Privacy Policy.

1. Who we are

EdTech Assurance Limited ("we", "us", "our") provides IQA Manager, a software platform used by further education centres and training providers to manage their internal quality assurance (IQA) records. We are registered with the Information Commissioner's Office (ICO).

For personal data that a centre enters into IQA Manager, the centre is the Data Controller and EdTech Assurance Limited acts as Data Processor on the centre's documented instructions. For personal data we collect directly through our website, enquiry and registration forms, we are the Data Controller. This policy covers both roles.

2. What IQA Manager is

IQA Manager is used by FE centres and training providers to manage internal quality assurance records — assessor registers, sampling records, observations, standardisation, CPD and related compliance logs. Learner reference numbers only are used; learner names must not be entered into the platform.

3. Personal data we process

As Data Processor, on behalf of centres: assessor and staff names, email addresses, roles, and professional IQA records. Learner reference numbers only — no learner names — and no special category data.

As Data Controller, for our own purposes: the name, organisation and email address you provide via our enquiry, registration and contact forms, together with limited website analytics data (see section 6).

4. Lawful basis for processing

• Legitimate interests — providing, securing and improving the service, and responding to enquiries.
• Contract — administering subscriptions and licences.
• Consent — analytics and advertising cookies, which are set only after you accept them.
• Legal obligation — where we are required by law to process or retain data.

5. Who we share data with (processors and sub-processors)

We use a small number of trusted providers. We do not sell your personal data.

• Google Firebase (Alphabet Inc.) — authentication, Firestore database and hosting. Centre data is stored in the EU (region eur3). Sub-processor of centre data.
• EmailJS — delivery of transactional and notification emails (for example welcome, licence key and enquiry notifications). Sub-processor of centre data.
• Stripe — payment processing for subscriptions. Card details are handled directly by Stripe; we do not store card numbers. Processor for our own billing activities.
• Google Analytics and Google Ads (Alphabet Inc.) — website analytics and advertising-conversion measurement, used only after you consent to cookies (see section 6).

6. Cookies, analytics and advertising

Our website and the IQA Manager application use cookies. Strictly necessary cookies — required for secure sign-in and platform security — are always active and do not require consent.

With your consent, given through our cookie banner, we also use:

• Google Analytics — to understand how visitors use our site so we can improve it.
• Google Ads conversion tracking — to measure the effectiveness of our own advertising campaigns.

These analytics and advertising cookies are set only after you accept them, in line with Google Consent Mode. Until you accept, analytics and advertising storage are denied. You can withdraw consent at any time by clearing cookies or adjusting your browser settings. We do not sell your data, and we do not use it for cross-site behavioural advertising beyond measuring conversions from our own campaigns.

7. International transfers

Centre data is stored in the EU (region eur3). Some providers (for example Google and Stripe) may process limited data outside the UK or EU under appropriate safeguards, such as the UK International Data Transfer Agreement / Addendum or relevant adequacy regulations.

8. How long we keep data

Centre data is retained for the duration of the licence. On termination, data export is available for 30 days, after which it is deleted from our systems. Enquiry and registration data is kept only as long as necessary to respond and for a reasonable follow-up period, then deleted.

9. Your rights

You have the right to access, rectification, erasure, restriction, data portability, and to object to processing. For personal data held within a centre's account, the centre is the Data Controller — please contact your centre, and we will assist them in responding. For data we hold as Controller, contact us directly.

You also have the right to lodge a complaint with the ICO at ico.org.uk or on 0303 123 1113.

10. Security

We implement appropriate technical and organisational measures, including encryption in transit and at rest, access controls, session management, audit logging, and application-level abuse protection (Firebase App Check).

11. Changes to this policy

We may update this policy from time to time. The version number and effective date at the top show the current version. Version 1.1 corrected the cookies and advertising disclosure to reflect our use of Google Analytics and Google Ads conversion tracking, and clarified our processors and sub-processors.

12. Contact

EdTech Assurance Limited
neil@edtechassurance.co.uk
www.edtechassurance.co.uk
Company No. 17089971 (England and Wales).