Privacy notice

1. Who we are

Sector 3 Group Ltd ("Sector 3", "we", "us") is a company registered in England and Wales (company number 16566947) and is registered with the Information Commissioner's Office (ICO registration number ZC039177).

Contact for all data protection matters: info@sector3group.co.uk.

2. Our role

The Digital Training Centre is provided to training organisations (our "customers"), such as Babcock International. Our role depends on the data:

If you are a learner and want to exercise your rights over your training records, please contact your training organisation. If you contact us, we will pass your request to them promptly.

3. What personal data is processed

• Account data: name, work email address, role (instructor, IQA or administrator), sign-in times.
• Course records: course dates and venue, instructor names, learner names, practical and theory assessment results, skills-station records, referral information, signatures entered by trainers, and photographs of course paperwork (registers, exam papers and feedback forms).
• CPD records: teaching, assessment and learning activity recorded by instructors.
• Learner feedback: ratings and comments; contact details only if the learner chooses to give them.
• Support tickets: your name, email, the message you send, and technical details to help us fix the problem (the screen you were on, the course reference, and your device and browser type).
• Technical data: our hosting providers keep standard server logs (such as IP addresses) for security and reliability.

We do not ask for special category data (such as health information). The app does not use advertising, tracking or analytics cookies, and we do not sell or share personal data for marketing.

4. Why we use it and our lawful basis

• Delivering the service for our customers — processed under our contract with them and on their instructions; the customer determines its own lawful basis (typically contract or legitimate interests in recording and evidencing training).
• Accounts and security — to let authorised staff sign in and to protect the service (legitimate interests; contract).
• Support tickets — to respond to and resolve your request (legitimate interests).
• Legal obligations — where we must keep or disclose information by law.

5. Where data is stored and who helps us

We use a small number of carefully selected service providers ("sub-processors") to run the service. Each processes personal data only on our instructions and is bound by a written data processing agreement with appropriate security requirements. They fall into these categories:

• Secure cloud hosting — the database, sign-in system and file storage for course records and photographs. This data is stored in the United Kingdom.
• Email delivery — sending sign-in, invitation, password-reset and support-ticket emails.
• Website and content delivery — hosting the app's program files and delivering fonts and software components. No course records are stored with these providers, though, like any website, they may process technical information such as IP addresses.

Some of these providers are based, or have staff or support operations, outside the UK. Where personal data may be accessed from outside the UK, we make sure it is protected by UK adequacy regulations or by the ICO's International Data Transfer Agreement or Addendum.

A full list of our sub-processors is provided to our customers as part of our data processing agreement and is available on request. We tell customers before we add or replace a sub-processor.

Some information is also kept on the iPad or device being used (for example, a course in progress and photographs awaiting upload), so the app can work without a signal. Signing out removes the user's records from that device.

6. How we protect it

• Data is encrypted in transit and at rest.
• Every user has their own login; public sign-up is disabled.
• Instructors can only see their own courses; quality assurance and administrator users have read-only access across the organisation.
• Administrator accounts are protected by multi-factor authentication, and access is removed when staff leave.
• Staff who handle data have completed data protection (GDPR) training and follow our written data protection and information security policies.
• The database is backed up daily.

7. How long we keep it

• Course, account and CPD records: for as long as the customer has an active subscription, or shorter if the customer asks us to delete records earlier.
• At the end of a subscription: we give the customer written notice before deletion and, on request, provide a full copy of their data. We then permanently delete it from live systems; any copies in backups expire within the backup cycle (up to 7 days). We confirm deletion in writing.
• Support tickets: up to 2 years after the ticket is closed, then deleted.

8. Your rights

Under UK data protection law you have rights to: be informed; access your data; have it corrected; have it erased; restrict or object to its use; and data portability (in some circumstances). For course and learner records, please contact your training organisation, who controls that data — we will help them respond. For anything we control, contact us at info@sector3group.co.uk. We respond within one month.

9. If something goes wrong

If a personal data breach occurs, we inform the affected customer without undue delay (and within 24 hours of becoming aware) so they can meet their legal duty to report to the ICO within 72 hours where required. Where we are the controller, we report to the ICO ourselves.

10. Complaints

Please contact us first at info@sector3group.co.uk so we can try to help. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint · 0303 123 1113.

11. Changes to this notice

We review this notice at least once a year. The version and date at the top show when it last changed; significant changes will be communicated to customers.