Privacy Policy

Who We Are

Qualify Nation operates as an online educational platform offering courses and career services. We are committed to protecting your privacy and handling your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Company Registration: 10588069
ICO Registration: ZB294348
Contact: [email protected]

Multi-Tenant Platform Structure

Our platform uses a multi-tenant architecture where educational institutions operate in logically separated environments. Personal data belonging to each Tenant Institution and its users is logically segregated from other tenants, ensuring data isolation and security.

Data We Collect

Account Information

• Name, email address, and contact details
• Account credentials (passwords are encrypted)
• Profile information you choose to provide

Payment Information

• Payment card details (processed securely by our PCI DSS-compliant payment provider)
• Billing address and transaction history

Usage Data

• Course progress and assessment results
• Platform usage analytics
• Device and browser information
• IP address and approximate location data

Learning Analytics and Comprehension Data

To help you learn effectively and to give you and your training provider an accurate picture of your progress, our learning platform records how you work through your courses and analyses your assessment results. This includes:

• Lesson completion, playback position, and time spent on lessons
• Your answers to quizzes and interactive activities, and the scores achieved
• Requests you make for additional explanation of course content

From your graded assessment results we derive a comprehension profile — an analysis of which topics and learning outcomes you have mastered, partially mastered, or may need to review. This analysis is used to show you your own strengths and gaps, to recommend content to revisit, and to help instructors and your institution support your learning. It is not used for marketing, and it does not by itself determine any grade.

Reading Engagement Data

Where your course includes required reading delivered through our reading platform, we record detailed reading engagement signals, including pages viewed, time spent on each page, scroll depth, reading sessions, and periods of inactivity or when the reading window loses focus. From these signals we derive engagement scores and an overall engagement status for each book.

This data is used to confirm that required reading has been completed, to protect the integrity of our qualifications (for example, identifying where pages have been turned too quickly for genuine reading), and to help your institution support learners who may be falling behind. Completion of required reading may be a condition of progressing to later course content. Engagement analysis is visible to authorised administrators at your institution and to our staff; you can see your own reading progress and overall engagement status.

AI Interaction Data

When you use our AI-powered features (chat support, voice call agents, or learning assistance), we collect:

• Chat messages and conversation history
• Voice recordings and transcriptions (when using AI voice call agents)
• Context provided to AI systems to generate responses (such as your course enrolment and progress data)
• Feedback or ratings you provide on AI responses

If you enquire about our services or interact with our sales or support team, calls may be recorded, transcribed, and summarised (including by AI systems), some calls may be handled by an AI voice assistant, and we may analyse these communications to understand your requirements and prioritise follow-up.

Important: This data is transmitted to third-party AI providers for processing (see Sub-Processors below). Do not share sensitive personal information such as financial details, passwords, government identification numbers, or health information in AI conversations.

AI-Assisted Feedback, Assessment and Moderation

We use artificial intelligence to support teaching, assessment, and platform safety. Depending on the features you use, the following may be processed by third-party AI providers on our behalf:

• Coursework you submit for feedback or assessment, such as portfolio entries, project work, practice code, and written or recorded presentations (including video and audio recordings of presentations and the transcripts generated from them)
• Questions and answers you post in course discussion areas, which are automatically screened for prohibited content
• Free-text questions you ask our AI learning assistants
• Your CV and career profile, where you use AI-powered career features such as CV analysis, job matching, skills-gap analysis, or mock interviews

AI outputs used in assessment are either advisory, based on objective marking rules, or verified by a human assessor before release, except where we state otherwise (see Automated Decision-Making and Profiling below).

Examination and Proctoring Data

• Webcam images and video during proctored examinations (for identity verification and integrity monitoring)
• Screen activity during proctored sessions
• Behavioural data and keystroke patterns for fraud detection
• Environment audio during proctored examinations

Assignment Submission Telemetry

To support fair assessment of written assignments, our submission tool records limited interaction signals while you are working on an assignment, including:

• Paste events (when content is pasted into the editor, and the length of pasted text)
• Editor focus time (how long the assignment editor was the active window)
• Writing-pace patterns (typing rhythm and timing, not the content of individual keystrokes)

This telemetry is accessible only to the instructor or assessor grading your submission, and is used solely to assess authorship and academic integrity. It is not used for marketing, profiling, or any automated decision-making, and is deleted when your account is deleted.

Lawful basis: Legitimate interest in protecting the integrity of assessments and the value of the qualifications we award (Article 6(1)(f) UK GDPR). Where you are enrolled through a Tenant Institution, the institution is the data controller for this telemetry and Qualify Nation acts as processor.

Recruitment and Career Services Data

If you participate in our recruitment and career placement services, we may additionally collect:

• Your CV, cover letter, and career profile information
• Job preferences including desired role, salary expectations, location, and working arrangement (remote, hybrid, on-site)
• Interview feedback and outcomes (from both you and prospective employers)
• Employment status and placement outcomes (to fulfil job guarantee obligations where applicable)
• Communications between you and our recruitment team

This data is collected only with your participation in recruitment services and is not shared with any employer without your explicit prior consent for each introduction. See our Terms and Conditions (Section 10) for full details of how recruitment services operate.

Cookies

We use the following categories of cookies:

• Strictly necessary cookies: Required for platform functionality, authentication, and security (no consent required)
• Analytics cookies: Help us understand how visitors use our site, provided by third-party analytics services (with your consent)
• Marketing cookies: Used to deliver relevant advertising and track campaign effectiveness (with your consent)

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies may affect platform functionality.

Using QualifyNation on a Recruitment Agency's Branded Website

Some recruitment agencies operate QualifyNation on their own web address, showing their own name and branding (a “white-label” or custom domain). If you reach the platform this way — for example through a link from an agency that represents you — the service is still provided and operated by QualifyNation (Group Everest Ltd), and QualifyNation remains the data controller for your personal data. The agency’s branding does not change who holds your data or who is responsible for it. These pages carry a “Powered by QualifyNation” notice and a link to this policy, and the qualifications and verification you receive are always issued in QualifyNation’s name.

Application Email Addresses and Employer Correspondence

Last updated: 14 July 2026. This section applies to candidates using our assisted-application service, and to employers and their staff who correspond with an application address.

For candidates

Where you have agreed to assisted applications, your appointed recruitment agency may submit applications on your behalf using a QualifyNation application email address (in the form [email protected]) rather than your personal email address. Any correspondence an employer sends to that address — including interview invitations and verification codes — is received and stored by QualifyNation and is visible to both you and your appointed recruitment agency in your respective QualifyNation portals. This is described in, and processed on the basis of, the assisted-applications agreement you accept in your portal; you can withdraw at any time, which stops future assisted applications.

For employers and their staff

If you correspond with a QualifyNation application email address, you are corresponding with a candidate represented by a recruitment agency. Your messages to that address are received and stored by QualifyNation and are visible to the candidate and to their appointed recruitment agency, so that both can act on your response. We process this correspondence on the basis of our and the candidate's legitimate interest in receiving and acting on responses to an application the candidate authorised. We do not use it for any other purpose.

Retention

We keep correspondence stored against an application address for as long as it remains relevant to the candidate's applications and their relationship with their recruitment agency. When the candidate's representation ends, or they withdraw from assisted applications, the address stops being used and stored correspondence is deleted once it is no longer needed for that purpose.

Questions or concerns

Contact [email protected]. You also have the right to lodge a complaint with the ICO.

Business Contact Directory (business contacts, not platform users)

Last updated: 14 July 2026. This section applies to individuals whose professional details appear in our business contact directory — typically staff at companies our recruitment agency customers work with. If you received an email from us saying you were added to the directory, this is the section that applies to you.

What we hold and why

As part of operating our recruitment and business-development platform, QualifyNation maintains a directory of business contact information — such as a person's name, job title, business function, work email address, and LinkedIn profile URL — for individuals at companies that our recruitment agency customers work with. This information is sourced from the recruitment agencies using our platform and from publicly available sources such as company websites and LinkedIn, and is reviewed by QualifyNation before it is published.

We only hold professional information of this kind — we do not collect or store home addresses, dates of birth, nationality, or any special category of data (such as health, ethnicity, or religious information) as part of this directory.

We process this information on the basis of our legitimate interest in helping recruitment professionals identify the appropriate business contact at a company, in the same way as other professional business-contact directories operate.

Who can see it

Entries in the directory are visible to recruitment agencies using the QualifyNation platform, including agencies other than the one that originally contributed the entry — this is a shared, cross-agency directory. The directory is never visible publicly or to unauthenticated users.

How you'll hear from us

Where an entry about you is approved and we hold a work email address for you, we will email you to let you know that your details have been added to the directory. That email tells you who added the entry and where the information came from, and includes a one-click link you can use to have your entry removed.

Your rights

You have the right to access the information we hold about you, to have it corrected if it's inaccurate, to have it erased, and to object to our processing of it. The one-click link in our email to you is the removal route — use it to have your entry erased. For everything else — accessing the information we hold, having it corrected, or objecting to our processing — email us at [email protected]. You can also request removal by email if you prefer.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.

Retention

We keep directory entries for as long as the directory is intended to stay current and accurate, and for as long as you have not objected to your inclusion. Entries belong to the directory, not to the agency that contributed them — an entry remains in the directory even if the contributing agency stops using our platform, because it continues to serve the same purpose for other recruitment agencies. When you ask us to remove your entry, or object to being included, your entry is hidden from the directory immediately; we permanently delete the personal details after 30 days (during which you can restore it if you change your mind), and keep only a limited internal record — which may include the role and company the entry related to — used only to prevent your information being added again. We won't add you back unless you ask us to: if you change your mind later, email [email protected] and we can relist you.

For this directory, the controller is Group Everest Ltd (QualifyNation). Contact: [email protected].

How We Use Your Data and Lawful Basis

Under UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out how we use your data and the legal basis we rely on for each purpose.

Purpose	Lawful Basis
Providing and delivering our educational services, including course access, labs, and examinations	Performance of contract
Processing payments and managing your account	Performance of contract
Issuing certificates and enabling third-party verification of qualifications	Performance of contract
AI-powered chat support, voice agents, and learning assistance	Performance of contract / Legitimate interest (service improvement)
Proctoring and academic integrity monitoring during examinations	Performance of contract / Legitimate interest (protecting certification value)
Assignment submission telemetry (paste events, editor focus time, writing-pace patterns) for authorship and integrity checks	Legitimate interest (fair assessment and protecting certification value)
Learning analytics and comprehension analysis derived from your assessment results	Performance of contract / Legitimate interest (supporting your learning)
Reading engagement tracking and analysis for required course reading	Legitimate interest (verifying completion of required reading and protecting certification value)
AI-assisted feedback, assessment support, and automated content moderation	Performance of contract / Legitimate interest (platform safety)
Analysing sales and support communications (including call recordings and transcripts) to understand your requirements and prioritise follow-up	Legitimate interest (responding effectively to enquiries)
Communicating with you about your courses, account, and services	Performance of contract
Recruitment and career placement services (matching you with employers, sharing your profile)	Consent (explicit opt-in before each employer introduction; you can withdraw at any time)
Tracking placement outcomes and fulfilling job guarantee obligations	Performance of contract (where a Job Guarantee Agreement exists)
Sending marketing communications about relevant courses and services	Consent (you can withdraw at any time)
Analysing usage patterns to improve our platform and content	Legitimate interest (service improvement)
Detecting and preventing fraud, abuse, and academic misconduct	Legitimate interest (platform security and certification integrity)
Complying with legal obligations (tax, regulatory, law enforcement requests)	Legal obligation

Automated Decision-Making and Profiling

We use the following automated processing that may affect you:

• Course progression rules: Access to later lessons or the ability to mark content as complete may be automatically gated until earlier content, assessments, or required reading has been completed.
• AI-assisted evaluation of coursework: Certain coursework (such as portfolio entries) may be scored automatically against a defined rubric with a pass threshold. Assessments recorded towards your final qualification either use objective automatic marking (such as multiple-choice quizzes) or are verified by a human assessor before results are released.
• Automated content checks: Posts in course discussion areas are automatically screened, and content that violates our policies may be automatically rejected.
• Recruitment matching: Where you apply for a role through our recruitment platform, AI-assisted tools may compare your application against the role requirements and produce a suitability score, which is used to prioritise and shortlist applications and to identify training that may suit you.
• Enquiry prioritisation: We may analyse communications with prospective customers (including call transcripts and emails) to assess interest and prioritise follow-up.

Where a decision based solely on automated processing produces legal or similarly significant effects for you, you have the right to request human intervention, to express your point of view, and to contest the decision. To request human review of any automated or AI-assisted outcome, contact your instructor or email us at [email protected].

Data Sharing

We share your personal data only to the extent necessary for the purposes described above. Your data may be shared with the following categories of recipients:

Third-Party Service Providers

• AI service providers: To power our chat support, voice call agents, and learning assistance features, your inputs (including messages and voice data) are processed by third-party artificial intelligence providers. These providers are based in the United States and process data under Data Processing Agreements with appropriate safeguards for international transfers.
• Cloud infrastructure and storage providers: Our platform is hosted on managed cloud infrastructure primarily located in the United Kingdom, with files such as uploaded documents, CVs, and recordings stored encrypted in UK-region cloud storage
• Payment processors: Payment card details and transaction data are processed by our PCI DSS-compliant payment provider and are never stored on our servers
• Email delivery services: Your name, email address, and communication preferences are shared with our email service provider to deliver transactional and marketing communications
• Telephony and messaging providers: Phone calls and SMS messages (including verification codes) are delivered by telecommunications providers; calls may be recorded and transcribed as described in this policy
• Video hosting providers: Recordings of assessed presentations are stored and streamed by a specialist video hosting provider using access-controlled links
• Code execution services: Where hands-on labs support certain programming languages, the code you submit may be executed by a specialist sandboxed code-execution service
• Email verification services: Email addresses (and associated IP addresses) submitted through our public forms may be checked against an email verification service to prevent abuse
• Job boards and recruitment partners: Where you apply for a role via a third-party job board, we receive your application details from that board, and application outcome statuses may be reported back to it
• Analytics providers: Anonymised usage data is shared with analytics services to help us understand how our platform is used and improve our services
• Content delivery and security providers: IP addresses and request metadata are processed by our CDN and security provider to deliver content efficiently and protect against attacks
• Examination proctoring services: Webcam images, audio, and screen activity may be processed by proctoring technology providers during examinations

We maintain Data Processing Agreements (DPAs) with all third-party service providers that process personal data on our behalf. A complete list of our current sub-processors, including their names, roles, data locations, and transfer mechanisms, is available upon request by submitting a support ticket through our platform.

Prospective Employers (Recruitment Services)

If you participate in our recruitment and career placement services, we may share the following data with prospective employers:

• Your name and contact details
• Your CV and career profile
• Relevant qualification and certification details (course completed, certificate status, grade where applicable)

We will never share your data with a prospective employer without your explicit prior consent for each specific introduction. You will always be told which employer will receive your data and what data will be shared before any introduction is made. You may decline any introduction and withdraw from recruitment services at any time without affecting your course access or progress. For full details, see our Terms and Conditions (Section 10).

Other Recipients

• Tenant Institutions: If you enrol through an educational institution, your progress, assessment results, and certificate data are shared with that institution in its capacity as data controller
• Certificate Verification: Employers or institutions who verify your certificate through our systems will receive confirmation of its validity, your name, and the qualification achieved
• Legal Requirements: When required by law, court order, or to protect our rights, property, or safety
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, with prior notice to affected users where practicable

How Grow Uses Google Account Data

When you connect a Google (Gmail) account to Grow, you grant Grow permission to send email on your behalf using the Gmail API (the gmail.send scope). Grow uses this permission solely to send the candidate submissions and recruitment messages that you or your agency initiate through the platform.

Grow does not request read access to your Gmail mailbox. We do not read, scan, copy, or store the contents of your inbox. Replies to messages Grow sends are delivered to a Grow-operated reply address and are stored only to display the relevant conversation to you within the platform.

We store only the minimum data necessary to provide this feature: your connected account’s email address, the OAuth tokens required to send on your behalf (encrypted at rest), and the messages you send together with their replies. We do not sell this data, use it for advertising, or transfer it to third parties except as necessary to provide the service, to comply with applicable law, or as part of a business transfer with appropriate notice.

Grow’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect your account at any time from your Grow settings, which revokes Grow’s access and stops all sending on your behalf. To request deletion of your stored data, contact us at [email protected].

Other Connected Email Accounts (Grow)

Grow also lets you connect a Microsoft (Outlook / Microsoft 365) account or a mailbox of your choice via SMTP. As with Google accounts, this allows you to manage your recruitment correspondence from within Grow: candidate submissions and recruitment messages you initiate are sent from your connected account, and replies are routed to a Grow-operated reply address and displayed in the relevant conversation, so you can send, receive, and respond without leaving the platform. Grow uses the connection solely for the correspondence you initiate through the platform.

Microsoft accounts are connected with send-only permission together with your basic account identity (name and email address) — Grow does not request or receive access to read your Microsoft mailbox. For SMTP connections, we store your server settings and credentials encrypted at rest, use them only to send the messages you initiate, and never read your mailbox. In all cases we store only your connected account’s email address, the tokens or credentials required to send on your behalf (encrypted at rest), and the messages you send together with their replies. You can disconnect any connected mailbox at any time from your Grow settings.

Student Accounts & Institutional Data

When schools or educational institutions create student accounts through our platform, Qualify Nation acts as a data processor on behalf of that institution (the data controller). We do not directly collect data from minors without institutional involvement. Institutions are responsible for ensuring they have obtained all required parental or guardian consents and that their use of our platform complies with the UK GDPR, the Data Protection Act 2018, and the ICO’s Age Appropriate Design Code (Children’s Code) where applicable.

Your Rights

Under UK GDPR, you have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing of your data
• Request restriction of processing
• Data portability
• Withdraw consent at any time

To exercise these rights, contact us at [email protected].

Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication
• Role-based permissions
• Regular security assessments
• Audit logging for tenant isolation

Apprenticeship Programme Data

Where a learner applies for or enrols on an apprenticeship programme, Qualify Nation® may collect and process additional personal data as required by the programme and applicable funding rules. This may include:

• Employer details (name, address, contact person)
• Employment information (job title, working hours, employment start date)
• Eligibility information (age, residency status, prior qualifications)
• Equality and diversity monitoring data (collected voluntarily for monitoring purposes)
• English and maths assessment records
• Progress review records and training plan documentation
• Unique Learner Number (ULN) and Individual Learner Record (ILR) data

Lawful basis: Where the processing relates to the performance of an apprenticeship agreement, the lawful basis is contractual necessity (Article 6(1)(b) UK GDPR). Where data is submitted to government bodies for funding or regulatory purposes, the lawful basis is legal obligation (Article 6(1)(c) UK GDPR). Equality and diversity monitoring data is processed under legitimate interest (Article 6(1)(f) UK GDPR) for the purpose of monitoring participation, achievement, and outcomes, and is collected with consent.

Data sharing: Apprenticeship programme data may be shared with:

• The learner’s employer (to the extent necessary for the delivery of the programme and progress reviews)
• Government funding bodies, as required by the applicable funding rules
• Regulatory and inspection bodies, where required by law or conditions of registration
• End-point assessment organisations, for the purpose of administering assessments

Retention: Apprenticeship records, including ILR data, training plans, and assessment records, are retained for a minimum of 6 years from the end of the funding year in which the programme ends, or longer where required by funding rules or regulatory obligations. Equality and diversity monitoring data is retained in anonymised aggregate form after the retention period.

All other provisions of the Qualify Nation® Privacy Policy apply to apprenticeship programme data.

Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Account data: Retained for the duration of your account and for up to 12 months after account closure or licence expiration, unless you request earlier deletion
• Course completion records and certificates: Retained indefinitely for verification purposes (employers and institutions may need to verify your qualifications years after completion)
• Payment records: Retained for 7 years to comply with HMRC tax obligations
• Recruitment data: CVs, career profiles, and job application records are retained for up to 24 months after your last interaction with recruitment services, or until you request deletion, whichever is sooner. Placement outcome data may be retained longer where required to fulfil job guarantee obligations.
• AI interaction data: Chat logs, call recordings, transcripts, and call logs are retained for up to 12 months for service improvement and support purposes
• Learning analytics, comprehension analysis, and reading engagement data: Retained for the duration of your account so that your progress record remains accurate, and handled in line with the account data terms above on account closure or deletion
• Assessed presentation recordings: Video recordings of assessed presentations are retained for up to 3 years after grading; the transcript and grading record are retained as part of your assessment record
• Proctoring data: Examination recordings are retained for up to 6 months after the assessment, or longer if an academic misconduct investigation is in progress

You can request deletion of your account and associated data at any time by submitting a support ticket through the platform. Certain data may be retained where we have a legal obligation or legitimate need to do so (such as certificate records and financial records).

International Transfers

Several of our third-party service providers, including AI service providers, payment processors, telephony providers, email verification services, and analytics providers, are based in the United States. This means your personal data may be transferred to, and processed in, countries outside the United Kingdom that may not offer the same level of data protection.

Where we transfer personal data outside the UK, we rely on one or more of the following safeguards:

• UK adequacy decisions: Transfers to countries that the UK government has determined provide an adequate level of data protection
• International Data Transfer Agreement (IDTA): The UK equivalent of EU Standard Contractual Clauses, incorporated into our Data Processing Agreements with relevant sub-processors
• UK GDPR Article 49 derogations: In limited circumstances, where the transfer is necessary for the performance of our contract with you (e.g., processing your payment through our international payment provider)

You can request further information about the specific safeguards applied to your data by contacting us at [email protected].

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms
• Document all breaches, including those not reported to the ICO, along with the facts, effects, and remedial actions taken

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any significant changes by email or through our platform.

Contact Us

If you have questions about this privacy policy or our data practices, please contact us:

Email: [email protected]
Phone: +44 7426 985335
Hours: Monday - Friday, 9:00AM - 5:00PM

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.