Global Human Capital Academy Inc.
Privacy Notice
GHCA holds personal information about candidates, training providers and anyone who writes in. This notice sets out what is held, why, where, for how long, and what you can ask us to do about it.
Who is responsible for your information
The Global Human Capital Academy Inc. is the controller of the personal information described in this notice. GHCA is a Canadian corporation with its registered office at 215-312 Erb St W, Waterloo ON N2L 0K9, Canada.
Questions, requests and complaints about your personal information should go to GHCA's Data Protection Officer at info@ghcaofficial.org, or by post to the address above.
What GHCA collects
When you register as a candidate: your first and last name, email address, a password you choose (stored only as a cryptographic hash, never in a readable form), and a learner number GHCA assigns you.
When you enrol on a programme: which provider and cohort you joined, your attendance at each session, your progress through the course material, and any prior certifications or years of experience you tell us about.
When you sit an assessment: the scheduled date, the result, the score, and who marked and approved it. GHCA does not currently record examinations by video or audio and does not collect biometric or face-match data of any kind.
When your organisation applies to become an Authorized Training Provider: the organisation's details and registration number, a primary contact name and email, and the documents you upload in support — business registration, trainer CVs, quality-assurance policy, course outline and, for in-person delivery, facility evidence.
When you write to GHCA through the website: your name, email address, the department you selected, your message, and the training provider you name if you name one.
Automatically, when you use the site: your IP address, used to apply rate limits that protect the Registry and the sign-in pages from automated abuse.
Fees are not currently taken online, and no card or bank details are collected or stored anywhere in the platform.
Why GHCA collects it, and on what basis
To register you, deliver your assessment, and issue and maintain your certification — this is the contract between you and GHCA, and the information is necessary to perform it.
To operate the public Global Registry and answer verification requests — this is the legitimate interest of employers, regulators and the public in being able to confirm that a credential is genuine, and it is the core purpose of a certification body.
To administer relationships with Authorized Training Providers and monitor delivery quality, which is necessary to the agreement between GHCA and each provider.
To meet legal, regulatory and accounting obligations.
To protect the platform from abuse — this is GHCA's legitimate interest in keeping the service available and the Registry accurate.
Where GHCA relies on your consent for anything optional, you can withdraw it at any time. Withdrawing consent for something the certification itself requires may mean GHCA cannot deliver that part of the service.
What appears on the public Registry
A Registry search result shows only: your full name as registered, the credential you hold, its current status, and the award date together with the expiry or status-change date where one applies.
The Registry never shows your contact details, your date of birth, your examination scores, your identity-document details, your learner number, or anything else beyond the minimum needed to confirm the credential is genuine.
Anyone can search the Registry without an account and without a fee, and without involving you. That is deliberate: third-party verification is the point of certification, and a credential nobody can check is worth nothing.
Because of that, GHCA does not remove a certified individual from the public Registry on request while their credential is active. You can ask at any time for a factual inaccuracy in your listing to be corrected, and GHCA will investigate it against the records behind the entry.
The historical fact that a credential was awarded is never deleted, even after it expires or is withdrawn. What changes is the status shown alongside it, so that anyone checking sees an accurate current position rather than a gap.
Who else sees your information
Your Authorized Training Provider sees the information needed to deliver your training and confirm your eligibility: your name and email, your attendance, and your examination status. A provider sees only its own candidates, never another provider's.
GHCA assessors and registry staff see assessment and certification records in order to mark, approve and maintain them. Every change to a record is logged with who made it and when.
GHCA uses a small number of service providers to run the platform: a hosting provider for the application and its database, Cloudflare for stored files, and Resend for sending email. Each processes information only to provide that service.
An employer or anyone else you point at the Registry sees only the fields listed in the section above.
GHCA may disclose information to regulators, law enforcement or a court where the law requires it.
GHCA does not sell personal information, and does not share your assessment content or results with anyone you have not authorised, beyond what operating the certification itself requires.
Where your information is held
The application and its database run on a server in Paris, France. Files you upload — CVs, provider documents — are stored in Cloudflare's Eastern Europe region. Both are in the European Union.
GHCA itself is established in Canada, so your information is accessible to GHCA staff there. Email is sent through Resend, which operates in the United States.
This means personal information held by GHCA is transferred between the European Union, Canada and the United States. Canada holds a European Commission adequacy decision for organisations subject to PIPEDA. Where a transfer is not covered by an adequacy decision, GHCA relies on the contractual and technical safeguards required of its service providers.
How long it is kept
A Registry entry — the record that a credential was awarded, to whom, and when — is kept permanently. It is the thing an employer checks, sometimes many years later, and deleting it would destroy the evidence that you earned it.
The assessment and learning records behind a credential are kept for as long as needed to support verification, appeals and dispute resolution.
Enquiries sent through the website are kept for as long as needed to answer them and to review the quality of GHCA's responses.
Records that are no longer needed for any of these purposes are deleted in line with GHCA's Records Retention and Destruction Schedule.
Your rights
You can ask GHCA for a copy of the personal information it holds about you, and to correct anything inaccurate or incomplete.
Where the General Data Protection Regulation applies to you, you also have the right to ask GHCA to erase information, to restrict how it is used, to object to processing GHCA carries out on the basis of legitimate interests, and to receive information you provided in a portable form.
These rights have limits, and one of them matters particularly here. A certification record exists so that other people can rely on it. GHCA will not erase the fact that a credential was awarded while that credential is active, because doing so would defeat the purpose the record was created for and would mislead anyone relying on the Registry. GHCA will always correct a record that is factually wrong.
To exercise any of these rights, contact the Data Protection Officer at info@ghcaofficial.org. GHCA will respond within 30 days.
Cookies and analytics
The public website sets no cookies and runs no analytics or advertising trackers. You can browse it, search the Registry and find a provider without anything being stored in your browser.
Signing in to the candidate, provider or staff portal sets a single cookie that keeps you signed in. It holds only your session and is removed when you sign out.
How to raise a concern
Contact GHCA's Data Protection Officer at info@ghcaofficial.org. GHCA will acknowledge your concern and respond in writing.
If you are not satisfied with the response, you can complain to a data protection authority. In Canada that is the Office of the Privacy Commissioner of Canada. If you are in the European Union or the United Kingdom, you may complain to the supervisory authority in the country where you live or work.