Privacy policy

Who we are

Data controller: Access2site Ltd. For privacy enquiries contact privacy@access2site.com.

What we collect

• Identity & contact: name, email, phone, address
• Qualification data: NI number, date of birth, gender, ethnic origin, disability (where required for awarding)
• Evidence: photos, videos, voice notes, question-paper answers
• Payment: handled by Stripe (we do not store card numbers)
• Communications: WhatsApp messages related to your NVQ

Lawful bases

• Contract — delivering your qualification and portal access
• Legal obligation — records required by awarding bodies
• Consent — special-category data (ethnicity, disability) where applicable
• Legitimate interests — fraud prevention and quality assurance

Who we share with

We share data only with parties directly involved in your NVQ:

• Awarding / quality assurance bodies (as required)
• Stripe (payments)
• Resend (transactional email)
• Meta WhatsApp (evidence messaging, if you use WhatsApp)
• Google (Calendar bookings, secure file archive when complete)

We do not sell personal data.

Retention

We keep registration and evidence for the period required by awarding-body rules (typically up to 7 years after certification). Pending enrolments that are not completed may be deleted after 12 months.

Security

• HTTPS encryption in transit
• Passwords and portal PINs stored hashed
• Staff access via signed sessions; admin shows only data needed for assessment
• Signed, time-limited links for evidence downloads

Cookies

• Portal login — essential session cookie (required to use the portal)
• Language preference — optional; stored only if you choose a language
• Admin login — essential staff session cookie

Mobile app

The Access2Site iOS and Android apps open this same evidence portal. They may request camera, microphone, and photo library permissions so you can capture and upload evidence. Those permissions are optional for some tasks but required for filming or recording. The apps use the same account (email and PIN) and the same privacy rules as the website. Work-based recorder staff sign in with a staff email and password in the same app.

Portal PINs are stored hashed. When we email a login PIN it is temporary — you choose your own memorable PIN after first sign-in. If you capture evidence while offline, files are stored temporarily on your device and uploaded automatically when you reconnect to Wi‑Fi or mobile data, then cleared after a successful upload.

Your rights

You may request access, correction, erasure, restriction, or portability of your data, and object to processing. Contact privacy@access2site.com. You may complain to the ICO (ico.org.uk).