Your data rights and how to use them

Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• be informed about how we use your information (our privacy notices);
• access a copy of your information and details of how we use it;
• rectification — have inaccurate information corrected and incomplete information completed;
• erasure — have information deleted where there is no longer a good reason to keep it;
• restriction — ask us to limit how we use it while a question is resolved;
• object — to processing based on legitimate interests or public task, and an absolute right to object to direct marketing;
• data portability — receive information you gave us, where we use it by consent or contract and by automated means, in a structured, machine-readable format;
• rights about automated decisions — to have a person review a significant decision, give your view and contest it (Automated processing and AI notice);
• withdraw consent at any time where we rely on it (for example marketing, sharing your job profile, analytics cookies).

How to make a request

Tell us in any way — email [to be confirmed: privacy and data protection email address], write to [to be confirmed: postal address for letters and rights requests], use our contact form, or tell any member of staff (who must pass it on the same day). You do not have to use particular words or a form. It is free unless a request is manifestly unfounded or excessive.

Checking who you are

To protect your information we check your identity in a proportionate way — usually through your existing learner or employer account, or the identity check made at enrolment. If we need more, we will ask straight away.

Timescales

We respond without undue delay and within one month of receiving your request (or of receiving anything we need to confirm your identity). If a request is complex or you have made several, we may extend by up to two further months and will tell you why within the first month. If we need you to clarify what you want, the time stops until you reply. We carry out reasonable and proportionate searches.

Access requests — how we do it

A compliance officer produces a complete export of your record from the platform (application, consents, enrolment, attendance, assessments, certificate, job profile, placements, funding case status, invoices and payments). The export is audited. We then check it for other people's information (for example an employer contact or another learner mentioned in a note) and remove what we must, and send it to you securely. We do not keep an extra copy.

Erasure — how it works

When you ask us to delete your information, a compliance officer records the request and the platform first checks for legal holds — reasons the law or a contract requires us to keep the record for now:

• an open funding case (ready, submitted, in clarification or approved) — the funding contract audit period;
• funding milestone evidence that has been evidenced or claimed;
• an unpaid invoice;
• an enrolment in progress;
• a placement still inside its 13-week retention period.

If a hold applies, the request is recorded as on hold and we tell you which obligation prevents erasure and when it is expected to end. If no hold applies — or once it ends — your record is anonymised: your name, email, phone number, date of birth and postcode are replaced, restricted records are deleted, documents are removed and your job profile is hidden. Anonymous references, dates and financial totals remain so that audits and accounts still reconcile. The audit trail, financial records and claims already sent to a funder keep a reference only. Marketing opt-outs are kept as a permanent "do not contact" entry so you are never contacted by mistake.

Rectification, restriction, objection and portability

We correct inaccurate records promptly and tell anyone we shared them with where practicable. While we check a disputed record or an objection, we restrict its use. For portability we provide the export in JSON, a common machine-readable format.

If we refuse

If we refuse all or part of a request (for example because an exemption in the Data Protection Act 2018 applies), we tell you why, and about your right to complain to us and to the ICO and to go to court.

Complaints

You can complain to us about how we handled your request — we acknowledge within 30 days and keep you updated (Complaints policy and procedure). You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

Change history