Privacy Policy.

1. Who we are

EdTech Assurance Limited ("we", "us", "our") provides IQA Manager, a software platform used by further education centres and training providers to manage their internal quality assurance (IQA) records. We are registered with the Information Commissioner's Office (ICO).

For personal data that a centre enters into IQA Manager, the centre is the Data Controller and EdTech Assurance Limited acts as Data Processor on the centre's documented instructions. For personal data we collect directly through our website, enquiry and registration forms, we are the Data Controller, and we are also the Data Controller for the business contact details we use to contact organisations about our services (see Contacting organisations about our services). This policy covers both roles.

2. What IQA Manager is

IQA Manager is used by FE centres and training providers to manage internal quality assurance records: assessor registers, sampling records, observations, standardisation, CPD and related compliance logs. Learner reference numbers only are used; learner names must not be entered into the platform.

3. Personal data we process

As Data Processor, on behalf of centres: assessor and staff names, email addresses, roles, and professional IQA records. Learner reference numbers only, no learner names, and no special category data.

As Data Controller, for our own purposes: the name, organisation and email address you provide via our enquiry, registration and contact forms, together with limited website analytics data (see section 6), and the work contact details of people at organisations we contact about our services (see Contacting organisations about our services). We also hold the details of assessors and quality assurers who register with us as associates, and introduce them to organisations with their consent (see Associates and candidates we put forward).

4. Lawful basis for processing

• Legitimate interests: providing, securing and improving the service, responding to enquiries, and contacting organisations about services that may help them.
• Contract: administering subscriptions and licences.
• Consent: analytics and advertising cookies, which are set only after you accept them; and each time we put an associate forward to an organisation.
• Legal obligation: where we are required by law to process or retain data.

5. Who we share data with (processors and sub-processors)

We use a small number of trusted providers. We do not sell your personal data.

• Google Firebase (Alphabet Inc.): authentication, Firestore database and hosting. Centre data is stored in the EU (region eur3). Sub-processor of centre data.
• EmailJS: delivery of transactional and notification emails (for example welcome, licence key and enquiry notifications). Sub-processor of centre data.
• Stripe: payment processing for subscriptions. Card details are handled directly by Stripe; we do not store card numbers. Processor for our own billing activities.
• Google Analytics and Google Ads (Alphabet Inc.): website analytics and advertising-conversion measurement, used only after you consent to cookies (see section 6).
• Anthropic: the website assistant ("Edie"). What you type into the chat window, and its replies, are sent to Anthropic's Claude API to generate an answer. Anthropic does not use commercial API inputs or outputs to train its models, and deletes them within 30 days. Do not type anything into the chat that you would not put in an email. Sub-processor of website enquiry data. We also use Anthropic's Claude API to help draft emails to organisations: it is given a first name, job title and public information about the organisation, never an email address.
• Cloudflare: the service that passes chat messages to Anthropic on our behalf. It does not store the conversation.
• Hunter.io (Hunter Web Services, Inc.): a business contact directory we use to find the published work email address of the right person at an organisation we intend to contact. Processor for our own prospecting. Hunter also runs its directory as a separate controller under its own privacy policy.

The website assistant

Our website has a chat assistant called Edie. A conversation with Edie is held only in your own browser for as long as the page is open, and is lost when you close or refresh it. We do not keep a copy and we cannot read your conversation.

The one exception is when you choose to send it. If Edie offers to pass your enquiry to us and you complete and submit that form, your name, email address, organisation and the full conversation are emailed to us so we can reply. That is treated exactly like any other enquiry made through this website, under section 4.

Messaging us on WhatsApp

You can message us on WhatsApp at +44 7947 234291. If you do, we receive your phone number, the name on your WhatsApp profile and the messages you send. We use them only to reply to your enquiry, and treat them like any other enquiry under section 4. WhatsApp is provided by WhatsApp Ireland Limited (part of Meta), which handles the service under its own terms and privacy policy; messages are end-to-end encrypted. We keep the conversation only as long as we keep other enquiries (section 8). If you would rather not use WhatsApp, email us or use the contact form instead.

Contacting organisations about our services

We look for organisations that may need our help, for example a training provider or college with a recent inspection outcome, a new provider under monitoring, a public tender for work we do, or a newly registered training company, and we write to people there whose work is relevant to what we offer.

What we hold. Your name, job title (or, if you are a company director, the fact of your directorship), work email address and employer; where we found your details and the date; and a record of any email we send you, any reply, and any request not to hear from us. We do not collect home addresses, personal email addresses, phone numbers, dates of birth, profile links or sensitive information.

Where it comes from. Your organisation's own website, and Hunter.io, a business contact directory. We use Hunter.io in three ways, in this order:

• a work email address that Hunter.io has seen published on a public web page, together with that page;
• if there is none, a work email address that Hunter.io has matched to your name and job title where these are listed publicly (for example on LinkedIn), using your organisation's email format. We use it only for roles relevant to our services, and only if Hunter.io has confirmed that the mailbox exists or, where your organisation's email system cannot confirm individual mailboxes, Hunter.io is highly confident the address is right;
• for a company, if there is still no one, the name of a current director from the public register at Companies House, with a work email address that Hunter.io has worked out from the company's email format, on the same basis. We take only the director's name, never their address, date of birth or other register details.

We never visit or copy from LinkedIn or other social media sites ourselves. The first email we send you says how we found you. To decide which organisations to contact, we also use public information about organisations, not individuals, from Find a Tender, Contracts Finder, Ofsted, the UK Register of Learning Providers, Companies House and GOV.UK.

Why, and our lawful basis. Legitimate interests: telling organisations with a clear and current need about services that may help them. We have carried out a legitimate interests assessment, and will send you a copy on request. We do not contact sole traders or partnerships in this way. Each email is written and sent individually by a member of our team. We never send bulk mailings, and we do not sell or share your details.

Who processes it for us. Google stores the record securely in London and carries our email. Hunter.io finds the contact. Anthropic helps us draft the email: it is given your first name, job title and public information about your organisation, never your email address, on the same terms described for our website assistant above.

How long we keep it. If we never contact your organisation, its record is deleted 12 months after we last found anything new about it. If we write to you and you do not reply, your details are deleted 12 months after our last email. If you ask us not to contact you, we keep only your email address and the date of your request, so that we never contact you again.

Your right to object. You can ask us to stop at any time by replying to any email from us or by writing to neil@edtechassurance.co.uk. You do not need to give a reason. We will stop straight away and permanently. You also have the other rights in section 9, including the right to complain to the ICO.

Associates and candidates we put forward

Assessors, internal and external quality assurers and end-point assessors can register with us as associates, so that we can match them to work with training centres, awarding bodies, end-point assessment organisations and other organisations.

What we hold. Your name and contact details, your CV, your roles, specialisms, levels and awarding bodies, your availability and working preferences, copies of the qualification certificates and other evidence you send us, and a record of our checks. Where a role needs it, we also note the type and date of your DBS certificate and whether you use the DBS Update Service. Where we pay you for work, we also hold the details we need to do so.

Putting you forward. When an organisation needs someone, we may send it an anonymised CV and profile, which leave out your name, contact details and home address. We only do this with your consent for that role. We share your name and contact details only after the organisation has chosen you and you have agreed to us sharing them with that named organisation. Once it has your details, the organisation is responsible for them as a separate controller under its own privacy notice.

Why, and our lawful basis. Consent, for each time we put you forward; legitimate interests, for keeping your registration and matching you to suitable work; and contract, where you carry out work through us.

How long we keep it. Consent forms and a record of each introduction are kept for 12 months after your CV was sent, so that any fee due can be checked, and then deleted. Your associate record is kept while you remain registered with us. You can withdraw your consent, or ask us to remove your registration, at any time by emailing kate@edtechassurance.co.uk or neil@edtechassurance.co.uk.

6. Cookies, analytics and advertising

Our website and the IQA Manager application use cookies. Strictly necessary cookies, required for secure sign-in and platform security, are always active and do not require consent.

With your consent, given through our cookie banner, we also use:

• Google Analytics: to understand how visitors use our site so we can improve it.
• Google Ads conversion tracking: to measure the effectiveness of our own advertising campaigns.

These analytics and advertising cookies are set only after you accept them, in line with Google Consent Mode. Until you accept, analytics and advertising storage are denied. You can withdraw consent at any time by clearing cookies or adjusting your browser settings. We do not sell your data, and we do not use it for cross-site behavioural advertising beyond measuring conversions from our own campaigns.

7. International transfers

Centre data is stored in the EU (region eur3). Some providers (for example Google and Stripe) may process limited data outside the UK or EU under appropriate safeguards, such as the UK International Data Transfer Agreement / Addendum or relevant adequacy regulations. Our prospecting records are stored in London (Google Cloud, europe-west2). Hunter.io stores data in the EU (Belgium) and may use sub-processors in the United States, and Anthropic processes data in the United States; both do so under data processing agreements that include the UK International Data Transfer Addendum.

8. How long we keep data

Centre data is retained for the duration of the licence. On termination, data export is available for 30 days, after which it is deleted from our systems. Enquiry and registration data is kept only as long as necessary to respond and for a reasonable follow-up period, then deleted. Business contact details used to contact organisations are kept for 12 months as described under Contacting organisations about our services; a request not to be contacted is kept, as the email address and date only, for as long as it is needed to honour it. Associate records and introductions are kept as described under Associates and candidates we put forward.

9. Your rights

You have the right to access, rectification, erasure, restriction, data portability, and to object to processing. For personal data held within a centre's account, the centre is the Data Controller: please contact your centre, and we will assist them in responding. For data we hold as Controller, contact us directly.

You also have the right to lodge a complaint with the ICO at ico.org.uk or on 0303 123 1113.

You can object to direct marketing at any time, and we will always stop.

10. Security

We implement appropriate technical and organisational measures, including encryption in transit and at rest, access controls, session management, audit logging, and application-level abuse protection (Firebase App Check).

11. Changes to this policy

We may update this policy from time to time. The version number and effective date at the top show the current version. Version 1.7 added WhatsApp as a way to contact us and what happens to a WhatsApp conversation. Version 1.6 added how we hold the details of associates and put them forward to organisations, with their consent for each introduction. Version 1.5 explained that, where an organisation's email system cannot confirm individual mailboxes, we may use an address Hunter.io is highly confident is right, and that the first email then says the address was worked out rather than confirmed. Version 1.4 added two further ways we find the work email address of a relevant person at an organisation we contact (an address matched to a name and job title listed publicly, and a company director's name from Companies House), each used only when the address is confirmed to exist, and named the UK Register of Learning Providers as a source of organisation information. Version 1.3 added how we contact organisations about our services: the business contact details we use, where they come from, who processes them for us and how long we keep them. Version 1.2 added the website assistant (Edie), naming Anthropic and Cloudflare as sub-processors and setting out what happens to a chat conversation. Version 1.1 corrected the cookies and advertising disclosure to reflect our use of Google Analytics and Google Ads conversion tracking, and clarified our processors and sub-processors.

12. Contact

EdTech Assurance Limited
neil@edtechassurance.co.uk
www.edtechassurance.co.uk
Company No. 17089971 (England and Wales).