Privacy Notice

1. Introduction

The Data and AI School of London (referred to in this policy as "the school", "we", "us", or "our") is committed to protecting the privacy and personal data of all individuals who interact with us. This includes learners enrolled on our programmes, prospective learners who enquire about our courses, staff and associate tutors, and any other person whose data we process in the course of our operations.

We deliver our qualifications entirely online. As a result, the personal data we collect is processed digitally across a range of platforms and cloud-based services. We recognise that this creates specific data protection obligations, and we take those obligations very seriously.

This Privacy Notice explains:

• who we are and how to contact us
• what personal data we collect and why
• the legal basis on which we process your data
• how long we keep your data
• who we share your data with
• your rights under UK data protection law
• how to make a complaint or exercise your rights

This Privacy Notice explains how The Data and AI School of London processes the personal data of website visitors, prospective learners, and applicants. For our full internal Data Protection Policy governing all centre operations including enrolled learners, staff, and assessment records, see the DAIS-POL-006 Data Protection Policy.

2. Who We Are

2.1 Data Controller

The Data and AI School of London is the data controller for all personal data processed in connection with our qualifications, services, and website.

2.2 ICO Registration

We are registered with the Information Commissioner's Office (ICO) as required by the Data Protection Act 2018. Our ICO registration number is ZC086597. You can verify our registration at the ICO register of fee payers.

3. Legal Framework

This policy and all of our data processing activities comply with the following legislation:

4. The Personal Data We Collect

We collect only the data that is necessary for the purposes described in this policy.

4.1 Learner Data

Identity and Contact Data

• Title, full name, date of birth, gender, email address, phone number, home address (town or city and postcode)
• Photographic identity (passport or driving licence, for identity verification)
• Unique Learner Number (ULN), assigned by the Learning Records Service
• Emergency contact details (the name, relationship and contact details of a person you nominate). Where you provide these, please make sure that person is aware we hold their details for this limited purpose.

Equality and Diversity Monitoring Data

• Ethnic background, disability or health status, and any access requirements or reasonable adjustments
• Provided voluntarily and used only to monitor equality of opportunity and to arrange learner support. You may choose "prefer not to say" for any of these.

Enrolment and Qualification Data

• Qualification enrolled on and units registered
• Entry requirements evidence (prior qualifications, transcripts)
• Application form responses, enrolment date, qualification completion status and certification records

Learning and Assessment Data

• Assessment submissions (assignments, projects, code repositories, portfolios)
• Assessment grades, feedback, and quality assurance records
• Originality check reports (e.g. Turnitin similarity scores)
• Recognition of Prior Learning (RPL) evidence and decisions
• Reasonable adjustment and special consideration applications and outcomes

Engagement and Platform Data

• VLE login activity, last access dates, and content completion records
• Assessment submission timestamps
• Messages sent through the VLE messaging system
• Attendance records for live online sessions

Special Category Data (Sensitive Data)

We may process information about your racial or ethnic origin (for equality monitoring), and health and disability information for reasonable adjustments and learner support, including mental health information where voluntarily disclosed. We process special category data only where we have obtained the learner's explicit consent, or where processing is necessary in the substantial public interest to provide education and training.

4.2 Prospective Learner Data

When someone enquires about our programmes, we collect name, email address, the course of interest, and any information provided voluntarily in the enquiry message. We retain prospective learner data for 12 months from the date of enquiry, after which it is securely deleted unless the individual has enrolled.

4.3 Website and Technical Data

When visitors use our website, we may collect IP address and browser type, pages visited and duration of visit, referral source, and cookie data (see Section 13). We measure how our website is read using our own software on our own server. It records the page, the day, the site that referred you and any campaign tag in the link. It does not store your IP address, and it does not place anything on your device. So that we can count visits rather than merely pages, your address and browser description are combined with a secret that changes every day and turned into a number that cannot be reversed; because the secret changes daily, the same reader cannot be recognised from one day to the next, by us or by anyone else. These records are deleted after thirteen months. We do not use Google Analytics or any other third party analytics service, and no measurement data about you leaves our server.

4.4 Data We Do Not Collect

In line with the data minimisation principle, our application form asks only for the information we genuinely need. In particular, we do not collect:

• National Insurance numbers
• Employment or income details (such as employer, job title or employment status)
• Payment card details (processed by a third-party payment provider, we do not store card data)
• Biometric data (we do not use fingerprint, facial recognition, or other biometric systems)
• CCTV recordings (we have no physical premises requiring CCTV)

5. How We Collect Personal Data

5.1 Directly from You

Most personal data is provided directly when you complete our online application or enquiry form, enrol on a qualification, upload identity documents, submit assignments or portfolios, communicate with staff, or complete feedback forms.

If you contact us by telephone, through the chat on our website, on WhatsApp, or by replying to an email we sent you, we record your enquiry so that somebody can answer it and so that it is not lost. We keep the name you give, the telephone number or email address you contacted us from, and a short summary of what you asked. The lawful basis is Article 6(1)(f), our legitimate interest in answering people who get in touch. Contacting us is not consent to marketing. We send marketing only to people who have separately asked for it, and you can ask us to stop at any time.

Telephone calls are answered by an automated assistant and what is said is converted to text so that we can act on your enquiry and check the quality of the answers you were given. Callers are told this at the start of the call. Outside office hours you can leave a voicemail, which is recorded.

Calls to our office number are recorded. The greeting tells you so before you say anything. The recording covers the whole call, including the part after you are put through to a member of staff. We record so that we can check the quality of the answers people are given and so that what was agreed on a call is not lost. The lawful basis is Article 6(1)(f), our legitimate interest in running the telephone line properly and answering accurately. Recordings are kept for six months and then deleted. They are held by our telephony provider, Twilio, and not copied into our own systems. If you would rather not be recorded, email info@dataaischool.com and we will answer in writing. Chat and WhatsApp conversations are kept in our own systems; WhatsApp messages are carried by Twilio and by WhatsApp (Meta), who can see their content while they are being delivered.

If you happen to mention a health condition, a learning need or a disability while enquiring, that is used only to support you. It is never sent to our marketing system and never used to decide what to advertise to you.

5.2 Automatically Through Platforms

Some data is collected automatically through VLE login records, assessment submission metadata, session recordings (with prior notice), and website cookies and analytics.

5.3 From Third Parties

In limited circumstances we receive data from the Learning Records Service (LRS) for ULN validation, from employers for work placement confirmation, and from the Disclosure and Barring Service (DBS) for staff checks.

6. Why We Process Your Data and Our Legal Basis

UK GDPR requires us to have a lawful basis for each purpose for which we process personal data.

7. Platforms and Third-Party Data Processors

Because we operate entirely online, we use third-party digital platforms to deliver our programmes. These providers process personal data on our behalf under written Data Processing Agreements (DPAs) and are contractually bound to process data only on our instructions.

We use the following third-party services across our website, our telephone line, our WhatsApp number, our payment process and our learning platform. Where a service only receives your data if you choose to use it, that is said in the table.

Our website currently uses the following third-party services:

If you telephone us, your call is answered by an automated assistant. The greeting tells you so at the start of the call. What you say is transcribed into text so the assistant can understand it, and we keep that transcript, together with your telephone number, so that a member of staff can pick up where the call left off and so we can see where the assistant is not helping people well enough. You can ask to speak to a person at any point and the call will be transferred. If you would rather not speak to an automated assistant at all, email info@dataaischool.com and we will telephone you back.

WhatsApp messages are handled the same way: an assistant answers, a member of staff can step in, and we keep the conversation so we can follow it up.

We review our platform register annually and update DPAs whenever we adopt a new platform. We will never allow a third-party processor to use your personal data for their own purposes.

Transcription of telephone calls, and the speaking of replies, take place outside the United Kingdom. Deepgram and ElevenLabs are established in the United States, and Twilio carries our calls and messages. On the telephone line both are engaged through Twilio rather than contracted directly by us. Twilio's data protection addendum applies to our account and covers its sub-processors, and transfers out of the United Kingdom are made under the International Data Transfer Addendum issued by the Information Commissioner. Where you use the microphone in the website chat, ElevenLabs receives that audio directly from us, and we are completing the transfer safeguard for that use under Article 46 of the UK GDPR. If you would prefer that your voice is not processed outside the United Kingdom, do not use the telephone line or the microphone button; email info@dataaischool.com instead and we will reply in writing.

Where you use our AI chatbot ("Talk to our AI"), the message content you type is transmitted to Anthropic PBC in the United States for processing under our Data Processing Agreement with Anthropic. Anthropic is not certified under the UK Extension to the EU-US Data Privacy Framework. The transfer is therefore made under Article 46 of the UK GDPR and is safeguarded by the Standard Contractual Clauses incorporated into Anthropic's Data Processing Addendum, together with the International Data Transfer Addendum issued by the Information Commissioner under section 119A of the Data Protection Act 2018. The evidence for this arrangement is held at DAIS-PROC-001. For details of Anthropic's own privacy practices, see their Privacy Policy at https://www.anthropic.com/legal/privacy.

The same safeguard covers the admissions assessment described in the table above: the application summary is transmitted to Anthropic PBC in the United States under the same Data Processing Agreement and the same Article 46 safeguards. If you would prefer your application to be assessed without it, tell us when you apply and a member of staff will assess it directly; it will not delay or disadvantage your application.

8. Sharing Your Personal Data

We do not sell your personal data. We do not share your data with organisations for their own marketing or commercial purposes. We share personal data only in the following circumstances:

• With NCFE, our awarding organisation. To register you as a candidate and to have your qualification awarded and certificated, we share the details NCFE requires for registration, including your name, date of birth, gender, postcode, country and your Unique Learner Number where you have one, together with your assessment outcomes. We cannot enter you for a qualification without this.
• With Ofqual and, where you have a Unique Learner Number, the Learning Records Service operated by the Department for Education. Ofqual regulates the qualifications and may require information as part of that role. The Learning Records Service records your achievement against your Unique Learner Number.
• With our platform providers, as described in Section 7, acting as data processors under DPAs.
• With employers (work placements), where a qualification includes a placement, with learner consent.
• In safeguarding situations, we may share data with local authority children's services, adult social care, or the police where necessary to protect life or prevent serious harm.
• With associate tutors, who are given access to learner data strictly necessary for their role, governed by their subcontractor agreement.
• Legal requirements, where required by law, court order, or formal law enforcement request.

9. International Data Transfers

We process and store personal data within the United Kingdom wherever possible. Where any of our platform providers transfer personal data outside the UK, we ensure adequate safeguards are in place, including UK adequacy decisions, Standard Contractual Clauses (SCCs), or Binding Corporate Rules (BCRs).

From 28 September 2026 this includes Turnitin, which checks submitted coursework for similarity and processes it in the United States. The copy kept there for matching sits in a repository private to this school. Turnitin is the processor and we are the controller, under a data processing agreement that forms part of our contract with them. The transfer to the United States is covered by the UK Extension to the EU-US Data Privacy Framework. This is a decision by the UK government that personal data sent to a certified United States company is protected to a standard equivalent to UK law. Turnitin, LLC holds that certification, we checked it on the public register on 24 September 2026, and we check again before each renewal, the next being due in January 2027. If it ever lapsed, the standard contractual clauses in our agreement with Turnitin would apply instead.

10. How Long We Keep Your Data

At the end of each retention period, personal data is securely deleted or anonymised.

If you register your interest with us instead of applying straight away, we process your details on the basis of your consent so we can contact you about the qualifications you are interested in and help you start your application when you are ready. You can withdraw that consent and ask us to delete your details at any time by contacting info@dataaischool.com. We keep interest registrations for 24 months from the date of registration if you do not enrol.

11. Your Rights Under UK GDPR

UK GDPR gives you significant rights over the personal data we hold about you. To exercise any of these rights, please contact our Data Protection Officer at dpo@dataaischool.com.

To exercise any right, send a written request to dpo@dataaischool.com including your full name, the email address associated with your account, and a clear description of the right you wish to exercise. We will respond within one calendar month.

12. How We Keep Your Data Secure

We implement robust technical and organisational measures to protect personal data, including:

• Access controls, role-based access ensures staff can only access data necessary for their role
• Multi-factor authentication (MFA), enforced on all accounts holding personal data
• Encryption, data in transit is protected by HTTPS/TLS; data at rest is encrypted on all platforms where available
• Cloud backups, automated daily backups to a secondary cloud location
• Data protection training, all staff complete training at induction and annually thereafter
• Data breach procedure, we notify the ICO within 72 hours of becoming aware of a notifiable breach (UK GDPR Article 33)

If you believe your personal data held by us has been compromised, contact our DPO at dpo@dataaischool.com immediately.

13. Cookies and Website Tracking

Cookies are small text files placed on your device when you visit a website. When you first visit our website, you will be shown a cookie consent banner. You can accept or decline non-essential cookies at any time using the Cookie Settings link in the footer.

You can also control cookies through your browser settings. Note that disabling strictly necessary cookies may affect your ability to use our website.

14. Marketing Communications

We will only send you marketing communications where you have given us your explicit consent. You can withdraw consent at any time by clicking the "unsubscribe" link in any marketing email, or by emailing privacy@dataaischool.com.

We do not share your contact details with other organisations for marketing purposes. We do not engage in cold calling or unsolicited SMS marketing.

15. Children's Data and Learners Under 18

Some of our programmes may be open to learners under the age of 18. Where we process personal data about a learner under 18, we apply additional safeguards:

• A parent or guardian must provide consent on behalf of learners under 13 for any data processing not strictly required by the qualification contract.
• Our safeguarding policy applies in full to all learners under 18.
• We do not use the personal data of learners under 18 for any marketing purpose.

16. Automated Decision-Making and Profiling

We do not use any automated system to make a legally significant decision about a learner or a member of staff without human involvement. All assessment decisions, support interventions, and qualification outcomes involve human review by qualified staff.

Every application is read by two AI assistants before it reaches a person: one assesses it against our published entry criteria, and a second independently re-assesses it and challenges the first. Both produce a written recommendation with the evidence they relied on, and both are recorded on your application.

Neither of them decides anything. Offers, rejections and requests for further information are issued only by the admissions manager, who sees both recommendations, may disagree with them, and is free to assess your application without reference to them. Because a human being makes every decision, this is not a decision based solely on automated processing within the meaning of Article 22 of the UK GDPR. You may still ask us how a recommendation was reached, ask for it to be reconsidered by a different member of staff, or object to the assessment being made this way, by contacting our DPO using the details in section 2.

We use VLE analytics to monitor learner engagement levels to identify learners who may be at risk of disengagement. However, this monitoring only informs human decisions, no automated action is taken without human review.

17. Special Situations

17.1 The Learning Records Service (LRS) and Unique Learner Numbers

All learners registered for a regulated qualification must have a Unique Learner Number (ULN), assigned by the Learning Records Service operated by the Department for Education (DfE). The LRS maintains a national record of qualification achievements.

17.2 Freedom of Information

The Data and AI School of London is a private training provider and is not a public authority for the purposes of the Freedom of Information Act 2000. All requests for information about our practices should be directed to our DPO.

18. Your Right to Complain

18.1 Complain to Us First

If you are unhappy with how we have handled your personal data, please contact our DPO in the first instance at dpo@dataaischool.com. We will investigate and respond promptly. For the full data protection complaints procedure including internal handling stages and timescales, see Section 6.10 of the DAIS-POL-006 Data Protection Policy.

18.2 Complain to the ICO

If you are not satisfied with our response, you have the right to make a complaint to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Online complaint form: ico.org.uk/make-a-complaint/

You should make a complaint to the ICO within three months of your last contact with us about the matter.

19. Changes to This Privacy Notice

We review this Privacy Notice at least annually, and also whenever there is a material change to the personal data we process, the platforms we use, or the applicable law. Where we make a material change, we will update the version number and date, publish the updated policy on our website, and notify currently enrolled learners by email.