Home › Policies › Data Protection & GDPR Policy

Data Protection & GDPR Policy

Centre: ACLAS Global International Education Group

Effective: 2025-07-05 | Review Date: 2026-07-05

Status: Draft — pending signature. This page was last reviewed on 2026-10-29. The scheduled review date of 2026-07-05 has passed; the policy will be updated with the signatory name and signature date once signed by the Centre Director.

Policy Owner: Centre Director (Data Protection Officer)

1. Purpose

This policy sets out how ACLAS Global International Education Group collects, uses, stores, and protects personal data. As an OTHM candidate centre handling data relating to learners in the UK and internationally, the Centre complies with the UK Data Protection Act 2018, the EU General Data Protection Regulation (GDPR) where applicable, and relevant US federal and applicable state privacy laws.

2. What Personal Data We Collect

Learner Data

  • Name, date of birth, contact details (email, telephone, postal address)
  • Government-issued photo identification (for identity verification, as required by OTHM)
  • Educational history, qualifications, and prior learning evidence
  • Assessment submissions, grades, Assessor feedback, and IQA records
  • Reasonable adjustment requests and supporting medical or professional evidence
  • Payment records
  • Communications between the learner and the Centre

Staff Data

  • Name, contact details, CV, qualifications, employment history
  • Performance and CPD records
  • Bank details for payroll
  • Right-to-work documentation

3. Why We Collect Personal Data

The Centre processes personal data for the following purposes:

  • To deliver OTHM qualifications, including teaching, assessment, and certification
  • To register learners with OTHM (required for qualification delivery)
  • To comply with OTHM regulatory requirements and quality assurance processes
  • To verify learner identity
  • To manage learner accounts and payments
  • To communicate with learners about their programme
  • To employ, manage, and develop staff
  • To meet legal and regulatory obligations

4. Legal Basis for Processing

The Centre processes personal data on the following lawful bases:

  • Contract: Processing is necessary to deliver the educational services the learner has contracted for.
  • Legal obligation: Processing is required to comply with OTHM regulatory requirements and applicable law.
  • Legitimate interest: Processing is necessary for the Centre's legitimate interests (e.g., quality improvement, staff management), provided these do not override the individual's rights.
  • Consent: Where the Centre relies on consent (e.g., for marketing communications), consent may be withdrawn at any time.

5. Data Sharing

The Centre shares personal data only where necessary:

  • With OTHM: For learner registration, certification, and quality assurance. This is a contractual and regulatory requirement.
  • With External Quality Assurers: EQAs may access learner work and records as part of OTHM's quality assurance activities.
  • With service providers: The Centre uses third-party services for hosting (Moodle), payment processing (Stripe), and communications. Data processing agreements are in place.
  • With regulatory or law enforcement bodies: Where required by law.

Personal data is never sold to third parties.

6. Data Security

The Centre implements appropriate technical and organisational measures:

  • All systems are password-protected with role-based access controls.
  • Data in transit is encrypted (SSL/TLS).
  • The Moodle LMS is hosted on secure servers with regular security updates.
  • Physical documents are stored in locked cabinets in a secure office.
  • Access to personal data is restricted to authorised staff on a need-to-know basis.
  • Staff receive data protection training during induction.

7. Data Retention

Personal data is retained only as long as necessary:

| Data Type | Retention Period |

|-----------|:----------------:|

| Learner academic records (submissions, grades, IQA records) | 3 years after certification or withdrawal |

| Learner personal data | 3 years after last interaction |

| Staff records | 3 years after termination of employment |

| Financial records | 7 years (tax and accounting requirements) |

| Safeguarding records | As advised by legal counsel |

At the end of the retention period, data is securely destroyed. Physical documents are shredded; electronic records are permanently deleted from all systems and backups.

8. Individual Rights

Individuals have the right to:

  • Access their personal data (Subject Access Request — free of charge, responded to within 30 days)
  • Rectify inaccurate data
  • Erase data ("right to be forgotten"), subject to legal and regulatory retention requirements
  • Restrict processing
  • Data portability
  • Object to processing
  • Withdraw consent where processing is based on consent

Requests should be directed to [email protected]. Identity will be verified before any data is released.

9. Data Breaches

1. Any suspected data breach is reported immediately to the Centre Director.

2. The breach is investigated, contained, and remediated.

3. If the breach is likely to result in a risk to individuals' rights and freedoms, the Centre notifies the relevant supervisory authority within 72 hours.

4. Affected individuals are notified without undue delay where the breach poses a high risk.

10. International Transfers

The Centre is based in the United States. Learner data may be transferred between the US and the UK (where OTHM is based). The Centre ensures that appropriate safeguards are in place for international data transfers, including standard contractual clauses where applicable.

11. Policy Review

This policy is reviewed annually.