Privacy policy

1. About this policy

This policy explains how Northgate Skills Centre uses your personal data. Personal data means information about you, such as your name, your photo or your test results.

It covers our website and app, the English check, your course and tests, NVQ assessment, and our support by email, WhatsApp, chat and phone.

Northgate Skills Centre Ltd is responsible for your data. Two other companies have a part. See "Who we are" at the end.

For any question about your data, email privacy@skillcertify.co.uk.

2. What data we collect

3. How we use your data

We use your data for these purposes. We do not sell your data.

• Your account and bookings: To run your account and your bookings.
• Your course and tests: To teach your course and run your tests.
• Identity verification: To check that you are the person taking the assessment. If you agree to the automatic face check, Stripe checks your ID document, selfie and liveness. If you do not agree, or you stop it later in your account settings, our staff check your ID document instead.
• The English check: To run the English check. See section 5.
• NVQ assessment: To assess your NVQ evidence.
• Qualification and card: To register you with GQA and apply for your card. GQA awards your qualification. CSCS posts your card to you.
• Extra support: To make reasonable adjustments for you.
• Payments: To take your payment and send you a receipt, through Stripe.
• Messages: To send you messages about your bookings, results and card by email, and by WhatsApp where your account settings allow WhatsApp updates.
• Reminders and offers: To send you reminders, for example when you have not done a lesson for a while, and sometimes an offer for a related card. You can stop these with the link in each email or in your account settings.
• Questions, complaints and appeals: To answer your questions and complaints, and to handle appeals.
• Awarding body records: To keep the records GQA asks us to keep.
• Agents: To pay an agent who referred you.
• Safety: To keep the service safe, stop misuse and make backups.
• Launch notifications: If you ask to be notified when bookings open, we store your email address, language, selected course interest and consent record to send the update you requested. Contact us to withdraw that request. We also keep a hashed IP address to limit abuse of the form.

4. Our legal reasons

The law says we must have a legal reason each time we use your data. Some data needs extra care in law, for example your health, your ethnic group, or your face when it is used to check who you are. The law calls this special category data. These are our reasons.

• Running your account, course, tests, English check and NVQ assessment, registering you with GQA and requesting your card: We need to, to give you what you bought (contract). If an agent or your employer paid, our reason is our legitimate interests: giving you the course that was booked for you.
• Keeping course, test and assessment records for as long as the awarding body asks: Our legitimate interests: showing that results are correct when GQA checks them.
• Taking payment and keeping payment records: Contract, and the law on tax records.
• The automatic face check: Your explicit consent. You can say no and have your ID checked by our staff instead. You can stop it at any time in your account settings.
• Checking your ID by eye: Our legitimate interests: making sure the right person takes the test.
• Recording a test you sit online: Our legitimate interests: showing the test was fair, and checking problems and appeals. GQA's rules also need the recording.
• AI help for our staff: Our legitimate interests: faster and more consistent checks. A person always decides.
• Equality questions for GQA: We need your answers to apply for your card, because GQA's card form asks for them (contract). Your ethnic group and any disability are special category data. For these, the law also lets us use them to check equality of opportunity (Data Protection Act 2018, Schedule 1, Part 2, paragraph 8).
• Extra support (reasonable adjustments): The law (legal obligation). The Equality Act 2010 says we must make reasonable adjustments.
• Answering your questions, complaints and appeals: Our legitimate interests: dealing with them fairly. If special category data is part of a legal claim, we use it to make or defend that claim.
• Messages about your bookings and results: Contract.
• Reminders and offers by email: Our legitimate interests. You can stop them at any time.
• Telling you when bookings open: Your consent.
• Checking your card before you buy a renewal: Steps you asked us to take before a contract.
• Paying an agent who referred you: Our legitimate interests.
• Keeping the service safe, logs and backups: Our legitimate interests.

When our reason is legitimate interests, you can object (see section 11). When our reason is consent, you can withdraw it at any time. This does not change what we did before you withdrew it.

5. The English check

If you buy the Level 1 course, or renew a Green CSCS Q-Card, you take a short English check. Your lessons stay locked until our staff accept your check. The check does not stop you buying the course. If you only do an NVQ, you do not take it. Before the check, we check your identity (see section 3).

How it works

• First we offer you a video conversation with an AI interviewer made by a company called Tavus. It is a computer program, not a person. It asks you five short questions in English. If you do not understand, it asks the question again once in simpler English. The conversation lasts up to 5 minutes. Your device records your camera and the conversation, and sends the recording to us.
• If the AI interviewer does not open, or you choose to, you record one video answer to the five questions on the screen instead. This takes about 1 minute.
• The questions are in English only. The instructions before you start are in your language.

What happens to your recording

• In the conversation, Tavus writes down what was said. If Tavus does not send us the words, we send your recording (video and sound) to OpenAI, which turns the speech into text. For the one video answer, OpenAI always does this.
• An AI from Anthropic reads the words you said, in writing, with the five questions and simple facts such as how long you spoke. It does not see the video or hear your voice. It suggests green, amber or red to our staff.
• Our staff (a centre admin or coordinator) watch your recording and decide. The AI never decides. Only our staff can accept your check or ask you to record again.
• If something goes wrong when we process your recording, you do not lose a try.
• When we request your card, we send your recording and the result to GQA, the awarding body. GQA checks it.
• We ask Tavus to delete the conversation after we save our own copy.
• We keep the recording, the transcript and the identity check result for 1096 days (3 years), unless a quality-assurance hold applies.

6. Who we share your data with

We share your data only when we need to. Most of the companies below work for us. They may only use your data to do that work. GQA, CSCS, Google and Meta also make their own decisions about your data, under their own privacy notices.

The awarding body and the card scheme

• GQA Qualifications: the awarding body. We send GQA what it needs to register you and award your qualification and card: your details, your card form, photo and signature, your English check recording and result, your NVQ evidence and your test results.
• CSCS: the card scheme. We check cards on the CSCS Smart Check website. CSCS posts your card to you, using the details GQA sends.

Running our service

• Supabase: our database, sign-in system and file store. Your data is stored in the EU.
• Vercel: hosts our website. Our server code runs in London.
• Cloudflare: stores and plays your NVQ evidence videos and professional discussion recordings, and keeps our encrypted backups.
• GitHub: runs our nightly backup job. A copy of our database passes through GitHub's computers before it is encrypted.
• Fly.io: hosts our gateway, in London. The gateway checks cards on the CSCS Smart Check website and in GQA's records. It also fills in GQA's online forms for our staff.
• Sentry: collects error reports from our website and servers, so we can find and fix faults. Before a report is sent, we remove email addresses, phone numbers and postcodes from it. A report can still show the page you were on and your browser. When something goes wrong in your browser, Sentry may also keep a short recording of the minute before it, so we can see what broke. We hide all the text, form entries, pictures and videos in it, so it shows the layout and where you clicked, not what you typed or read. We do not record you when nothing goes wrong, and we never record payment, sign-in, identity check, English check, test sitting, evidence upload or account settings pages. We also collect timing data for a small share of page loads to find slow pages.

Email, messages and calls

• Resend: sends our emails, and receives some of the emails you send us.
• Zoho: runs our email inboxes, in its EU data centre. Emails you send to our addresses, such as privacy@skillcertify.co.uk, go there.
• Twilio: sends our WhatsApp Business updates where your account preference permits them, and our text messages (SMS). It connects phone calls between you and our staff, and connects and records calls to our phone helper when the helper is switched on.
• WhatsApp (Meta): carries the WhatsApp messages you send us and that we send you.

Payments and identity

• Stripe: takes your payment for the centre. If you agree to the automatic face check, Stripe checks your ID document, selfie and liveness.

Our accounts

• Xero: our accounting system. Invoices and payment records in it can show your name.
• PocketSmith: brings our bank account into our accounts. A bank line can show the name of the person who paid.

Video calls

• Tavus: the AI interviewer for the English check. It sees and hears you during the conversation and writes down what was said.
• LiveKit: carries the live video and sound of a remote invigilated test between you and your invigilator, and records it into our private storage, when remote invigilation is switched on. LiveKit runs in the EU. See the invigilation recording notice.
• Daily: video calls for NVQ professional discussions, which Daily records for us. Daily also carries the English check conversation for Tavus.

AI and speech to text

• OpenAI: turns speech into text (transcribing). It gets your English check recording when Tavus has not sent us the words (see section 5), the sound from NVQ evidence and other recordings you upload, professional discussions, witness statements and practice clips, and calls to our phone helper when the helper is switched on.
• Anthropic: AI that helps our staff and gives you quick practice feedback. It gets:
  • the words you said in your English check, in writing, so it can suggest a result to our staff;
  • your NVQ evidence (still pictures from videos, transcripts and documents), so it can suggest notes for your assessor;
  • photos of documents and cards you send us, so it can read the printed text;
  • your card photo, to check it meets the card rules, for example no hat and eyes open. If it does not, we ask you to take a new photo;
  • your practice answers and your answers in lesson checks, so it can give you quick feedback.
  The AI only helps. A person makes every decision about your English check, your evidence and your results.
• Anthropic: For the AI helper that writes replies in our support chat and on the phone helper. In the chat it receives your message, your first name and the status of your bookings and course. On the phone it receives only a written transcript of what you said, not the recording.

Finding your address

• Ideal Postcodes: finds your address from your postcode. It gets your postcode only.
• postcodes.io: a free postcode service. When you type a postcode in your account settings, your browser sends it the postcode. We also use it to check that an address and its postcode match.

Signing in, only if you choose it

• Google and Facebook (Meta): if you choose to sign in with Google or Facebook, that company tells us your name and email address, and it knows you used our site.

People who booked or referred you

• An agent who referred you or booked for you can see how far you have got (for example booked, paid, sent to GQA or card issued) and what is still to do. The agent cannot see your contact details or your evidence.

Our software company

• SkillCertify Platform LLC (UAE): see section 7.

7. Sending data outside the UK

Some of the companies in section 6 are in other countries, or their staff or systems can reach data from other countries.

The European Union (EU). Some companies keep your data in the EU, for example Supabase (our database) and Zoho (our email inboxes). The UK accepts that the EU protects personal data to UK standards.

The United States (US). These companies are based in the US, or may handle your data there: Anthropic, Cloudflare, Daily, Fly.io, GitHub, OpenAI, Resend, Sentry, Stripe, Supabase, Tavus, Twilio, Vercel, WhatsApp (Meta) and Xero. Some of them keep your data in the UK or the EU, but their staff or systems in the US may still be able to reach it.

UK law has safeguards for sending personal data to the US. Each of these companies names the safeguard it uses in its own published terms:

• The UK Extension to the EU-US Data Privacy Framework: Cloudflare, Daily, Fly.io, Sentry, Stripe, Tavus and Twilio. If it stops applying, the terms of Cloudflare, Daily, Sentry, Stripe and Twilio name another safeguard.
• The UK Addendum to the EU standard contractual clauses (contract terms issued by the UK Information Commissioner): Anthropic, GitHub, OpenAI, Resend, Supabase, Vercel, WhatsApp (Meta) and Xero.

To ask how your data is protected, email privacy@skillcertify.co.uk.

New Zealand. Xero (our accounting system) and PocketSmith (our bank feed tool) are New Zealand companies. The UK accepts that New Zealand protects personal data to UK standards. PocketSmith's published terms do not say where it stores data.

The United Arab Emirates (UAE). Some support and admin work is done by our software company in the UAE, on our instructions. The UK has not decided that the UAE protects personal data to UK standards. We are putting the UK's standard data-transfer agreement (the IDTA) in place for this work. To ask how your data is protected, email privacy@skillcertify.co.uk.

8. WhatsApp

The WhatsApp link on our website opens a chat with the centre’s own business number. We use that number and Twilio to send WhatsApp updates where your account preference permits them, and to reply to your messages. WhatsApp is owned by Meta, so your messages also go through WhatsApp. Our staff can see your messages and keep them to deal with your request. We delete photos, voice notes and files in WhatsApp messages 12 months after the message. You can turn off WhatsApp updates in your account settings.

If you send us your details through a lead form, a member of our team sends you a first WhatsApp message automatically between 8am and 8pm UK time. Reply STOP to receive no more messages.

9. Phone support

Our staff take and make calls on our phone line. Twilio connects these calls. We do not record them. We keep a note of each call: the phone number, the time and whether it was answered.

When our phone helper is switched on, an automated helper answers calls to its number. It is a computer program, not a person. At the start of every call it tells you this. It also tells you that the call is recorded and written down (transcribed) to handle your enquiry, and where to find this policy. If the helper is switched off, the caller hears that the line is not available and nothing is recorded.

• What we collect: your phone number, the recording of what you say and a written transcript of it. If your call needs a person, for example a complaint or a safeguarding concern, we email your number and what you said to our team.
• Who handles it: Twilio connects the call and holds the recording. OpenAI turns the recording into text. Anthropic's AI writes the helper's reply from that text.
• How long we keep it: we delete the audio recording as soon as it has been turned into text. If that does not work, we delete it anyway. We keep the transcript and your phone number for 90 days. If the call is part of a complaint or a safeguarding concern, we keep it for as long as that matter needs.
• Our legal basis: legitimate interests, which means giving you the support you asked for. You can object, or ask us to delete your recording and transcript, by emailing privacy@skillcertify.co.uk.
• Speaking to a person: the phone helper cannot put you through to a person. To reach a person, send us a message in the app or email privacy@skillcertify.co.uk.

10. How long we keep your data

• Course and assessment records (your enrolment, assessment decisions, GQA registration and certificates): 7 years after your course ends, under our retention policy. Videos and other recordings have the limits below.
• Payment records: 7 years.
• Identity check records (the result and the photo of your ID): 3 years.
• English check: the recording, the transcript and the identity check result are kept for 1096 days (3 years), unless a quality-assurance hold applies.
• Remote test recordings: kept for 12 months. This is the awarding body’s minimum. We delete them when this period ends unless a legal hold applies.
• NVQ evidence videos and professional discussion recordings: kept until 3 years after you get your certificate. The awarding body checks this evidence, so we never delete it before you get your certificate. If you do not finish, we keep them for 3 years after your course is closed. We delete them after that unless a legal hold applies.
• Phone calls to our helper: the audio recording is deleted once it has been turned into text. The transcript and your phone number are kept for 90 days, unless the call is part of a complaint or a safeguarding concern. See Phone support above.
• Payments you start but do not finish: we keep what was in your basket, and whether it was paid, for 90 days so we can help you finish. Then we delete it. A payment you finish is kept with your payment record.
• Photos, voice notes and files you send us by WhatsApp or email: 12 months after the message. We keep the message itself.
• Records of which step you reached when signing in or buying, with no name or IP address: 90 days.
• Backups: our encrypted backups keep a copy of changed or deleted data for up to 35 days.
• Legal holds: if there is an appeal, a complaint or an investigation, we keep the records it needs until it ends.

11. Your rights

You have the right to:

• get a copy of your data;
• correct data that is wrong;
• ask us to delete your data;
• ask us to limit how we use your data;
• object when we use your data because of our legitimate interests;
• get your data in a form you can move to another service;
• withdraw your consent at any time, where we use your data because you agreed. For example, you can stop the automatic face check in your account settings;
• ask a person to look again at a decision made by a computer.

Some rights have limits. For example, we must keep some records for GQA, for tax and for appeals. We will tell you what we can and cannot do.

In your account settings you can:

• download a copy of the data in your account;
• ask us to delete your account. We wait 30 days, in case you change your mind. Then our staff delete your name, email, phone number, address, photo, signature and notification settings. We keep your GQA registration and certificate, your payment records (7 years), your identity check (3 years) and a record of who did what. If a legal hold applies, we keep what it needs until it ends.

To use any right, email privacy@skillcertify.co.uk. We must reply within one month.

How tests are marked, who decides NVQ outcomes and how to request a human review are explained in How assessment decisions are made. A short summary of our impact assessment for identity checks, recorded sittings and assessor support is at How we assess high-risk processing. Other customer information is at Customer information.

12. Contact us

Email privacy@skillcertify.co.uk.

Northgate Skills Centre Ltd is registered with the ICO, number ZC219584.

If you are not happy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

13. Changes to this policy

We may change this policy when our service or the law changes. The newest version is always on this page, with the date at the top.

Who we are

Three companies are involved.

• Northgate Skills Centre Ltd (registered office: Unit 4, Millbrook Business Park, Canal Road, Leeds, LS99 4NG) is the training centre. It sells you the course, test and card services. It decides how your data is used for your enrolment, identity checks, English check, tests, evidence, qualification and certificate records. This makes it the "controller" of that data.
• SkillCertify Ltd (Company No. 17408823), the UK platform company. It takes a platform fee from payments made through the platform, and it is the controller for the payment and billing records of that fee.
• SkillCertify Platform LLC (UAE), Formation No. 2539013. The software provider operating the platform our service runs on. It processes your data on the instructions of the companies above (account management, hosting, support tooling).

GQA Qualifications and CSCS are separate organisations. They are responsible for the data they hold about you, under their own privacy notices.