Last updated: 7 November 2026
1. Who controls account data
Institutions create and manage learner and staff accounts. The institution decides which courses and records its users can access. Cardiot LMS processes that data to provide the platform. Contact messages sent through this website are handled by the Cardiot LMS team.
2. What we store
- Account details: name, email address, institution, role and, where provided, phone number.
- Learning records: enrollments, lesson progress, assessment attempts, results and issued certificates.
- Contact messages: the name, email address, subject and message you submit through the contact form.
- Verification records: certificate codes attempted, the result of the check, a hashed IP address and the browser user agent.
- Technical logs: records needed to operate and secure the service.
3. How we use it
Data is used to deliver courses, record progress and results, issue and verify certificates, respond to support messages, keep the service secure and prevent misuse. We do not sell personal data.
4. IP addresses
When a contact message is submitted or a certificate is checked, the IP address is stored as a one-way SHA-256 hash rather than as the original address. This supports abuse prevention without keeping the raw address in those records.
5. Cookies and local storage
The site uses a session cookie to keep the site working. The cookie notice stores a small preference in your browser's local storage so the notice is not shown again after you accept it. No advertising or analytics cookies are used.
6. Sharing
Institution administrators and teachers can see records for their own institution. Service providers that host or operate the platform may process data on our behalf. We do not share data with advertisers, and no third-party analytics scripts are loaded on this site.
7. Retention
Account and learning records are kept while the institution account is active and as needed for certificates and operational records. Contact messages are kept for support handling. Exact retention periods and deletion rules are pending legal review.
8. Security
Passwords are stored as hashes, access is limited by role and institution, and security-relevant actions are written to an audit log. No system is completely secure, and no formal security certification has been obtained.
9. Your choices
For account questions, including correction or deletion requests, contact your institution administrator because the institution controls your account. For questions about this website or contact messages, use the contact form. Requests may be limited by legal or record-keeping obligations.
10. Students and institutions
Learner accounts are created and managed by institutions. Institutions are responsible for obtaining any consent or permission required for their learners, including where students self-register.
11. Changes
This notice may be updated when the platform or legal requirements change. The date at the top shows the latest revision.