucher, you deal with The Open Group directly: you create or use your own account at opengroup.org and schedule your exam session yourself. From that point, The Open Group \u2014 and Pearson VUE, their exam delivery partner \u2014 process your data as independent controllers under The Open Group's own privacy policy, which we recommend you review. We are not party to, and have no visibility into, your account registration, exam scheduling, or exam delivery with The Open Group or Pearson VUE.<\/p>\n<p>We may also disclose personal data where required by law, to protect our legal rights, or in connection with a business transfer such as a merger or acquisition (with notice to you beforehand). We do not sell personal data.<\/p>\n<h2>8. International data transfers<\/h2>\n<p>Some of our processors are based outside the UK and EEA, principally in the United States. This currently includes <strong>ThriveCart<\/strong>, <strong>Amazon SES<\/strong>, <strong>Zoom<\/strong>, <strong>Dropbox<\/strong>, <strong>Backblaze<\/strong>, <strong>BlogVault<\/strong> (whose contracting entity includes both US and Indian operations), and elements of <strong>Stripe<\/strong>, <strong>PayPal<\/strong>, <strong>Google Analytics<\/strong>, and <strong>Google Ads<\/strong>. It also includes the portion of our inMotion hosting that remains in the United States (currently serving jnwarfield.com only \u2014 see Section 7); the majority of our inMotion hosting, including our Fluent CRM database, was migrated to an EU (Amsterdam) server and no longer requires the safeguards below. Where we do transfer personal data to a provider outside the UK\/EEA, we rely on one of the following safeguards, as applicable to each provider:<\/p>\n<ul>\n<li>The provider's certification under the EU-US Data Privacy Framework, or<\/li>\n<li>UK International Data Transfer Agreements (IDTA), or the EU Standard Contractual Clauses with the UK Addendum<\/li>\n<\/ul>\n<p>inMotion's standard terms include a Data Processing Agreement incorporating the EU Standard Contractual Clauses with the UK Addendum, which covers the remaining US-hosted portion. We have a Data Processing Agreement in place with BlogVault on the same basis.<\/p>\n<p>Providers based in the EU or UK (bunny.net, Wise, Barclays, our Microsoft 365 tenant, and the EU portion of our inMotion hosting) do not require these additional safeguards for data staying within the UK\/EEA, though standard data processing agreements are still in place.<\/p>\n<p>Note that hosting data on an EU server reduces data residency risk but does not by itself remove all exposure under US laws such as the CLOUD Act for providers that are themselves US-headquartered, even when they offer EU-based storage \u2014 this remains relevant to the jnwarfield.com hosting and to our other US-based processors listed above. We take this into account when choosing providers and safeguards.<\/p>\n<h2>9. How long we keep your data<\/h2>\n<ul>\n<li><strong>Financial and invoicing records<\/strong> (Xero, payment processor records): 6 years from the end of the accounting or tax period they relate to, in line with HMRC requirements and the Companies Act 2006.<\/li>\n<li><strong>Marketing and CRM contacts<\/strong> (Fluent CRM, and the jnwarfield.com account list): for as long as you remain subscribed and engaged with our communications. If you have not engaged with our communications for 24 months, we will review your record and either seek renewed permission or remove you from active marketing lists. You can unsubscribe or ask us to delete your details at any time.<\/li>\n<li><strong>Client, course, and certification engagement records<\/strong>: for the duration of our relationship with you, plus 6 years afterward, in line with the standard limitation period for contract claims in England and Wales and to support our tax record-keeping obligations.<\/li>\n<li><strong>Website comments<\/strong>: retained for as long as the associated page remains published, and reviewed periodically.<\/li>\n<li><strong>Exam voucher reporting records shared with The Open Group<\/strong> (first name, last name, email, order number): retained by us as part of our course and certification engagement records \u2014 see the entry above (duration of relationship plus 6 years). Retention of your data by The Open Group and Pearson VUE once you deal with them directly is governed by The Open Group's own privacy policy, not this one.<\/li>\n<li><strong>Classroom video recordings<\/strong>: we tell attendees they will have access to their course recording for 12 months. Recordings are removed from bunny.net (our video hosting provider) no later than 18 months after the session. We may retain a copy on our own servers for up to 3 years for internal course-quality and record-keeping purposes.<\/li>\n<li><strong>General business call recordings<\/strong> (Zoom\/Teams, stored on our own systems or in Microsoft 365): retention depends on why the recording was made \u2014\n<ul>\n<li>Recordings kept as a record of commercial discussions (for example, agreeing contract terms) are retained for as long as required by the record-keeping rules applicable to that type of business record.<\/li>\n<li>Recordings used, with the consent of everyone involved, as source material for YouTube or other publicly available videos are retained indefinitely, as that is their intended purpose.<\/li>\n<li>Recordings kept only as a personal note (an aide-memoire) for one or more participants are deleted within 3 years.<\/li>\n<li>No one is recorded on a business call without their consent.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Backup copies<\/strong> (Dropbox, Backblaze, OneDrive\/SharePoint, BlogVault): these sync automatically with our live systems and are not held under a separate retention schedule of their own. They follow the same retention period as the underlying record described above (for example, financial records for 6 years), or are retained indefinitely where the source system has no defined deletion trigger.<\/li>\n<\/ul>\n<p>We will not retain personal data for longer than necessary for the purposes described in this policy, except where we are legally required to do so.<\/p>\n<h2>10. Your rights<\/h2>\n<h3>Under UK GDPR<\/h3>\n<p>You have the right to:<\/p>\n<ul>\n<li><strong>Access<\/strong> the personal data we hold about you<\/li>\n<li><strong>Correct<\/strong> inaccurate or incomplete data<\/li>\n<li><strong>Erase<\/strong> your data, where there is no good reason for us to continue holding it<\/li>\n<li><strong>Object<\/strong> to processing based on our legitimate interests, or to direct marketing at any time<\/li>\n<li><strong>Restrict<\/strong> processing in certain circumstances<\/li>\n<li><strong>Data portability<\/strong>, where processing is based on consent or contract and carried out by automated means<\/li>\n<li><strong>Withdraw consent<\/strong> at any time, where consent is the basis for processing<\/li>\n<\/ul>\n<p>To exercise these rights, contact us using the details in Section 13, or via Prighter (Section 12). We may need to verify your identity before responding.<\/p>\n<h3>California residents (CCPA)<\/h3>\n<p>Ajar Group Limited does not currently meet the CCPA's applicability thresholds (based on revenue and the volume of personal data processed), so the CCPA's specific statutory rights do not currently apply to our processing. If you are a California resident and would like to make a privacy request, we will make reasonable efforts to honour it in line with the rights described above. If our business grows to meet CCPA's thresholds \u2014 which is possible as we expand our online course and membership offerings \u2014 we will update this policy to reflect the applicable CCPA rights in full.<\/p>\n<h2>11. How to complain<\/h2>\n<p>If you believe we have mishandled your personal data, please tell us \u2014 we would rather put it right directly.<\/p>\n<p><strong>Contact us directly<\/strong>: email [email protected] with a description of your concern. We will acknowledge your complaint within 30 days of receiving it, and respond without undue delay, in line with our obligations under the Data (Use and Access) Act 2025.<\/p>\n<p><strong>You do not have to contact us first.<\/strong> You also have the right to complain to a supervisory authority at any time:<\/p>\n<ul>\n<li>In the UK: the Information Commissioner's Office (ICO) \u2014 <a href=\"https:\/\/ico.org.uk\">org.uk<\/a>, helpline 0303 123 1113.<\/li>\n<li>If you are in the EEA: your local data protection authority.<\/li>\n<\/ul>\n<h2>12. Representation for data subjects in the EU<\/h2>\n<p>We value your privacy and your rights as a data subject, and have appointed Prighter as our privacy representative and point of contact in the EU. Prighter provides an easy way to exercise your privacy rights (for example, requests to access or erase personal data). To contact us via Prighter, visit: <a href=\"https:\/\/prighter.com\/q\/15034368\">https:\/\/prighter.com\/q\/15034368<\/a><\/p>\n<h2>13. Security<\/h2>\n<p>We take reasonable technical and organisational measures to protect your personal data, but no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.<\/p>\n<h2>14. Changes to this policy<\/h2>\n<p>We may update this Privacy Policy from time to time. We will post the new policy on this page and update the \"Last updated\" date above. Where changes are significant, we will let you know by email or a prominent notice on our Service before the change takes effect.<\/p>\n<h2>15. How to contact us<\/h2>\n<ul>\n<li>By email: <a href=\"mailto:info@ajargroup.com\">info@ajargroup.com<\/a><\/li>\n<li>By mail: Ajar Group Limited, 37 Great Pulteney Street, Bath BA2 4DA, United Kingdom<\/li>\n<\/ul>__TVE_SHORTCODE_RAW___<\/div><\/div>","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{"e":"1","font_cls":[]},"tcb2_ready":1,"tcb_editor_enabled":1,"tve_landing_page":"","_tve_header":"0","_tve_footer":"0"},"class_list":["post-76","page","type-page","status-publish","hentry","post-wrapper","thrv_wrapper"],"_links":{"self":[{"href":"https:\/\/ajargroup.com\/index.php\/wp-json\/wp\/v2\/pages\/76","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ajargroup.com\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/ajargroup.com\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/ajargroup.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ajargroup.com\/index.php\/wp-json\/wp\/v2\/comments?post=76"}],"version-history":[{"count":1,"href":"https:\/\/ajargroup.com\/index.php\/wp-json\/wp\/v2\/pages\/76\/revisions"}],"predecessor-version":[{"id":1072,"href":"https:\/\/ajargroup.com\/index.php\/wp-json\/wp\/v2\/pages\/76\/revisions\/1072"}],"wp:attachment":[{"href":"https:\/\/ajargroup.com\/index.php\/wp-json\/wp\/v2\/media?parent=76"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}