Privacy Policy

What the portal records

• Account details: your name, username, e-mail address, phone number (if you add one), your role at the Academy and, if you choose to upload one, your profile photo.
• Training and administration records entered by you or by authorised staff, for example admission profile, attendance, leave, tours, marks and results, feedback, diary entries, library and mess records, circulars, certificates and chat messages with the files attached to them.
• Security information: your password is stored only as a one-way hash and cannot be read by anyone, including administrators. Answers to your security questions are stored the same way. For administrator accounts, the key of the authenticator app is stored encrypted.
• Technical records: a security log notes each sign-in, sign-out and failed attempt with the time, account name, role and the network (IP) address it came from. This is used to keep the portal secure and to investigate misuse.

Why it is recorded

To run the Academy's training programmes and administration through the portal, to keep accounts and records secure, and to meet the Academy's legal and administrative obligations. The information is not used for advertising or marketing and is not sold.

Cookies and browser storage

The portal sets only the cookies it needs to keep you signed in:

• access_token and refresh_token — keep your session active (about 30 minutes, renewed while you work, and up to 7 days at most). They cannot be read by scripts in the page, are sent only to this site, and are marked secure when you use HTTPS. Signing out ends the session.

Your browser also keeps a few non-sensitive items so pages work smoothly: your name, role and which menus you may use, and drafts of forms you have not submitted yet (cleared when you sign out).

The portal contains no analytics, advertising or tracking cookies and loads no third-party tracking scripts.

Who can see your information

Access is limited by role. You can see your own records; Academy staff see only what their role needs (for example a Course Director sees their batch, the Principal sees institution-wide records). The security log can be read only by the Principal and the portal administrators. Information may also be disclosed to a Government authority where the law requires it.

How it is protected

• The portal is served over HTTPS.
• Access is controlled by role, and every request is checked on the server.
• Repeated wrong passwords are blocked, and administrator accounts require a second step (an authenticator app).
• Security-relevant events are logged.

How long records are kept

Records are kept for as long as they are needed for the training programme and under the Academy's record-keeping rules. Accounts that are no longer needed are deactivated by the Academy.

Your choices

You can view and update your phone number, e-mail address and photo under My Profile after signing in. To ask for any other record about you to be corrected, or to raise a concern about how your information is handled, write to the Academy using the details on the Contact page.

Changes to this policy

If this policy changes, the date at the top of the page changes with it. Questions about it can be sent through the Contact page.