Privacy notice

Digital Training Centre is a training management platform run by Sector 3 Group Ltd. Training providers (our customers) use it to run courses, registers, assessments, certificates, scheduling and instructor pay.

Sector 3 Group Ltd, Kennards, Harleston Road, Langmere, Diss IP21 4PD, is registered with the Information Commissioner's Office as a data controller (registration ZC039177).

Contact for anything in this notice: miles.ward@sector3group.co.uk.

• Learner and course records: the training provider running the course is the data controller. We process that data on their behalf, under a Data Processing Agreement, and only on their instructions.
• Customer accounts, staff logins, support and billing: we are the data controller.

If you are a learner, please contact the training provider who ran your course first; we will help them answer your request.

• Staff: name, email, phone, role, town, qualifications and certificates, availability, schedule, timesheets, and pay and invoice details they choose to add.
• Learners: name, email, date of birth, employer or unit, signatures, attendance, assessment results, photographed exam papers, feedback, and any learning needs or adjustments they share.
• Customer contacts: names, job titles, emails and phone numbers.
• Technical: login times, the activity log of changes, and security logs kept by our hosting providers.

We do not hold payment card details or patient records, and we do not sell personal data or use it for advertising.

• To provide the service under our contract with each training provider (contract; legitimate interests).
• To meet awarding body and quality assurance requirements for the courses delivered (legal obligation and legitimate interests of the training provider).
• To keep the service secure and fix problems (legitimate interests).
• Learning needs a learner chooses to share are used only to arrange reasonable adjustments, with the learner's agreement.

Only the suppliers needed to run the service, under contracts that protect the data:

• Supabase: database, file storage and logins, hosted in London (UK).
• Vercel: application hosting, London (UK).
• Resend: sending the emails you ask the app to send.
• Google Calendar and Xero: only when a customer connects them.
• Awarding bodies and quality assurers: course paperwork, when the training provider submits it.

Where a supplier processes data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement.

Course records are kept for as long as the training provider needs them for awarding body and audit requirements, normally six years, unless they delete them sooner. When a customer leaves, we return or delete their data within 90 days. Backups roll off within 30 days.

We use only essential cookies: one keeps you signed in and one remembers which organisation you are working in. There are no advertising or tracking cookies, so we do not ask for cookie consent.

You can ask to see, correct or delete your data, to restrict or object to its use, or to receive a copy. Contact the training provider (for course records) or us. We reply within one month.

If you are unhappy with how your data is handled, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Data is stored in the UK, encrypted in transit and at rest, and separated between organisations at database level. See our security summary for details. We will tell affected customers within 72 hours of confirming a personal data breach.