QA Group Privacy Notice

The QA Group, including but not limited to QA Limited and QA USA, Inc. (formerly Cloud Academy, Inc.), ("QA", "we", "our" or "us") are committed to ensuring that your privacy is protected. This Privacy Notice describes how we use the personal information that we collect from you, or that you provide, when you:

• visit any of our websites, platforms, portals or online learning environments (the "Websites");
• use the educational services, testing, certification, products, and consultancy services (together the "Services") that we provide; or
• communicate with us.

This Privacy Notice also describes the personal data processing where personal data about you is provided by third parties, such as your employer or agents acting on your behalf.

QA may act as a Data Controller or a Data Processor within our relationship depending on the nature of Services that we are providing to you.

Please read this notice carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.

We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR). We are also subject to the EU General Data Protection Regulation (EU GDPR) in relation to Services we offer to individuals and our wider operations, as applicable, in the European Economic Area (EEA). In the United States of America, various States have enacted consumer privacy legislation providing respective State residents with certain privacy rights. To learn more about these rights please visit our Supplementary QA Group Privacy Notice. We may also be subject to other rules and regulations pending the Services we offer in other countries.

1. Personal Information We Collect

The personal information we collect from you, either directly or indirectly, will depend on how you interact with us and with our Services. We collect personal information about you from the following different sources:

• Information that you provide directly We collect personal information directly from you when you choose to provide us with this information online on our Websites, through communications with us, and through your other interactions with us (such as data collected via social media, customer service communications).
• Information that we collect indirectly We collect personal information about you indirectly, including through automated means from your device when you use our Services. Some of the information we collect indirectly is captured using cookies and other tracking technologies, as explained below.
• Information from third parties We may receive personal information about you from third party sources such as your employer or other third parties if they enrol you on a course or create an account on your behalf, or agencies if you apply for study, but only where we believe that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us.

We collect only the minimum amount of information required from these third parties to enable us to provide the requested service or process any application you send to us (for example, your educational or employment history). We only use the information we receive from these third parties as set out in this Privacy Notice.

We collect this information for the purposes described in this Privacy Notice, and we also may process your data in relation to COVID-19 or within other crisis management activities.

The table below describes the categories of personal information we collect from and about you through our Services.

Special Category Data

Certain personal data we collect is treated as a special category to which additional protections apply under data protection law e.g. personal data revealing racial or ethnic origin, religious beliefs, or health-related information.

Special Category Data is only processed where it is necessary, for example to provide the necessary duty of care, or in support of our statutory and regulatory reporting obligations. Health information may be required to process reasonable adjustments within learning and examination environments or conditions.

Where we process Special Category Data, we will ensure we are permitted to do so under data protection laws, e.g. we have your explicit consent, the processing is necessary to protect your (or someone else’s) vital interests where you are physically or legally incapable of giving consent; or the processing is necessary to establish or exercise or defend legal claims.

2. Use of your Information

The information that we collect and store relating to you is primarily used to enable us to provide our Services to you. In addition, we may use the information for the following purposes:

• to provide information on other QA group products and Services which we feel may be of interest to you, in accordance with your communications and consent preferences;
• to ensure that all learners and/or delegates are able to access learning materials in a virtual environment including the provision of recorded classes and learning events;
• to allow us to make reasonable adjustments under the Equality Act, including the provision of recorded material for those learners and/or delegates who are unable to attend in person
• to meet our contractual commitments to you or the purchasing organisation or to take steps at your / their request before entering into a contract;
• to act on your behalf where third party involvement is available and appropriate – for example through a third party specialist training provider or certification/awarding body;
• to review the performance and effectiveness of Services and products, including related continual improvement activities;
• to comply with our legal and regulatory obligations, including but not limited to, applicable legislation surrounding COVID-19 test and trace or other crisis management schemes;
• to obtain additional personal information to secure funding or satisfy statutory legal or Government scheme requirements – for example through an Apprenticeship scheme or at the request of Education and Skills Funding Agency (ESFA) to provide data and information to such entity or government organisation;
• to market our Services (and those of selected third parties) to:
• existing and former customers,
• third parties who have previously expressed an interest in our Services,
• third parties with whom we have had no previous dealings, or
• an individual or organisation that we have collected personal contact data for prospecting to.
• to support internal efficiency, training and quality control activities;
• to analyse and monitor your use of our AI products or features to ensure:
• compliance with our terms of use,
• for partners, such as exam bodies’, and
• help develop, improve, and provide our Services.
• We may process and analysis your personal data, such as AI User Content, Usage Data and Learner Account Data, using AI for the purposes of providing and enhancing the services. This includes, but not limited to, personalise, and contextualise responses within AI products or features, such as the Learning Assistant and Lab Assistant.
• We will not use your AI User Content to train our AI products or features;
• We will use our Website Data and Usage Data to monitor and analyse trends, usage and activities in connection with our Websites/Services; and
• as necessary to prevent or detect crime.

We may also monitor or record telephone calls for training, customer service and quality assurance purposes, and to detect or prevent crime. These recordings will be retained for a maximum of 30 days.
In general, we will use any of the information we collect from you only for the purposes described in this Privacy Notice or for purposes that we explain to you at the time we collect such information.

However, we may also use your personal information for other purposes that are not incompatible with the purposes we have disclosed to you (such as statistical purposes) if and where this is permitted by applicable data protection laws.

If you do not want us to use your data for any marketing purposes, you will have the opportunity to withhold your consent to this when you provide your details to us. Marketing consent can be varied online via our consent portal at cp.qa.com or through unsubscribe links presented to you in our communications. Please see section on Data Protection Rights for further details.

3. Storing and retaining your personal data

The personal information provided to us is stored within secure servers. We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information.

All QA email addresses support TLS email encryption, so it is advised that if you are concerned about the contents of any email to use this encryption. Where we have given you (or where you have chosen) a password so that you can access certain parts of our sites and portals, you are responsible for keeping these passwords confidential.

Please note that the transmission of information via the internet (including email) is not completely secure and therefore, although we endeavour to protect the personal information you provide to us, we cannot guarantee the security of data sent to us electronically and the transmission of such data is therefore entirely at your own risk.

We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

When we have no ongoing legitimate business or statutory need to process your personal information, we will either delete or anonymise it.

4. Disclosing your Information

We may disclose your personal information to any company within our corporate group. This includes, where applicable, our subsidiaries, our holding company and its subsidiaries. This will only be done where lawful bases exist.

We will also disclose, where required, your personal information with:

• third party service providers and partners who provide data processing services to us (for example, to support the delivery of Services), or who otherwise process personal information for purposes that are described in this Privacy Notice;
• your employer, where they have instructed us or funded the goods or services provided to you. This may include progression, assessment, attainment or exam results as well as other personal data as and when required;
• a third party where they have funded the Services that we deliver to you or your organisation;
• the purchasing organisation or course vendor in respect of any product evaluation or feedback comments you provide;
• exam certification bodies where reasonable adjustments are required on health grounds;
• National Health Service (NHS) or other authorised government agencies in connection with COVID-19 containment measures or other crisis management scenarios;
• government agencies, where required by the scheme or education path you elect to follow;
• regulatory bodies and supervisory authorities to comply with our legal and regulatory obligations;
• the ESFA or similar entity or government organisation;
• partners with whom we work to provide Services (such as course vendors, examination bodies, customer suppliers and trainers);
• regulatory bodies or other third parties relating to audits, enquiries or investigations in compliance with applicable law;
• other commercial organisations with regards to potential work placements or provision of, or attendance at, employment fairs;
• any third party in connection with, or during negotiations of, any merger, sales of company assets, financing or acquisition of all or a portion of our business by another company;
• any law enforcement agency, court, regulator, government authority or other third party where we believe this is necessary to comply with a legal or regulatory obligation (and may not be able to inform you so as not to compromise any investigation or other proceedings), or otherwise to protect our rights or the rights of any third party; and to
• any other person where we have a legitimate interest or with your consent to the disclosure.

Where you are a customer or prospective customer, we may disclose your data to third parties for our marketing purposes so that we can identify products and services we think you will be interested in. Personal data used in this way may include contact details such as name, address, phone number, and email address. When sharing with third party marketing organisations, your data may be processed in countries inside or outside of the EEA (includes EU), Switzerland and/or UK.

5. Third Party Links

You might find links to third party websites on our Websites or within documentation we provide. If you access other websites using the links provided, the operators of these sites may collect information from you which will be used by them in accordance with their own Privacy Notices which you should review.

We do not accept any responsibility or liability for their policies whatsoever as we have no control over them.

6. Social Networking

Our Websites may offer you the opportunity to share or follow information about us (using third party social networking functionality (such as through "share this", "like" or "follow" buttons).

We offer this functionality in order to generate interest in us, the Websites and our Services among the members of your social networks, and to permit you to share and follow opinions, news and recommendations about us with your friends. However, you should be aware that sharing personal or non-personal information with a social network may result in that information being collected by the social network provider or result in that information being made publicly available, including through Internet search engines.

Please note that we do not exercise, endorse, secure or control the policies or practices of any third party social network whose functionality you may access through our Websites.

You should always carefully read the Privacy Notice of any social network through which you share information in order to understand their specific privacy and information usage practices.

7. International data transfers

QA is a global organisation. In order to provide our Services to you, your personal data may be transferred to, stored in and processed in, countries outside of the EEA (includes EU), Switzerland, the UK and/or the United States. If you are using our Services from:

• outside the United States, you acknowledge your personal data may be transferred, stored and processed in the United States or other countries and that your personal data will be processed by entities and individuals either operating outside of the EEA (includes EU), Switzerland, and/or the UK for the purposes as described in this Privacy Notice; or
• within the United States, you acknowledge your personal data may be transferred, stored and processed in the UK, Switzerland, the EEA (includes EU), and/or other countries and that and that your personal data will be processed by entities and individuals operating outside of the United States for the purposes as described in this Privacy Notice

These entities and individuals include subsidiaries and affiliates of QA Limited and QA USA, Inc. as well as various business partners and counterparties. Transfers of your personal data are legally permitted, amongst other mechanisms, under the QA Group’s intra-group data sharing agreement and contractual agreements that include standard contractual clauses for controllers, and where relevant for processors.

When we transfer, store, or process your data, we do so in accordance with this Privacy Notice and applicable law, including the implementation of appropriate and adequate safeguards in seeking to ensure that personal data is transferred to an adequate level of protection.

We are conscious of our obligations as of March 2022 in relation to international data transfers of personal data outside of the EEA and/or the UK and seek to implement a risk assessment with respect to these international transfers, either in accordance with EU Standard Contractual clauses with the addition of the UK addendum or the International Data Transfer Agreement; in each scenario to seek compliance with law and regulation.

For further information please see: QA Ltd Data Processing and Data Sharing Agreements 

8. Data Privacy Framework

QA USA, Inc. (formerly Cloud Academy, Inc.)  does not only rely on the QA Group’s intra-group data sharing agreement and contractual agreements as their only legal basis for transfers of personal data but also complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.  QA USA, Inc. (formerly Cloud Academy Inc.)  has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.  QA USA, Inc. (formerly Cloud Academy Inc.)  has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.  To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

QA USA, Inc. (formerly Cloud Academy, Inc.)  is responsible for the processing of personal data it receives, under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF and subsequently transfers to a third party acting as an agent on its behalf. QA USA, Inc. (formerly Cloud Academy Inc.)  complies with the EU-U.S. DPF Principles and the Swiss-U.S. DPF Principles for all onward transfers of personal data from the EU, UK, and Switzerland, including the onward transfer liability provisions.

The Federal Trade Commission has jurisdiction over QA USA, Inc.’s (formerly Cloud Academy, Inc.) compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF). QA USA, Inc. (formerly Cloud Academy Inc.)  may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

If there are any unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, QA USA, Inc, (formerly Cloud Academy, Inc) commits to refer unresolved complaints to JAMS, an alternative dispute resolution provider based in the United States.  If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information or to file a complaint.  The services of JAMS are provided at no cost to you. Under certain conditions you may also be entitled to invoke binding arbitration. Further information can be found on the official DPF website: https://www.dataprivacyframework.gov/.

For complaints regarding EU-U.S. DPF, the UK Extension to the EU-U.S DPF, and Swiss-U.S. DPF compliance not resolved by any of the other DPF mechanisms, you have the possibility, under certain conditions, to invoke binding arbitration. Further information can be found on the official DPF website: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction

9. Cookies

We use cookies and similar tracking technology (collectively, "Cookies") to collect and use personal information about you. For further information about the types of Cookies we use, why we use them and how you can control Cookies please see our Cookie Notice at: www.qa.com/legal-privacy/cookie-notice.

10. Lawful Basis (EEA and UK visitors only)

Our lawful bases for collecting and using personal information will depend on the personal information being collected and the specific context in which we collect it.

However, we will normally collect personal information from you or appropriate third parties only:

• where we need the personal information to perform a contract with you (for example, to enrol you into a course or provide you with learning materials);
• where the processing is undertaken on the grounds of legitimate interest and is not overridden by your rights;
• where we have your consent to do so; or
• where we need the personal information to fulfil legal obligation;
• where we need to protect vital interests of the individual or other individuals. In this instance we only use personal information to seek and provide care in association with emergency services and agencies.

A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and freedoms. We carry out an assessment when relying on legitimate interests, to balance our interests against your own.

If we collect and use your personal information in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our platform or for our legitimate commercial interest, for instance, when responding to your queries, improving our platform, undertaking marketing, or for the purposes of detecting or preventing illegal activities. We may have other legitimate interests and if appropriate we will make clear to you at the relevant time what those legitimate interests are.

In some cases, we may also have a legal obligation to collect personal information from you.

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

In respect of data processed within COVID-19 frameworks processing is carried out under the basis of either:

• Legal obligation;
• Substantial public interest; or
• Vital interests of the individual or other individuals.

If you have queries concerning the lawful bases on which we collect and use your personal information, please contact us using the contact details provided below.

11. Sale of personal data

We do not “sell” or “share” Personal Information as defined under California and other applicable USA state privacy laws, other than to our subprocessors for the purposes of providing our products and services. Please see more information in our Supplementary QA Group Privacy Notice.

12. Marketing

We may use your personal data to send you updates (by email, text message, telephone or post) about our Services including exclusive offers, promotions or new Services.

Where we do not have explicit consent to send you marketing information, we may still have a legitimate interest in using your personal data for marketing purposes. When we use legitimate interest as a lawful basis we will provide you with the option to opt out of receiving further marketing communications.

If we change our marketing approach in the future so that consent is needed, we will ask for this separately and clearly. You have the right to opt-out of receiving marketing communications at any time by:

• contacting us at privacy@qa.com;
• using an ‘unsubscribe’ link in emails or ‘STOP’ number in texts; or
• updating your marketing preferences on applicable links provided to you e.g. cp.qa.com.

We may ask you to confirm or update your marketing preferences if you ask us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.

We will always treat your personal data with the utmost respect and never sell it to other organisations outside the QA Group including for marketing purposes. We only allow certain organisations to handle your personal data if we are satisfied they take appropriate measures to protect your personal data.

We also impose contractual obligations on them to ensure they can only use your personal data to provide services to us and to you.

Usually information will be anonymised (or pseudonymised) but this may not always be possible. The recipient of any of your personal data will be bound by confidentiality obligations.

13. Data Protection Rights

You have the following data protection rights, which you can exercise using the details under ‘Contacting us’ or as otherwise directed below:

• You have the right to access, correct, update or request deletion of your personal information. In addition to contacting us, you may update/amend your learner profile information within your account settings.
• You can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information (i.e. your data to be transferred in a readable and standardised format).
• You have the right at any time to request the use of your personal information contained within AI products or features is removed. This removal is to the extent legally and practically possible. This will not affect the lawfulness of any processing we conducted prior to request of removal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent, such as legitimate interest.
• You have the right at any time to request that we stop processing your personal data in AI, but such withdrawal may affect QA’s ability to provide the full scope of Services. This removal is to the extent legally and practically possible. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal.
• You have the right at any time to opt-out of marketing communications we send you. You can exercise this right by following links within emails to ‘Unsubscribe’ or ’Manage your Marketing Preferences’ or similar in marketing and outreach e-mails we send you, or directly within our consent portal at cp.qa.com, or as per ‘Contacting us’. This will not prevent legitimate service-related communications.
• Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
• You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority, such as the ICO in the UK who QA Limited is registered with.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

14. Data Retention

We may retain all categories of your personal information described above for as long as needed to carry out the purposes described herein or as otherwise required by applicable law. Unless we are required or permitted by law to keep your personal information for a longer period of time, when your personal information is no longer necessary to carry out the purposes for which we process it, we will delete your personal information or keep it in a form that does not permit identifying you. When determining the retention period, we take into account various criteria, such as the nature of the use of the Websites, your general relationship with us, the impact on our ability to provide you the Websites if we delete your personal information, mandatory retention periods provided by law and the statute of limitations, and our use of your personal information for aggregated market research.

15. Contacting us

The data controller of your personal information will be the QA group entity that you are dealing with, and as such will be one of the following:

• IndigoCyan TopCo Limited
• Seckloe 208 Limited
• QA Limited
• QA Consulting Services Limited
• QA Consulting USA Inc
• QA Gateway Limited
• QA USA, Inc.
• QA Group Americas, Inc.
• QAHE Limited
• QAHE (SU) Ltd
• QAHE (UR) Limited
• QAHE (Ulst) Limited
• QAHE (NU) Limited
• QAHE (Mdx) Limited
• QAHE (Services) Limited
• QAHE (Solent) Limited
• QAHE (LM) Limited
• Branch Campus (London and Birmingham) Limited NI
• Northumbrian London Campus Limited
• Roehampton Pathway Campus Limited
• Solent Pathway Campus Limited
• Cloud Academy SAGL
• Circus Street London Limited
• Circus Street Australia Pty. Limited
• Circus Street (SG) Pte/ Singapore

We welcome any queries, comments or requests you may have regarding this Privacy Notice. Please do not hesitate to contact us via email at: privacy@qa.com.

16. Changes to the Privacy Notice

We may change this Privacy Notice from time to time by updating this document.

The online version is available at: www.qa.com/legal-privacy/privacy-notice. You should check this page from time to time to ensure that you are happy with any changes.

If material changes are made to this Privacy Notice, we will notify you by placing a prominent notice on the Website or by contacting you to let you know via the contact details you have provided us with.

Changes in this version:

• Updates to the following “Personal Information we Collect” and “Use of your Information”.