Privacy Policy

The data controller responsible for personal information collected through this website is:

The Lambert Institute for Professional Standards & Recognition
Email: [email protected]
Website: https://lambertinstitute.org

We collect personal information that you provide when interacting with our portal, purchasing credentials, or configuring team rosters:

• Contact & Account Data: Name, purchaser email address, company name (for B2B orders).
• Customization Details: Recipient name, achievement distinction title, and conferral date entered for certificate personalization.
• Technical & Log Data: IP address, browser type, operating system, and timestamp logs collected automatically for security and fraud prevention.

Payment Card Data: We do NOT collect or store your payment card numbers, CVVs, or bank details. All payment information is captured directly and securely by our Merchant of Record (Lemon Squeezy) via encrypted PCI-DSS Level 1 compliant gateways.

We process your personal information under the following legal bases:

• Performance of a Contract: To generate personalized credentials, issue verification serial numbers, process orders, and send transactional download links.
• Legitimate Interests: To maintain the integrity of our public verification register, prevent fraudulent misuse, secure our digital infrastructure, and respond to support requests.
• Legal Compliance: To satisfy accounting, taxation, and regulatory requirements.

We share personal data strictly with trusted service providers who adhere to data protection standards under binding Data Processing Agreements:

• Lemon Squeezy (Merchant of Record): Online reseller and Merchant of Record handling billing, payment gateway processing, currency conversion, and sales tax compliance.
• Supabase, Inc. (USA / AWS): Encrypted cloud database infrastructure hosting credential verification serials and order metadata.
• Resend, Inc. (USA): Transactional email service provider delivering credential download links and order notifications.
• Cloudflare, Inc. (USA): Content delivery network (CDN), DNS management, and web application firewall (WAF) security.

Transactional and tax records are retained for five (5) to seven (7) years in accordance with statutory accounting obligations.

Serial numbers and associated recipient names are retained permanently in the Lambert Public Registry to allow public verification of issued credentials at lambertinstitute.org/verify. If a credential holder wishes to have their public listing de-indexed or redacted, they may submit an anonymization request at any time.

Your information may be transferred to and maintained on servers located outside of your jurisdiction. Where data is transferred from the European Economic Area (EEA) or UK to third countries, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

Our website uses only essential session cookies required for core site functionality, navigation, and security. We do NOT use invasive cross-site advertising cookies or third-party behavioral profiling trackers.

Depending on your location, you have the right to:

• Access, review, or obtain a copy of the personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Request erasure (“Right to be Forgotten”) of your personal data, subject to statutory retention obligations.
• Restrict or object to our processing of your data.
• Request data portability in a structured, machine-readable format.
• Lodge a complaint with your local Data Protection Authority (DPA) or Information Commissioner's Office (ICO).

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

The Lambert Institute — Data Protection Desk
Email: [email protected]