STRATEGIC VALUE STREAMS
Privacy Policy
Effective Date: 29 July 2026
For privacy enquiries, data protection requests, or complaints, please contact [email protected].
1. About This Privacy Policy
This Privacy Policy explains how Strategic Value Streams collects, uses, stores, shares, and protects personal data.
It applies when you:
• visit the Strategic Value Streams website;
• create an account;
• purchase or access the Body of Knowledge;
• register for membership;
• purchase or sit a certification examination;
• receive a digital credential;
• join a community, webinar, event, or mailing list;
• download a resource;
• contact us;
• interact with us as a customer, candidate, member, partner, supplier, or website visitor.
This Privacy Policy should be read together with our Terms and Conditions, Cookie Policy, and any product-specific, examination, membership, or certification terms that apply.
2. Who We Are
Strategic Value Streams is the professional body responsible for publishing the Strategic Value Streams Body of Knowledge and administering Strategic Value Streams certification examinations.
Our registered address is: Strategic Value Streams, 124 City Road, London, EC1V 2NX, United Kingdom.
For the purposes of UK data protection law, Strategic Value Streams is the controller of the personal data described in this Privacy Policy, unless stated otherwise.
References to "Strategic Value Streams", "we", "us", or "our" mean Strategic Value Streams.
References to "you" or "your" mean the individual whose personal data we process.
3. Personal Data We Collect
We may collect and use the following categories of personal data.
3.1 Identity and Contact Data
This may include:
• name;
• email address;
• telephone number, if provided;
• organisation name;
• job title;
• professional profile information;
• billing address;
• country or region.
3.2 Account and Membership Data
This may include:
• username or account ID;
• login and access records;
• membership type;
• subscription status;
• renewal date;
• account preferences;
• community membership;
• learning access permissions.
3.3 Purchase and Payment Data
This may include:
• products or services purchased;
• payment status;
• transaction records;
• invoice or receipt information;
• coupon, discount, or promotion use;
• renewal and cancellation records.
We do not intentionally store full payment card details. Payment details are normally processed by authorised payment providers.
3.4 Learning and Certification Data
This may include:
• courses or learning products accessed;
• progress through learning materials;
• quiz, examination, or assessment attempts;
• scores, outcomes, pass or fail status;
• examination date and time;
• retake eligibility;
• certification level;
• certification issue date;
• expiry date;
• renewal status;
• credential verification status.
3.5 Digital Credential Data
This may include:
• credential name;
• certification level;
• issue date;
• expiry date;
• credential ID or verification reference;
• public verification status;
• badge sharing activity, where available.
3.6 Communications Data
This may include:
• enquiries sent to us;
• support requests;
• feedback;
• complaint correspondence;
• email preferences;
• survey responses;
• webinar or event questions;
• testimonial or endorsement content you choose to provide.
3.7 Marketing and Engagement Data
This may include:
• mailing list subscription status;
• email opens, clicks, and engagement;
• webinar registrations;
• resource downloads;
• campaign source;
• marketing preferences;
• opt-in and opt-out records.
3.8 Technical and Usage Data
This may include:
• IP address;
• browser type;
• device type;
• operating system;
• approximate location based on IP address;
• pages visited;
• time spent on pages;
• referring website;
• cookie identifiers;
• platform logs;
• security and access logs.
3.9 Community and User Contribution Data
This may include:
• posts;
• comments;
• messages;
• discussion contributions;
• profile information;
• event participation;
• community engagement.
3.10 Accessibility and Reasonable Adjustment Data
If you request reasonable adjustments for an examination, event, or learning service, you may choose to provide information about accessibility needs, disability, health, or other relevant circumstances.
This may include special category data under data protection law. We will only use this information where necessary to assess and provide reasonable adjustments, and where we have a lawful basis and any required additional condition for processing it.
4. How We Collect Personal Data
We may collect personal data:
• directly from you when you complete forms, create an account, make a purchase, contact us, join a mailing list, sit an examination, or participate in a community;
• through our website, learning platform, payment systems, email systems, credential systems, analytics tools, and event platforms;
• from your organisation where it purchases training, membership, or certification access on your behalf;
• from authorised partners, platforms, or service providers involved in delivering our services;
• from public sources, such as LinkedIn or professional websites, where relevant to professional enquiries, partnerships, or business relationships.
5. How We Use Personal Data
We use personal data for the purposes set out below.
5.1 To Provide Website and Account Access
We use personal data to:
• create and manage accounts;
• provide access to website areas, learning products, communities, and purchased services;
• manage login, authentication, and access permissions;
• provide customer support.
Our lawful basis is usually performance of a contract or legitimate interests in operating our services.
5.2 To Provide Learning Products and the Body of Knowledge
We use personal data to:
• provide access to learning content;
• track learning progress;
• manage course enrolment;
• provide resources, updates, and learning support.
Our lawful basis is usually performance of a contract or legitimate interests in delivering and improving professional learning services.
5.3 To Administer Certification Examinations
We use personal data to:
• register candidates;
• provide examination access;
• administer assessments;
• record examination attempts;
• calculate results;
• manage retakes;
• investigate technical issues or misconduct;
• protect the integrity of the certification process.
Our lawful basis is usually performance of a contract and legitimate interests in maintaining certification integrity, preventing fraud, and protecting professional standards.
5.4 To Issue and Verify Digital Credentials
We use personal data to:
• issue certificates, badges, and digital credentials;
• verify certification status;
• manage expiry, renewal, revocation, or supersession of credentials;
• allow third parties to confirm credential validity where verification is requested or enabled.
Our lawful basis is usually performance of a contract and legitimate interests in providing professional recognition and protecting the integrity of Strategic Value Streams credentials.
5.5 To Process Payments and Manage Purchases
We use personal data to:
• process payments;
• issue invoices and receipts;
• manage subscriptions and renewals;
• apply coupons or discounts;
• manage refunds, retakes, cancellations, chargebacks, or billing enquiries;
• keep financial records.
Our lawful basis is usually performance of a contract, compliance with legal obligations, and legitimate interests in managing payments and business records.
5.6 To Communicate With You
We use personal data to:
• respond to enquiries;
• provide support;
• send service messages;
• provide examination instructions;
• notify you of account, membership, certification, payment, or access issues;
• handle complaints.
Our lawful basis is usually performance of a contract, legitimate interests, or compliance with legal obligations.
5.7 To Send Marketing and Professional Updates
We may use personal data to send:
• newsletters;
• product updates;
• webinar invitations;
• certification information;
• community updates;
• offers or promotions;
• thought leadership and professional content.
We will only send marketing where we have a lawful basis to do so, such as your consent or our legitimate interests where permitted by law.
You can unsubscribe from marketing emails at any time by using the unsubscribe link in the email or by contacting us.
We may still send non-marketing service messages where necessary, such as purchase confirmations, exam instructions, certification notices, account updates, or legal notices.
5.8 To Improve Our Services
We use personal data to:
• understand how people use our website and learning products;
• improve content, product design, user experience, and service quality;
• develop new learning, certification, and membership services;
• measure campaign performance;
• review feedback and engagement.
Our lawful basis is usually legitimate interests in improving our services. Where cookies or similar technologies require consent, we will seek consent through our cookie mechanisms.
5.9 To Protect Security and Prevent Misuse
We use personal data to:
• protect accounts and systems;
• detect fraud, misuse, misconduct, unauthorised access, or security threats;
• enforce our Terms and Conditions;
• investigate suspected credential misuse or examination misconduct;
• maintain logs and evidence where required.
Our lawful basis is usually legitimate interests, compliance with legal obligations, and, where relevant, the establishment, exercise, or defence of legal claims.
5.10 To Comply With Legal and Regulatory Obligations
We use personal data to:
• comply with tax, accounting, consumer, data protection, and legal obligations;
• respond to lawful requests from authorities;
• maintain legally required records;
• handle data protection requests and complaints;
• establish, exercise, or defend legal claims.
Our lawful basis is compliance with legal obligations and legitimate interests.
6. Special Category Data
We do not normally seek to collect special category data.
However, you may choose to provide special category data if you request accessibility support or reasonable adjustments, or if such information is included in a communication you send to us.
Special category data may include information about health, disability, or accessibility needs.
Where we process special category data, we will do so only where necessary and where we have both:
• a lawful basis under UK data protection law; and
• an additional condition for processing special category data.
This may include explicit consent, employment or social protection requirements where relevant, legal claims, or substantial public interest conditions where applicable.
You may withdraw consent where consent is the lawful basis for processing, although this may affect our ability to provide certain adjustments or services.
7. Automated Processing and Examination Scoring
Some examination scoring, learning progress tracking, email automation, access control, and credential status updates may be carried out automatically through our digital platforms.
Certification outcomes may be generated by applying pre-set scoring rules to examination answers.
If you believe there has been a material platform error, administrative error, or verified delivery issue affecting your examination, you may contact us using the details in this policy and in our Terms and Conditions.
We do not use automated processing to make decisions that have legal effects on you outside the delivery and administration of the certification services you choose to access, unless we tell you otherwise.
8. Who We Share Personal Data With
We may share personal data with trusted third parties where necessary to operate and deliver our services.
This may include:
• website, learning platform, and course hosting providers;
• payment processors and billing providers;
• email, marketing, and customer communication providers (including our CRM and marketing platform, Active Contact);
• webinar, event, and meeting platforms, including our webinar platform, Zoho Meetings;
• community platform providers;
• examination, assessment, or proctoring platforms, including our examination platform, Brillium;
• digital credential, certificate, or badge providers, including our badging platform, Hyperstack;
• analytics and cookie technology providers;
• cloud hosting, storage, security, and IT support providers;
• professional advisers, such as accountants, lawyers, insurers, or consultants;
• your employer or sponsoring organisation, where they purchase or manage access on your behalf;
• law enforcement, regulators, courts, public authorities, or other third parties where required by law or necessary to protect rights, safety, security, or certification integrity.
Where a third party processes personal data on our behalf, we require them to process it only in accordance with our instructions and applicable data protection law.
9. Corporate, Employer, and Sponsored Access
Where an organisation purchases membership, learning, or certification access for you, we may share relevant information with that organisation.
This may include:
• enrolment status;
• access status;
• course completion status;
• certification outcome;
• credential status;
• expiry or renewal status;
• attendance or participation information.
We will not share more information than is reasonably necessary for the organisation to manage the access, cohort, payment, learning programme, or certification arrangement.
10. International Transfers
Some service providers may process personal data outside the United Kingdom. This may include providers such as Brillium, Active Contact, Hyperstack, and Zoho Meetings, where those platforms process or store data outside the UK.
Where personal data is transferred internationally, we will take steps intended to ensure that appropriate safeguards are in place, where required by data protection law.
These safeguards may include adequacy regulations, standard contractual clauses, the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses, or other lawful transfer mechanisms.
11. How Long We Keep Personal Data
We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, tax, certification, dispute, security, and operational purposes.
Typical retention periods include:
• account data: for as long as the account remains active and for a reasonable period afterwards;
• purchase, invoice, and payment records: normally up to 6 years for tax, accounting, and legal purposes;
• learning access and progress records: for the access period and a reasonable period afterwards;
• examination attempt records: normally up to 6 years after the attempt or the end of the certification relationship;
• certification and credential records: for the duration of certification and for a reasonable period afterwards to support verification, renewal, integrity, and dispute handling;
• credential verification records: retained as necessary to confirm current, expired, revoked, or superseded status;
• support and enquiry records: normally up to 2 years unless longer retention is needed;
• marketing records: until you unsubscribe or object, after which we may keep a suppression record to ensure you are not contacted again;
• complaint records: for as long as needed to handle the complaint and maintain appropriate evidence;
• accessibility or reasonable adjustment records: only for as long as needed to assess and provide adjustments, unless longer retention is required for legal, integrity, or dispute reasons;
• security logs: for a limited period unless needed to investigate misuse, fraud, security incidents, or legal claims.
We may retain anonymised or aggregated data that no longer identifies you.
12. Your Data Protection Rights
Depending on the circumstances and the lawful basis for processing, you may have the following rights:
• the right to be informed about how your personal data is used;
• the right of access to your personal data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to object to processing in certain circumstances;
• the right to data portability in certain circumstances;
• the right to withdraw consent where processing is based on consent;
• the right to complain to a supervisory authority.
These rights are not absolute and may depend on the circumstances, the type of data, the purpose of processing, and applicable legal requirements.
13. Your Right to Object
You have the right to object to processing of your personal data in certain circumstances, including where we rely on legitimate interests.
You also have the right to object to direct marketing at any time.
If you object to direct marketing, we will stop sending marketing communications to you.
You can object or unsubscribe by using the unsubscribe link in our emails or by contacting [email protected].
14. How to Make a Data Protection Request
To make a data protection request, contact [email protected].
Please provide enough information for us to identify you and understand your request.
We may need to request additional information to verify your identity before responding.
We will respond to valid requests within the timeframe required by data protection law.
15. Data Protection Complaints
If you are unhappy with how we use your personal data, you can contact us at [email protected].
Please include:
• your name;
• your contact details;
• a description of your concern;
• any relevant dates, account details, product details, or correspondence.
We will review your complaint and respond in accordance with applicable data protection law.
You also have the right to complain to the UK Information Commissioner's Office. The ICO can be contacted through its website at:
If you are based outside the United Kingdom, you may also have the right to complain to your local data protection authority.
16. Marketing Communications
You can opt out of marketing communications at any time.
You can do this by:
• clicking the unsubscribe link in a marketing email;
• changing your email preferences, where available;
• contacting [email protected].
Opting out of marketing does not stop us sending essential service communications, such as purchase confirmations, account notices, certification information, examination instructions, renewal reminders, security notices, or legal updates.
17. Cookies and Similar Technologies
We use cookies and similar technologies to operate the website, understand website usage, improve services, support security, remember preferences, and, where applicable, support marketing or analytics.
Some cookies are necessary for the website and services to function. Other cookies may be optional and used only where permitted by law.
Further information is provided in our Cookie Policy.
You can manage cookies through your browser settings and, where available, through our cookie consent tools.
18. Security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction.
These measures may include access controls, authentication, secure platforms, restricted permissions, monitoring, backups, and supplier controls.
No website, platform, or online service can be guaranteed to be completely secure. You are responsible for keeping your account credentials confidential and for using a secure device and internet connection.
If you believe your account or personal data may have been compromised, please contact us as soon as possible.
19. Children
Strategic Value Streams services are intended for adults aged 18 and over.
We do not knowingly collect personal data from children.
If we become aware that we have collected personal data from a child without appropriate lawful basis or consent, we will take reasonable steps to delete it.
20. Third-Party Links and Platforms
Our website and services may link to third-party websites, platforms, tools, or resources.
Third-party websites and platforms have their own privacy policies, cookie policies, and terms.
We are not responsible for the privacy practices, content, security, or policies of third-party websites or platforms.
21. Changes to This Privacy Policy
We may update this Privacy Policy from time to time.
The latest version will be published on our website with an updated effective date.
Where changes are material, we may take reasonable steps to notify users, members, candidates, or customers.
Continued use of our services after an updated Privacy Policy is published means that you acknowledge the updated policy.
22. Contact
For privacy enquiries, data protection requests, complaints, or questions about this Privacy Policy, please contact:
Strategic Value Streams
Strategic Value Streams, 124 City Road, London, EC1V 2NX, United Kingdom