Privacy & GDPR Policy

1. Who We Are

Archangelica is a trading name of FD2i Limited, a company registered in England and Wales.

We are committed to protecting personal data and being transparent about how we collect, use, store and share it.

Data Controller: FD2i Limited (trading as Archangelica)

Contact: fiona@archangelica.co.uk

This policy explains how we handle personal information relating to our website visitors, clients, learners, programme participants, associates, contractors and others who engage with our services.

2. What Data We Collect

We collect personal data only where it is necessary and proportionate for a legitimate business, contractual or regulatory purpose.

Depending on how you engage with Archangelica, this may include:

• Name, job title, organisation and contact details.
• Information provided through contact forms, applications and enquiries.
• Booking and registration details for learning programmes and events.
• Information required to register learners for professional qualifications, including      Chartered Management Institute (CMI) qualifications.
• Learning, assessment, progress and feedback information.
• Information provided through surveys, questionnaires, assessments or research activities.
• Newsletter subscription details and communication preferences.
• Booking, payment confirmation and transaction information.
• Personal and professional information relating to associates, contractors and      facilitators, where required for contracting, delivery and governance.
• Technical information associated with website use, including information collected      through cookies and similar technologies.

Some activities may involve information about protected characteristics or other sensitive personal information. Where this occurs, we apply appropriate safeguards and process the information only where there is a valid lawful basis and, where required, an additional condition under data protection legislation.

We do not collect more personal information than is reasonably necessary for the relevant purpose.

3. Data Provided by Client Organisations

In some circumstances, client organisations provide personal data to Archangelica as part of delivering agreed services.

• This may include names, job roles, contact details or other relevant information about individuals participating in workshops, interviews, focus groups, research or learning programmes.
• We use this information only for the agreed purposes and in accordance with applicable data protection requirements.
• Information provided by clients for service delivery is not used for unrelated marketing activities.
• Depending on the nature of the engagement, Archangelica may act as a data controller or data processor. Where we act on behalf of a client organisation, the relevant contractual and data protection arrangements will apply.

4. Aggregated and Anonymised Organisational Data

As part of our consultancy and systems transformation work, Archangelica may analyse organisational or workforce information to identify patterns, risks and opportunities for improvement.

Where possible, information is aggregated or anonymised so that individuals cannot be identified.

This may include demographic or organisational characteristics relevant to the agreed work.

Our approach is to:

• Analyse information at organisational, group or system level.
• Avoid identifying individuals where this is not necessary.
• Apply appropriate safeguards where information remains identifiable or could      reasonably be linked to individuals.
• Use findings for the agreed consultancy, research or organisational      development purposes.

We do not seek to re-identify genuinely anonymised information.

5. How We Use Personal Data

We use personal information to:

• Respond to enquiries and requests.
• Deliver consultancy, advisory, learning and professional development services.
• Manage applications, bookings and programme participation.
• Register learners for professional qualifications and support their assessment journey.
• Administer surveys, assessments, feedback and agreed research activities.
• Manage payments, transactions and associated financial records.
• Send newsletters and updates where individuals have subscribed or where another      lawful basis permits.
• Manage contractual relationships with clients, associates, suppliers and delivery partners.
• Meet legal, regulatory, professional and contractual obligations.
• Maintain appropriate business records and improve our services.

We do not sell personal data.

6. CMI Qualifications and Data Sharing

Archangelica delivers learning under the Chartered Management Institute (CMI) Registered Centre status held by FD2i Limited.

Where an individual chooses to undertake a CMI qualification, Archangelica collects and shares the information necessary to register the learner with CMI and administer the qualification.

Relevant privacy information and declarations are provided at appropriate stages, including programme booking and the CMI registration process.

Information shared with CMI may include learner identification and contact details, registration information, assessment submissions, outcomes and other information required for qualification administration and quality assurance.

This processing is undertaken on the applicable lawful basis, including where necessary to deliver the qualification or meet relevant obligations.

CMI processes personal information in accordance with its own privacy arrangements and data protection responsibilities.

Further information is available in Archangelica's Learner Data Protection Policy.

7. Lawful Basis for Processing

Under UK data protection legislation, we process personal information only where an appropriate lawful basis applies.

Depending on the purpose, this may include:

• Consent: Where an individual has freely agreed to a particular activity, such as      receiving newsletter communications or participating in optional      activities.
• Contract: Where processing is necessary to provide an agreed service, programme or      qualification, or to take requested steps before entering into a contract.
• Legitimate interests: Where processing supports legitimate business activities, provided these interests do not override individuals' rights and freedoms.
• Legal obligation: Where processing is required to comply with applicable law.

Different lawful bases may apply to different activities, including where information is collected through Ticket Tailor, learner registration questionnaires or other forms.

Where processing relies on consent, individuals may withdraw that consent at any time. Withdrawal does not affect processing lawfully undertaken before consent was withdrawn.

Where special-category personal data is processed, we also identify an appropriate additional legal condition.

8. Third-Party Platforms and Services

Archangelica uses third-party platforms and service providers to support its business operations and service delivery.

These include:

• GoDaddy: Website hosting, website services and newsletter subscriptions.
• Ticket Tailor: Course and event booking  and registration.
• Stripe: Secure payment processing for bookings made through Ticket Tailor.
• Chartered Management Institute (CMI): Learner registration, qualification administration, assessment and quality assurance.
• Other relevant learning, survey, communication, collaboration and business      administration platforms.

When individuals make payments through Ticket Tailor using Stripe, relevant payment information is processed through those services.

Archangelica does not store payment card details. We may retain booking confirmations, payment status and transaction records where necessary for administration, accounting and legal obligations. We take reasonable steps to ensure that third-party providers are appropriate for the services they deliver and that relevant data protection arrangements are in place.

Where personal data is transferred outside the United Kingdom, appropriate safeguards will be applied where required by law.

9. Data Storage, Security and Retention

• We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.
• Access to personal information is restricted to those who require it for legitimate business, delivery or regulatory purposes.
• We retain personal information only for as long as necessary for the purpose for which it was collected, taking account of legal, contractual, regulatory and professional requirements.

Retention periods vary according to the type of information.

For CMI qualifications, learner and programme records, including assessment and progress information, are securely retained for a minimum of three years following qualification completion, in accordance with CMI requirements.

• Where a learner withdraws, essential registration, assessment and audit records are retained for three years following withdrawal. 
• Information no longer required, including unnecessary correspondence or sensitive supporting documentation, is securely deleted when appropriate.
• Records relating to active learners are maintained for as long as necessary to administer their qualification and meet applicable requirements.
• Financial and transaction records are retained for the periods required by applicable accounting and tax legislation.

Other personal information is reviewed and securely deleted or anonymised when no longer required.

10. Your Data Protection Rights

Under UK data protection legislation, individuals have rights in relation to their personal information, subject to applicable legal conditions and exemptions.

These include the right to:

• Request access to personal information held about them.
• Request correction of inaccurate or incomplete information.
• Request deletion of information where applicable.
• Request restriction of processing in certain circumstances.
• Object to certain processing activities.
• Request data portability where applicable.
• Withdraw consent where consent is the lawful basis for processing.

Requests can be made by contacting:

info@archangelica.co.uk

Individuals also have the right to raise concerns with the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Website: www.ico.org.uk

We encourage individuals to contact us first so that we have an opportunity to address their concerns.

11. Cookies and Newsletter Communications

Cookies

Our website is hosted by GoDaddy and uses cookies to support website functionality and analyse website traffic.

Website traffic tracking is enabled only where visitors choose to accept tracking cookies through the website's cookie banner. Visitors can decline tracking cookies.

Archangelica does not use Google Analytics.

Newsletter communications

Visitors may voluntarily subscribe to receive Archangelica newsletters, insights and updates through GoDaddy.

We use the contact details provided for these communications and manage subscriptions in accordance with applicable data protection and electronic marketing requirements.

Subscribers can withdraw their consent and unsubscribe at any time using the unsubscribe option provided or by contacting Archangelica directly.

Newsletter subscription is not a condition of booking or participating in a learning programme.

12. Changes to This Policy

We review this Privacy & GDPR Policy periodically and update it where necessary to reflect changes in our activities, systems, legal obligations or data protection requirements.

The most recent version will be available on the Archangelica website.

Last reviewed: November 2026
Next review: November 2027
Policy owner: CEO, Archangelica