Privacy Policy

SkillGuardian ("we", "us", "our") is the data controller for personal data collected through the Platform. We are registered in England and Wales.

Our data protection contact is: support@skillguardian.co.uk

We collect personal data in the following categories:

We do not knowingly collect special category data (health, biometric, etc.) unless explicitly provided by you or your organisation in the context of training records, in which case it is processed under Article 9(2)(b) UK GDPR (employment / social security obligations) or your explicit consent.

• Directly from you: when you register, complete courses, submit contact forms, or communicate with us.
• From your employer / organisation: when an organisation administrator creates or manages your account.
• Automatically: through cookies and similar tracking technologies when you use the Platform (see Section 11).

Under the UK GDPR, we rely on the following lawful bases to process your personal data:

• To create and manage your user account and organisation profile.
• To deliver training content, track course progress, record assessment results, and issue completion certificates.
• To send you notifications about expiring training, platform updates, and service messages.
• To generate compliance reports and analytics for organisation administrators.
• To respond to enquiries submitted via our contact form or email.
• To process subscription payments and manage billing.
• To detect, investigate, and prevent fraud or security incidents.
• To fulfil our legal obligations, including retaining records as required under applicable UK legislation.
• With your consent, to send marketing communications about new features, courses, and offers. You may withdraw consent at any time.

We do not sell, rent, or trade your personal data. We may share it with:

• Your organisation's administrators: who may view your training records, competency status, and certificates within the Platform.
• Service providers: who process data on our behalf under Data Processing Agreements (e.g. cloud hosting, payment processing, email delivery). These providers are contractually required to protect your data and may not use it for their own purposes.
• Law enforcement or regulators: where required by law, court order, or to protect the rights and safety of individuals.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with appropriate safeguards.

We aim to keep personal data within the UK and the European Economic Area (EEA). Where any transfer outside these areas is necessary, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or equivalent adequacy decisions, in accordance with Chapter V of the UK GDPR.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

• Active account data: retained for the duration of your subscription plus 6 years (limitation period for contract claims under the Limitation Act 1980).
• Training and certificate records: retained for a minimum of 7 years from the date of completion to support regulatory audit requirements.
• Contact form submissions: retained for 2 years.
• Usage/technical logs: retained for up to 12 months.

When data is no longer required it is securely deleted or anonymised in accordance with our Data Retention Policy.

You have the following rights in relation to your personal data. To exercise any of them, contact us at support@skillguardian.co.uk. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113, although we encourage you to contact us first so we can address your concern directly.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These include:

• Encryption of data in transit (TLS) and at rest.
• Role-based access controls and audit logging.
• Regular security assessments and penetration testing.
• Staff training on data protection and information security.
• Incident response procedures in accordance with ICO guidance.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, inform you without undue delay.

We use cookies and similar technologies to operate the Platform and improve your experience. Cookies are small text files stored on your device.

You can control non-essential cookies through your browser settings. Blocking cookies may affect Platform functionality.

The Platform is not directed at children under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately.

The Platform may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes we will notify you by email or by a prominent notice on the Platform at least 14 days before the changes take effect. The "last updated" date at the top of this page will always reflect the most recent version.

For any questions, concerns, or to exercise your data protection rights, please contact: