Information and purpose
CRA will collect only information needed for enquiries, booking, learner administration, certificates, purchases, support and consented updates. Each workflow will state its purpose before collection.
Lawful use
The final notice will map contract, legal obligation, legitimate interests and consent to the specific processing activities for the launched business.
Storage and sharing
Access will be role-controlled. Service providers will receive only the data needed for their function under appropriate terms. CRA will not sell learner or customer data.
Retention and rights
Retention periods will be defined by record type. Individuals will be told how to request access, correction, deletion, restriction, objection or portability where applicable.
Security and incidents
CRA is building restricted database access, minimum public certificate proof and audit-ready workflows. A documented breach assessment and notification process remains a launch requirement.