Privacy policy

Who we are

Data controller: Access2site Ltd. For privacy enquiries contact privacy@access2site.com.

What we collect

• Identity & contact: name, email, phone, address
• Qualification data: NI number, date of birth, gender, ethnic origin, disability (where required for awarding)
• Evidence: photos, videos, voice notes, question-paper answers
• Payment: handled by Stripe (we do not store card numbers)
• Communications: WhatsApp messages related to your NVQ

Lawful bases

• Contract — delivering your qualification and portal access
• Legal obligation — records required by awarding bodies
• Consent — special-category data (ethnicity, disability) where applicable
• Legitimate interests — fraud prevention and quality assurance

Who we share with

We share data only with parties directly involved in your NVQ:

• Awarding / quality assurance bodies (as required)
• Stripe (payments)
• Resend (transactional email)
• Meta WhatsApp (evidence messaging, if you use WhatsApp)
• Google (Calendar bookings, secure file archive when complete)

We do not sell personal data.

Retention

We keep registration and evidence for the period required by awarding-body rules (typically up to 7 years after certification). Pending enrolments that are not completed may be deleted after 12 months.

Security

• HTTPS encryption in transit
• Passwords and portal PINs stored hashed
• Staff access via signed sessions; admin shows only data needed for assessment
• Signed, time-limited links for evidence downloads

Cookies

• Portal login — essential session cookie (required to use the portal)
• Language preference — optional; stored only if you choose a language
• Admin login — essential staff session cookie

Your rights

You may request access, correction, erasure, restriction, or portability of your data, and object to processing. Contact privacy@access2site.com. You may complain to the ICO (ico.org.uk).