WSRO Academy

Version	1.01
Date	August 2026
Owner	World Sugar Research Organisation (WSRO)
Prepared by	Eggu
Review Date	August 2027
Classification	Public

 

Document Control

Version	Date	Description	Author
1.01	August 2026	First draft for client review	Eggu

 

Approval Record

Role	Name	Date
Document Owner	World Sugar Research Organisation	Pending
Approved by	WSRO	Pending

 

1. Introduction

The World Sugar Research Organisation (WSRO) is committed to protecting your privacy and ensuring that your personal information is handled responsibly, securely and transparently.

This Privacy Policy explains how personal information is collected, used, stored and protected when you access or use the WSRO Academy Learning Platform ("the Platform"). The Platform is provided to support the delivery of online learning, professional development and educational resources.

We recognise the importance of maintaining the confidentiality and integrity of personal information and are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

By creating an account or using the Platform, you acknowledge that you have read this Privacy Policy and understand how your personal information will be processed.

2. About this Privacy Policy

This Privacy Policy explains:

• what personal information we collect
• why we collect it
• how we use it
• who we share it with
• how long we retain it
• the measures we take to protect it
• the rights available to you under data protection legislation.

This Privacy Policy applies specifically to the WSRO Learning Platform (Academy) and should be read alongside the WSRO Privacy Policy, which explains how WSRO collects and processes personal information more generally through its website, membership services and other activities. Where both policies apply, they should be read together. In the event of any inconsistency, this Academy Privacy Policy will apply to your use of the Learning Platform.

The WSRO Privacy Policy is available at: www.wsro.org/privacy-policy

3. Who we are

The WSRO Academy is owned by the World Sugar Research Organisation (WSRO).

For the purposes of UK GDPR, WSRO acts as the Data Controller. This means WSRO determines why and how personal information is processed through the Platform.

The Platform is hosted, maintained and technically supported by Eggu, who acts as a Data Processor on behalf of WSRO.

A written Data Processing Agreement is in place between WSRO and Eggu governing the processing of personal information in accordance with UK GDPR.

Data Controller

World Sugar Research Organisation (WSRO)

Contact details to be confirmed prior to publication.

Data Processor

Eggu

Eggu provides:

• secure hosting
• platform administration
• software maintenance
• technical support
• routine backups
• security updates
• helpdesk services.

Eggu accesses personal information only where necessary to provide these contracted services.

4. Definitions

For the purposes of this policy:

Account

Your registered user profile on the WSRO Academy.

Certificate

A digital certificate issued after successful completion of a course or assessment where applicable.

Data Controller

The organisation responsible for deciding how and why personal information is processed.

Data Processor

An organisation that processes personal information on behalf of the Data Controller.

Learning Records

Information relating to your participation in online learning, including enrolments, progress, assessment results and certificates.

Personal Information

Any information that identifies, or could identify, an individual.

Platform

The WSRO Academy is powered by Moodle.

5. Scope

This Privacy Policy applies to:

• registered learners
• course administrators
• authorised WSRO staff
• contracted support personnel
• anyone creating or managing an account on the Platform.

It applies to all personal information processed through the Platform regardless of whether it is collected directly from users or generated through normal use of the learning environment.

This Privacy Policy applies to everyone who uses the WSRO Learning Platform, including both WSRO Members and non-Member learners. It applies equally regardless of whether access to the Platform is provided through membership, invitation or another authorised route.

6. Information we collect

The amount of information we collect is limited to what is necessary to operate and administer the Platform effectively.

Registration information

When you create an account, we may collect:

Information	Purpose
Name	Identify you on the Platform
Email address	Login, notifications and communication
Job title	Reporting and learner management
Organisation name	Course reporting and administration
Marketing preference	Record whether you wish to receive communications

Learning information

As you use the Platform, we create records relating to your learning activity.

This may include:

• course enrolments
• course progress
• lesson completion
• quiz attempts
• assessment scores
• completion status
• certificates issued
• learner feedback
• timestamps relating to learning activity.

These records enable WSRO to administer learning programmes, monitor course completion and issue certificates where appropriate.

Technical information

To help operate and secure the Platform, we also collect technical information such as:

• login history;
• IP addresses;
• browser type;
• operating system;
• device information;
• session information;
• access times;
• security logs.

This information is primarily used to:

• maintain platform security;
• diagnose technical issues;
• investigate suspicious activity;
• improve performance;
• support users experiencing technical difficulties.

Communications

If you contact WSRO or Eggu for support, correspondence may be retained in order to:

• resolve technical issues;
• investigate incidents;
• improve support services; and
• maintain an audit trail of support provided.

Support requests will only be retained for as long as necessary to fulfil these purposes.

Information we do not intentionally collect

The Platform is not intended to collect special category personal information (such as health information, ethnicity, political opinions or religious beliefs) unless this is specifically required for a particular learning programme and users have been informed in advance.

Users should avoid entering sensitive personal information into free-text fields unless explicitly requested as part of a course activity.

7. How we collect information

We collect personal information in a number of ways to enable us to provide and manage the WSRO Academy effectively.

Information you provide directly

Most of the personal information held about you is provided directly by you when you:

• create a learner account;
• complete your user profile;
• enrol onto a course;
• update your account details;
• complete quizzes, assessments or feedback forms;
• contact us for technical support; or
• choose whether or not to receive marketing communications.

You are responsible for ensuring that the information you provide is accurate and kept up to date.

Information generated through your use of the platform

As you use the Platform, Moodle automatically creates learning records and technical logs.

Examples include:

• the date and time you log in;
• the courses you access;
• your progress through learning activities;
• quiz attempts and assessment results;
• course completion records;
• certificates achieved;
• pages visited;
• time spent on activities; and
• feedback submitted.

This information forms part of your learning record and helps WSRO administer and improve its training programmes.

Information collected automatically

The Platform uses essential cookies and basic platform analytics to enable secure login, maintain user sessions, improve performance and understand how the learning platform is being used. These analytics are limited to supporting the operation and improvement of the Platform and are not used for advertising or profiling purposes.

Certain technical information is collected automatically by the Platform in order to maintain security, reliability and performance.

This includes:

• IP address;
• browser type and version;
• operating system;
• device type;
• session identifiers;
• login timestamps;
• system error logs.

This information is not used to monitor your personal browsing habits outside of the Platform.

Further information about the cookies used by the Platform is available in the WSRO Learning Platform Cookie Policy. Information about cookies used on the main WSRO website is available in the WSRO Website Cookie Policy.

Information provided by WSRO

In some circumstances, WSRO administrators may create user accounts on behalf of learners.

Where this occurs, WSRO may provide information such as:

• your name;
• email address;
• organisation;
• job title; and
• course enrolments.

This information is provided solely for the purpose of administering training.

8. Why we process your information

We process personal information only where there is a legitimate reason for doing so.

The primary purposes for processing your information are outlined below.

Purpose	Why we need your information
Account administration	To create and manage your learner account.
Authentication	To verify your identity when you sign in.
Course enrolment	To enrol you on relevant courses.
Learning delivery	To provide access to course materials and assessments.
Progress tracking	To record your learning progress and completion status.
Certificates	To generate certificates following successful completion of courses where applicable.
Reporting	To produce completion reports for authorised WSRO administrators.
Technical support	To investigate and resolve support requests.
Security	To protect the Platform against unauthorised access or misuse.
Platform maintenance	To maintain, update and improve the Platform.
Feedback	To understand learner experiences and improve future courses.
Legal compliance	To comply with applicable legal obligations.

WSRO does not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

9. Lawful basis for processing

Under the UK General Data Protection Regulation (UK GDPR), organisations must have a lawful basis for processing personal information.

Depending on the nature of the processing activity, WSRO relies on one or more of the following lawful bases.

Performance of a Contract

Most personal information is processed because it is necessary to provide you with access to the learning platform and deliver the learning services you have requested.

Examples include:

• creating your account;
• allowing you to log in;
• enrolling you onto courses;
• recording your progress;
• issuing certificates.

Without this information, we would be unable to provide access to the Platform.

Legitimate interests

WSRO also processes certain information where it has a legitimate interest in operating, improving and protecting the Platform.

This includes:

• maintaining system security;
• monitoring platform performance;
• troubleshooting technical issues;
• providing user support;
• improving learning resources;
• reporting on course completion;
• preventing fraud and misuse.

When relying on legitimate interests, WSRO carefully considers your rights and ensures that the processing is proportionate and necessary.

Legal obligations

Some information may be processed where WSRO is required to comply with legal or regulatory obligations.

This may include:

• responding to lawful requests from regulatory authorities;
• investigating suspected fraud;
• complying with court orders; or
• maintaining records required under applicable legislation.

Consent

Where your consent is required, WSRO will ask for it separately.

For example, consent may be used for:

• receiving marketing communications;
• joining mailing lists; or
• participating in optional surveys.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before consent was withdrawn.

10. Learning records

One of the primary purposes of the Platform is to maintain an accurate record of your learning activity.

Your learning record may include:

• courses you are enrolled on;
• course completion status;
• dates of completion;
• assessment attempts;
• quiz scores;
• certificates issued;
• feedback submitted;
• learning history.

These records allow WSRO to:

• monitor learner progress;
• demonstrate completion of training programmes;
• provide evidence of certification;
• identify learners requiring additional support;
• improve future learning programmes.

Learning records are considered an essential part of operating the Platform and cannot normally be deleted while they remain necessary for the administration of learning.

Reporting

Authorised WSRO administrators may access reports showing learner progress.

These reports are used solely for legitimate educational and administrative purposes.

Reports may include:

• completion reports;
• assessment reports;
• learner activity reports;
• certificate reports;
• feedback summaries.

Only authorised personnel are granted access to these reports.

11. Certificates

Some courses available through the Platform may issue digital certificates following successful completion.

Certificates typically contain:

• learner name;
• course title;
• completion date;
• certificate identifier;
• issuing organisation.

Certificates are generated automatically by the Platform based on course completion criteria configured by WSRO/Eggu.

Copies of issued certificates may be retained within your learner record to enable future verification.

12. Learner feedback

The Platform may invite learners to complete evaluation or feedback forms after completing courses.

Feedback helps WSRO:

• improve course content;
• identify areas for enhancement;
• evaluate learner satisfaction;
• improve future training programmes.

Where possible, feedback will be reviewed in aggregate.

However, depending on how a feedback activity has been configured, responses may be attributable to individual users.

Learners will normally be informed where responses are not anonymous.

13. Marketing preferences

During registration you may be asked whether you wish to receive marketing or promotional communications from WSRO.

Providing consent is entirely optional.

Choosing not to receive marketing communications will not affect your ability to:

• register for the Platform;
• access learning materials;
• complete courses;
• receive certificates; or
• use any core functionality of the Platform.

If you choose to receive marketing communications, you may withdraw your consent at any time by:

• updating your communication preferences (where available);
• contacting WSRO directly; or
• using the unsubscribe option included within marketing emails.

Marketing preferences are managed separately from your learner account and learning records.

Separation of learning data and marketing

WSRO recognises the importance of ensuring that participation in learning is kept separate from marketing activity.

Your decision to receive or decline marketing communications has no impact on:

• your access to the Platform;
• your learning history;
• your certificates;
• your assessment results; or
• your relationship with WSRO as a learner.

Marketing consent is stored independently and may be updated at any time without affecting your use of the Platform.

14. Sharing your information

WSRO is committed to protecting your personal information and will only share it where there is a legitimate business, contractual or legal reason to do so.

We do not sell, rent or trade your personal information to third parties for marketing purposes.

Personal information is only shared where necessary to operate, support and secure the Platform.

Sharing with Eggu

Eggu provides the technical infrastructure and support services required to operate the Platform.

As a contracted Data Processor, Eggu processes personal information only on behalf of WSRO and only in accordance with documented instructions.

Services provided by Eggu include:

• secure hosting;
• platform administration;
• software maintenance;
• technical troubleshooting;
• software updates;
• platform backups;
• user support;
• system monitoring.

Eggu employees and authorised contractors are only granted access to personal information where it is necessary to fulfil these services.

All personnel with administrative access are expected to maintain the confidentiality of personal information and to follow appropriate security procedures.

Sharing with service providers

From time to time, WSRO may engage carefully selected third-party service providers to support delivery of the Platform.

Examples may include:

• cloud infrastructure providers;
• email delivery services;
• domain and DNS providers;
• security monitoring services;
• backup services.

Where such providers process personal information on behalf of WSRO, appropriate contractual safeguards will be in place to ensure compliance with UK GDPR.

Third-party providers may only process personal information for the agreed purpose and may not use it for their own commercial activities.

At the time of publication, the Platform does not integrate with external customer relationship management (CRM) systems, payment services or marketing automation platforms.

Should this change in the future, this Privacy Policy will be updated accordingly.

Legal disclosure

WSRO may disclose personal information where required to do so by law.

Examples include:

• complying with a court order;
• responding to lawful requests from regulators;
• preventing or investigating fraud;
• protecting the rights, property or safety of WSRO, Eggu or Platform users.

Where permitted by law, WSRO will seek to ensure that only the minimum amount of information necessary is disclosed.

15. Hosting and security

Protecting personal information is a fundamental part of operating the WSRO Learning Platform.

The Platform is hosted within a secure virtual private server (VPS) environment provided through 123-reg.

The hosting environment is managed by Eggu on behalf of WSRO and is maintained using recognised security practices designed to protect the confidentiality, integrity and availability of information.

Security measures are reviewed periodically and updated where appropriate.

Technical security measures

Appropriate technical controls have been implemented to reduce the risk of unauthorised access, accidental loss or misuse of personal information.

These measures include, where appropriate:

• encrypted connections using HTTPS (SSL/TLS);
• firewall protection;
• server hardening;
• operating system security updates;
• Moodle security updates;
• strong password requirements;
• role-based permissions;
• administrator authentication controls;
• routine security monitoring;
• malware protection;
• automated backups.

These controls are designed to minimise security risks while ensuring the Platform remains available to authorised users.

Organisational security measures

In addition to technical controls, WSRO and Eggu maintain organisational procedures to help protect personal information.

These include:

• restricting administrative access to authorised personnel;
• maintaining appropriate access permissions;
• applying the principle of least privilege;
• documenting support processes;
• reviewing user permissions periodically;
• maintaining audit logs where appropriate;
• ensuring staff understand their responsibilities regarding confidential information.

Access to learner information is limited to those individuals who require it to perform their role.

User responsibilities

Security is a shared responsibility.

Users are expected to:

• keep passwords confidential;
• choose strong passwords;
• avoid sharing login credentials;
• log out of shared computers;
• report suspected security issues promptly;
• keep their own devices appropriately protected.

Users should never attempt to gain unauthorised access to another user's account or any area of the Platform for which they have not been granted permission.

16. Data breaches

Despite robust security measures, no online service can guarantee absolute security.

Eggu has procedures in place to identify, investigate and respond to suspected personal data breaches.

Where a breach involving personal information is identified, Eggu will:

• investigate the incident promptly;
• take appropriate action to contain the breach;
• assess the potential impact on affected individuals;
• notify the Information Commissioner's Office (ICO) where legally required;
• notify affected individuals where there is a high risk to their rights and freedoms.

Eggu will support WSRO in responding to security incidents affecting the Platform in accordance with its contractual obligations.

17. International data transfers

The Platform is hosted within the United Kingdom.

At the time this Privacy Policy was published, personal information processed through the Platform is not routinely transferred outside the United Kingdom.

If, in the future, personal information is transferred internationally, WSRO will ensure that appropriate safeguards are implemented in accordance with UK GDPR.

These safeguards may include:

• adequacy regulations;
• the UK International Data Transfer Agreement (IDTA);
• approved contractual clauses;
• other lawful transfer mechanisms recognised by UK data protection legislation.

Where international transfers occur, this Privacy Policy will be updated to reflect those arrangements.

18. Data retention

WSRO only retains personal information for as long as it is necessary to fulfil the purposes for which it was collected or to comply with legal, regulatory or contractual obligations.

Retention periods are reviewed periodically to ensure information is not kept for longer than necessary.

Typical retention periods

Information	Typical retention period
User account information	Duration of active account plus up to 5 years after inactivity
Learning records	Duration of active account plus up to 5 years after inactivity
Course completion records	Up to 5 years after inactivity
Certificates	Up to 5 years after inactivity (or longer where required for verification)
Quiz attempts and assessment results	Up to 5 years after inactivity
Feedback forms	Normally up to 5 years, unless anonymised earlier
Technical logs	Normally between 6 and 12 months, depending on operational requirements
Helpdesk correspondence	Normally up to 2 years after resolution
Marketing preferences	Until consent is withdrawn or no longer required

These periods may be extended where necessary to:

• comply with legal obligations;
• investigate security incidents;
• resolve disputes;
• establish or defend legal claims.

Deletion of information

When personal information is no longer required, Eggu will ensure it is securely deleted, anonymised or otherwise disposed of in accordance with recognised information security practices.

Where backups contain personal information, data will be removed through the normal backup retention cycle rather than being edited individually.

Account closure

If you no longer require access to the Platform, you may request that your account be closed.

Closing an account does not necessarily result in the immediate deletion of learning records, as certain information may need to be retained to:

• demonstrate completion of training;
• verify certificates;
• comply with legal obligations;
• maintain historical training records;
• protect against fraudulent certificate claims.

Where information can be deleted, WSRO will do so in accordance with applicable legislation and its retention policies.

19. Your rights

Under the UK General Data Protection Regulation (UK GDPR), you have a number of rights regarding the personal information that WSRO holds about you.

These rights are not absolute and may be subject to certain legal exemptions, particularly where information must be retained to comply with legal obligations or to maintain accurate learning records.

WSRO is committed to responding to all legitimate requests fairly, transparently and within the timescales required by law.

Right to be informed

You have the right to understand:

• what personal information we collect;
• why we collect it;
• how it is used;
• who it is shared with;
• how long it is retained; and
• the rights available to you.

This Privacy Policy has been prepared to help you understand these matters.

Right of access

You have the right to request a copy of the personal information held about you.

This is commonly known as a Subject Access Request (SAR).

Information that may be provided includes:

• your account information;
• learning records;
• course enrolments;
• assessment results;
• certificates;
• support correspondence;
• other personal information processed through the Platform.

WSRO will normally respond within one month of receiving a valid request.

Right to rectification

You have the right to request that inaccurate or incomplete personal information is corrected.

You may be able to update certain profile information yourself by logging into your account.

If information cannot be updated directly, you may contact WSRO to request a correction.

Maintaining accurate information helps ensure certificates, reports and learning records remain correct.

Right to erasure

In certain circumstances you may request that your personal information is deleted.

This is sometimes known as the "right to be forgotten."

This right does not automatically apply where WSRO has a legitimate reason or legal obligation to retain information.

For example, learning records may need to be retained in order to:

• verify completion of training;
• maintain historical certification records;
• comply with legal obligations;
• investigate security incidents;
• defend legal claims.

Where information can lawfully be deleted, WSRO will do so securely.

Right to restrict processing

You may request that processing of your personal information is temporarily restricted in certain circumstances.

Examples include where:

• you believe information is inaccurate;
• you have objected to processing;
• processing may be unlawful;
• information is required for legal claims.

During any restriction period, information may still be securely stored but its use will be limited where appropriate.

Right to object

Where WSRO relies on legitimate interests as the lawful basis for processing, you have the right to object.

WSRO will carefully consider each request and determine whether there are compelling legitimate grounds to continue processing.

Right to data portability

Where processing is based on your consent or the performance of a contract and carried out using automated means, you may request a copy of your personal information in a commonly used electronic format where applicable.

This right generally applies to information you have provided directly.

Rights relating to automated decision-making

WSRO does not use automated decision-making or profiling that produces legal or similarly significant effects in relation to users of the Platform.

Moodle automatically records learning activity, calculates quiz scores and generates certificates based on predefined course completion criteria. These automated processes are used solely for educational administration and reporting. They do not affect WSRO membership status, employment, professional standing or any other legal rights.

20. Exercising your rights

If you wish to exercise any of your rights, please contact WSRO using the contact details provided at the end of this policy.

To help protect your personal information, WSRO may request proof of identity before responding to certain requests.

Requests are normally provided free of charge.

However, where requests are manifestly unfounded, excessive or repetitive, WSRO may:

• refuse the request where permitted by law; or
• charge a reasonable administrative fee.

21. Children's privacy

The WSRO Learning Platform is primarily intended for adult learners and professionals. However, some learning programmes may also be made available to students or learners under the age of 18.

Where WSRO knowingly provides access to learners under 18, it will ensure that appropriate safeguards are implemented in accordance with applicable data protection legislation. Where required by law or the nature of the learning programme, appropriate parental or guardian consent will be obtained before personal information is processed.

22. Accessibility

Eggu is committed to making the Learning Platform accessible to as many people as possible.

The Platform is designed to support recognised accessibility standards and is continually reviewed and improved where practical.

If you experience any difficulty accessing this Privacy Policy or any area of the Platform, please contact WSRO or Eggu so that reasonable assistance can be provided.

23. Complaints

WSRO hopes to resolve any concerns about the way personal information is handled promptly and fairly.

If you have any questions or concerns about this Privacy Policy or the processing of your personal information, you should contact WSRO in the first instance.

If you remain dissatisfied after contacting WSRO, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Information Commissioner's Office (ICO)

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk

Telephone: 0303 123 1113

Making a complaint to the ICO does not affect any other legal rights or remedies available to you.

24. Changes to this Privacy Policy

This Privacy Policy may be updated periodically to reflect:

• changes in legislation;
• updates to the Learning Platform;
• new functionality;
• changes to the way personal information is processed; or
• improvements to our privacy practices.

Where significant changes are made, users may be asked to review and acknowledge the updated Privacy Policy when they next sign in to the Platform.

The latest version will always be made available within the Learning Platform.

25. Contact Us

If you have any questions about this Privacy Policy or how your personal information is processed, please contact:

Data Controller

World Sugar Research Organisation (WSRO)

Email: info@wsro.org

Postal Address:
Salisbury House
Station Road
Cambridge
CB1 2LA

Technical Support

Eggu

Technical support relating to the operation of the Learning Platform is provided by Eggu on behalf of WSRO.

Where enquiries relate specifically to personal information or data protection rights, Eggu will refer requests to WSRO as the Data Controller where appropriate.

26. Document review

Document	WSRO Learning Platform Privacy Policy
Version	0.9 (Draft)
Owner	World Sugar Research Organisation
Prepared by	Eggu
Approved by	Pending
Effective Date	To be confirmed
Review Frequency	Annually, or sooner if required
Next Scheduled Review	August 2027