Privacy policy
Last updated: 30 October 2026
1. About this policy
This policy explains how P3GQA Ltd (“P3GQA”, “we”, “us”) collects and uses personal data when you visit p3gqa.com, contact us, download our materials, register for our events, courses or the P3GP® certification exam, or buy from our shop. It also explains your rights and how to contact us.
2. Who we are
P3GQA Ltd, the Project, Programme and Portfolio Governance Qualification Authority, is a company registered in England and Wales (company number 13351575). Our registered office is 128 City Road, London EC1V 2NX, United Kingdom. We are the controller of the personal data described in this policy.
Contact us about this policy or your personal data at info@p3gqa.com, or write to the address above. We have not appointed a Data Protection Officer.
3. The personal data we collect and why
a. You contact us or send a partner enquiry
Data: name, job title, organisation, email, phone, country and your message; for partner enquiries, your organisation’s website and LinkedIn page.
Why: to answer your enquiry and, for partner enquiries, to assess a possible partnership.
Lawful basis: legitimate interests (answering enquiries about our services); steps you ask us to take before a contract.
b. You download the P3G Guide sample or the P3GP syllabus
Data: name, job title, organisation, country and email.
Why: to give you the file and follow up about the P3GP certification.
Lawful basis: legitimate interests (providing material you asked for and following up). You can object at any time.
c. You request a place on a course or workshop, or register for the hackathon
Data: name, job title, organisation, country, email, phone, who is paying, preferred payment method and LinkedIn profile.
Why: to manage your place, invoice you or your employer and send joining details.
Lawful basis: contract, or steps you ask us to take before a contract.
d. You register for a roundtable or webinar
Data: the details you give on the Zoom registration page.
Why: to approve registrations, send joining links and run the session.
Lawful basis: legitimate interests (running invite-only sessions for the intended audience).
e. You apply for the P3GP exam
Data: name, contact details, organisation, city and country, exam choices, any adjustment you ask for (such as extra time), identity checks and proctoring records on exam day, and your result.
Why: to book and deliver your exam, verify your identity, protect exam integrity, and issue your result, certificate and digital badge.
Lawful basis: contract. If you tell us about a disability or health condition to ask for an adjustment, we use that information only for that purpose and only with your explicit consent.
f. You take the governance maturity self-assessment
Data: name, job title, company, industry, email, phone, country and your answers.
Why: to give you your report and, if useful, discuss the results with you.
Lawful basis: legitimate interests. You can object at any time.
g. You subscribe to updates
Data: email address.
Why: to send news about P3 governance, webinars and events.
Lawful basis: consent. Every email has an unsubscribe link.
h. You buy from our shop
Data: name, billing details, email, phone and order details. Stripe handles card payments; we never see or store full card numbers.
Why: to process your order, deliver products such as exam vouchers and e-books, and keep financial records.
Lawful basis: contract; legal obligation (accounting records).
i. You visit our website
Data: IP address, browser and device information, and security signals.
Why: to keep the site and its forms secure and to block spam and bots, including through Cloudflare Turnstile.
Lawful basis: legitimate interests (security).
j. We contact you about our services
Data: name, job title, organisation, business email and public profile details from third-party professional networking platforms and business contact databases.
Why: to introduce our certification, events and partner programme to professionals in project, programme and portfolio governance.
Lawful basis: legitimate interests. You can object at any time and we will stop.
k. We measure how our website is used
Data: pages visited, clicks on links and buttons, approximate location (country and city), device and browser type, and a random identifier stored in a cookie.
Why: to count visits and see which pages and links are used, so we can improve the site. We look at this only as aggregated statistics.
Lawful basis: consent where you accept analytics cookies; for visitors in the UK who have not rejected them, legitimate interests (improving our website). See section 7.
l. You make a cookie choice
Data: your choice, the date, the page, your browser details and a shortened IP address (the last part removed).
Why: to remember your choice and show that we respected it.
Lawful basis: legitimate interests (keeping proof of the cookie choices you made).
You do not have to give us your personal data, but without it we cannot answer your enquiry, book your exam or process your order.
4. Where we get personal data
Mostly from you. We also receive it from your employer when it books for you, from our Authorised Training Organisations and Authorised Training Partners when you train or book through them, from the exam and digital badge platforms we use, and from third-party professional networking platforms and business contact databases.
5. Who we share it with
We use trusted providers who process personal data for us under contract:
- Google (Google Workspace): email and documents.
- Interspace: website hosting (servers in Skopje, North Macedonia).
- Cloudflare: Turnstile bot protection on our website forms.
- Google (Google Analytics, through Google Tag Manager): website statistics; see section 7.
- Zoom: event registration, online sessions and booking calls.
- Mercer | Mettl: online exam delivery and proctoring.
- Credly: digital badges for certified professionals.
- Kortext: e-book access for the P3G Guide.
- Stripe: card payments, when our shop is open.
We also share personal data with our Authorised Training Organisations and Authorised Training Partners where you book or train through them, with professional advisers and insurers where needed, and with authorities when the law requires it. We do not sell personal data.
6. Transfers outside the UK
Some of these providers process personal data outside the UK, and our website is hosted in North Macedonia. Where personal data leaves the UK, we rely on UK adequacy regulations where they apply, or on contractual safeguards with our providers. Contact us for details.
7. Cookies and similar technologies
- Strictly necessary: needed to run the site, keep our forms secure (Cloudflare Turnstile security signals), remember your basket in the shop, process card payments securely and help prevent fraud (Stripe), and remember your cookie choice (pressidium_cookie_consent, 6 months). These do not need your consent.
- Analytics: we use Google Analytics, through Google Tag Manager, to count visits and clicks so we can improve the site (cookies _ga and _ga_QJ52HY3EHV, up to 2 years). Google processes this data for us under its data processing terms; we have switched off sharing this data with Google for other purposes, and we do not use Google signals or advertising links. For visitors in the UK, these cookies are on unless you reject them; for visitors elsewhere, they are set only if you accept them.
- Advertising: we do not use advertising cookies.
- Embedded content: some pages show LinkedIn posts. LinkedIn may set its own cookies when these load. See LinkedIn’s cookie policy for details.
You can change your choice at any time with the round cookie button at the bottom left of every page. You can also block or delete cookies in your browser settings; some parts of the site may then not work.
8. How long we keep it
- Enquiries and partner enquiries: 2 years after our last contact.
- Downloads and self-assessment answers: 2 years after your request.
- Course, workshop, hackathon and event bookings: 6 years after the end of the financial year of the booking (financial records).
- Exam and certification records: name, exam date, result and certificate number for as long as we verify the certification, which does not expire. Identity checks and proctoring recordings for the period set with our exam platform.
- Orders and invoices: 6 years from the end of the financial year they relate to.
- Email updates: until you unsubscribe.
- Website security logs: up to 90 days.
- Website statistics (Google Analytics): event-level data 2 months and user-level data 14 months; aggregated reports are not affected by these limits.
- Records of your cookie choice: deleted automatically 12 months after your last choice.
9. Your rights
You have the right to:
- ask for a copy of your personal data;
- ask us to correct it;
- ask us to delete it;
- ask us to restrict how we use it;
- object to our use of it, including an absolute right to object to direct marketing;
- ask us to transfer it to you or another organisation, where the law allows;
- withdraw your consent at any time, where we rely on consent.
Email info@p3gqa.com to use any of these rights. We will reply within one month. We may ask you to confirm your identity first.
10. Complaints
If you are unhappy with how we handle your personal data, please complain to us first at info@p3gqa.com. We will acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113.
11. Automated decisions
We do not make decisions about you based only on automated processing that have legal or similarly significant effects. The maturity self-assessment calculates a score from your answers to produce your report; it has no such effect.
12. Security
We protect personal data with access controls, encrypted connections (HTTPS), spam and bot protection on our forms, and reputable providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
13. Children
Our services are for professionals. We do not knowingly collect personal data from children under 18.
14. Changes to this policy
We will post any changes on this page and update the date at the top.