Qualhub Loading

Privacy Policy

PRIVACY NOTICE

Qualhub Limited — how we collect, use, store and protect personal data

1. Who we are and what this notice covers

Qualhub Limited (company number 09913170, registered office 36 Scotts Road, Bromley, England, BR1 3QD) ("Qualhub", "we", "us") provides a platform and services for the delivery, invigilation and administration of examinations and assessments, including qualifications linked to Security Industry Authority (SIA) licensing.

We deliver these services through a single system called Smartclass, which candidates use through a mobile app and which trainers, centres, invigilators and examination inspectors use through our web portals.

Our role, and Get Licensed

Most candidates come to us through Get Licensed Limited, with whom their course was booked, and Smartclass is operated on shared infrastructure with Get Licensed. Which of us is responsible for what depends on the purpose:

  • Get Licensed is the controller of your booking, payment and customer records, and of the course you purchased.
  • Qualhub is the controller where an awarding organisation, the SIA or the law places the duty on us directly — verifying your identity at the examination, running the examination and handling the result, examination integrity and malpractice investigation, and retaining assessment evidence for audit.
  • Qualhub is also the controller of the personal data we hold about the training centre contacts, trainers, invigilators and inspectors we deal with directly (sections 3 to 5).
  • Where we process personal data on Get Licensed's instructions in order to deliver services it has engaged us to provide, Get Licensed is the controller and we act as its processor.

Get Licensed and Qualhub have an arrangement between them setting out their respective responsibilities under data protection law. You may raise any request or concern with either of us, and we will make sure it reaches the right one.

If you have any questions about this notice or your data, or wish to exercise any of your rights, contact us at: support@qualhub.org.

This notice explains how we handle personal data for each of the groups we work with. Section 2 applies to candidates and learners, section 3 to training centres, section 4 to trainers, and section 5 to invigilators and examination inspectors. Sections 6 to 12 apply to everyone.

2. Candidates and learners

What we collect

When you enrol on a course or sit an examination or assessment through our platform, we collect and hold: your name, date of birth and contact details; a photograph of you taken for identification purposes; details of the identity documents checked before your examination; your signed learner declarations; attendance records; your assessment and examination answers, results and any logbooks or portfolios; evidence of language competency or first aid certification where your qualification requires it; any exemption or recognition of prior learning evidence you provide; records of any suspected malpractice investigation; a video recording of your practical assessment, which we are required to take (see below); and technical data generated by your use of the platform and the Smartclass mobile app (such as login records).

Where this information comes from. We collect some of it directly from you, including through the Smartclass mobile app. We receive the rest — including your booking, enrolment and contact details — from Get Licensed, with whom you booked your course, and from the training centre delivering it.

Your photograph. You upload your own photograph through the Smartclass app while you are at your training, or your trainer uploads it for you through our portal. It is used to confirm your identity and forms part of the candidate identity record we are required to produce, which is provided to the awarding organisation for your qualification. We do not use facial recognition or any other automated matching of your photograph, and we do not use it for any purpose other than confirming who sat the examination.

Access arrangements and health information. If you request reasonable adjustments or access arrangements for an examination, or a medical exemption, we may need to process limited health information. We only use it to provide the adjustment or assess the exemption, we ask for no more than is needed, and we treat it as special category data under UK GDPR, processed with your explicit consent or as otherwise permitted by law. We do not decide your application. We prepare it and submit it to the awarding organisation with your supporting evidence, and the awarding organisation approves or refuses it. We then arrange whatever has been approved. If your application is refused, you may appeal to the awarding organisation, and we will explain how.

What you have to give us. You must provide identity documents and a photograph, and sign the learner declarations, before you can be assessed. We are required to check and record these by the SIA and by the awarding organisation for your qualification. If you do not provide them we cannot allow you to sit the examination and your qualification cannot be certified.

Learners aged 16 and 17. An SIA licence can only be held from the age of 18. Candidates under 18 taking a CCTV or security guarding qualification are exempt from the SIA requirement to have their practical assessment video recorded, and we record their assessment in writing instead. We will only make a recording if the candidate agrees, and they are free to refuse without it affecting their assessment. Where a candidate is under 18 we take particular care over what we collect and how long we keep it.

Why we use it, and our lawful basis

  • To register you for examinations and assessments, verify your identity, run the examination, send your answers to the awarding organisation, record and communicate the result it issues, and support the issue of certificates (lawful bases: performance of a contract, and legitimate interests in administering examinations for the training centre and awarding organisation involved in your course).
  • To meet the requirements of the SIA and awarding organisations for licence-linked qualifications, including identity checking, attendance recording, retention of assessment evidence, and cooperation with audits and malpractice investigations (lawful bases: legal obligation and legitimate interests in maintaining the integrity of regulated qualifications).
  • To prevent, detect and investigate examination malpractice (lawful basis: legitimate interests).
  • To tell you your result and keep you informed about your course and examination, by email and by WhatsApp message (lawful basis: performance of a contract). These are service messages about your own examination, not marketing.

How long we keep it

Because SIA licence-linked qualifications are subject to audit, we retain learner records — including identity check records, attendance records, learner declarations and assessment evidence — for three years from the date of your assessment, in line with SIA and awarding organisation requirements. We are required by the SIA to video record practical assessments, except where the candidate is under 18. Those recordings are retained for one year. We keep records for longer only where an awarding organisation or the SIA requires it, or where they are needed for a live complaint, investigation, claim or legal proceedings. Records are securely deleted once they are no longer required.

3. Training centres

Most of the information we hold about training centres is business information about the organisation. However, we also hold personal data about centre staff and contacts: names, job titles, work contact details, records of approvals, correspondence, and records of centre visits, audits and compliance findings which may identify individuals.

We use this information to approve and manage centres, schedule and coordinate examinations, monitor compliance with SIA, awarding organisation and Qualhub requirements, and investigate any concerns (lawful bases: performance of a contract, legal obligation, and legitimate interests in running and quality-assuring our services). Centre records, including audit and compliance records, are retained for three years for audit purposes, and records relating to contracts and payments for six years, in line with tax and legal record-keeping requirements.

4. Trainers

For trainers delivering courses connected with our platform, we collect and hold: your name and contact details; your qualifications and evidence that you meet trainer requirements for the courses you deliver; continuing professional development (CPD) records; records of the courses and cohorts you have delivered; quality assurance and monitoring records; and correspondence with you.

We use this information to confirm you meet SIA and awarding organisation requirements for delivering licence-linked training, to coordinate course delivery and examinations, and for quality assurance and audit (lawful bases: performance of a contract, legal obligation, and legitimate interests). Trainer qualification and CPD records are retained for three years for audit purposes; records relating to contracts and payments are retained for six years.

5. Invigilators and examination inspectors

For invigilators and inspectors engaged by Qualhub, we collect and hold: your name, address and contact details; evidence of your right to work in the UK; your Unique Taxpayer Reference (UTR) and bank details; records of assignments offered, accepted and completed; invoices and payment records; training and induction records, including the induction record you sign; and correspondence with you.

Criminal convictions. Before your first assignment, and if your circumstances change, you are required to tell us about any unspent criminal conviction relevant to the integrity of examinations, and to complete any declaration an awarding organisation requires. This is criminal offence data under Article 10 of the UK GDPR. We process it because it is necessary for preventing or detecting unlawful acts and for the integrity of regulated qualifications, relying on the substantial public interest conditions in Part 2 of Schedule 1 to the Data Protection Act 2018. We hold an Appropriate Policy Document, as that Act requires, explaining how we comply and how long we keep this data; a copy is available on request. Declarations are held separately, with access restricted to those who need it, and are not used for any other purpose.

We use this information to offer and manage assignments, pay your invoices and administer your engagement (lawful basis: performance of a contract); to check your right to work and keep tax and accounting records (lawful basis: legal obligation); and to schedule and run examinations securely and deal with any complaints or disputes (lawful basis: legitimate interests). You are required to provide certain information (such as right-to-work evidence and your UTR) as a condition of your agreement with us; without it, we cannot offer you assignments. We keep invigilator records for the duration of your engagement and for six years afterwards, in line with tax and legal record-keeping requirements.

6. Where your data is held, and how it is protected

Our systems are hosted with Amazon Web Services and Google Cloud. Our servers and our live database are in Frankfurt, Germany; our testing database is in Ireland; and our file storage is in London and Frankfurt. Backups are taken daily.

Germany and Ireland are in the European Economic Area, which the United Kingdom recognises as providing an adequate level of protection, so your data remains subject to equivalent safeguards.

Some of our personnel are based outside the United Kingdom, in Pakistan, where part of our operations and system development is carried out, and they may access personal data in order to provide and maintain our services. They are bound by the same confidentiality and security obligations as our UK personnel, access is limited to what each role requires, and appropriate safeguards are in place for that access.

We protect personal data with appropriate technical and organisational measures, including encryption in transit, role-based access controls so that staff, invigilators and centres can only see the data they need, secure backups, and staff confidentiality obligations. Paper records, where they exist (such as attendance registers and learner declarations), are transferred to us securely and stored securely until digitised or destroyed.

Where we do transfer personal data outside the United Kingdom or the European Economic Area, we do so only with legally recognised safeguards in place, such as an adequacy decision, the International Data Transfer Agreement, or the UK Addendum to the standard contractual clauses.

7. Who we share personal data with

We share personal data only where necessary, and only with:

  • Get Licensed Limited, in connection with the courses and candidates it introduces — for booking and scheduling, results and certification, quality assurance and complaint handling, and so that it can audit our records under our agreement with it;
  • the awarding organisations for the qualifications concerned, including Laser Learning Awards, for certification, candidate identity records, standardisation and malpractice investigations. Awarding organisations decide for themselves how they use the data we send them, and their own privacy notices apply;
  • the SIA and other regulators, where required in connection with licence-linked qualifications, audits or investigations;
  • the training centre and trainer involved in a candidate's course, and the invigilator conducting the examination (each limited to what they need for that course or examination);
  • examination venues (limited to names and identification);
  • the operator of the examination system we use to mark and return results, XAMS;
  • WhatsApp (Meta Platforms Ireland Limited) and our email provider, where we message you about your examination or result;
  • our hosting and infrastructure providers, Amazon Web Services and Google, and our other IT, professional advisory, accountancy and payment service providers, who act under contract and on our instructions;
  • our insurers and insurance brokers, and any loss adjuster or solicitor they instruct, in connection with a claim or a possible claim;
  • and HMRC, law enforcement or other authorities where required by law.

Anyone who enters a valid certificate number into our certificate verification page can confirm whether a certificate is genuine and see the certificate number, the candidate's name, the date of issue, the course and course date, the centre, the location and the trainer. It shows nothing else, and it cannot be searched by name.

We do not sell personal data to anyone.

8. Your rights

Under UK data protection law you have the right to: request access to a copy of your personal data; have inaccurate data corrected; have your data erased in certain circumstances (note that we cannot erase records we are required to keep for SIA, awarding organisation or tax purposes while the required retention period is running); restrict or object to how we use your data, including the right to object to processing based on our legitimate interests; data portability; and, where processing is based on your consent, withdraw that consent at any time. To exercise any right, contact us at the address in section 1. We will respond within one month. If your request is complex, or you have made several requests, we may extend that by up to two further months; we will tell you within the first month if we need to, and why. Where Get Licensed rather than Qualhub is the controller of the data you are asking about, we will pass your request to Get Licensed and confirm to you that we have done so.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113, although we would welcome the chance to address your concerns first.

9. How your examination result is decided

Your multiple-choice examination is set and marked by the awarding organisation for your qualification. We deliver it through Smartclass. Marking is automatic: your answers are compared against the mark scheme set by the awarding organisation, the number of correct answers is counted, and the pass mark for that qualification is applied. No member of our staff marks your paper by hand.

Your practical assessment is assessed by the trainer delivering your course, and the outcome is then confirmed by the awarding organisation.

We record the result we receive and notify you by email and by WhatsApp message. We do not decide your result and we cannot change it. We can ask the awarding organisation to correct, replace or reissue a result or certificate — after a re-sit, or where a certificate has been lost — but the decision is theirs.

Because your result affects whether you can obtain a licence, you have the right to ask for a person to look at it. Tell us and we will check everything on our side: your identity and registration records, your attendance, the session record, and whether the result we received was recorded and passed on correctly. Where the challenge is to the marking itself, we refer it to the awarding organisation on your behalf, with your grounds and our records attached. You may also use that organisation's own appeals and enquiries-about-results process directly, and we will explain it on request. Our Appeals Policy sets out the timescales for each step, which is available on request.

We do not otherwise use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

10. Cookies and our website

Our website and platform use only cookies and similar technologies that are strictly necessary to sign you in, keep your session secure and remember your settings. We do not use analytics, advertising or session-recording tools, and we do not track you across other websites. Because we use only strictly necessary technologies, we do not ask for your consent to them; if that changes, we will ask before anything non-essential is used.

11. If something goes wrong

We have procedures for dealing with any suspected personal data breach. Where a breach is likely to result in a risk to people's rights and freedoms we report it to the Information Commissioner's Office without undue delay and, where the law requires, within 72 hours; where the risk is high, we will tell the individuals affected. If you believe your data has been lost, disclosed or misused, please tell us straight away using the contact details in section 1.

12. Changes to this notice

This notice was published on 18 September 2026 and is the version currently in force. It replaces the Qualhub privacy policy dated 20 June 2024, which it supersedes in full. We may update it from time to time; the latest version will always be available at qualhub.org/privacy and at the link provided with your agreement. We keep dated copies of previous versions and will provide one on request.