Privacy Policy and Learner Privacy Notice
Last updated: 18 September 2026
In short
We are a training provider. We collect personal information from people who enquire about our courses, from learners who take them, and from the organisations that buy training for their staff. We use it to run the training and to meet the requirements of the awarding body that certificates the qualification. We do not sell it. This notice tells you what we hold, why, for how long, and what you can do about it.
Who we are
Obsidian Arc Training Ltd is the data controller for the information described in this notice.
Company number 17401446
We are a separate legal entity from Obsidian Arc Ltd (company number 16436270). Where the two companies share a system or a member of staff, we say so in this notice.
Who this notice covers
- Enquirers — people who contact us or complete a form on our website
- Learners — people enrolled on, or who have completed, a course with us
- Employer and corporate clients — the people we deal with at organisations that buy training
- Suppliers, associates and freelance tutors
- Job applicants
It does not cover our own employees, who receive a separate notice.
What we collect and why
3.1 Enquirers
| What | Why | Lawful basis |
| Name, email address, telephone number, organisation, job role | To respond to your enquiry | Legitimate interests — responding to a request you made |
| Sector (investigator, corporate risk, compliance, | To understand demand and design | Legitimate interests — |
| HR, fraud, public sector, service leaver, close protection, critical national infrastructure and protective security) | courses for the right audience. We report on this internally in aggregate | understanding our market |
| How you found us, pages visited, campaign | To understand which of our | Legitimate interests, and |
| source | marketing works | consent where cookies are involved — see our Cookie Policy |
| Anything else you choose to tell us in a free-text field | To answer you properly | Legitimate interests |
If we ask to keep you on a list for course announcements, that is consent, and you can withdraw it at any time usingthe unsubscribe link in any email or by writing to us. Withdrawing it does not affect anything we did before you withdrew it.
3.2 Learners
| What | Why | Lawful basis |
| Name, date of birth, contact details, address | To register you with the awarding body and to identify you correctly on a certificate | Contract, and legal obligation |
| Proof of identity | To confirm you are who you say you are before certification | Contract, and legitimate interests — preventing certification fraud |
| Confirmation that you are 18 or over | Our courses have a minimum age of 18 | Contract, and legitimate interests |
| Initial assessment results, prior learning and qualifications, literacy and digital skills check | To confirm the qualification is appropriate for you and that you can achieve at Level 3, as the qualification specification requires | Contract, and legal obligation arising from our awarding body agreement |
| Attendance, participation, coursework, assessment evidence, assessor and internal quality assurance decisions, appeals, certification records | To deliver, assess and quality assure the qualification | Contract, and legal obligation |
| Learner agreement and declarations | To evidence the terms you accepted | Contract |
| Fee and payment records | To take payment and meet our accounting duties | Contract, and legal obligation |
| Feedback you give us | To improve what we do | Legitimate interests |
3.3 Special category and other sensitive information
We ask for health, disability or learning difficulty information only where you tell us you need a reasonable adjustment or a special consideration, and only so much of it as we need to make that adjustment or to support an application to the awarding body. Where we process it, we rely on:
- Article 9(2)(b) UK GDPR and Part 1 of Schedule 1 to the Data Protection Act 2018, where the processing is necessary in connection with our obligations in the field of employment or social protection; or
- Article 9(2)(g) UK GDPR and paragraph 8 of Part 2 of Schedule 1 to the Data Protection Act 2018, equality of opportunity or treatment, where the processing is necessary to identify or review the existence or absence of equality of opportunity between groups of people.
We hold a written appropriate policy document covering this processing, as Schedule 1 requires. It is available on request.
We may also collect equality monitoring information — for example ethnicity or disability — where the awarding body or a funding body requires it. Where we do, providing it is optional, it is held separately from your learning record, and it is reported only in aggregate.
We do not ask for, and you should not send us, information about your security clearance, vetting status, operational role, case work, or any protectively marked or classified material. If you send it to us anyway, we will delete it.
3.4 What we do not do
- We do not sell personal information.
- We do not use automated decision-making that produces legal or similarly significant effects about you. Assessment decisions are made by qualified human assessors and quality assured by human internal quality assurers.
- We do not knowingly collect information about anyone under 18. Our minimum age for enrolment is 18. If you believe we hold information about a child, tell us and we will delete it.
- We do not use the open source research techniques we teach to build profiles of enquirers, learners or applicants.
Who we share it with
| Who | What | Why |
| NOCN (the awarding organisation) | Learner registration details, assessment and certification records | NOCN awards the qualification. It registers learners, allocates certificates and quality assures our delivery through an allocated External Quality Assurer. NOCN is a separate data controller for the purposes for which it uses your information, and its own privacy notice applies to that use |
| Ofqual and, where relevant, other regulators | Records relating to regulated qualifications, on request | Statutory regulation of the qualification |
| Your employer or sponsor, where they are paying for your course | Enrolment confirmation, attendance, and completion or certification outcome | Contract with the employer. We tell you at enrolment exactly what will be reported back. We do not share assessment detail, feedback or personal circumstances with an employer without your consent |
| Our tutors, assessors and internal quality assurers, including freelancers | Only what each of them needs to do their job | Contract. All are bound by written confidentiality and data protection terms |
| Our technology suppliers — including our CRM and marketing platform, our email and file storage provider, our website host and our payment processor | Contact and transaction data | Running the business. They act as our processors under written contract and may not use your information for their own purposes |
| Our professional advisers — accountants, insurers, lawyers | As needed | Legitimate interests, and legal obligation |
| Law enforcement or a regulator | As required | Legal obligation |
| A buyer, if we sell or reorganise the business | As needed | Legitimate interests |
If we are admitted to the Apprenticeship Provider and Assessment Register in future, or deliver publicly funded training, we will share learner data with the relevant government department and funding body, and we will update this notice before we do.
Where your information is held
Our primary systems are hosted in the United Kingdom or the European Economic Area wherever we can arrange it.
Some of our suppliers — including our CRM and marketing platform — process data in the United States. Where information is transferred outside the UK, we rely on one of the following:
- UK adequacy regulations, including the UK-US Data Bridge where the recipient is certified under it; or
- the International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, supported by a transfer risk assessment.
You can ask us for details of the safeguards applying to any particular transfer.
How long we keep it
| Record | Period | Why |
| Enquiry where you do not go on to book | 24 months from last contact, then deleted | Long enough for a normal buying cycle in our market |
| Marketing consent record | For as long as consent is live, plus 24 months | To evidence consent |
| Learner registration and certification record | At least 7 years from certification | Learners need certificates replaced, employers verify them, and the awarding body may audit |
| Assessment evidence, internal quality assurance records, appeals and malpractice records | For the period required by the NOCN Quality Assurance Manual and our centre agreement, and in any event no less than 3 years | Awarding body requirement. The exact period is to be confirmed with NOCN in writing before publication |
| Reasonable adjustment and special consideration records | For the life of the learning record, then deleted with it | Evidence that the adjustment was properly made |
| Financial and transaction records | 6 years from the end of the accounting period | Companies Act 2006 and HMRC |
| Complaints and appeals | 6 years from closure | Limitation periods |
| Unsuccessful job applications | 6 months | Employment tribunal time limits, plus a margin |
| Website and CRM activity data | 26 months | Marketing analysis |
When a period ends we delete the record or anonymise it so that it can no longer identify you.
How we keep it safe
We hold Cyber Essentials certification across the Obsidian Arc group. In practical terms we use access control on a need-to-know basis, multi-factor authentication on business systems, encryption in transit and at rest on our main platforms, managed devices, staff training, and written contracts with every supplier who touches personal data. We keep a record of security incidents and we will tell you, and the ICO, where the law requires it.
No system is perfect. If you think your information has been compromised, tell us immediately.
Your rights
Under UK data protection law you have the right to:
- be informed about how we use your information — this notice;
- access a copy of the information we hold about you;
- rectification of information that is inaccurate or incomplete;
- erasure of information, in certain circumstances;
- restrict our processing, in certain circumstances;
- data portability for information you gave us, where we process it by consent or under a contract and by automated means;
- object to processing based on legitimate interests, and to direct marketing at any time and without giving a reason;
- withdraw consent at any time, where we rely on consent.
Some of these rights are qualified. In particular, we cannot delete an assessment or certification record while the awarding body requires us to hold it, because we are under a legal obligation to keep it.
To exercise a right, write to [email protected]. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you if we do. There is no charge unless a request is manifestly unfounded or excessive.
We may ask you to confirm your identity before we act. That is to protect you, not to delay you.
Complaints
You have a statutory right to complain to us directly about how we handle your personal data. This is a right under section 164A of the Data Protection Act 2018, which took effect on 19 June 2026.
To complain, write to [email protected], marking it “Data protection complaint”. You can also complain by post or by telephone, and we will accept a complaint however it reaches us.
We will:
- acknowledge your complaint within 30 days of receiving it;
- take appropriate steps to investigate and respond without undue delay;
- tell you the outcome.
If you are not satisfied, you can complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk — telephone 0303 123 1113. We would rather you came to us first, but you do not have to.
Complaints about the qualification itself — an assessment decision, a certification delay, a centre process — are handled under our Complaints Policy and Appeals Policy, and may be escalated to NOCN and, ultimately, to Ofqual. Those are separate routes from a data protection complaint and are set out in the learner handbook.
Cookies
See our separate Cookie Policy.
Changes to this notice
We review this notice at least annually and whenever our processing changes materially. The version number and date at the head of the document tell you which version you are reading. Where a change affects you significantly, we will tell you directly rather than relying on you to check.