Privacy and Data Protection Policy (UK GDPR)
The Data and AI School of London
Privacy Notice and Data Protection Policy
Contents (8 sections)
- Who we are
- What personal data we collect
- Legal basis for processing
- Who we share your data with
- How long we keep your data
- Your rights under UK GDPR
- Cookies and platform tracking
- Changes to this policy
Data Controller: The Data and AI School of London
Address: Office LG06, 1 Quality Court, Chancery Lane, London WC2A 1HR
ICO Registration Number: ZC086597
Data Protection Officer: dpo@dataaischool.com
Version: 1.0 | Effective date: 1 January 2026
1. Who we are
The Data and AI School of London is an NCFE-approved training provider delivering regulated qualifications in Programming, Cyber Security, Data Science, Cloud and Functional Skills English. We are registered with the Information Commissioner's Office (ICO) under registration number ZC086597.
2. What personal data we collect
We collect and process the following categories of personal data:
- Identity data: full name, date of birth, gender, nationality, title
- Contact data: home address, email address, telephone number
- Education data: prior qualifications, grades, learning needs, English and maths levels
- Employment data: employment status, employer name, job title
- Equality and diversity data: ethnicity, disability or learning difficulty status (collected under the Equality Act 2010 and for NCFE reporting)
- Assessment data: submitted work, assignment grades, internal verification records, portfolio evidence
- Platform usage data: login times, pages visited, activity completion, time on task within the VLE
- Financial data: fee payment records (where applicable)
- Special category data: health information relevant to access arrangements or safeguarding (collected only with explicit consent where required)
3. Legal basis for processing
| Purpose | Legal basis |
|---|---|
| Administering your enrolment and delivering your qualification | Contract (Article 6(1)(b) UK GDPR) |
| Registering you with NCFE as an awarding organisation | Legal obligation (Article 6(1)(c) UK GDPR) |
| Safeguarding duties | Legal obligation (Article 6(1)(c)); Vital interests (Article 6(1)(d)) |
| Equality monitoring and reporting | Legal obligation and legitimate interests (Article 6(1)(c) and (f)) |
| Quality assurance and internal verification | Legitimate interests (Article 6(1)(f)) |
| Processing special category data (disability, health) | Explicit consent (Article 9(2)(a)) or substantial public interest (Article 9(2)(g)) |
4. Who we share your data with
- NCFE (our awarding organisation): we are required to share your registration data, assessment outcomes and equality monitoring data with NCFE to issue your qualification certificate.
- The Education and Skills Funding Agency (ESFA) / Skills England: funding and statistical reporting where applicable.
- IT service providers: our Moodle VLE is hosted by a UK-based provider operating under a data processing agreement compliant with UK GDPR.
- Regulatory bodies: Ofqual, ICO or law enforcement where required by law.
- We do not sell your data to third parties or use it for marketing without your separate consent.
5. How long we keep your data
- Learner records and qualification evidence: 7 years after the end of your qualification (NCFE centre requirements)
- Financial records: 6 years (HMRC requirement)
- Safeguarding records: as required by statutory guidance
- Platform usage logs: 12 months
6. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right of access: request a copy of the personal data we hold about you
- Right to rectification: ask us to correct inaccurate data
- Right to erasure: ask us to delete your data (subject to our legal retention obligations)
- Right to restrict processing: ask us to limit how we use your data
- Right to data portability: receive your data in a structured format
- Right to object: object to processing based on legitimate interests
- Rights relating to automated decision-making: we do not make solely automated decisions that produce legal or significant effects
To exercise any of these rights, contact our Data Protection Officer at dpo@dataaischool.com. You also have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.
7. Cookies and platform tracking
Our Moodle VLE uses session cookies essential for platform operation and optional analytics cookies (with your consent via the cookie banner). We do not use third-party advertising cookies on the learning platform.
8. Changes to this policy
We will notify all users of any material changes to this policy. The current version is always available on this platform and at www.dataaischool.com/privacy-policy.html.