Section 1   Introduction

1.1  Scope of the policy

This policy applies to all individuals who may have personal data stored with DNA Skills. Please read this Policy carefully, as it contains important information about what information we collect, how and why we do so, how we process and protect this data after collection, your rights in relation to your personal data and how to contact us and / or the appropriate external authorities in the event that you wish to report a concern about the way in which we process your data. The term 'apprentice' used in this policy refers to registered apprentices with DNA Skills who attend end-point assessment events.

This policy should be read alongside our organisational policies and procedures including:

  • Cookie Policy
  • Data Protection and GDPR Policy

1.2  Purpose of the policy

DNA Skills, part of the SCL Education Group, is committed to the security and fair processing of personal and/or sensitive data. At all times we aim to respect personal information that you share with us, or that we receive from others, and keep it safe. This privacy policy explains what data we collect and how we process it thereafter in accordance with applicable data protection law, in particular the General Data Protection Regulation (EU) 2016/679 (GDPR).

1.3  A shared responsibility

Where appropriate it is important that all approved staff within a centre who are involved in the processing of personal data are made aware of this policy and its range of possible outcomes, should they fail to comply with DNA Skills requirements as described above.

1.4  Reviewing the policy

We will review this policy regularly and where otherwise necessary and may revise it as required in response to the findings of any review.

Section 2    What information do we collect?

Under the terms of the GDPR, DNA Skills is considered the ‘controller’ of data that individuals or companies provide us.

Information that we may collect is listed below:

Personal Data

Data that you provide us with when working with us is collected. This information includes information that you will provide our partner training providers with when you undertake an apprenticeship. For example:

  • Personal and contact details (name, date of birth, email, address, telephone etc.);
  • Data classified as Sensitive Personal Data (ethnicity, additional learning needs);
  • Financial information (payment information such as credit/debit card or direct debit details or bank account details).
  • Marketing and Communications Data, such as preferences about receiving communications from us or third parties.
  • Technical information such as IP addresses, login data, browser information, time zone, browser plug-ins, operating systems, platforms and other technology on the device used to access the website.

Information from your relationship with DNA Skills or other organisations

When you become involved with DNA Skills this will result in some personal data being created, such as details of apprenticeships/training that have been undertaken.

Personal data is also sometimes received about individuals from other organisations, such as, partner training providers/employers (for example, if you have completed a functional skills qualification with a different provider, and we need that additional information as evidence of completion).

From time to time, we may also use other organisations to help us conduct research and analysis on personal data, in turn, resulting in new personal data being created.

Sensitive Personal Data

Information classified as ‘Sensitive Personal Data’ may be collected by DNA Skills, such as ethnicity or additional learning needs. We will only carry this out where we have been asked to do so by official Government agencies, or where the information is needed for the assessment of additional educational support needs, or reasonable assessment adjustment. If we do so, we will take extra care to ensure your personal data is protected.

Accidents or incidents

If an accident or incident occurs in one of our assessment locations or office, and/or involving one of our employees, then we are required to keep a formal record of this, (which may include sensitive personal data.

Section 3    How do we collect personal information?

Data is either sent directly to us via means such as email and online services (e.g. learner registration uploads in Creatiogreen, our online registration system) or collected automatically via out website (e.g. items such as IP address and browser type). To find out more about the website data that is collected automatically, please see our Cookie Policy.

It is very important for individuals that are undertaking an EPA with DNA Skills to know that certain elements of their personal data will typically need to be shared with us via their training provider or employer, in order for us to deliver the relevant service.

Wherever personal information is shared with us by anyone other than the person whose information we are collecting (the ‘data subject’), it is the responsibility of the third party to ensure that the data subject is fully aware that their information will be shared with us and has obtained their consent for this to happen prior to their information being shared. In this context, DNA Skills is the ‘data processor’, rather than the controller. For example, a training provider/employer ensuring that an apprentice has consented to their personal information being shared with us during their sign-up registration.

Section 4    What do we use your personal information for?

At DNA Skills we only ever use personal data with your consent, or where it is necessary to:

  • Enter into, or perform, a contract with you.
  • Comply with a legal duty.
  • Protect your vital interests.

By doing so it means that we are keeping you safe from harm or for (or a third party’s) lawful interests, provided your rights do not override these. We will only use your information for the purpose or purposes it was collected for.

End-Point Assessments

Your personal information will be used to:

  • Register you as an apprentice on our Creatiogreen system for examination administration purposes and to enable us to carry out assessments and issue results.
  • Ensure that we comply with Ofqual’s or any other regulatory body’s General Conditions of Recognition or equivalent documentation.


We use personal data for administrative purposes, and this includes:

  • Receiving payment (e.g. direct debits, payment card details or bank details)
  • Maintaining databases of our apprentices through the EPA process
  • Performing our obligations under provider contracts
  • Helping us respect your choices and preferences (e.g., if you ask not to receive marketing material, we will keep a record of this)
  • Answer your questions/requests and communicate with you in general 

Analysis and research 

DNA Skills may carry out research and analysis on the data that we hold in our Creatiogreen system, to determine success rates of end-point assessments, understand behaviours and identify patterns and trends. 

To help us to ensure that communications are relevant and timely to our customers we profile them in terms of their interaction with our website and resources that are downloaded. This allows us to keep information on preferences and send material that you are most likely to be interest in.

We will also obtain information about you from other sources, such as partner training providers and employers as previously described.


We use personal data to communicate with people and to promote DNA Skills. This includes keeping you up to date with our news and offerings.

Section 5    Who will we share your personal information with?

We will take all reasonable steps to ensure that our staff protect your personal data and are aware of the information security obligations. We limit access to your personal data to those who have a genuine business need to know it.

We will never sell your personal information. We may disclose and share your personal information with:

  • Regulatory bodies ensuring compliance with Conditions of Recognition or other equivalent documentation. We also share aggregated achievement data with regulatory bodies such as Ofqual.
  • Relevant third parties (such as your training provider/employer, service suppliers or law enforcement agencies) if we reasonably believe that you may be in breach of the law, or if required to do so in accordance with applicable law.
  • Consultants and/or professional experts whose remit specifically requires access to personal data.

Sometimes we use third parties to process information on our behalf. If we do so, we require these third parties to comply strictly with our privacy guidelines.

When we transfer your data, we will:

  • Always share it in a secure way
  • Make sure it is treated consistently within our privacy promise
  • Never allow other companies to use it to contact you with their own marketing 

Where personal data needs to be transferred to countries outside of the European Economic Area (‘EEA’), we will take appropriate steps to ensure your personal information is afforded the same level of protection as described in this Policy.

Section 6    How do we protect and store your personal data?

We use a variety of physical and technical measures to keep your data safe and to prevent unauthorised access or sharing of your personal information. 

Electronic data and databases are stored on secure computer systems and we control who has access to information using both physical and electronic means. Our employees receive data protection training and we have a set of detailed data protection procedures which personnel are required to follow when handling personal data.

DNA Skill’s operations are based in the UK and we store our data within the EEA. We will never process or store personal information outside of the EEA.


Section 7    What are your rights?

The GDPR outlines various rights that a data subject has with regard to their personal data. Please see a summary below:

  • The “Right to be informed”: individuals must be made aware of how and why their personal data is collected. In providing the Policy, DNA Skills meets this requirement
  •  The “Right of access”: individuals can request access to copies of their personal data in order to verify that it is being processed in a lawful and correct way
  • The “Right to rectification”: individuals can request that inaccurate personal data is corrected (or completed if it is incomplete)
  • The “Right to erasure”: under certain circumstances, an individual can request that their personal data is deleted (e.g. if they wish to unsubscribe from receiving marketing communications and also have their contact details completely deleted from our systems. This would be possible, provided there was no legitimate ongoing reason for us to retain their details)  
  • The “Right to restrict process”: under certain circumstances an individual can request the suppression of their personal data (e.g. allowing us to continue holding their data, but pausing all processing of that data whilst they seek to verify that it is accurate and / or being processed lawfully)
  • The “Right to portability”: under certain circumstances, an individual can request that their personal data is electronically transferred from us to another data controller
  • The “Right to object”: under certain circumstances, an individual can object to the way in which their data is being processed (for example, if they believe that we do not have legitimate grounds for collecting and processing certain information about them). If the objection is upheld, we are required to stop processing that information.

If you wish to exercise any of these rights, or raise a data protection issue with us, please find the appropriate contact details below.

Section 8    How long do we keep your data for?

DNA Skills retain data for as long as is required to fulfil our ongoing regulatory, quality assurance and/or legal obligations. For example, apprentice achievement data will be retained beyond the end of a contract between us and the apprentice’s employer and/or provider, in case it should be required during regulatory audits, complaint handling, appeals and / or legal proceedings. For these reasons we will hold personal data that is essential, as described here, for a period of seven (7) years.

Where you have opted into marketing communications, please note that you can update your preferences or unsubscribe at any time but emailing

How long we keep information for depends on the information and what it is used for. For example, if you ask us not to send you marketing emails, we will stop storing your emails for marketing purposes (though we will keep a record of your preference not to be emailed). We continually review what information we hold and delete what is no longer required. We never store payment card information.

Section 9   Young People

As an End Point Assessment Organisation, we regularly process the personal data relating to young people who undertake one of our End-Point Assessment opportunities.

Information for Parents

If your child is under 18 then we will seek permission to record any audio-visual communications. We take great care to ensure that individual’s rights are protected and respected in relation to their personal data, especially in the case of young people.

Section 10   Complaints

If you believe that your data protection rights may have been breached you can raise your concerns directly to, with accompanying relevant evidence. However, if we have been unable to resolve the situation to your satisfaction, you may lodge a complaint with the Information Commissioner’s Office.

Please visit for more information on how to report a concern to the ICO.

Section 11   Contacts

Your contact for this policy

If you have any queries about the contents of the policy, please contact our DNA Skills EPA Team:


Telephone: 01344 944675

DNA Skills EPA Team
7 Lakeside Business Park
GU47 9DN