IPMA is a worldwide company with offices, candidates, and members in different countries. In the Netherlands, IPMA-NL is active as an association. IPMA Certificering B.V. – hereafter IPMA – is a subsidiary company of IPMA-NL responsible for carrying out the IPMA exams within the Dutch language area and territory.
This Privacy Statement applies to all personal data that IPMA processes from her clients, candidates, trainers, and other interested parties. With personal data we mean information that can be traced back directly or indirectly to an individual, without the name of that individual having to be known. Think of a customer number, address, place of residence, e-mail address, telephone number, and financial data.
Responsible for the processing of personal data are:
IPMA Certificering BV
3432 NA Nieuwegein
Phone 088 – 3376330
3781 XK Voorthuizen
IPMA processes personal data based on the following legal foundations:
The goals of processing personal data are:
IPMA obtains your personal data by various means. For example, when you create a customer account, sign up for an IPMA course or exam, or when visiting a session of IPMA. If you apply through your employer or a training institution, we receive your information through these parties.
Data that IPMA collects through its websites can also be combined with data you provide us with at other moments. Like completing attendance forms for exams.
We use the following information for the purposes stated in this privacy statement:
Name and surname
Date of birth
Phone number (s)
E-mail address (ES)
IPMA Membership number
Company name of the contact person
Company phone number of the contact person
Company e-mail address of contact person
We will share your personal data with different third parties if this is necessary for the execution of the agreement and to comply with any legal obligation. With companies who process your data on our behalf, we arrange a processing agreement to ensure the same level of security and confidentiality of your data. We remain responsible for this processing
Your personal data can be transferred to IPMA-NL or IPMA (international) on the basis of the goals and foundations as stated above. For instance, if this is necessary for data operation and storage, to provide you with access to our services, for customer support, to make decisions about the improvement of the service, for content developments, and other purposes as described.
We work with a limited number of external parties who have access to your personal data. All these parties IPMA found to be reliable and they have signed agreements with us. In our agreements is stated what these parties have to comply with.
We do not provide your personal data to parties in countries outside the European Union/European Economic Area.
We will only share your personal information with public authorities if required by law. For example, requests from courts, law enforcement agencies, regulators, and other government and government bodies.
IPMA ensures that your personal information is provided with an adequate level of security in order to protect your personal information and to protect it from unauthorized use, unauthorized access, alteration, and wrongful destruction. We do this by means of two-step authorization procedures, applying passwords, and encrypting data, among other things.
Your data will be kept by us for an extended period of time, but never longer than necessary to carry out activities or based on a legal arrangement where we keep your data longer.
The personal data regarding not finished or not positively finished courses will be stored up to 24 months after registration for the course.
The personal data regarding positively finished courses we store up to 12 months after the expiry date of the certificate.
We keep the data we process for the execution of other agreements up to a maximum of 24 months.
We keep invoice data, on the basis of legal obligations, for 7 years.
Your email address and name are stored in Mailchimp. The storage is indefinite until the moment you sign out for the newsletters.
As the person involved you have specific legal rights regarding the personal data we collect from you. This applies to all processing activities listed in this privacy statement. Below you find the information about your rights.
If the processing of personal data is based on your consent, you may withdraw this consent at any time. We guarantee that the permission can be withdrawn in the same way as it was given, such as electronic.
You can ask us to correct your personal details. We make reasonable efforts to keep personal data in our possession or management that is used on a continuous basis, accurate, complete, current, and relevant on the basis of the latest information available to us. Inappropriate cases we offer portals where users can check and correct their personal data.
You may, where appropriate, obtain restrictions from us on the processing of your personal data; such as:
You may ask us for information about your personal data, including information about the categories of personal data we hold or control, for which it will be used, where we collected it if not directly from you, and to whom it has been disclosed if any. You may ask us to provide you with a free copy of any personal data we hold about you. We reserve the right to charge a reasonable fee for any other copy you request.
In certain situations, we may not be able to give you access to all or some of your personal data due to legal requirements. If we reject your request, we will inform you of the reason for this refusal.
Upon your request, we will pass on your personal data to another processing manager, if technically feasible, provided that it is based on your consent or if it is necessary for the execution of an agreement. Instead of receiving a copy of your personal data, you may request that we pass the data directly to another processing manager appointed by you.
We may erase your personal data at your request. For instance:
Unless the processing is necessary:
You may object at any time to the processing of your personal data as a result of your specific situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this case, we will no longer process your personal data, unless we can demonstrate compelling legitimate reasons and an overriding interest in the processing or in the establishment, exercise, or defense of a legal claim. If you object to the processing, state whether you want your personal data to be deleted or whether you want us to restrict the processing of your personal data.
You have the right to lodge a complaint with the Personal data Authority if you feel that IPMA does not correctly deal with your personal data. You can do this via this link:
To exercise your legal rights, you can submit a written or electronic request to us. To make sure that the request has been made by you, please attach a copy of your identity document. In this copy, make the photograph, the numbers at the bottom of the passport or the ID-proof number, and the BSN unreadable.
We will try to grant your request within 30 days. However, this period may be extended for specific reasons relating to the specific legal right or the complexity of your request.
You find our contact information at the end of this privacy statement.
On the website, you will find a number of links to third-party websites. If you follow these links, you will leave the website of IPMA. Although these websites are carefully selected, IPMA cannot hold any responsibility with regard to the use of your data by those organizations. Please read the privacy statement, if available, of the website you are visiting.
You can send all your questions about data protection and all requests regarding exercising your legal rights to:
Attn. Product and Process specialist – Privacy
P.O. Box 10
3430 AA Nieuwegein