Privacy Notice

1. Introduction

The Data and AI School of London (referred to in this policy as "the school", "we", "us", or "our") is committed to protecting the privacy and personal data of all individuals who interact with us. This includes learners enrolled on our programmes, prospective learners who enquire about our courses, staff and associate tutors, and any other person whose data we process in the course of our operations.

We deliver our qualifications entirely online. As a result, the personal data we collect is processed digitally across a range of platforms and cloud-based services. We recognise that this creates specific data protection obligations, and we take those obligations very seriously.

This Privacy Policy explains:

• who we are and how to contact us
• what personal data we collect and why
• the legal basis on which we process your data
• how long we keep your data
• who we share your data with
• your rights under UK data protection law
• how to make a complaint or exercise your rights

This Privacy Notice explains how The Data and AI School of London processes the personal data of website visitors, prospective learners, and applicants. For our full internal Data Protection Policy governing all centre operations including enrolled learners, staff, and assessment records, see the DAIS-POL-006 Data Protection Policy.

2. Who We Are

2.1 Data Controller

The Data and AI School of London is the data controller for all personal data processed in connection with our qualifications, services, and website.

2.2 ICO Registration

We are registered with the Information Commissioner's Office (ICO) as required by the Data Protection Act 2018. Our ICO registration number is ZC086597. You can verify our registration at ico.org.uk/registration.

3. Legal Framework

This policy and all of our data processing activities comply with the following legislation:

4. The Personal Data We Collect

We collect only the data that is necessary for the purposes described in this policy.

4.1 Learner Data

Identity and Contact Data

• Title, full name, date of birth, gender, email address, phone number, home address (town or city and postcode)
• Photographic identity (passport or driving licence, for identity verification)
• Unique Learner Number (ULN), assigned by the Learning Records Service
• Emergency contact details (the name, relationship and contact details of a person you nominate). Where you provide these, please make sure that person is aware we hold their details for this limited purpose.

Equality and Diversity Monitoring Data

• Ethnic background, disability or health status, and any access requirements or reasonable adjustments
• Provided voluntarily and used only to monitor equality of opportunity and to arrange learner support. You may choose "prefer not to say" for any of these.

Enrolment and Qualification Data

• Qualification enrolled on and units registered
• Entry requirements evidence (prior qualifications, transcripts)
• Application form responses, enrolment date, qualification completion status and certification records

Learning and Assessment Data

• Assessment submissions (assignments, projects, code repositories, portfolios)
• Assessment grades, feedback, and quality assurance records
• Originality check reports (e.g. Turnitin similarity scores)
• Recognition of Prior Learning (RPL) evidence and decisions
• Reasonable adjustment and special consideration applications and outcomes

Engagement and Platform Data

• VLE login activity, last access dates, and content completion records
• Assessment submission timestamps
• Messages sent through the VLE messaging system
• Attendance records for live online sessions

Special Category Data (Sensitive Data)

We may process information about your racial or ethnic origin (for equality monitoring), and health and disability information for reasonable adjustments and learner support, including mental health information where voluntarily disclosed. We process special category data only where we have obtained the learner's explicit consent, or where processing is necessary in the substantial public interest to provide education and training.

4.2 Prospective Learner Data

When someone enquires about our programmes, we collect name, email address, the course of interest, and any information provided voluntarily in the enquiry message. We retain prospective learner data for 12 months from the date of enquiry, after which it is securely deleted unless the individual has enrolled.

4.3 Website and Technical Data

When visitors use our website, we may collect IP address and browser type, pages visited and duration of visit, referral source, and cookie data (see Section 13). We measure how our website is read using our own software on our own server. It records the page, the day, the site that referred you and any campaign tag in the link. It does not store your IP address, and it does not place anything on your device. So that we can count visits rather than merely pages, your address and browser description are combined with a secret that changes every day and turned into a number that cannot be reversed; because the secret changes daily, the same reader cannot be recognised from one day to the next, by us or by anyone else. These records are deleted after thirteen months. We do not use Google Analytics or any other third party analytics service, and no measurement data about you leaves our server.

4.4 Data We Do Not Collect

In line with the data minimisation principle, our application form asks only for the information we genuinely need. In particular, we do not collect:

• National Insurance numbers
• Employment or income details (such as employer, job title or employment status)
• Payment card details (processed by a third-party payment provider, we do not store card data)
• Biometric data (we do not use fingerprint, facial recognition, or other biometric systems)
• CCTV recordings (we have no physical premises requiring CCTV)

5. How We Collect Personal Data

5.1 Directly from You

Most personal data is provided directly when you complete our online application or enquiry form, enrol on a qualification, upload identity documents, submit assignments or portfolios, communicate with staff, or complete feedback forms.

5.2 Automatically Through Platforms

Some data is collected automatically through VLE login records, assessment submission metadata, session recordings (with prior notice), and website cookies and analytics.

5.3 From Third Parties

In limited circumstances we receive data from the Learning Records Service (LRS) for ULN validation, from employers for work placement confirmation, and from the Disclosure and Barring Service (DBS) for staff checks.

6. Why We Process Your Data and Our Legal Basis

UK GDPR requires us to have a lawful basis for each purpose for which we process personal data.

7. Platforms and Third-Party Data Processors

Because we operate entirely online, we use third-party digital platforms to deliver our programmes. These providers process personal data on our behalf under written Data Processing Agreements (DPAs) and are contractually bound to process data only on our instructions.

Our website currently uses the following third-party services:

We review our platform register annually and update DPAs whenever we adopt a new platform. We will never allow a third-party processor to use your personal data for their own purposes.

Where you use our AI chatbot ("Talk to my AI"), the message content you type is transmitted to Anthropic PBC in the United States for processing under our Data Processing Agreement with Anthropic. Anthropic is a party to the EU-US Data Privacy Framework and equivalent UK arrangements, providing an adequate safeguard for the transfer of personal data. For details of Anthropic's own privacy practices, see their Privacy Policy at https://www.anthropic.com/legal/privacy.

The same safeguard covers the admissions assessment described in the table above: the application summary is transmitted to Anthropic PBC in the United States under the same Data Processing Agreement and the same adequacy arrangements. If you would prefer your application to be assessed without it, tell us when you apply and a member of staff will assess it directly; it will not delay or disadvantage your application.

8. Sharing Your Personal Data

We do not sell your personal data. We do not share your data with organisations for their own marketing or commercial purposes. We share personal data only in the following circumstances:

• With our platform providers, as described in Section 7, acting as data processors under DPAs.
• With employers (work placements), where a qualification includes a placement, with learner consent.
• In safeguarding situations, we may share data with local authority children's services, adult social care, or the police where necessary to protect life or prevent serious harm.
• With associate tutors, who are given access to learner data strictly necessary for their role, governed by their subcontractor agreement.
• Legal requirements, where required by law, court order, or formal law enforcement request.

9. International Data Transfers

We process and store personal data within the United Kingdom wherever possible. Where any of our platform providers transfer personal data outside the UK, we ensure adequate safeguards are in place, including UK adequacy decisions, Standard Contractual Clauses (SCCs), or Binding Corporate Rules (BCRs).

10. How Long We Keep Your Data

At the end of each retention period, personal data is securely deleted or anonymised.

If you register your interest with us instead of applying straight away, we process your details on the basis of your consent so we can contact you about the qualifications you are interested in and help you start your application when you are ready. You can withdraw that consent and ask us to delete your details at any time by contacting info@dataaischool.com. We keep interest registrations for 24 months from the date of registration if you do not enrol.

11. Your Rights Under UK GDPR

UK GDPR gives you significant rights over the personal data we hold about you. To exercise any of these rights, please contact our Data Protection Officer at dpo@dataaischool.com.

To exercise any right, send a written request to dpo@dataaischool.com including your full name, the email address associated with your account, and a clear description of the right you wish to exercise. We will respond within one calendar month.

12. How We Keep Your Data Secure

We implement robust technical and organisational measures to protect personal data, including:

• Access controls, role-based access ensures staff can only access data necessary for their role
• Multi-factor authentication (MFA), enforced on all accounts holding personal data
• Encryption, data in transit is protected by HTTPS/TLS; data at rest is encrypted on all platforms where available
• Cloud backups, automated daily backups to a secondary cloud location
• Data protection training, all staff complete training at induction and annually thereafter
• Data breach procedure, we notify the ICO within 72 hours of becoming aware of a notifiable breach (UK GDPR Article 33)

If you believe your personal data held by us has been compromised, contact our DPO at dpo@dataaischool.com immediately.

13. Cookies and Website Tracking

Cookies are small text files placed on your device when you visit a website. When you first visit our website, you will be shown a cookie consent banner. You can accept or decline non-essential cookies at any time using the Cookie Settings link in the footer.

You can also control cookies through your browser settings. Note that disabling strictly necessary cookies may affect your ability to use our website.

14. Marketing Communications

We will only send you marketing communications where you have given us your explicit consent. You can withdraw consent at any time by clicking the "unsubscribe" link in any marketing email, or by emailing privacy@dataaischool.com.

We do not share your contact details with other organisations for marketing purposes. We do not engage in cold calling or unsolicited SMS marketing.

15. Children's Data and Learners Under 18

Some of our programmes may be open to learners under the age of 18. Where we process personal data about a learner under 18, we apply additional safeguards:

• A parent or guardian must provide consent on behalf of learners under 13 for any data processing not strictly required by the qualification contract.
• Our safeguarding policy applies in full to all learners under 18.
• We do not use the personal data of learners under 18 for any marketing purpose.

16. Automated Decision-Making and Profiling

We do not use any automated system to make a legally significant decision about a learner or a member of staff without human involvement. All assessment decisions, support interventions, and qualification outcomes involve human review by qualified staff.

Every application is read by two AI assistants before it reaches a person: one assesses it against our published entry criteria, and a second independently re-assesses it and challenges the first. Both produce a written recommendation with the evidence they relied on, and both are recorded on your application.

Neither of them decides anything. Offers, rejections and requests for further information are issued only by the admissions manager, who sees both recommendations, may disagree with them, and is free to assess your application without reference to them. Because a human being makes every decision, this is not a decision based solely on automated processing within the meaning of Article 22 of the UK GDPR. You may still ask us how a recommendation was reached, ask for it to be reconsidered by a different member of staff, or object to the assessment being made this way, by contacting our DPO using the details in section 2.

We use VLE analytics to monitor learner engagement levels to identify learners who may be at risk of disengagement. However, this monitoring only informs human decisions, no automated action is taken without human review.

17. Special Situations

17.1 The Learning Records Service (LRS) and Unique Learner Numbers

All learners registered for a regulated qualification must have a Unique Learner Number (ULN), assigned by the Learning Records Service operated by the Department for Education (DfE). The LRS maintains a national record of qualification achievements.

17.2 Freedom of Information

The Data and AI School of London is a private training provider and is not a public authority for the purposes of the Freedom of Information Act 2000. All requests for information about our practices should be directed to our DPO.

18. Your Right to Complain

18.1 Complain to Us First

If you are unhappy with how we have handled your personal data, please contact our DPO in the first instance at dpo@dataaischool.com. We will investigate and respond promptly. For the full data protection complaints procedure including internal handling stages and timescales, see Section 6.10 of the DAIS-POL-006 Data Protection Policy.

18.2 Complain to the ICO

If you are not satisfied with our response, you have the right to make a complaint to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Online complaint form: ico.org.uk/make-a-complaint/

You should make a complaint to the ICO within three months of your last contact with us about the matter.

19. Changes to This Privacy Policy

We review this Privacy Policy at least annually, and also whenever there is a material change to the personal data we process, the platforms we use, or the applicable law. Where we make a material change, we will update the version number and date, publish the updated policy on our website, and notify currently enrolled learners by email.