This policy sets out how National LifeSkills Academy collects, uses and protects personal data. It applies to all personal data NLSA holds about learners, purchasing organisations, staff, associates and anyone else, whether held electronically or on paper.

Responsibility

National LifeSkills Academy Ltd is the data controller for the personal data it holds for its own purposes. The Director is responsible for data protection and can be contacted at director@nlsa.uk. ICO registration number: ZB398726.

Where a school or employer enrols its pupils or staff, that organisation is normally the data controller for their data and NLSA acts as its processor under a written agreement.

The law

NLSA complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and has regard to guidance from the Information Commissioner's Office (ICO).

Principles

NLSA makes sure that personal data is:

• Lawful, fair and transparent: processed on a lawful basis, and people are told clearly how their data is used.
• Limited to its purpose: collected for specified purposes and not used for anything incompatible with them.
• Minimised: limited to what is needed.
• Accurate: kept up to date, and corrected or deleted when it is wrong.
• Not kept longer than needed: see the retention periods below.
• Secure: protected against unauthorised access, loss, change or disclosure.

NLSA is accountable for showing that it meets these principles.

What we collect and why

• Learners: name, email address, enrolment, progress, assessment results and certificate details, so that we can deliver courses, issue and verify certificates, and support learners.
• Purchasing organisations: contact details and enrolment records, so that we can manage their accounts.
• Staff, associates and contractors: the information needed to engage them and to evidence their competence, including DBS status where relevant.

We collect as little data as possible from children and young people, and none for open-access material. See the Child and Young Person Safeguarding Policy.

How long we keep data

At the end of the retention period, data is securely deleted or anonymised.

Your rights

You have the right to access your personal data, and to ask for it to be corrected, deleted or restricted, or to object to how it is used. To make a request, contact director@nlsa.uk. We respond within one month.

If you are unhappy with how we have handled your data, you can complain to NLSA under the Complaints Policy, or to the ICO.

Sharing data

NLSA does not sell personal data. Data is shared only where necessary: for example, confirming a certificate to an employer (see the Certification Policy), or with service providers who host our platform. Service providers act under written contracts that require them to protect the data. Where data is transferred outside the UK, appropriate safeguards are put in place.

Learner personal data is never entered into a public or third-party artificial intelligence tool (see the Artificial Intelligence Use Policy).

Data breaches

Any suspected breach must be reported to the Director straight away. NLSA contains the breach and assesses the risk. Where required, it reports the breach to the ICO within 72 hours of becoming aware of it, and tells the people affected when there is a high risk to them.

Training

Everyone who handles personal data for NLSA is trained in their responsibilities and follows this policy.

Review

This policy is reviewed annually, and sooner if data protection law or guidance changes.

National LifeSkills Academy Ltd  |  Data Protection Policy  |  v2.0 September 2026