DPIA: identity, recorded sittings, AI screening
SiteTicket Ltd (17373241), GQA centre 00454. Full narrative:
docs/centre-file/siteticket/ST-DPIA-01-identity-invigilation-ai.md.
Public summary: siteticket.co.uk/privacy/dpia. Lawful basis and
residual-risk acceptance are unsigned.
1. Why this is required
UK GDPR Article 35. The profile is systematic monitoring (live invigilation), new technology (AI pre-mark and liveness checks), sensitive data (face, voice, government ID, NI), and a real consequence if a sitting or an identity check is refused. This is not a nice-to-have.
2. Roles
| Party | Role |
|---|---|
| SiteTicket Ltd | Controller for enrolment, identity, recordings, assessor decisions, qualification records |
| SkillCertify Ltd | Controller for platform application-fee records. Processor for the centre on the software |
| SkillCertify Platform LLC | Processor / IP owner (Shams 2539013) |
| GQA Qualifications | Independent controller for the data the centre agreement requires |
3. What we process
| Stream | Data | Human loop |
|---|---|---|
| Identity (AOP-042) | ID image, liveness, name, DOB, status. Provider-agnostic. Stripe Identity is interim (US storage) | Staff review inconclusive or disputed checks. Vendor score does not award a qualification |
| Recorded sittings (AOP-026) | Webcam, mic, entire-screen share, consent, event timeline. Daily.co live; Cloudflare Stream retain. No extra ID image | Named invigilator. Malpractice escalation to GQA is manual. Flag default off |
| AI screening |
Evidence video, Whisper transcript, Claude pre-mark,
append-only ai_runs
|
Named assessor decides. IQA cannot sample their own assessments. See ST-POL-22 |
Retention: learner records 7 years (ST-POL-08). Invigilation recordings 1096 days (AOP-042 / Stream cap), which meets the AOP-026 12-month floor, then purge unless legal hold. The public privacy notice quotes the same figures.
4. Processors (August 2026)
Supabase (EU), Vercel, Cloudflare Stream, Daily.co (residency to confirm), Stripe (payments + interim identity), Anthropic, OpenAI Whisper, Tavus/Daily (interviews), Resend, GQA portal. No analytics vendor. WhatsApp is disabled. Struck services are not processors.
5. Lawful basis (counsel to complete)
| Processing | Suggested basis to test |
|---|---|
| Enrolment and certification records | Contract and/or legal obligation |
| Identity verification | Legal obligation (AOP-042) |
| Invigilation recording | Legal obligation and/or legitimate interests. AOP-026 consent may be a sitting control, not the GDPR basis |
| AI pre-mark / transcription | Legitimate interests, with ST-POL-22 as the safeguard |
Boxes still open: Article 9 on face video; LIAs; processor DPAs / SCCs; Daily.co DPA; identity-vendor residency.
6. Decision (draft)
Processing may continue in its current dark / interim form. Production invigilation stays flagged off until Daily residency, counsel sign-off, and GQA written acceptance are closed. Review August 2027 or on vendor / retention / method change.
| Role | Name | Date | Signature |
|---|---|---|---|
| Head of Centre | Stefana Strimbei | 14 August 2026 | Signed |
| Director | |||
| Advisor (lawful basis) |