Privacy policy

Last updated: August 2026

1. Introduction

SiteTicket is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your personal data when you use our website and mobile application ("the Service").

Contact for all privacy matters: privacy@siteticket.co.uk.

Some support and admin work is done by our software company in the UAE. UK law does not treat the UAE as automatically safe for personal data, so we use the standard UK data-transfer contract to protect it.

2. Information We Collect

To provide our qualification and assessment services, we collect the following types of data:

A. Information You Provide

Identity: your name, date of birth, National Insurance number and photo (for CSCS card and GQA registration).
Contact Data: Email address, phone number, and postal address.
Assessment Evidence: Videos, photos, and audio recordings of your work, and transcripts of professional discussions.
Identity Verification: Images of your government ID (passport/driving licence) and facial scans for liveness checks.

B. Information from Third Parties

CSCS: We may look up your existing card on the CSCS Smart Check website.

C. Information Collected Automatically

Usage and security data: IP address, browser type, interaction logs and limited first-party events, such as page views, application starts, checkout clicks and lead submissions. We use these to protect the service and understand how it is used.

3. How We Use Your Data

We use your data to provide and administer your assessment and card services, support service security and handle your requests. We do not sell your data.

Qualification delivery: To register you with GQA Qualifications, review NVQ evidence and process your qualification.
Card request: To request your CSCS card (Green, Blue, Gold, or Black) through GQA as your approved centre.
Identity verification: To check that you are the person taking the assessment. Stripe checks your ID document, selfie and liveness.
Communication: To send booking confirmations, assessment feedback and results by email; to reply to your messages; and to send WhatsApp updates where you have enabled WhatsApp messages for your account.
Launch notifications: If you ask to be notified when bookings open, we store your email address, language, selected course interest and consent record to send the update you requested. Contact us to withdraw that request. We also keep a hashed IP address to limit abuse of the form.
Payments: To process fees and generate invoices (via Stripe).

4. Data Sharing (Third Parties)

We share data only with the essential partners required to deliver your service:

GQA Qualifications: The Awarding Body, for registration and certification.
Stripe: For secure payment processing and, as our identity-check provider, identity verification (document, selfie, and liveness).
Cloudflare: For secure hosting and streaming of your assessment video evidence.
OpenAI: For transcribing assessment videos (audio-to-text) to assist assessors.
Twilio: For SMS and WhatsApp Business delivery of WhatsApp updates where your account preference permits them.

5. WhatsApp

The site’s WhatsApp link is the centre’s own business line (click-to-chat). We use the centre’s WhatsApp business line and Twilio to send WhatsApp updates where your account preference permits them and to reply to messages you send us. Staff can see and retain replies to handle your request. You can turn off WhatsApp updates in your account settings.

6. Data Retention

Learner and course records (enrolment, assessment evidence, verification, registration and certification): 7 years after the course ends, under our retention policy. Remote test and English verification recordings have the shorter limits below.
Remote test recordings: kept for 1096 days (three years). The awarding body’s twelve-month minimum is met. We delete them when this period ends unless a legal hold applies.
English verification recordings: the one-minute video, transcript and identity result are kept for 1096 days (three years) unless a quality-assurance hold applies. A centre assessor reviews the recording and decides whether your English is sufficient; there is no automated score.

7. Your data rights

You may ask us to provide a copy of your personal data, correct or erase it, restrict or object to some processing, or transfer data where the right applies. We will explain what we can provide and any records we must retain.

Access: Request a copy of the data we hold about you.
Correction: Request corrections to wrong information.
Deletion: Request deletion, subject to exceptions that may apply.
Portability: Receive your data in a structured format where the right applies.

To exercise these rights, contact us at privacy@siteticket.co.uk.

How tests are marked, who decides NVQ outcomes and how to request a human review are explained in How assessment decisions are made. A short summary of our impact assessment for identity checks, recorded sittings and assessor support is at How we assess high-risk processing. Other customer information is at Customer information.

8. Data protection contact

Contact us at privacy@siteticket.co.uk. SiteTicket Ltd is registered with the ICO, registration ZC219584. You can also complain to the ICO if you are not satisfied with how we handle your data.

9. Changes to This Policy

We may update this policy to reflect changes in our service or regulations. The latest version will always be available on this page.

Who we are

The Service is delivered by three entities, each with a distinct role:

SiteTicket Ltd, the GQA-approved delivery centre and the seller of the qualification and card services you buy. It is the Data Controller for your enrolment, assessment evidence, qualification and certificate records. Registered office: Zeus House, 16-30 Provost Street, London, N1 7NG.
SkillCertify Ltd, the UK platform company, which processes the application fees on payments taken through the platform. It is a Data Controller for payment and billing records connected to those fees.
SkillCertify Platform LLC (UAE), Formation No. 2539013. The software provider operating the platform the Service runs on. It processes your data on the instructions of the entities above (account management, hosting, support tooling).