Privacy Notice

This Privacy Notice explains how The Edge Works Limited (“EdgeWorks™”) collects, uses, stores, shares and protects personal information.

It applies to all personal data processed by EdgeWorks™ in connection with:

• Our website;
• Our employer client services;
• The registration, delivery, assessment and certification of regulated qualifications; and
• The operation of the Care Academy platform.

EdgeWorks™ is committed to processing personal data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and associated legislation as amended from time to time, including the Data (Use and Access) Act 2025.

We will only process personal data where we have a lawful basis to do so. Depending on the circumstances, this may include:

• Performance of a contract;
• Compliance with a legal obligation;
• Legitimate interests pursued by EdgeWorks™; or
• Consent, where required.

We implement appropriate technical and organisational measures to protect personal information and ensure it is retained only for as long as necessary to meet operational, contractual and regulatory requirements.

This Privacy Notice should be read alongside our internal data protection and information security policies.

Who we are

The Edge Works Limited (“EdgeWorks™”) is a company registered in England and Wales (Company No. 3406606) with its registered office at Jactin House, 24 Hood Street, Manchester M4 6WX.

We deliver training, assessment and regulated qualifications through our Care Academy platform and associated services.

For the purposes of UK data protection law, EdgeWorks™ is the Data Controller.

Contact: dpo@edgeworks.co.uk

Who this notice applies to

This Privacy Notice applies to:

• Website visitors.
• Employer clients.
• Learners registering for and completing qualifications.
• Individuals making enquiries.
• Representatives of organisations we work with.

If you are a learner, this notice applies throughout your registration, learning and certification journey.

The information we collect

A. Website Users

• Name
• Contact details
• Organisation details
• Enquiry content
• IP address and technical usage data
• Cookie data

B. Employer Clients

• Business contact details
• Contract and billing information
• Communications
• Learner sponsorship information

Marketing communications are directed at employer contacts only.

C. Learners

When registering for a qualification, we collect information necessary to administer and deliver your programme.

Identity and contact details

• Full name
• Date of birth
• Address
• Email
• Telephone number
• Employment details

Qualification and registration data

• Qualification enrolled on
• Unique Learner Number (ULN), where issued
• Personal Learning Record (PLR) data (where permission is given)
• Registration with awarding organisations
• Certification details

Learning and assessment data

• Login records
• Assessment submissions
• Assessment attempts
• Feedback and assessor comments
• Internal Quality Assurance (IQA) records
• Progress tracking and activity monitoring
• Communications with centre staff

Special category data (where applicable)

• Health or learning support needs (for reasonable adjustments).
• Ethnicity data (used for monitoring and anonymised reporting).

We do not process DBS data for learners.

How we collect information

We collect information:

• Directly from you at registration or enrolment
• Through the Care Academy platform
• From your employer (where they sponsor your qualification)
• From awarding organisations
• Through system-generated learning activity

How we use your information

Website Users and Employers
We use personal data to:

• Respond to enquiries
• Deliver services
• Manage contracts
• Send employer marketing communications
• Maintain and improve our website

Learners
We use learner information to:

• Register you with awarding organisations
• Deliver learning materials
• Assess your work
• Conduct internal quality assurance
• Monitor progress and engagement
• Issue certification
• Provide reasonable adjustments
• Maintain regulatory compliance

Where your employer sponsors your qualification, we may share:

• Learning activity records
• Assessment attempts
• Units completed
• Qualification status

We do not share full assessment content with employers unless required for quality assurance or regulatory purposes. This information is shared only where necessary for programme administration, contractual reporting, workforce planning, quality assurance, or regulatory compliance.

Lawful basis for processing

We rely on:

• Contractual necessity – to deliver qualifications and services
• Legal obligation – to comply with awarding body requirements
• Legitimate interests – to manage our centre, systems and quality assurance
• Consent – where required (e.g. PLR access)

For special category data, including health and ethnicity data where applicable, EdgeWorks™ relies on the relevant condition under Article 9 UK GDPR and Schedule 1 of the Data Protection Act 2018, including substantial public interest, equality of opportunity or treatment, and provision for individuals with a disability or medical condition, with explicit consent used where required.

Artificial Intelligence (AI) in assessment

EdgeWorks™ uses AI tools to support assessors and IQAs.

AI may assist with draft feedback or highlighting areas for review. AI does not make autonomous assessment decisions.

All final assessment outcomes are determined by qualified assessors and subject to internal quality assurance.

Learner work is not used to train external AI systems unless EdgeWorks™ has a documented lawful basis, has informed affected individuals appropriately, and has implemented suitable safeguards.

Sharing your information

We may share data with:

• Awarding organisations (e.g. NCFE, City & Guilds, VTCT Skills).
• External verifiers.
• Your employer (where they sponsor your qualification).
• IT and hosting providers.
• Regulators or law enforcement where legally required.

We do not sell personal data.

International transfers

The Care Academy platform is hosted in the UK.

We may process employer contact data outside the UK. Where this occurs, EdgeWorks™ will ensure that an appropriate transfer mechanism and UK-approved safeguards are in place in accordance with applicable data protection law.

Learner assessment data is not routinely transferred outside the UK.

Data retention

We retain personal data only as long as necessary for operational, contractual and regulatory purposes.

Learner Registration Data
Retained in accordance with awarding organisation and operational requirements.

Assessment and IQA Records
Retained in line with awarding organisation requirements.

Certification Records
Retained for audit, verification and replacement certificate purposes.

Platform Account Data (Care Academy User Accounts)
A learner account is considered inactive where:

• There has been no login activity; and
• There is no active qualification, including no units in progress and no pending reassessments.

The 10-year inactivity period is calculated from the later of:

• The date of the last recorded login;
• The date the learner’s employment status is changed to “ex-employee”; or
• The date the qualification status changed to completed, withdrawn or lapsed.

Where an account remains inactive for 10 continuous years, it will be deleted or anonymised.

Deletion may occur sooner where requested by a sponsoring employer, unless continued retention is required for regulatory or contractual reasons, provided this does not conflict with regulatory or awarding organisation retention requirements.

Core certification records may be retained separately.

When data is no longer required, it is securely deleted or anonymised.

Where an individual raises a complaint, legal claim, regulatory concern, or other issue requiring review of data handling, EdgeWorks™ may retain relevant records for longer where there is a documented lawful basis for doing so.

Your rights

You have the right to:

• Access your data.
• Correct inaccurate data.
• Request erasure, where applicable.
• Restrict processing.
• Object to processing based on legitimate interests, where applicable.
• Data portability, where applicable.
• Withdraw consent where processing is based on consent.
• Raise a data protection complaint directly with EdgeWorks™.
• Lodge a complaint with the Information Commissioner’s Office.

Requests and complaints: dpo@edgeworks.co.uk

Where you raise a data protection complaint with EdgeWorks™, we will acknowledge receipt within 30 days and will investigate and respond without undue delay.

Security

We implement appropriate technical and organisational measures including:

• Secure UK hosting.
• Role-based access controls.
• Regular backups.
• Staff training.
• Controlled access to learner data.