Privacy Policy

Effective Date: 17 July 2025
Last updated: 22 June 2026
Reviewed Annually

Functional Skills UK Limited ("we", "us", "our") is committed to protecting and respecting your privacy, and to complying with the Data Protection Act 2018 and the UK GDPR (General Data Protection Regulation).

This policy explains what data we collect, how and why we use it, how we keep it secure, and what rights you have.

1. Who We Are

Functional Skills UK Ltd is the data controller for all personal data you provide to us. We determine the purposes for which and the manner in which your data is processed. We are registered with the Information Commissioner's Office (ICO), registration number Z9810793.

We have appointed a Data Protection Officer (DPO) who oversees compliance with this policy.

2. What Data We Collect

The data we collect depends on your relationship with us, but may include:

General Information

• Full name, date of birth, gender, address, email, and telephone number
• National Insurance number and passport or other ID
• Records of prior attainment or qualifications
• Employment or benefit status (if applicable)
• Booking and payment records when you buy a course — the courses booked, the amount paid, your billing address, and a payment reference from Stripe (we never see or store your card number)
• Technical information collected automatically when you contact us through the website, including your IP address and browser/device information, which we use for security and to prevent spam and abuse

Sensitive Data

In some cases, particularly for funded learners, we are required to collect Special Category Data:

• Ethnicity (for DFE reporting)
• Health or additional needs (to provide support or make adjustments)
• Disability status
• In some instances, information about criminal convictions or safeguarding disclosures

We only collect this data when necessary and will always inform you why it's required.

We also provide a "report a concern" safeguarding form on our website, which anyone can use not only funded learners. Because you choose what to write, a concern may contain special category data (such as information about health or someone's wellbeing) and information about criminal offences. We collect this to safeguard learners and others at risk. You may submit a concern anonymously; if you do, we do not ask for your name or contact details, but for security our systems still record the IP address the report was sent from.

3. Legal Basis for Processing

We only process your data when there is a lawful basis for doing so, such as:

• Consent: You have given explicit permission (e.g. marketing or enrolment follow-up)
• Contractual Obligation: Processing is required to deliver a course or service you've requested
• Legal Obligation: We're required to collect certain information by funding bodies or law
• Legitimate Interest: We may process minimal data to improve services, evaluate outcomes, or ensure learner safety
• Safeguarding & Substantial Public Interest: For special category data and information about criminal offences (for example in safeguarding concerns or funding records), we rely on the safeguarding and substantial-public-interest conditions in the Data Protection Act 2018 (Schedule 1)

4. How We Use Your Data

We use your personal information for the following:

• Enrolling you on a course and maintaining academic records
• Verifying funding eligibility and meeting DFE or other government requirements
• Contacting you about course details, changes, or support
• Providing reports to referral partners (e.g. the Department for Work and Pensions) where required
• Sending updates on courses or qualifications you may be eligible for (if you've consented)

You will never be automatically enrolled in marketing unless you opt in, and you can unsubscribe at any time.

5. How We Protect Your Data

Our core learner and booking records are held in a secure database hosted in the UK/EU(Amazon Web Services, London region). Only trained Functional Skills UK staff access your data, and all our data-handling practices follow strict data processing agreements in line with UK GDPR. As explained in section 9, some of the service providers we rely on operate outside the UK and EU — see "International transfers" below.

Our hosting and software providers, including Amazon Web Services and our learner-records provider, are contractually bound by data protection requirements.

We maintain physical, digital, and managerial safeguards to prevent data misuse, loss, or unauthorised access.

6. How Long We Keep Your Data

We only retain data for as long as it is legally or operationally required. This may vary depending on the nature of the course or funding body involved.

We regularly audit and review our data retention schedules to ensure compliance with legal, funding, and regulatory obligations.

7. Cookies and Tracking

We use cookies to enhance user experience, support live chat, and process payments securely. For full details of every cookie we place, the categories they fall into, and how to manage your consent, please see our Cookie Policy.

Cookies we use may include:

• Functional cookies — needed for the site to work
• Statistics cookies — to help us understand how the site is used and improve it
• Marketing cookies — to support advertising and course promotions

Cookies are managed via our consent banner when you visit the site. You may change your settings at any time.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data when no longer needed
• Object to certain types of processing
• Withdraw consent at any time (for consent-based processing)
• Transfer your data to another provider
• File a complaint with the ICO if you believe your data is being mishandled

If you request deletion of your data, we will comply unless we are legally obligated to retain it. Please note that for security and to meet our legal and financial obligations we keep secure change-history logs and finance records for a limited period, so some information may be retained for a while after a live record is deleted.

9. Data Sharing

We do not sell your personal data, and we never will. We do share it with organisations that help us deliver our courses and run the website (our "processors"), and where we are legally required to. The main recipients are:

• Stripe — to take payment and prevent fraud (name, email, phone, billing address and amount)
• Our course platforms (FLIP and Flow) — to enrol you and keep your learning record (name, contact details, date of birth and, for commercial bookings, gender and billing address)
• Google — website analytics (Google Analytics) and advertising measurement (Google Ads), only after you accept cookies
• Amplitude — product analytics, where enabled and only after you accept cookies
• OpenWidget (Text, Inc.) — to run our live-chat widget
• Google Workspace / Gmail — to send and receive our emails, including booking confirmations, enquiries and safeguarding reports
• Amazon Web Services — to host our database and website files
• Sentry — error monitoring that may incidentally include technical data if something goes wrong
• An embedded postcode checker (Lovable) on our eligibility page, which receives the postcode you enter
• Government and funding bodies (e.g. the Department for Education), referral partners (e.g. the DWP or an employment support service), and commercial employers who book on your behalf — where applicable
• Any third party where we are required to share by law

We do not sell personal data to any third party under any circumstance.

9.1 International transfers

Some of the providers above are based outside the UK and the European Economic Area, including in the United States (for example Stripe's group, Google, Amplitude, OpenWidget and Sentry). Where your data is transferred outside the UK/EEA, we rely on appropriate safeguards — such as UK "adequacy" regulations, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum — to keep your data protected.

10. Safeguarding and Special Considerations

In some cases, especially when working with vulnerable adults or young people, safeguarding information may be collected. We follow strict protocols to ensure data is:

• Only handled by relevant safeguarding staff
• Stored securely with access control
• Only shared when legally required (e.g. for safeguarding referrals or DBS compliance)

11. Changes to This Policy

This Privacy Policy is reviewed annually and may be updated as required. If significant changes are made, we will notify you via email or display a notice on our website.

If you have any questions or need to exercise your rights under this policy, please contact us at info@functionalskillsuk.com.