For Website Users, Enquirers, Learners, and Individuals Providing Personal Data

 

1. Who We Are

Pawsitive Education is a training and education provider.  We are the Data Controller for the personal data we collect and process.

Tracey Rawbone (partner)

Amy Gibson (partner)

Email: info@pawsitive-education.co.uk

 

2. What This Privacy Notice Covers

This Notice describes how we collect, use, store and share personal data relating to:

• people using our website
• individuals completing online or paper forms
• prospective and current learners
• individuals who contact us by phone, email or social media
• individuals whose data we process during complaints, investigations, regulatory enquiries or awarding organisation monitoring activities

 

This Notice applies to personal data we collect:

• directly from you
• automatically through our website
• through our training and assessment activities
• as part of a complaint, investigation, regulatory requirement or awarding organisation monitoring activity

It explains the lawful bases we rely on and your rights under UK GDPR.

 

3. The Personal Data We Collect

Information you provide directly. Examples include:

• name, address, contact details
• date of birth
• enrolment or application information
• identification documents
• assessment submissions and course-related material
• reasonable adjustment requests, special condition requests, appeals and supplementary documentation supporting these processes
• emails, messages, phone calls or complaint correspondence
• information entered into paper and website forms

 

Information we'll create or record as part of our work. We maintain internal records such as:

• learner files
• assessment records
• internal quality assurance (IQA) reports
• tutor/assessor observations
• communications or case notes
• investigation or complaint documents

 

Information collected automatically via our website

• IP address
• device/browser settings
• pages viewed and time spent
• cookies and analytics

 

Information received indirectly (occasionally): We may receive personal data incidentally where it relates to our training, safeguarding, or complaints management functions. For example:

• a complainant may name another learner or staff member
• an employer may provide information relating to a learner
• an individual may raise a safeguarding concern

 

This information is processed only where relevant, necessary and proportionate.

 

Important clarification:

We do not routinely obtain learner personal data from awarding organisations, regulators, or external bodies. However, we may be required to share personal data with those bodies (see Section 6).

In some cases, we collect or process special category data, for example:

• information about health or disability where required for reasonable adjustments or safeguarding
• information relating to safeguarding concerns
• equality and diversity information (if collected voluntarily)

 

We process this information only where necessary and rely on the appropriate UK GDPR Article 9 conditions, such as:

• substantial public interest (e.g., safeguarding and preventing harm)
• vital interests (protecting someone’s life)
• obligations in employment, social protection or education law
• explicit consent (where applicable)

This information is always handled sensitively and stored securely.

 

4. Why We Collect Personal Data

We process personal data for the following purposes:

• responding to enquiries
• course applications and learner registration
• delivering training, assessment and certification
• providing learner support and reasonable adjustments
• maintaining quality assurance and internal verification
• managing our website and improving user experience
• handling complaints, appeals or investigations
• ensuring regulatory compliance
• maintaining records for audit and legal obligations

 

5. Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR:

• Contract – to provide education, training and assessment services
• Legal Obligation – regulatory, safeguarding, funding and audit requirements
• Legitimate Interests – centre administration, communication, quality assurance
• Consent – only for certain marketing or optional activities
• Vital Interests – where needed to protect someone’s life or wellbeing

Where we rely on legitimate interests, these include:

• ensuring the effective delivery and quality of our training and assessment
• maintaining accurate learner and assessment records
• monitoring and improving our services and website
• managing centre administration and internal operations
• preventing and investigating malpractice or misuse of our services
• communicating with learners, employers and stakeholders in a proportionate manner

We only rely on legitimate interests where these are not overridden by your rights or freedoms.

We do not rely on consent where another lawful basis is more appropriate.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects for individuals. All assessment decisions involve human judgement.

6. Who We Share Personal Data With

We only share personal data where necessary and lawful.

Awarding Organisations (AOs):

We share personal data with AOs for:

• learner registration
• assessment, moderation and certification
• external quality assurance
• investigations (including malpractice or maladministration)
• complaints and appeals
• regulatory compliance

AOs act as independent Data Controllers.

Regulators and Statutory Bodies:

Where required, we may share data with bodies such as:

• Ofqual
• Qualifications Wales
• CCEA
• ESFA
• Ofsted
• safeguarding partners
• the police or other authorities

Employers or Referring Organisations (where applicable). For example, when training forms part of employment or an apprenticeship.

Complaints, Appeals and Investigations:

If a complaint or investigation arises, we may need to share relevant:

• learner records
• assessment evidence
• internal notes and IQA records
• correspondence
• investigation documents

 

This may include information not originally supplied by the individual themselves if it forms part of the official record.

 

Data Processors (service providers):

We use trusted third-party suppliers to support our operations, including:

• secure cloud storage
• email and IT systems
• learning or assessment platforms

 

These organisations act only on our instructions and must keep your data secure.

 

7. How Long We Keep Your Data

How Long We Keep Your Data:

We keep personal data only for as long as necessary to meet our awarding‑organisation obligations, legal requirements, and legitimate business needs. Retention periods are determined by:

• UK legislation
• awarding organisation (AO) rules
• Ofqual and regulatory requirements
• safeguarding legislation
• HMRC and financial regulations
• operational needs for audit, quality assurance, and complaint resolution

 

We do not retain personal data for longer than necessary and follow the minimum retention periods set out in our Record Keeping and Retention Policy.

 

Typical Minimum Retention Periods:

• Learner registration details: 3 years after certification or withdrawal
• Assessment evidence and decisions: 3 years after certification
• Internal Quality Assurance (IQA) records: 3 years after certification
• Appeals records: 3 years after resolution
• Complaint records: 3 years after resolution (unless part of malpractice)
• Malpractice investigations: 6 years after closure
• Reasonable adjustment and special consideration records: 3 years after certification
• Certification records: 3 years after issue
• Assessor and IQA competence records: 3 years after last activity
• Conflict of interest declarations: 3 years

 

Safeguarding Records:

Safeguarding records may be kept until the learner reaches age 25 if they were under 18 at the time of the concern, unless statutory agencies require a different period.

 

Other Records

Financial records: 6 years (HMRC requirement)

Website analytics data: 12–26 months

General communications (e.g. emails, enquiries): 12–24 months, unless part of an ongoing case or investigation

 

Full retention periods, including qualification‑specific and awarding‑organisation‑specific requirements, are set out in our Record Keeping and Retention Policy.

 

8. Your Rights

You have the right to:

• access your personal data
• request correction
• request erasure (where lawful)
• restrict or object to processing
• request data portability
• withdraw consent (for consent-based processing)
• complain to the Information Commissioner’s Office (ICO)

 

To exercise your rights, contact us at:

info@pawsitive-education.co.uk

You have the right to submit a complaint to ICO: https://ico.org.uk

 

9. How We Protect Your Data

We use appropriate technical and organisational measures including:

• secure and encrypted systems
• password protection and access restriction
• staff data protection training
• secure transmission of data to awarding organisations
• regular audit and monitoring

 

10. Updates to This Notice

We may update this Notice periodically.

Any changes will be published on our website with a revised date.

Pawsitive Education  22/2/2026