0117 314 2800
Login to epaPRO Logo epaPRO logo green
Privacy policy

Version: 7.0 – Last updated: 07/10/2025

 

Innovate Awarding is committed to protecting your personal data. This Privacy Policy explains how and why we use your personal data, your rights, and how you remain in control of your information.

 

We will only process your personal data fairly, lawfully and transparently, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

 

1. Contact details

If you have any questions about this policy or how we use your personal data, please contact our Data Protection Officer (DPO):

 

  • Email: dataprotectionofficer@Innovateawarding.org
  • Post: Data Protection Officer, Innovate Awarding, 291 Paintworks, Arnos Vale, Bristol, BS4 3AW
  • Telephone: 0117 314 2800 (Mon–Fri:  08:30am–5pm)

You may also contact the Information Commissioner’s Office (ICO) if you are not satisfied with our response (see section 14).

 

2. About us

 

Innovate Awarding is a private limited company, Company No. 7212507, registered in the UK.

 

For the purposes of data protection law, we are the Data Controller (ICO Registration No. ZA027909).

 

3. What information do we collect?

 

We collect data you give to us. This includes information you give when undertaking a qualification or apprenticeship with one of our partner training/employer providers, or when you work for us as a consultant, or communicating with us.

 

We collect the following categories of personal data:

 

  • Personal details: name, date of birth, email, address, telephone number, education history.
  • Special category data: ethnicity, additional learning needs (only where required by law or to provide support).
  • Financial information: Payment information such as credit/debit card or direct debit details of bank account details.
  • Marketing preferences: opt-in/opt-out choices.

 

We may also receive data from other organisations – for example, if we are partnering with another organisation (e.g. training providers and employers).

 

4. Legal bases for processing

 

We only process your personal data when we have a lawful basis. The main bases we rely on are:

 

  • Contract: to deliver the contracted service (your apprenticeship and qualification assessment).
  • Legal obligation: to meet regulatory and funding requirements (e.g., Ofqual reporting).
  • Consent: for optional marketing communications or processing sensitive data where required.
  • Vital interests: to protect your health and safety.
  • Legitimate interests: for administrative purposes, service improvement, and security (balanced against your rights).

 

Where we process special category data (e.g., ethnicity, learning needs), we do so under Article 9(2)(b) UK GDPR (employment, social security and social protection law) or with your explicit consent.

 

5. How we use your data

 

We use personal data to:

 

  • Deliver apprenticeship and qualification assessment services to learners and apprentices; perform our obligations under apprenticeship and training contracts.
  • Maintain databases of our learners and their educational progress.
  • Process payment for our services (e.g. direct debits or card payments).
  • Provide additional learning support.
  • Manage funding, compliance and reporting obligations.
  • Send marketing communications (only if you have opted in).
  • Analyse and improve our services.
  • Keep our sites and systems secure.

 

We do not sell your personal data.

 

6. Automated decision-making and AI

 

Innovate Awarding does not use AI software to mark your assessments. If automated decision-making is used in the future, this will be reflected in an updated Privacy Policy which will be available here. Furthermore, if Innovate Awarding decides to use automated decision-making in the future, the following controls will be in place:

 

  • A human will review outcomes where appropriate.
  • You have the right to request that decisions are reviewed by a person.
  • You may also object to automated decision-making.

 

Please note that, whilst we do not use AI or automated-decision-making during the apprenticeship and qualification assessment process itself, some of our third-party providers do use these features for support purposes.

 

For example:

 

  • Turnitin LLC. This product is used to check for plagiarism in submitted work. This is not a decision-making tool but is used to support the service we provide. However, before any final decisions are made, the outcome is always reviewed by a human.
  • Surpass uses automated processing to mark our multiple-choice questions (MCQs) in the system. This is an industry standard, used by other awarding organisations. Learners are not able to opt out of this, but they may appeal a mark, if necessary. All appeals will be reviewed by a human.

 

Please contact the DPO if you wish to exercise these rights.

 

7. Children and young people

 

As an apprenticeship and qualification assessment organisation, we regularly process personal data relating to young people, including those under the age of 18. If the child is under 18, we will seek permission from the parent or legal guardian before engaging in audio-visual communications to ensure that their personal data is adequately protected.

 

8. Sharing your data

 

We only share your data where necessary to deliver our services, with:

 

  • Funding bodies, regulators and government agencies (where legally required).
  • Service providers (e.g., IT, cloud hosting, assessment platforms).
  • External assessors, exam boards, or awarding bodies.
  • Marketing service providers (only if you have opted in).

 

All third-party processors are bound by contracts that require them to keep your information secure and confidential.

 

We share personal data with the following organisations who provide services to us:

 

Data Processor

Purpose of Processing

Location of Data

Backupify

Back-up solution for Lifetime’s Microsoft 365 data

Processed and hosted in the UK.

BTL (Surpass)

On-screen testing

Processed and hosted in the EEA.

Delaware

Provider of advanced ICT solutions and services to Lifetime with access to Lifetime's personal data.

Data is hosted in Microsoft CRM in UK based data centres.

Forsta

Surveying of learners on programme for quality purposes

Data is processed mainly in the UK and EU but may also be processed in Bosnia, Australia and Singapore

Gordon Associates (Monarch)

Compliance software provider

Processed and hosted in the UK.

Meazure Learning*

Remote proctoring (invigilation) software and service.

Data hosted in the USA.

Microsoft

Data analysis, business intelligence and data forecasting; cloud computing environment.

Data hosted in Microsoft Azure data centres in the UK.

Microsoft

Microsoft 365, including Office and Copilot.

Microsoft Data Centres in London, Durham and Cardiff; data may be replicated to Data Centres in the EU (e.g. Amsterdam) for resilience

Nutcracker Agency

Managing marketing campaigns for Innovate Awarding.

Processed and hosted in Microsoft’s UK Data Centres.

Portico Consulting (Quartz)

AO management system

Processed and hosted in the UK.

Positive Internet

Servers for epaPRO

Processed and hosted in the UK

SCC Ltd

Managed service provider and UK Hosted Data Centre for Lifetime Training

Hosted in Birmingham, UK. Some processing takes place in Romania (EU).

Skilltech Solutions (epaPRO)

Apprenticeship assessment management platform

Processed and hosted in the UK.

TalkDesk

Call centre function

Processed and hosted in the EU / EEA.

Thinkology

Third-party IT website support for Lifetime Training

Does not routinely process personal data but will have access to personal data in the course of its role supporting Innovate Awarding.

Turnitin LLC

Online tool used to check academic integrity by checking for instances of plagiarism in student work.

Data is processed and stored in the EU, US, and Asia Pacific regions to accommodate customer needs. Turnitin is  part of the EU - US Data Privacy Framework and uses Standard Contractual Clauses to protect data being sent outside of  the EEA, Switzerland and UK.

 

*Meazure Learning is a company that provides a remote proctoring (invigilation) service enabling learners/apprentices to take on-demand tests either at home or in their workplace with a “Proctor” who is online with them for the duration of the test. Meazure Learning is based in the US and has proctors based in Mexico, the Philippines, Jamaica and India.

 

International transfers: Some providers store data outside the UK/EEA (e.g., USA). Where this occurs, we use the UK International Data Transfer Agreement (IDTA) or other approved safeguards to protect your data.

How long we keep your data

 

We keep personal data only for as long as necessary. Typical retention periods are:

  • Learner records: 6 years after completion of training (to comply with funding regulations).
  • Accident/incident records: 3 years (or longer if involving a minor).
  • Marketing contact details: Until you withdraw consent.*

 

After retention periods, data is securely deleted or anonymised.

 

*If you withdraw consent for marketing, we will retain minimal details on file for the purposes of ensuring that unwanted marketing communications are not sent to you and for associated reporting purposes. This information will be retained for 6 years.

 

Marketing

 

We will only send you marketing communications if you have opted in. You can change your preferences or withdraw consent at any time by contacting us or using the unsubscribe option in our communications.

 

You can unsubscribe from any advertising by emailing hello@innovateawarding.org

 

Cookies and online tracking

 

We use cookies and similar technologies to:

 

  • Ensure our website functions properly.
  • Analyse usage (Google Analytics).
  • Provide personalised advertising (Google Ads, LinkedIn).

 

You can manage your cookie preferences here: https://innovateawarding.org/privacy-settings/

 

Security

 

We use appropriate technical and organisational measures to keep your data safe, including:

 

  • Encryption, access controls, and secure hosting.
  • Regular staff training on data protection.
  • Compliance with information security standards such as ISO/IEC 27001 and Cyber Essentials Plus.
  • Third-party supplier due diligence measures, including security questionnaires and Data Protection Impact Assessments (DPIAs).

 

Your rights

 

You have the following rights under UK GDPR:

 

  • Access – to request a copy of the data we hold about you.
  • Rectification – to correct inaccurate or incomplete data.
  • Erasure – to request deletion of your data (subject to legal obligations).
  • Restriction – to limit how we use your data.
  • Data portability – to receive your data in a portable format.
  • Objection – to object to processing based on legitimate interests or marketing.
  • Rights in relation to automated decision-making – to request human review.

 

To exercise any of these rights, please contact our DPO.

 

Complaints

 

If you are unhappy with how we handle your personal data, please contact our DPO in the first instance.
If you remain dissatisfied, you can complain to the ICO:

 

  • Website: www.ico.org.uk
  • Telephone: 0303 123 1113
  • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

 

Changes to this policy

 

We may update this Privacy Policy from time to time. The most recent version will always be available on our website.