--- title: "Privacy Policy — Mandatory Training" --- # Privacy Policy Last updated October 8, 2026 Mandatory Training is operated by AWFA Projects Pty Ltd (ACN 664 826 877), an Australian company. This policy explains what we collect when you use getmandatorytraining.com, why, who we share it with, and the choices you have. ## What we collect **When you enrol in a course:** your name (as you want it on your certificate), email address, country and state or region. **While you learn:** the courses you enrol in, which lessons you open and when, your test attempts and the answers you give, and whether you passed. **Certificates:** the certificates we issue you, with their ID, the name and course printed on them, and their dates. We also record when you choose to get your certificate. **Signing in:** we sign you in with one-time links sent to your email, or, when you're connecting an app to your account, a 6-digit code sent to your email that you type into the same page. We store only a fingerprint of each link, code and sign-in cookie, never the link, code or cookie itself. **Early-access list:** if you join it, your email address, when you joined, which form you used, and the campaign tag the page was visited with. **When you contact us:** your name, email address, the topic you choose and your messages, our replies, and when each was sent. If you're signed in, we link your message to your account so we can help with your course. To stop automated spam we also keep a fingerprint of your IP address (never the address itself) for our hourly limits, and the form uses Cloudflare Turnstile, a check that you're a person, which runs in your browser and is covered by Cloudflare's own privacy policy. **Visits:** standard technical logs (page requested, time, IP address, browser type) for security and performance, and the campaign tag, ad click ID and referring page you arrived with. We also record the country and region your IP address suggests you are in, to suggest your country on our forms, to show you the courses for that country, and to count visits by country. It never changes a price or a course you have already started, and you can change the country at any time. ## Cookies We set five first-party cookies: a random visit ID (kept for up to 90 days) so we can tell which pages a visit included and which ad it came from; once you sign in, a sign-in cookie (up to 30 days); once you choose a country, enrol or sign in, a cookie remembering the country (and US state) you chose, used only to fill in our forms for you and to show you the courses for that country, which we renew each time you visit and which lapses 400 days after your last visit; if you open someone's referral link, a cookie remembering whose link it was (up to 90 days); and, while you're connecting an app to your account, a cookie that keeps the connection in one browser (15 minutes). Our advertising partner Meta also sets cookies through the Meta Pixel; see below. ## Course emails When you sign up for a course, we add your name, email address, country and course to our email list, so we can remind you to finish your course and tell you how to get your certificate. Every one of these emails has an unsubscribe link, and unsubscribing doesn't affect your course, your sign-in links or your certificate. Some of these emails include your referral link and ask whether anyone you know would like to learn CPR too. ## Referral links Once you pass a course, you get your own link to share the course with people you know. You share it yourself, through your own apps or email: we never message the people you send it to. If someone signs up within 90 days of opening your link, we record that you referred them. Your account shows how many people have started and passed through your link, but never who they are, and we don't tell them anything about you beyond what they see in your message. ## Connected apps You can connect an app, such as an AI assistant, to your account so it can answer questions about your own courses and certificates. Nothing is shared unless you sign in and choose Allow, and the app sees only what you allow: your name, email address, country and state, your courses and progress through them (lessons viewed, test attempts and whether you passed), and, if you allow it, your certificates and a short-lived link to download them. An app can't see your test answers or lesson content, can't take lessons or tests for you, can't get or pay for a certificate, and can't change anything in your account. What the app does with what it reads is covered by that app's own privacy policy, not ours. An app can also ask to connect by giving us your email address. If you have an account, we email you a link; if you don't, nothing is sent and no account is created. Nothing is shared unless you open that email, enter the code the app is showing you and choose Allow. We keep a record of the request (the app's name, your email address, and when it was made) for up to a day after it ends. Your account page lists every app you've connected, when you allowed it and when it last read your account. Choose Revoke there and the app loses access at once. We keep a record of each connection (which app, what you allowed, and when) and only fingerprints of its access keys, and we can switch off an app for everyone if it's misused. ## How we use it To run your course, keep your progress, mark your test, issue and email your certificate, and let employers check it. To understand which ads and pages bring people to the course and how many finish it. To keep the site secure. We do not sell your personal information. ## Advertising measurement (Meta) We advertise on Facebook and Instagram. To measure those ads, our pages load the Meta Pixel, and we also tell Meta, from the page and directly from our servers, when you reach four steps: signing up, starting a course, passing its test and receiving a certificate. What we send for those steps is the step, the course, the ad click ID if you came from an ad, your IP address and browser type, and your email address, name and location in hashed (scrambled) form, which Meta uses to match the step to its own accounts. Meta's use of this information is covered by Meta's own privacy policy. You can limit ad tracking in your Facebook and Instagram ad settings and with your browser's privacy settings. ## Who else sees it - **Employers and anyone you share your certificate with:** anyone who enters a certificate's ID on our verification page, or scans its QR code, sees the name, course, dates and whether it is valid. Nothing else about you is shown. - **Service providers** who work for us: our email delivery provider (to send sign-in links, certificates and our replies to your messages), Cloudflare (for the contact form's spam check), our email marketing provider, ActiveCampaign (for the course emails below), an AI assistant provider, Anthropic, which our staff use to help read and answer your messages, and our hosting providers. - **Meta**, for advertising measurement as described above. - Anyone we are required to tell by law. ## Where it is stored and for how long Your information is stored on servers in Australia. We keep your account, learning records and certificates for as long as your certificate is valid plus a reasonable period after, so it can still be verified and replaced, unless you ask us to delete them. Technical logs are kept for a short period. ## Your choices You can ask for a copy of your information, ask us to correct it, or ask us to delete your account and records, by sending us a request on our [contact page](https://getmandatorytraining.com/contact?topic=privacy). If we delete a certificate's record, it will no longer verify. You can also ask us to delete your messages to us, and we will. You can leave the early-access list by asking us on the same page. ## Changes and contact If we change this policy we will update the date above. Questions? [Contact us](https://getmandatorytraining.com/contact?topic=privacy). [← Back to the site](https://getmandatorytraining.com/)