Privacy Policy

Privacy Policy for www.paraqual.co.uk

Paradigm Qualifications, trading as ParaQual ("ParaQual", "we", "us", "our"), is the data controller for the personal data described in this policy. Our registered address is 333 Davidson House, The Forbury, Reading, RG1 3EU, and you can reach us at director@paraqual.co.uk.

This policy explains what personal data we collect when you visit www.paraqual.co.uk, enquire about or enrol on a qualification, use your learner, assessor or centre account, or otherwise deal with us. It also explains why we collect it, who we share it with, how long we keep it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Cookies and similar technologies are covered separately in our Cookie Policy.

We do not intentionally collect special category data such as health, ethnicity or religious information. If you choose to tell us about a disability or health condition so that we can make reasonable adjustments to your assessment, we record only what is needed to provide that support, on the basis of your explicit consent.

UK GDPR requires us to have a lawful basis for each use of your personal data. The table below sets out what we do and why we are allowed to do it.

Some of our programmes, including the Digital and AI-Based Safety and Health Management diploma, use artificial intelligence tools to generate practice scenarios, provide draft feedback on your submissions and help assessors review work more consistently. To do this, the relevant parts of your submission are sent to our AI service providers, currently Anthropic and OpenAI, under contracts that prohibit them from using your data to train their models.

AI output is always reviewed by a qualified human assessor. No decision that affects your grade, certification or account is made solely by automated means. If you have concerns about the use of AI in your assessment, you can raise them with your assessor or contact us at the address below.

We never sell your personal data. We share it only with the organisations below, and only as far as needed for the purpose described.

• Awarding bodies and regulators: ProQual Awarding Body and NOCN receive your registration details, assessment outcomes and, where sampled, your portfolio evidence, so that they can quality assure our centre and issue your certificate. They may share data with Ofqual and other regulators as required.
• Assessors and internal quality assurers: the qualified professionals who assess and verify your work, some of whom are independent contractors bound by confidentiality agreements.
• Assesseez: the e-portfolio platform used for some qualifications, which stores your evidence and assessment records on our behalf.
• Stripe: our payment processor, which handles card payments and instalment plans. Stripe's own privacy policy applies to the data you enter on its payment pages.
• Hosting and email providers: DigitalOcean, which hosts our platform and stores uploaded files, and Amazon Web Services, which delivers our emails.
• AI service providers: Anthropic and OpenAI, as described in the section above.
• Google: Google Analytics and Google Ads, only if you accept analytics and advertising cookies.
• Your employer or centre: if they enrolled you or are paying for your qualification, we may confirm your enrolment status and progress to them.
• Professional advisers and authorities: our accountants, insurers and legal advisers, and public authorities where the law requires it.

All service providers act under written contracts that require them to protect your data and use it only on our instructions.

Your data is stored primarily in the United Kingdom and the European Economic Area. Some providers, including Stripe, Google, Amazon Web Services, Anthropic and OpenAI, may process data in the United States. Where that happens we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or on the UK International Data Transfer Agreement or Addendum together with additional safeguards, so that your data receives protection equivalent to UK law.

We keep personal data only for as long as we need it for the purpose it was collected, and then for any further period required by law or by our awarding bodies. Our standard retention periods are:

Certificates issued by an awarding body are held by that awarding body under its own retention rules, so that your achievement can be verified in future.

All traffic to our website and platform is encrypted with HTTPS. Passwords are stored using strong one-way hashing and cannot be read by our staff. Uploaded evidence is stored in access-controlled cloud storage, and access to learner records is restricted to staff and assessors who need it for their role. Payment card data is handled entirely by Stripe, which is certified to PCI DSS Level 1.

No system is completely secure. If we become aware of a personal data breach that is likely to put your rights at risk, we will tell you and the Information Commissioner's Office without undue delay, as the law requires.

Under UK GDPR you have the following rights. Some apply only in certain circumstances, and we will explain if that is the case.

• Access: ask for a copy of the personal data we hold about you.
• Rectification: ask us to correct data that is inaccurate or incomplete.
• Erasure: ask us to delete your data where we no longer need it. We may need to keep assessment and financial records for the periods above.
• Restriction: ask us to pause processing while a question about accuracy or lawful basis is resolved.
• Portability: receive the data you gave us in a common electronic format, or have it sent to another provider.
• Objection: object to processing based on our legitimate interests, and object at any time to direct marketing.
• Withdraw consent: where we rely on consent, withdraw it at any time without affecting earlier processing.
• Automated decisions: not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

We may email you about qualifications, offers and news that are similar to the services you have enquired about or bought from us. Every marketing email includes an unsubscribe link, and you can also opt out by emailing us. Opting out does not stop service messages about your enrolment, assessments or account, which we must send to fulfil our contract with you.

Our qualifications are designed for people in work and our website is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We review this policy at least once a year and whenever our practices, providers or the law change. The date at the top shows when it was last updated. If we make a change that significantly affects how we use your data, we will tell registered learners by email before it takes effect.

Paradigm Qualifications (ParaQual)
333 Davidson House, The Forbury, Reading, RG1 3EU
Email: director@paraqual.co.uk
Telephone: +44 118 405 0146