Parties and roles
To be drafted by a solicitor
- The provider as controller and the platform as processor.
Subject matter, duration, nature and purpose
To be drafted by a solicitor
- What processing is done, for how long, and why.
Data subjects and categories of data
To be drafted by a solicitor
- Apprentices, tutors, employers, provider staff, moderators; the categories of data for each, including special category data.
What the platform does — notes for the drafter
- See the “Data we hold” notes on the privacy notice — the same list.
Processor obligations
To be drafted by a solicitor
- Acting only on documented instructions, confidentiality of personnel, and the other Article 28(3) obligations.
Security measures
To be drafted by a solicitor
- Technical and organisational measures (Article 32).
What the platform does — notes for the drafter
- Row-level security isolates each provider’s data in the database.
- Signed records (reviews, approvals, observations) are immutable once signed, enforced by the database.
- Admin actions and data-rights actions are written to an append-only audit log.
- Uploads are checked by file signature, not only the declared type.
Subprocessors
To be drafted by a solicitor
- General authorisation, notice of changes and the right to object.
Current list: subprocessors.
International transfers
To be drafted by a solicitor
- Transfers outside the UK and the transfer mechanism for each (IDTA / UK Addendum).
Breach notification
To be drafted by a solicitor
- Notifying the controller without undue delay, and what the notice contains.
Data subject requests
To be drafted by a solicitor
- How the processor assists the controller with requests.
What the platform does — notes for the drafter
- Apprentices can self-serve a full data export, correction requests and account deletion; providers see every request, with its one-month deadline, in their compliance console.
- Deletion keeps statutory apprenticeship records pseudonymised for the retention period.
Return and deletion at the end
To be drafted by a solicitor
- What happens to the provider’s data when the contract ends.
Audit
To be drafted by a solicitor
- Information and audit rights for the controller.