Privacy Notice
Apollo Accreditation
1. Who we are
Apollo Accreditation is a trading name of Auren Institute, which is the data controller for the personal data described in this notice. We are established in Malta at 92, No. 1, St Edward Street, Qormi QRM 2136, Malta. Our registration number is P1421 and our VAT number is MT20967027.
We provide accreditation, curriculum development and quality assurance services to training providers, academies, colleges, awarding organisations and professional bodies.
You can reach us about anything in this notice at info@aureninstitute.com.
2. Why you are reading this
Most people reading this notice are here because we sent them a message they did not ask for. This notice explains where we got their details, what allows us to write to them, and how to make it stop. Those three things are in sections 3, 4 and 6 and we have put them first for that reason.
If you are a client rather than a prospective one, sections 7 onwards cover you as well.
3. What we hold, and where we got it
If we have contacted you about our services, we hold your name, your business email address, your job title, your employer and its website, publicly stated information about your organisation such as whether and with whom it is accredited, and one fact drawn from public material that we used to make our message relevant to you.
We obtained these details from sources other than you. Specifically, from published directories of accredited training providers, from public registers of licensed education providers, and from commercial business contact-data providers who confirm names, job titles and business email addresses. If you would like to know which of these your details came from, ask us and we will tell you.
We hold business contact details only. We do not hold your personal address, your personal email, your personal phone number, or anything about you outside your professional role. We do not hold special category data as defined in Article 9, and we do not knowingly hold data about anyone under 18.
4. What allows us to contact you
We rely on legitimate interests under Article 6(1)(f) of the General Data Protection Regulation. Our interest is in reaching the small number of organisations for whom accreditation services are genuinely relevant, and in telling the person who would make that decision that the option exists.
We have carried out a formal assessment weighing that interest against your rights and freedoms, and recorded the outcome in writing before contacting anyone. You are entitled to a copy of it and we will send it on request.
We contact people at incorporated organisations only. We do not contact sole traders or unincorporated partnerships by email. We do not send unsolicited marketing email to recipients in Malta, because Maltese law requires prior consent for that and extends the requirement to organisations as well as individuals.
5. What we do with it
| Purpose | Lawful basis |
|---|---|
| Contacting you about accreditation, curriculum development and quality assurance services | Article 6(1)(f), legitimate interests |
| Keeping a record of who we contacted and when, so that we can honour objections and demonstrate we acted properly | Article 6(1)(f), legitimate interests, and Article 6(1)(c) where an accountability obligation applies |
| Delivering services to you if you become a client, including managing the engagement | Article 6(1)(b), performance of a contract |
| Meeting accounting, tax and regulatory obligations | Article 6(1)(c), compliance with a legal obligation |
6. How to make it stop
Reply to any message from us and say so. Any wording works. You do not need to give a reason, we will not ask for one, and we will not try to change your mind.
You can also write to info@aureninstitute.com.
Your right to object to direct marketing under Article 21(2) is absolute. There is no balancing test and no exception. We stop immediately, not at the end of a campaign.
When you object we keep your email address, and nothing else, on a suppression list. We keep it indefinitely, because it is the only thing that stops us contacting you again if your details reappear in a directory we use later. If you would prefer we deleted it entirely, tell us and we will, but we will then have no way of recognising you as someone who asked not to be contacted.
7. How long we keep it
| What | How long we keep it |
|---|---|
| Business contacts we approached who did not respond | 24 months from the date we last verified the details, and then deleted |
| Anyone who objected or unsubscribed | Email address alone, indefinitely, for suppression only |
| Client records and engagement files | For the duration of the engagement and then for 7 years, for audit and professional obligations |
| Financial and transaction records | For the period required by Maltese tax and accounting law |
8. Who we share it with
We share personal data with service providers who process it on our behalf and under contract: our customer relationship management provider, our email sending provider, our business contact-data providers, our cloud hosting providers and our professional advisers.
Where an engagement requires it, we share information with the relevant accreditation or awarding body. We tell clients before we do so.
We do not sell personal data and we do not share it with third parties for their own marketing.
9. Sending data outside the European Economic Area
Some of our providers are established outside the European Economic Area, including in the United States. Where data is transferred we rely on an adequacy decision of the European Commission, the European Commission Standard Contractual Clauses, or, for transfers from the United Kingdom, the International Data Transfer Addendum, together with any additional measures required. Ask us and we will tell you which applies.
10. Your rights
You have the right to be told what we hold and to receive a copy, to have inaccurate data corrected, to have data erased, to have processing restricted, to receive your data in a portable format, to object to processing based on legitimate interests, and to object to direct marketing.
All of these are free of charge. We respond within one month and will tell you if a complex request needs longer.
Write to info@aureninstitute.com.
11. Complaints
Please tell us first if something has gone wrong, and we will try to put it right. You also have the right to complain to a supervisory authority without doing so.
We are established in Malta, so our lead authority is the Information and Data Protection Commissioner, at idpc.org.mt. If you are in the United Kingdom you may complain to the Information Commissioner’s Office, at ico.org.uk.
13. Our website
Our website uses Cloudflare Web Analytics to count visits and see which pages are read. It does not set cookies, does not fingerprint your browser and does not track you across other websites. It processes your IP address to do its work.
Our website also loads a typeface from Google’s servers when a page opens. That request sends your IP address to Google. We are moving this typeface onto our own servers so that it no longer happens.
We set no advertising cookies and no tracking cookies on this site.
14. Changes to this notice
The version and date are shown at the top. We update this notice when what we do changes, and record material changes in the change log at the foot.
v1 (31 July 2026): First publication.