Student Data Protection & Retention Policy

We collect only the information needed to deliver your training and meet awarding-organisation and SIA requirements: your name, contact details, identification documents, first aid or qualification evidence where required, attendance, and assessment evidence including practical assessment video where the qualification requires it.

We process this under contract (to deliver your course), legal obligation and legitimate interests (to meet awarding-body and regulator evidence requirements), and consent where you have opted into marketing.

When your booking is confirmed, we create a private folder for you in The Security Tutor's Google Workspace. Only you and authorised Security Tutor staff can open it. You receive a Google invitation to your registered email address — if you don't have a Google account, Google's secure email verification lets you in without one. We never create, see or store a Google password for you.

Course materials and pre-course learning live in your folder, and you upload requested documents (such as ID or first aid certificates) there or through your My Course page. Uploading a document does not make it valid evidence — a tutor or administrator verifies it first.

When your course is completed, your folder access is removed and verified automatically. The records themselves stay under The Security Tutor's control for the periods below, counted from your recorded course completion date:

• Eligible practical assessment video: 13 calendar months, where the awarding organisation permits; where a three-year minimum applies, the longer rule wins.
• SIA assessment and training documentation: 37 calendar months.
• Other training records subject to a three-year requirement: 37 calendar months.
• Longer statutory or awarding-body requirements: retained for the longer period.

Other data, such as abandoned enquiries and marketing preferences, has its own separately justified retention periods.

Every day at 06:00 UK time, including weekends and holidays, our system reconciles all managed records: it checks retention classifications, recalculates eligibility dates, verifies student access has ended after completion, flags permission anomalies and emails a report to our administrator. A report is produced even on quiet days.

No document is ever permanently deleted just because its retention date has passed. Eligible records are flagged for review, checked for legal or compliance holds, and only an authorised administrator can approve deletion. Every step is written to a secure audit trail. Note that deletion removes our copies; anything you have previously downloaded remains yours, and Google Workspace backup/recovery controls may retain residual copies for a limited period.

Google Workspace (Google Ireland Ltd) stores your training folder under our organisation's control. Our website and booking platform, payment processor (Stripe) and email service process the minimum data needed for their function. Where providers process data outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

You can ask us for a copy of your data, correction of anything wrong, deletion where the law allows, restriction or objection to processing, and data portability. Contact us at contact@thesecuritytutor.com or 0330 133 4984. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.