Privacy Notice
Version 1.0 · effective 13 November 2026
This notice explains what personal information AspireAPC holds about you, why we hold it, who sees it and the rights you have. It covers our coaching services, the AspireAPC portal and our website.
1. Who we are
ASPIRE APC LIMITED, trading as AspireAPC (company number SC897816, registered in Scotland), is the controller of your personal data. We are registered with the Information Commissioner's Office (ICO) as a data controller.
AspireAPC is an independent APC coaching service. We are not affiliated with, endorsed by or acting for RICS.
For anything about your data, contact Andrew Donaldson, Director, at info@aspireapc.com.
2. What we collect
| Identity and contact | your name, email address, phone number, employer and job title. |
|---|---|
| Professional information | your RICS route and pathway, qualifications, years and type of experience, the projects you have worked on, your competency choices and levels, the experience you map against each competency, written statements, case study, presentation notes, diary and CPD records, test and practice results, mock interview notes, meeting notes, and your progress through the programme. |
| Account data | your login email, a securely hashed password, your portal settings, and a log of activity on your account. |
| Files you upload | documents you send us for review. |
| Payment data | the service you have bought, the amount, payment status and payment references. If you pay by card, your card details are entered with our payment provider and are never seen or held by us. |
| Communications | emails and messages between you and us, and feedback you give. |
| Marketing | if you opt in, your email address and preferences. |
Your written work may describe employers, clients and projects. Please anonymise anything confidential before you enter or upload it, and make sure you have any consent your employer or client requires.
We do not ask for special category data (such as health information). Please do not include it.
3. Where we get it
Most of it comes from you. If your employer has arranged your place, they give us your name, work email, role and route so we can set up your account. Your counsellor, supervisor or AspireAPC reviewer adds reviews, sign-offs and notes as you progress.
4. Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Provide coaching, run your portal account, track and report your progress, review your work | Contract |
| Report progress to an employer who is paying for your place | Legitimate interests (delivering the service your employer has arranged), as described in section 5 |
| Take payment, issue invoices and keep accounts | Contract; legal obligation |
| Keep the portal secure, prevent misuse, keep audit logs | Legitimate interests |
| Answer enquiries and sign-up requests | Steps before a contract; legitimate interests |
| Service emails and reminders about your programme | Contract |
| Marketing emails | Consent, which you can withdraw at any time |
| Use anonymised examples of work in our training material | Consent |
We do not make decisions about you by automated means alone. Sign-offs and assessments are always made by a person.
5. Who sees it
| AspireAPC staff and associates | the Director and the counsellors, assessors and reviewers working with you, who are bound by confidentiality. |
|---|---|
| Your employer, if they are paying | named people at your employer see your progress: your tier, competency levels, document status, attendance and readiness. They do not see your counsellor's private notes, your messages to us or your test answers. |
| Your counsellor and supervisor | what they need to review and confirm your experience. |
| Service providers acting on our instructions | Render (portal hosting, in the EU), Resend (sending portal emails), Microsoft (email, calendar, Teams and file storage), Stripe (card payments, where used) and our accountants. |
We do not sell your data. We do not share it with RICS; you make your own submission to RICS.
6. International transfers
The portal is hosted in the European Union, which the UK recognises as providing adequate protection. Some providers may process data in other countries, including the United States. Where they do, the transfer is covered by UK adequacy regulations (including the UK–US data bridge) or by the UK International Data Transfer Agreement or Addendum.
7. How long we keep it
| Coaching and portal records | for the length of your engagement and six years after it ends, to deal with queries and legal claims. You can ask us to delete your portal content sooner once your engagement has ended. |
|---|---|
| Accounting records | six years, as the law requires. |
| Enquiries and sign-ups that do not go ahead | 90 days. |
| Marketing preferences | until you unsubscribe or withdraw consent. |
8. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to move it to another provider. Where we rely on consent you can withdraw it at any time. Email info@aspireapc.com and we will reply within one month. There is no charge.
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
9. Security
The portal is served over an encrypted connection. Passwords are stored hashed, access is limited by role, sign-in attempts are rate limited and changes are recorded in an audit log. We keep only the data we need. No system is perfectly secure: if a breach is likely to affect you, we will tell you and the ICO as the law requires.
10. Cookies
The portal uses only essential cookies: one to keep you signed in and one to remember your light or dark display choice. We do not use advertising or tracking cookies on the portal.
11. Changes to this notice
We will post any update on this page and tell you about significant changes by email or in the portal.