Data controller
To be drafted by a solicitor
- Who the controller is for apprentice, tutor and employer data (the training provider) and who the processor is (the platform).
- Who is controller for platform-level data such as provider-admin accounts and billing.
- ICO registration number and contact details for the platform.
What the platform does — notes for the drafter
- Each training provider is a separate tenant on its own subdomain; its staff can see only its own learners.
- Accounts are created by the provider (invitation or CSV import). There is no self sign-up.
Data we hold
To be drafted by a solicitor
- Every category of personal data, with the source of each.
- Any special category or criminal offence data, and the condition relied on.
What the platform does — notes for the drafter
- Account: name, email, role, provider, employer (and optionally job title and photo).
- Learning: lesson activities completed, scores, signed reflections, private notes, bookmarks.
- Evidence files and reflections; off-the-job hours with approvals and signatures.
- Tripartite progress reviews with notes and signatures from learner, tutor and employer.
- Messages between learner, tutor and employer.
- AI helper conversations, each classified with a one-word theme and scanned for welfare signals.
- Safeguarding records where a concern has been raised (may include special category data).
- Connected social-account analytics, only if the learner connects an account.
Lawful basis
To be drafted by a solicitor
- The Article 6 basis for each purpose (delivering the apprenticeship, funding compliance, safeguarding, analytics with consent).
- The Article 9 condition for safeguarding and any health information.
- Automated processing: KSB tag suggestions and welfare scanning, and why neither is a solely automated decision under Article 22.
What the platform does — notes for the drafter
- AI suggests KSB tags on reflections; a tutor decides what counts.
- AI welfare scanning routes possible concerns to the provider’s safeguarding queue for a person to read. Nothing is escalated outside the provider automatically.
- Analytics (PostHog) loads only after cookie consent.
Retention
To be drafted by a solicitor
- How long each category is kept and why, including the apprenticeship funding retention requirement.
- What happens at the end of the period.
What the platform does — notes for the drafter
- Apprenticeship records (training records, progress reviews, evidence of achievement, off-the-job hours) are kept for 7 years after completion. The requirement is the DWP Provider Agreement: 6 years from the end of the financial year in which the last funding payment was made, which 7 years covers.
- On an erasure request those records are kept with the name and email replaced by a reference code. Signatures and safeguarding records are kept unchanged.
- Data exports are deleted 7 days after they are made.
Your rights
To be drafted by a solicitor
- Each right (access, rectification, erasure, restriction, objection, portability) and how to use it.
- The one-month response time and when it can be extended.
- The right to complain to the ICO.
What the platform does — notes for the drafter
- Learners can download all their data, ask for corrections and request account deletion themselves on the My data page in the platform.
- Deletion has a 30-day cooling-off period and can be cancelled before it runs.
- Safeguarding records and moderation notes are not in the automatic export; the provider reviews them first.
Subprocessors
To be drafted by a solicitor
- Reference to the subprocessor list and how customers are told about changes.
- International transfers and the safeguards used.
The current list is on the subprocessors page.
Breach notification
To be drafted by a solicitor
- What happens if personal data is breached, who is told and when.
- The processor’s duty to tell the provider without undue delay.
What the platform does — notes for the drafter
- Providers have an incident log in their console. It records; it does not notify anyone.
Contact
To be drafted by a solicitor
- Contact details for the platform (and DPO if appointed).
- That learners should usually contact their training provider first.