Your data.
Your privacy.

01Who is responsible for your information?

A Security Academy Ltd (ASA) is the controller of the personal information covered by this notice. Company number: 16889426.

Registered with the ICO

Data protection registration

A Security Academy Ltd is registered with the Information Commissioner’s Office, the UK’s independent regulator for data protection.

Reference

ZC146640

Registered

13 May 2026

Expires

12 May 2027

Registration period: 13 May 2026 – 12 May 2027

View certificate Download PDF Verify on ICO register

View full size

This policy covers our website and course-related pages, enquiries, bookings, teaching, assessment and learner support. It applies to prospective learners, learners and people contacting us on their behalf.

Contact us at info@asecurityacademy.com, call 07541 999 007, or write to A Security Academy, 2 Ditchfield Road, Hayes, London, UB4 9BH.

02Information we collect

• Enquiries and bookings: your name, contact details, chosen course, agreed dates and correspondence.
• Learner registration and checks: date of birth, address, copies of passports or other accepted identity documents, proofs of address, relevant qualifications and licence details where needed for your course. Copies are retained after the course where required for approved-centre compliance, verification and audit purposes.
• Training and assessment: attendance, e-learning certificates, workbooks, assessment evidence, results, feedback, certificates and resit records. We retain learner photographs and video recordings with audio as training and assessment evidence, including practical assessments and evidence needed for quality assurance.
• Premises CCTV: images of learners, staff and visitors captured by CCTV at our training premises.
• Payments: amounts paid, transaction references, receipts, balances and refund information. Do not send full card numbers, security codes or online-banking passwords to ASA.
• Support needs: information you choose to provide about accessibility, health or learning support where relevant to safe participation or reasonable adjustments.
• Website use: technical information such as IP address, browser, device, pages requested and security logs, depending on the service you use.

We normally obtain information from you. We may also receive relevant information from someone booking for you, your employer or sponsor, our payment and learning services, or the awarding organisation administering your qualification.

03Why we use it

Where we rely on legitimate interests, we consider your rights and the impact on you. Providing core identity, eligibility and assessment information may be necessary to register you or award a qualification. If you do not provide it, we may be unable to offer or complete the relevant service.

04Health information, recordings and CCTV

Health and disability information needs additional protection. For optional support or adjustment requests, we ask for explicit consent where that is the applicable condition, alongside an appropriate lawful basis. If a different condition is necessary—for example, for a legal claim—we explain it where appropriate.

Share only the information needed to explain your request. Access should be limited to the staff or assessment personnel who need it. Contact us privately rather than posting sensitive information in a group chat.

Photographs, video and audio evidence

We keep identifiable photographs and video recordings with audio to document training and assessment, demonstrate learner performance and support internal or external quality assurance, audits, appeals and malpractice investigations. This processing supports our training contract and legitimate interests in maintaining reliable qualifications and meeting approved-centre requirements. Relevant evidence may be reviewed by authorised staff, quality-assurance personnel and the awarding organisation.

CCTV at our premises

CCTV operates at our training premises. We use relevant footage for premises security, the safety of learners, staff and visitors, and investigating incidents, relying on our legitimate interests in protecting people and property. CCTV footage is handled separately from course assessment recordings and is not used as promotional material. Contact ASA for information about the system covering your visit, including its coverage, operator and retention arrangements.

We distinguish assessment evidence from publicity photographs. Recording required for an assessment is not permission to use your image for marketing. We ask separately before using identifiable learner images for promotional purposes.

05Calls, WhatsApp and our AI receptionist

ASA uses an AI receptionist to help answer enquiries and pass details to the team. It processes what you say, your telephone number where available, and the enquiry or booking details you provide. Depending on the call-service settings, this may include audio, transcripts and call summaries.

We use these details to respond and arrange the service you request, relying on steps towards a contract and our legitimate interests in managing enquiries. Where calls are recorded or retained, a notice should be provided at the start of the call.

For a staff response, email info@asecurityacademy.com or message us on WhatsApp. Please ask the team to confirm eligibility, prices and booking arrangements; do not rely solely on an automated answer.

WhatsApp messages are handled through WhatsApp/Meta as well as ASA. If you follow a WhatsApp link, the message is sent when you choose to send it. Avoid sharing unnecessary financial or health information through messaging services.

06Who receives your information?

Relevant information may be shared with:

• Our authorised training team: tutors, assessors, invigilators and internal quality-assurance staff involved in your course.
• Awarding organisations and learning providers: for learner registration, e-learning, exams, certification, external quality assurance and malpractice investigations. The provider relevant to your qualification is identified during enrolment.
• Payment services: our bank and Stripe where you use a Stripe payment link, to process and reconcile payments or refunds.
• Service providers: website hosting, email, secure document storage, booking administration and the AI call-handling service used to provide our services.
• Professional advisers and public authorities: accountants, insurers, legal advisers, regulators or law-enforcement bodies where necessary and lawful.

If an employer or sponsor books your training, we explain any attendance or progress reporting arrangement. We do not treat sponsorship as permission to share unrelated personal information.

Some recipients act on our instructions; others, such as an awarding organisation or payment provider, have their own responsibilities and privacy notices.

07How long we keep information

Retention depends on the record and why it is needed. We use the following criteria, rather than keeping every record for the same period:

• Financial records: normally six years from the end of the company financial year they relate to; longer where tax rules or an ongoing enquiry require it.
• Learner and assessment records: the retention requirements for the particular qualification, including certification, quality-assurance and appeal periods. Relevant records may also be needed for unresolved complaints or claims.
• Passports, ID and proofs of address: copies are retained after course completion as part of our learner compliance records for the period required by the applicable approved-centre and qualification requirements, including verification, quality assurance and audit. Records relevant to an outstanding investigation, appeal or claim may be kept until it is resolved. Course completion does not automatically trigger deletion.
• Photographs and video recordings with audio: retained for the relevant assessment-evidence and quality-assurance period, including any applicable audit, appeal or investigation requirements.
• Premises CCTV: retained only for the period necessary for its security and safety purposes; relevant footage may be preserved for a specific incident, investigation or legal claim. Routine footage is not automatically retained for the same period as learner records.
• Support information: retained for the time needed to provide agreed support and meet relevant assessment or record-keeping requirements.
• Enquiries and call records: the time needed to handle and follow up the enquiry or resolve an associated dispute. A call recording need not be retained for the full lifetime of a learner record.
• Marketing choices: while the permission remains valid, with a limited suppression record where necessary to respect an opt-out.

Contact us for the retention period that applies to your course or a particular record. Information no longer required should be securely deleted or anonymised.

08Security and overseas services

We use appropriate technical and organisational measures to protect personal information and limit access to people who need it. No online system or transmission can be guaranteed completely secure. Please tell us promptly if you think information you have sent us has been exposed or sent to the wrong person.

Cloud, payment and communication services may process information outside the UK. Where a transfer is restricted under UK data-protection law, it must be covered by an applicable UK adequacy arrangement, appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, or a valid legal exception.

You can ask us which destinations and safeguards apply to the service handling your information, and how to obtain details of the relevant safeguards.

09Cookies and external websites

Cookies and similar technologies can support essential website functions, remember choices or measure website use. Their purposes and duration depend on the services enabled on the page you visit.

Technologies requiring consent should only be activated after you agree. You can refuse optional cookies without losing access to basic course information, and change a choice through the cookie controls provided on the relevant website. Browser settings can also block or remove cookies, although some functions may then stop working.

This privacy page does not add analytics or advertising trackers. Other ASA pages and external services may use different technologies. A privacy policy does not itself grant consent to optional tracking.

Links to payment, e-learning, review, map or social-media services take you to services with their own privacy information. Read their notices when you use them.

10Marketing and photographs

Booking confirmations, course instructions, results and payment reminders are service communications. They are different from advertising.

For optional promotional messages, we obtain consent where required or use another route permitted by the applicable marketing rules. You can opt out at any time by replying to the message or contacting ASA. An opt-out does not stop essential messages about a course you have booked.

Consent for promotional photographs or videos is separate from your booking. You can withdraw it for future use by contacting us; withdrawal does not make earlier lawful use unlawful.

11Your privacy rights

Depending on the circumstances, you can ask to access your personal information, correct it, erase it, restrict its use or receive certain information in a portable format. You can object to processing based on legitimate interests and to direct marketing. Where we rely on consent, you can withdraw it at any time.

Rights are not absolute: completing a course or asking for deletion does not automatically require us to delete records that we still have a lawful and necessary reason to retain. We assess requests against applicable qualification and approved-centre requirements, our lawful basis, tax obligations and any ongoing legal claims. We will explain if a request cannot be met. Safeguards may also apply to significant decisions made solely through automated processing; contact ASA if you want a person to review how an automated service has handled your enquiry.

Make a request by email, phone or post using the details below. We may need proportionate information to verify your identity. We normally respond within one month, subject to any lawful extension or adjustment to that period, and usually without a fee.

12Questions, requests or complaints

Tell us what happened or which information you want us to review. Include enough detail to locate your record, but do not attach identity documents unless we ask for them.

Please contact ASA with any privacy concern. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk · 0303 123 1113.

We update this policy when our services or data practices change. The date at the top identifies this version; significant changes may also be explained through an appropriate service communication.