Privacy notice for website visitors

Who this notice is for

Anyone who visits our website, uses a public form, verifies a certificate or reports a problem without signing in.

Forms

If you use the contact form or the employer enquiry form we collect what you enter — name, email, phone, organisation and your message — together with the version of this notice you were shown, a one-way scrambled ("hashed") version of your network address and your browser type (to stop abuse and repeated submissions). We use it to reply (legitimate interests). Contact messages are deleted 12 months and employer enquiries 24 months after they are closed. Marketing is only sent if you ask for it.

Certificate verification

If you verify a certificate we record a log of the look-up without personal data, to detect misuse; a manual look-up needs the certificate number and the learner's surname and is limited to 30 an hour per network. The log is kept for 24 months.

Error monitoring and service logs

See "Keeping the service working" in the main Privacy notice: Sentry and Better Stack receive technical details only, with personal details removed first.

When you report a problem

The "Report a problem" link keeps your description, the page and — unless you untick it — a masked transcript of the pages you opened and buttons you pressed in that tab in the last 30 minutes (never what you typed). You may give an email address for a reply. Reports are read only by our platform administrators and deleted after 12 months (legitimate interests).

Cookies and analytics

Essential cookies only, unless you accept analytics (PostHog, EU) — see the Cookie policy. We also count page views on our server without cookies: page template, referring site and device type, with unique visitors counted by a same-day salted hash that is deleted after the day. "Do Not Track" and "Global Privacy Control" signals are honoured. Aggregates are kept for 26 months. Our lawful basis is legitimate interests in improving the site; you can object by sending one of those signals or contacting us.

Security

Our systems record a salted hash of network addresses for rate limiting for 24 hours. Contact our Data Protection Lead ([to be confirmed: Data Protection Lead (name or role holder)]) at [to be confirmed: privacy and data protection email address] or write to [to be confirmed: postal address for letters and rights requests].

Change history