Introduction

 

ATHE Academy is run by ATHE Ltd, which is an Ofqual regulated awarding organisation. For details about our background and activities see www.athe.co.uk/about and  www.athe.co.uk/athe-academy.

We value everyone who engages with us by whatever means, and we do all we can to fully protect your privacy and to make sure the personal data you provide to us is kept safe.

 

This Privacy Notice is designed to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act and is issued in the interests of transparency over how we use (“Process”) the Personal Data we collect. We also have specific Terms and Conditions for the use of our website, which you should read as well.

 

We treat all our stakeholders in line with our values, and we welcome any feedback about any of our actions.

 

Your Information

 

We collect personal information each time you deal with us, for example when you register learners, provide staff CVs, sign up for an event, provide comments, complete surveys, or otherwise provide your personal details

 

• When you visit our websites: We collect non-personal data such as IP addresses, details of pages visited, and files downloaded. Website usage information is collected using cookies (see the section on Cookies below). If you provide us with any personal data while using our website, we may use it to provide you with any information or services you have requested.

 

• Information from social media: We may collect information that you make available on social media, for example, Facebook, YouTube, and LinkedIn. You may wish to check their privacy policies to find out more about how they process your data.

 

• Other publicly available information: We may collect information from organisations such as Companies House, the Charity Commission, QAA, ISI, Ofqual, and Ofsted, as well as information published in articles, newspapers, or blogs.

 

• Sensitive Personal Data (Special Category Data): Where you provide the information, we may collect Special Category Data, which may include your religious beliefs, racial or ethnic origin, or your physical or mental health.

• ATHE Academy collects the following information upon sign up:

• Full name
• Email
• Date of birth
• Country
• If they are currently registered onto an ATHE qualification
• Title of qualification (if relevant)
• Title of centre (if relevant)
• Learner ID (If relevant)

 

The ATHE Academy team also has visibility on general activity metrics of the website via Google Analytics.What Do We Do with Your Personal Data?

 

We may use the personal data we collect to:

 

• Keep you up to date on news and stories about our work.
• Provide a personalised service, such as customised website content or personalised emails.
• Keep records of your relationship with us (e.g., questions you have asked, suggestions, or complaints you have made).
• Conduct market research to aid our understanding of our customers and their views.
• Comply with regulatory requirements as an Ofqual-regulated awarding organisation. We may use publicly available information such as newspaper articles, or information you have given permission to other organisations to share, such as LinkedIn

 

We reserve the right to remove access or deactivate accounts for non-payment or in cases where a student is misusing website communication tools.

Our legal basis for holding and processing your personal data

 

Under the UK GDPR, we must establish a lawful basis for processing your personal data. We rely on the following bases:

 

Consent: When you register for an ATHE Academy account, we may ask you to provide consent for specific processing activities where consent is the appropriate lawful basis. Where we rely on your consent, you can withdraw it at any time through the relevant privacy settings or by contacting us. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.

• Legitimate Interest & Recognised Legitimate Interests: We may process your personal data where it is necessary for our legitimate business interests (or those of a third party), provided your fundamental rights do not override those interests. This includes contacting existing centres/learners by post, telephone, or email regarding qualifications being delivered and related opportunities. We also rely on statutory Recognised Legitimate Interests where applicable for specific purposes such as security, safeguarding, crime prevention, and emergency response, without requiring a separate Legitimate Interests Assessment (LIA).
• Contractual Necessity: Processing necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract.
• Legal Obligation: Processing necessary to comply with our legal and regulatory duties (such as requirements set by Ofqual or statutory authorities).

Applications / Recruitments and Training Events.

 

Applying for a job with us: Where you provide personal and special category data when applying for a job, we will process, store, and disclose it to:

• Support the recruitment process and manage online applications/alerts.
• Answer any questions you may have.
• Use third parties to provide services such as references, qualification checks, criminal records/dbs checks, verification, health screening, and psychometric evaluations or skills tests.
• Provide anonymised data to monitor compliance with our equal opportunities policy.

 

Attending training events: Where you provide personal or special category data (such as dietary, mobility requirements, or health information) to attend training events, we will store, process, and disclose it to:

• Deliver the event safely, including disclosing necessary medical information to partners where required.
• Administer the event and handle feedback or queries.
• Monitor equal opportunities via anonymised data.

 

How and Where We Store Your Information

 

We will keep your personal information only for as long as necessary to carry out each activity, taking account of legal obligations, accounting and tax considerations, and statutory retention schedules. For example, sensitive medical information provided for overseas trips will be held for no longer than two years after the trip is completed.

 

 

 

If you have any questions, please contact our Data Protection Officer, Prisela Periera, in writing at ATHE Ltd, Suite 5a, Rosebery Court, Central Avenue, St Andrews Business Park, Norwich, NR7 0HS, UK, or via email at prisela.p@athe.co.uk.

How Safe Is the Personal Information We Hold?

 

We ensure appropriate technical and organisational controls are in place to protect your personal data, including encryption of online forms, robust network protection, and routine monitoring.

We ensure that access to personal data is restricted only to those staff members or associates whose job roles require such access and that suitable training is provided for these staff members and associates.

 

We may make limited use from time to time of external companies to collect or process personal data on our behalf. When we do so, we carry out checks on these companies, put in place contracts to make sure our requirements are clear, and carry out periodic reviews. When we do use external companies, we remain responsible for the storing and processing of your personal data.

 

However, we need to remind you that despite all our efforts, the internet cannot be guaranteed to be 100% secure, and that you submit data at your own risk.

 

Credit / Debit Card Security

 

We use third-party payment processors compliant with the Payment Card Industry Data Standard (PCI-DSS).

 

We do not store your debit or credit card details once a transaction is completed; card details are securely destroyed immediately.

 

Bank account details are held solely for the purpose of paying invoices to approved providers and associates

 

International Data Transfers

 

We use secure cloud-based systems to store and process personal data. Where personal data is transferred outside the UK (e.g., to cloud hosting services or international delivery partners):

 

• Transfers are made to countries covered by UK Adequacy Regulations.
• Where adequacy is not present, transfers are protected using ICO-approved contractual mechanisms, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses.
• Explicit consent will be sought if sensitive health data must be transferred overseas to support international travel or study programmes.

 

Third Parties and Data Processors

 

We engage vetted third-party service providers and external associates (such as External Quality Assurers and IT support).

• If you choose to use the ATHE Academy’s contact form functions—including ‘Contact University’, ‘Contact Centre’, or ‘Contact CPD Partner’—and provide your consent via the checkbox, your contact information and message content will be shared with the specific third-party provider you choose. These providers operate independently of ATHE Academy. Once your information is shared, they act as independent data controllers responsible for their own compliance and privacy practices.
• We engage vetted third-party service providers and external associates (such as IT support). All third-party processors are bound by legally compliant Data Processing Agreements requiring them to act only on our instructions and maintain robust security standards. We remain legally responsible for how these data processors handle your personal data on our behalf. Aggregated and anonymized user data may also be shared with third parties for analytical purposes.

Cookies and Tracking Technologies

 

Our website uses cookies and similar technologies to ensure core functionality and analyse website performance:

 

• Strictly Necessary Cookies: Essential for page navigation, secure logging, and processing online applications.
• Analytics & Performance Cookies: Help us understand site traffic and usage patterns (e.g., Google Analytics).
• Third-Party Media & Marketing Pixels: Embedded videos (YouTube/Vimeo) or social tracking tags (Meta) may set cookies to monitor content engagement.

 

Managing Cookies: Non-essential cookies are disabled by default under PECR guidelines and will only activate if you grant explicit consent via our site cookie banner. You can update or revoke your cookie choices at any time through your browser settings or the cookie preferences link on our site.

Children and Vulnerable Persons

 

In compliance with the UK Age-Appropriate Design Code (Children’s Code):

• We do not knowingly collect personal details from children under 13 without verified consent from a parent or legal guardian.
• Where materials are directed at young learners, clear parental consent controls are enforced prior to data collection.
• Information relating to vulnerable individuals is protected with heightened security and restricted access.

Your Data Protection Rights

 

Under UK data protection law, you hold the following rights:

• Right of Access: Request a copy of the personal information held about you (Subject Access Request) free of charge.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data where no legal ground exists for its retention.
• Right to Object / Restrict Processing: Object to direct marketing or request processing restrictions in certain circumstances.
• Right to Data Portability: Obtain and transfer your personal data in a structured, machine-readable format.

 

How to Contact Us & Direct Complaints Process

 

Updating Details or Exercising Rights

To update your preferences, request access, or tell us to stop processing your data, contact our team:

• Telephone: +44 (0)1603 760030
• Email: support@athe.co.uk
• Post: ATHE Ltd, Suite 5a, Rosebery Court, Central Avenue, St Andrews Business Park, Norwich, NR7 0HS, UK

 

Direct Complaint Right

 

You have a legal right to submit a data protection complaint directly to ATHE before escalating matters externally. You can contact our Data Protection Officer, Prisela Periera, in writing at the postal address above or via email at prisela.p@athe.co.uk. We will acknowledge, log, and investigate your complaint promptly.

 

If you remain unsatisfied with our response, you retain the statutory right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: https://ico.org.uk
• Helpline: 0303 123 1113

 

Changes to this Policy

 

This Privacy Notice was last revised in September 2026. Any significant operational or legislative updates will be communicated clearly on our website or via direct correspondence.

 

Feedback

 

We welcome feedback or questions on this policy or on any of our actions by

• Calling us on: +44 (0)1603 760030
• Email us on: atheacademy@athe.co.uk
• Write to us at: ATHE Ltd, Suite 5a, Rosebery Court, Central Avenue, St Andrews Business Park, Norwich NR7 0HS

 

*Disclaimer: these T&Cs are pending post-Beta finalisation.