Privacy Notice

Last updated: 12 October 2026 · Version 2.0 · Replaces the notice dated 28 May 2026

1. Who we are and how to contact us

The Training and Learning Company (“TLC”, “we”, “us”) is the trading name of Impact Learning & Data Solutions Limited, a company registered in England and Wales under number 05526370, whose registered office is at Axis 17-19, Axis Court, Mallard Way, Riverside Business Park, Swansea SA7 0AJ. We are an apprenticeship training provider listed on the Department for Education’s Apprenticeship Providers and Assessment Register and inspected by Ofsted. We also operate The Academy of Culinary Excellence (academyce.co.uk), which has its own privacy notice.

We are the data controller for the personal data described in this notice, which means we decide why and how it is used. We are registered with the Information Commissioner’s Office under registration number Z1601195.

Our data protection lead is Alex Gateshill, Head of Contracts, who is responsible for this notice and for your rights under it:

• Email: Alexg@tlc-uk.org
• Post: Alex Gateshill, Data Protection Lead, The Training and Learning Company, Axis 17-19, Axis Court, Mallard Way, Riverside Business Park, Swansea SA7 0AJ
• Telephone: 01792 700611

2. Who this notice is for

This notice explains how we use personal data about:

• visitors to tlc-uk.org;
• people who contact us — through the contact form, by email, by telephone or in person — including parents and carers enquiring for someone else;
• employers and their staff who work with us to recruit, host and support apprentices;
• apprentices and learners on our programmes, from first enquiry to completion and beyond (section 5);
• people who apply to work for us (section 3 and our job applicant privacy notice);
• suppliers, partners, associates and subcontractors we work with.

It does not cover our employees, who have a separate staff privacy notice, or other organisations’ websites that we link to (section 14). Where we hold data because another organisation has asked us to — for example an awarding organisation’s assessment records — that organisation’s notice also applies.

3. The personal data we hold

If you visit our website. Our hosting provider records technical details in its server logs: your IP address, browser and device type, the pages you request, the date and time, and the page that referred you. With your permission (see our Cookie Policy), a usage-measurement tool of our own may record how you use the pages; it is not in use at the time of this notice. Our site loads its typefaces from Google Fonts, which means Google’s servers receive your IP address to serve the font files.

If you contact us. Your name, email address, telephone number if you give it, whether you are an employer, learner, parent or carer, partner or other, the sector you are interested in, and your message. If you telephone, email or meet us, we keep what you tell us and any notes we take.

If you are an employer contact. Your name, job title, work contact details, the organisation you represent, the apprentices you support, and the agreements, reviews and correspondence between us.

If you are an apprentice or learner. Identity and contact details, date of birth, National Insurance number and Unique Learner Number; evidence of eligibility, residency and prior attainment; your employer and job role; your learning plan, progress reviews, assessments, attendance and achievement; English and maths records; end-point assessment records; and, where you tell us or we need it to support you, health, disability and learning-support information, and information for equality monitoring (such as ethnicity), which the funding rules require us to record. We may also hold safeguarding and welfare records where a concern is raised.

If you apply to work for us. Your CV and application, the information we gather at interview, references, right-to-work evidence and, for roles that require it, Disclosure and Barring Service check results. Our job applicant privacy notice has the detail.

If you are a supplier, partner or associate. Your business contact details, the contract between us, invoices and correspondence, and the vetting information our safer-recruitment process requires for anyone who works with learners.

What we ask you not to send. Please do not put sensitive information about other people — residents, patients, pupils, colleagues — into the contact form or an email; tell us a concern exists and we will arrange a secure way to discuss it. Our website is for adults and for young people aged 16 and over considering an apprenticeship; it is not directed at children under 16, and we do not knowingly collect their data through it.

4. Why we use your personal data, and our lawful bases

Data protection law requires a lawful basis for each use of personal data. These are ours:

Where we rely on legitimate interests we have weighed them against your interests, rights and freedoms and recorded that assessment; you can ask us for it and you can object (section 12). Where we rely on a substantial public interest condition we do so under Schedule 1 of the Data Protection Act 2018 and keep the policy document it requires. We do not make decisions about you by automated means, and we do not profile you.

5. Apprentices and learners

An apprenticeship is publicly funded and regulated, so some of your data has to go to the bodies that fund, assess and inspect it. This is what happens and why.

The Department for Education. We record your details in the Individualised Learner Record (ILR), which we return to the DfE throughout your programme, and we use the apprenticeship service to manage your employer’s funding. The DfE uses this information to administer and audit funding, to produce statistics, and for education, training, employment and well-being purposes including research; it may share it with other organisations where the law allows, and it or its agents may contact you for research and evaluation. The DfE is the controller for the data it holds. Its own privacy notice is on our learner privacy page and at the DfE’s personal information charter; you will be asked to confirm you have seen it when you enrol.

The Learning Records Service. We use your Unique Learner Number to check your prior qualifications and to record your achievements on your Personal Learning Record.

Awarding organisations and end-point assessment organisations — for example City & Guilds, Pearson and CMI, and the organisation that carries out your end-point assessment — receive the details they need to register you, quality-assure your assessments and issue your certificates. Each is a controller for the records it holds.

Ofsted may see your records and speak to you during an inspection. We may also be audited by the DfE or its appointed auditors.

Your employer receives your progress reviews, attendance and achievement information, and takes part in your reviews, because the apprenticeship is a three-way agreement.

Support and welfare. If you tell us about a health condition, disability or learning need, we use it to agree reasonable adjustments and support, and we share it only with the staff and assessment organisations who need it to provide that support. If a safeguarding concern is raised, we keep a confidential record and may share it with the relevant authorities, as our Safeguarding and Prevent policies explain.

After you finish. We keep your records for the period the funding rules and awarding organisations require (section 9), confirm your achievement to anyone you authorise, and, if you agree, keep in touch about alumni opportunities. If you are under 18, we may also share information with your parent or carer where you have agreed or where safeguarding requires it.

6. Keeping in touch

We will only send you marketing — news about programmes, events, open days and opportunities — if you have asked us to, or if you are an existing contact at an organisation we work with and the news relates to that work. We do not send marketing to apprentices under 18 unless they have opted in themselves. We send it through Mailchimp, which keeps the list for us and processes it in the United States (section 8). Every email we send includes a link to stop further emails, and you can also opt out by writing to Alexg@tlc-uk.org; we act on it within 10 working days. We never sell, rent or swap your details with anyone for their marketing.

7. Who we share your personal data with

Within TLC. The staff who need your data to do their jobs. Enquiries from the website go to our senior leadership team, who pass them to the head of the relevant department; job applications go to our recruitment team; skills coaches and assessors see the records for their learners; the quality and compliance team sees records for audits and reviews; the safeguarding team sees them where a concern arises.

Funding, assessment and inspection bodies — the Department for Education, the Learning Records Service, awarding organisations, end-point assessment organisations and Ofsted — as section 5 describes. Each is a controller for the data it holds.

Your employer, if you are an apprentice; the apprentice, if you are an employer contact, for the reviews and agreements the programme requires.

Our service providers, who act only on our instructions under written contracts and may not use your data for their own purposes:

• Pedwar, our web agency, which hosts the website on Amazon Web Services infrastructure and relays contact-form submissions to our mailbox;
• Microsoft, which provides the Microsoft 365 email, Teams and document systems in which our records are held and through which we hold calls and reviews;
• Impact, our management information system, and TLC Base, our learning platform, which is built and hosted for us by Sonoro AI — the systems in which learner, employer and programme records are kept;
• Adobe, whose Acrobat Sign service we use to sign enrolment and employer documents;
• Mailchimp (Intuit), which sends our marketing emails to people who have opted in;
• Anthropic, PBC, which provides Claude, the AI-assisted tool we may use to help read and draft replies to enquiries (section 11);
• IONOS, which registers our domain name and provides DNS; it holds our business details for that purpose, not information about visitors.

Professional advisers and insurers, where we need their advice or they need the information to act for us.

Regulators, courts and public authorities where the law requires or allows it — including the Information Commissioner’s Office, the police and local authorities where safeguarding requires, and HMRC.

A buyer or successor if our business, or substantially all of its assets, is sold or reorganised; your data would pass to the new owner under the same protections.

We do not sell your personal data.

8. Where your data is stored, and transfers outside the UK

Our records are held in the United Kingdom and in Microsoft 365 systems that may process data in the European Economic Area and other countries. Our website is hosted by Pedwar on Amazon Web Services servers in the United Kingdom and the European Economic Area; the only personal data on the hosting platform is the server logs described in section 3 and, for the moments it takes to email it to us, the content of a contact-form message. Mailchimp processes our marketing list in the United States. If you accept usage-measurement cookies, the data stays with us; no other company receives it. Your browser requests the site’s typefaces from Google Fonts, so Google’s servers — which may be in the United States — receive your IP address to serve the font files; Google states that this request sets no cookie and is not linked to a Google account. If we use Claude to help with your enquiry, Anthropic processes the data in the United States.

Where any provider processes personal data outside the United Kingdom, it does so in a country covered by the UK Government’s adequacy regulations, or under contract terms approved for the purpose (the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses) or the UK Extension to the EU–US Data Privacy Framework, so that your data receives protection equivalent to UK law. You can ask us for details of the safeguard that applies.

9. How long we keep your personal data

We keep personal data only for as long as we need it for the purposes above or for as long as the funding rules, awarding organisations or the law require, and then delete or anonymise it. Our standard periods are set in our retention schedule; the main ones are:

10. How we keep your data safe

Our systems are protected by access controls, multi-factor authentication and encryption in transit; learner and employer records are held in systems that only authorised staff can reach, and staff are trained in data protection every year. Our website is served over HTTPS. Our service providers are bound by written contracts that require them to keep your data secure and to use it only on our instructions. We have a procedure for personal data breaches: where a breach is likely to put your rights at high risk we will tell you without undue delay, and we report to the Information Commissioner’s Office within 72 hours where the law requires.

11. AI-assisted tools

We may use Claude, an AI-assisted tool provided by Anthropic, to help us read, summarise and draft replies to enquiries and correspondence. A member of our team reviews everything before it is sent, and no decision about you is made automatically. Anthropic processes the data only on our instructions, under a contract that prevents it using your data to train its models, and the transfer safeguards in section 8 apply. We do not put learner assessment records, safeguarding records or special category data into AI tools.

12. Your rights

You have the right to:

• access the personal data we hold about you, and receive a copy;
• correct data that is inaccurate or incomplete;
• have your data deleted in certain circumstances — though we cannot delete records the funding rules or awarding organisations require us to keep, and we will explain when that applies;
• restrict how we use your data while a question about it is resolved;
• object to our use of your data where we rely on legitimate interests — and to object at any time to direct marketing, which we will always honour;
• receive the data you gave us in a portable, machine-readable form, where we process it by automated means on the basis of your consent or a contract;
• withdraw consent at any time where we rely on it, without affecting what was done before you withdrew it; and
• not to be subject to a decision based solely on automated processing that significantly affects you (we make no such decisions).

To exercise any of these rights, email Alexg@tlc-uk.org or write to the address in section 1. There is normally no charge. We will respond within one month; if your request is complex or you have made several, we may take up to two months longer and will tell you if so. If we need to confirm who you are, or need you to clarify what you are asking for, we will tell you promptly, and the time we spend waiting for that does not count towards the deadline. Apprentices can make a request themselves at any age; a parent or carer can make one on behalf of a young person with their agreement. More about these rights is on the Information Commissioner’s website, ico.org.uk.

13. Complaints

If you are unhappy with how we have handled your personal data, please tell us. You can complain by email to Alexg@tlc-uk.org, by post to the address in section 1, by telephone, or in any other way that reaches us. We will acknowledge your complaint within 3 working days, look into it in a way that is proportionate to what you have raised, keep you informed, and give you our response without undue delay — our Complaints & Appeals policy on the Policies page explains the steps.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at any time: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would welcome the chance to address your concern first, but you do not have to come to us before going to the ICO.

14. Other websites

Our site links to other organisations’ websites — Skills England’s apprenticeship standards, the government’s Find an Apprenticeship service, awarding organisations, Indeed and others. Those sites have their own privacy notices and cookie practices, and we are not responsible for them.

15. Changes to this notice

We review this notice at least once a year and whenever the way we use personal data changes. The date and version at the top tell you when it was last updated; if a change is significant and we are in contact with you, we will tell you directly. Previous versions are available on request.

Version 2.0, 12 October 2026, replaces the notice dated 28 May 2026.