The QA group of companies ("QA", "we", "our" or "us") are committed to ensuring that your privacy is protected. This Privacy Notice describes how we use the personal information that we collect from you, or that you provide, when you:

  • visit any of our websites, portals or online learning environments (the "Website");
  • use the educational services, testing, certification, products, and consultancy services (together the "Services") that we provide; or
  • communicate with us.

This Privacy Notice also describes the personal data processing where personal data about you is provided by third parties, such as your employer or agents acting on your behalf.

QA may act as a Data Controller or a Data Processor within our relationship depending on the nature of services that we are providing to you.

Please read this notice carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.

We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR). We are also subject to the EU General Data Protection Regulation (EU GDPR) in relation to services we offer to individuals and our wider operations, as applicable, in the European Economic Area (EEA). We may also be subject to other rules and regulations pending the services we offer in other countries.

Information we collect

We collect personal information from you:

  • through the use of forms, which may be on paper or on our Websites, such as when you login to access our Services, signup to receive our newsletters, register for information, make a purchase or commence a course of study;
  • when you create an account on our Websites or platforms
  • if you choose to provide us with information when you use any of our Websites or access our Services, for example information about any special requirements, such as dietary requirements, that you may have;
  • when you communicate with us for any reason, including by email, postal mail or telephone, and when you use our Services;
  • through your chat history and any personal information in inputs, in the form of data, documentation, questions, answers or otherwise (‘User Content’) into our AI products or features, including our Learning Assistant. You must not upload any User Content which contains any personal information of third parties without their express consent;
  • we may also process your data in relation to COVID-19 or within other crisis management activities.

Certain personal data we collect is treated as a special category to which additional protections apply under data protection law e.g. personal data revealing racial or ethnic origin, religious beliefs, or health-related information.

Special Category Data is only processed where it is necessary, for example to provide the necessary duty of care, or in support of our statutory and regulatory reporting obligations. Health information may be required to process reasonable adjustments within learning and examination environments or conditions.

Where we process Special Category Data, we will ensure we are permitted to do so under data protection laws, e.g. we have your explicit consent, the processing is necessary to protect your (or someone else’s) vital interests where you are physically or legally incapable of giving consent; or the processing is necessary to establish or exercise or defend legal claims.

Generally, the personal data we collect about you depends upon the particular services we provide to you; but includes, although is not limited to:

  • your name and contact information, including email address and telephone number and company details;
  • information to check and verify your identity, e.g. your date of birth;
  • your gender, if you choose to give this to us;
  • location data, if you choose to give this to us;
  • your billing information, transaction and payment card information;
  • your personal or professional interests;
  • your professional online presence, e.g. LinkedIn profile;
  • information to enable us to undertake credit or other financial checks on you;
  • information about how you use our website, IT, communication and other systems; and
  • feedback including your responses to surveys, competitions and promotions.

We collect this information for the purposes described in this Privacy Notice.

Information that we collect automatically

When you visit our Websites, we may collect certain information automatically from your device. The information we collect automatically may include information like your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g. country or city-level location) and other technical information. We may also collect information about how your device has interacted with our Website, including the pages accessed and links clicked.

Collecting this information enables us to better understand the visitors who come to our Websites, where they come from, and what content on our Website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Websites to our visitors.

Some of this information may be collected using cookies and similar tracking technology, as explained further under the heading 'Cookies', below.

Information we obtain from third party sources

We may receive personal information about you from third party sources such as your employer or other third parties if they enrol you on a course or create an account on your behalf, or agencies if you apply for study or employment, but only where we believe that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us.

We collect only the minimum amount of information required from these third parties to enable us to provide the requested service or process any application you send to us (for example, your educational or employment history). We only use the information we receive from these third parties as set out in this Privacy Notice.

Use of your information

The information that we collect and store relating to you is primarily used to enable us to provide our Services to you. In addition, we may use the information for the following purposes:

  • to provide you with information or Services you request from us;
  • to provide information on other QA group products and Services which we feel may be of interest to you, in accordance with your communications and consent preferences;
  • to ensure that all learners and/or delegates are able to access learning materials in a virtual environment including the provision of recorded classes and learning events;
  • to allow us to make reasonable adjustments under the Equality Act, including the provision of recorded material for those learners and/or delegates who are unable to attend in person;
  • to meet our contractual commitments to you or to take steps at your request before entering into a contract;
  • to act on your behalf where third party involvement is available and appropriate – for example through a third party specialist training provider or certification/awarding body;
  • to review the performance and effectiveness of services and products, including related continual improvement activities;
  • to comply with our legal and regulatory obligations, including but not limited to, applicable legislation surrounding COVID-19 test and trace or other crisis management schemes;
  • to obtain additional personal information to secure funding or satisfy statutory
    legal or Government scheme requirements – for example through an Apprenticeship scheme or at the request of ESFA to provide data and information to such entity or government organisation;
  • to market our services (and those of selected third parties) to: (i) existing and former customers, (ii) third parties who have previously expressed an interest in our services and (iii) third parties with whom we have had no previous
    dealings;
  • to support internal efficiency, training and quality control activities;
  • to analyse and monitor your use of our AI products or features to ensure: compliance with our terms of use; for partners, such as exam bodies; and help develop, improve, and provide our Services. We will not use your User Content to train our AI products or features;
  • to monitor and analyse trends, usage and activities in connection with our Websites/Services; and
  • as necessary to prevent or detect crime.

We may also monitor or record telephone calls for training, customer service and quality assurance purposes, and to detect or prevent crime. These recordings will be retained for a maximum of 30 days.

In general, we will use any of the information we collect from you only for the purposes described in this Privacy Notice or for purposes that we explain to you at the time we collect such information.

However, we may also use your personal information for other purposes that are not incompatible with the purposes we have disclosed to you (such as statistical purposes) if and where this is permitted by applicable data protection laws.

If you do not want us to use your data for any marketing purposes, you will have the opportunity to withhold your consent to this when you provide your details to us.
Marketing consent can be varied online via our consent portal at cp.qa.com.

Storing and retaining your personal data

The personal information provided to us is stored within secure servers. We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information.

All QA email addresses support TLS email encryption, so it is advised that if you are concerned about the contents of any email to use this encryption. Where we have given you (or where you have chosen) a password so that you can access certain parts of our sites and portals, you are responsible for keeping these passwords confidential.

Please note that the transmission of information via the internet (including email) is not completely secure and therefore, although we endeavour to protect the personal information you provide to us, we cannot guarantee the security of data sent to us electronically and the transmission of such data is therefore entirely at your own risk.

We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

When we have no ongoing legitimate business or statutory need to process your personal information, we will either delete or anonymise it.

Disclosing your information

We may disclose your personal information to any company within our corporate group. This includes, where applicable, our subsidiaries, our holding company and its subsidiaries. This will only be done where lawful bases exist.

We will also disclose, where required, your personal information with:

  • third party service providers and partners who provide data processing services to us (for example, to support the delivery of Services), or who otherwise process personal information for purposes that are described in this
    Privacy Notice;
  • your employer, where they have instructed us or funded the goods or services provided to you. This may include progression, assessment, attainment or exam results as well as other personal data as and when required;
  • a third party where they have funded the services that we deliver to you or your organisation;
  • the purchasing organisation or course vendor in respect of any product evaluation or feedback comments you provide;
  • exam certification bodies where reasonable adjustments are required on health grounds;
  • NHS or other authorised government agencies in connection with COVID-19 containment measures or other crisis management scenarios;
  • government agencies, where required by the scheme or education path you elect to follow;
  • regulatory bodies and supervisory authorities to comply with our legal and regulatory obligations, including but not limited to, applicable legislation surrounding COVID-19 test and trace or other crisis management schemes;
  • the ESFA or similar entity or government organisation;
  • partners with whom we work to provide Services (such as course vendors, examination bodies, customer suppliers and trainers);
  • regulatory bodies or other third parties relating to audits, enquiries or investigations in compliance with applicable law;
  • other commercial organisations with regards to potential work placements or provision of, or attendance at, employment fairs;
  • any third party in connection with, or during negotiations of, any merger, sales of company assets, financing or acquisition of all or a portion of our business by another company;
  • any law enforcement agency, court, regulator, government authority or other third party where we believe this is necessary to comply with a legal or regulatory obligation (and may not be able to inform you so as not to compromise any investigation or other proceedings), or otherwise to protect our rights or the rights of any third party; and to any other person with your consent to the disclosure.
  • any other person where we have a legitimate interest or with your consent to the disclosure.

Where you are a customer or prospective customer, we may disclose your data to third parties for our marketing purposes so that we can identify products and services we think you will be interested in. Personal data used in this way may include contact details such as name, address, phone number, and email address. When sharing with third party marketing organisations, your data may be processed in countries inside or outside of the European Economic Area (EEA).

Third party links

You might find links to third party websites on our Websites or within documentation we provide.

If you access other websites using the links provided, the operators of these sites may collect information from you which will be used by them in accordance with their own Privacy Notices which you should review.

We do not accept any responsibility or liability for their policies whatsoever as we have no control over them.

Social Networking

The Websites may offer you the opportunity to share or follow information about us (or the Websites or our Services) using third party social networking functionality (such as through "share this", "like" or "follow" buttons).

We offer this functionality in order to generate interest in us, the Websites and our Services among the members of your social networks, and to permit you to share and follow opinions, news and recommendations about us with your friends. However, you should be aware that sharing personal or non-personal information with a social network may result in that information being collected by the social network provider or result in that information being made publicly available, including through Internet search engines.

Please note that we do not exercise, endorse, secure or control the policies or practices of any third party social network whose functionality you may access through the Website.

You should always carefully read the Privacy Notice of any social network through which you share information in order to understand their specific privacy and information usage practices.

International data transfers

QA is a global organisation. In order to provide our Services to you, your personal data may be transferred to, stored in and processed in, countries outside of the EEA, including but not limited to, the United States. It will be processed by entities and individuals operating outside of the EEA for the purposes of providing the Services to you.

These entities and individuals include subsidiaries and affiliates of QA Limited as well as various business partners and counterparties. Transfers of your personal data are legally permitted, amongst other mechanisms, under the Group’s intra-group data sharing agreement and contractual agreements that include standard contractual clauses for controllers, and where relevant for processors.

When we transfer, store, or process your data, we do so in accordance with this Privacy Notice and applicable law, including the implementation of appropriate and adequate safeguards in seeking to ensure that personal data is transferred to an adequate level of protection.

We are conscious of our obligations as of March 2022 in relation to international data transfers and seek to implement a risk assessment with respect to international transfers of personal data, either in accordance with EU Standard Contractual clauses with the additional of the UK addendum or the International Data Transfer Agreement; in each scenario to seek compliance with law and regulation.

If you are using our Services from outside the United States, you acknowledge your personal data may be transferred, stored and processed in the United States or other countries.

For further information please see: WorkForce Learning Data Processing and Data Sharing Agreements

Cookies

We use cookies and similar tracking technology (collectively, "Cookies") to collect and use personal information about you. For further information about the types of Cookies we use, why we use them and how you can control Cookies please see our Cookie Notice at: www.qa.com/legal/cookie-notice

Lawful basis (EEA visitors only)

Our lawful bases for collecting and using personal information will depend on the personal information being collected and the specific context in which we collect it.

However, we will normally collect personal information from you only:

  • where we need the personal information to perform a contract with you (for example, to enrol you into a course or provide you with learning materials);
  • where the processing is undertaken on the grounds of legitimate interest and is not overridden by your rights; or
  • where we have your consent to do so.

A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. We carry out an assessment when relying on legitimate interests, to balance our interests against your own.

If we collect and use your personal information in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our platform or for our legitimate commercial interest, for instance, when responding to your queries, improving our platform, undertaking marketing, or for the purposes of detecting or preventing illegal activities. We may have other legitimate interests and if appropriate we will make clear to you at the relevant time what those legitimate interests are.

In some cases, we may also have a legal obligation to collect personal information from you.
If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).
In respect of data processed within COVID-19 frameworks processing is carried out under the basis of either:

  • Legal obligation;
  • Substantial public interest; or
  • Vital interests of the individual or other individuals.

If you have queries concerning the lawful bases on which we collect and use your personal information, please contact us using the contact details provided below.

Sale of personal data

We do not “sell” or “share” Personal Information as those terms are defined under California and other applicable state privacy laws. To the extent Personal Information is shared with third parties, it is only provided to third party service providers/processors.

Marketing

We will use your personal data to send you updates (by email, text message, telephone or post) about our services including exclusive offers, promotions or new services.
We have a legitimate interest in using your personal data for marketing purposes. This means we do not usually need your consent to send you marketing information.
If we change our marketing approach in the future so that consent is needed, we will ask for this separately and clearly.

You have the right to opt-out of receiving marketing communications at any time by:

  • contacting us at privacy@qa.com;
  • using an ‘unsubscribe’ link in emails or ‘STOP’ number in texts; or
  • updating your marketing preferences on applicable links provided to you e.g. cp.qa.com.

We may ask you to confirm or update your marketing preferences if you ask us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.

We will always treat your personal data with the utmost respect and never sell it to other organisations outside the QA group including for marketing purposes. We only allow certain organisations to handle your personal data if we are satisfied they take appropriate measures to protect your personal data.

We also impose contractual obligations on them to ensure they can only use your personal data to provide services to us and to you.

We or these third parties occasionally also share personal data with:

  • our and their external auditors, e.g. in relation to the audit of our or their accounts, in which case the recipient of the information will be bound by confidentiality obligations;
  • our and their professional advisors (such as lawyers and other advisors), in which case the recipient of the information will be bound by confidentiality obligations;
  • law enforcement agencies, courts, tribunals and regulatory bodies to comply with our legal and regulatory obligations; and
  • other parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency.

Usually information will be anonymised (or pseudonymised) but this may not always be possible. The recipient of any of your personal data will be bound by confidentiality obligations.

Data protection rights

You have the following data protection rights, which you can exercise using the details under ‘Contacting us’ or as otherwise directed below:

  • You have the right to access, correct, update or request deletion of your personal information..
  • You can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information.
  • You have the right at any time to request use of your personal information contained within AI products or features is removed. This removal to the extent legally and practically possible will not affect the lawfulness of any processing we conducted prior to request of removal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds, such as legitimate interest.
  • You have the right at any time to opt-out of marketing and telemarketing communications we send you. You can exercise this right by following links within emails to ‘Unsubscribe’ or ’Manage your Marketing Preferences’ or
    similar in marketing and outreach e-mails we send you, or directly within our consent portal at cp.qa.com, or as per ‘Contacting us’. This will not prevent legitimate service-related communications.
  • Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to
    your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
  • You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

Contacting us

The data controller of your personal information will be the QA group entity that you are dealing with, and as such will be one of the following:

  • IndigoCyan TopCo Limited
  • Seckloe 208 Limited
  • QA Limited
  • QA Consulting Services Limited
  • QA Consulting USA Inc
  • QA Gateway Limited
  • QAHE Limited
  • QAHE (SU) Ltd
  • QAHE (UR) Limited
  • QAHE (Ulst) Limited
  • QAHE (NU) Limited
  • QAHE (Mdx) Limited
  • QAHE (Services) Limited
  • QAHE (Solent) Limited
  • QAHE (LM) Limited
  • Branch Campus (London and Birmingham) Limited NI
  • Northumbrian London Campus Limited
  • Roehampton Pathway Campus Limited
  • Solent Pathway Campus Limited
  • Cloud Academy SAGL
  • Cloud Academy, Inc.
  • Circus Street London Limited
  • Circus Street Australia Pty. Limited
  • Circus Street (SG) Pte/ Singapore
  • M2 Education (Hong Kong) Limited

We welcome any queries, comments or requests you may have regarding this Privacy Notice. Please do not hesitate to contact us via email at: privacy@qa.com

Changes to the Privacy Notice

We may change this Privacy Notice from time to time by updating this document.

The online version is available at: www.qa.com/legal/privacy-notice. You should check this page from time to time to ensure that you are happy with any changes.

If material changes are made to this Privacy Notice, we will notify you by placing a prominent notice on the Website or by contacting you to let you know via the contact details you have provided us with.

Changes in this version:

  • Inclusion within the ‘Information we collect’ section to account for the personal information in chat history or User Content in AI products or features;
  • Inclusion within the ‘Use your information’ section to allow us to analyse and monitor use of our AI products or features; Inclusion within the ‘Data protection rights’ to account for right to request removal of personal information in AI products or features.
  • Removal of Circus Street Inc.