How we assess high-risk processing
Last updated: August 2026
We check your identity, record some remote tests, and use software to help assessors sort evidence. Because of that, the law asks us to assess the risks properly. This page is the short public summary of that assessment.
SiteTicket is the delivery centre and the controller for your enrolment, identity evidence, assessment recordings, and qualification records. The SkillCertify platform companies run the software on the centre's instructions. GQA is a separate controller for the data it needs to register and certificate you.
1. What this covers
- Identity verification at registration, so the person who enrols is the person who sits and is certificated.
- Recorded remote sittings for official Level 1 knowledge tests and the CSCS HS&E test, when that sitting is invigilated live. See the recording notice.
- AI evidence checks for NVQ evidence (completeness checks and a draft note). A person still decides. See how assessment decisions are made.
2. What we do not do
- We do not sell your data.
- We do not run third-party analytics or tracking scripts on this site.
- We do not let a model pass, fail, or certificate you.
- We do not automatically report a concern to GQA. A person does that when it is required.
3. How long records are kept
Learner and course records are kept for 7 years after the course ends, under our retention policy. Remote-invigilation recordings have the shorter limit of 1096 days (three years), which meets our awarding body’s twelve-month floor. We delete records when their retention period ends unless a legal hold applies.
4. Your rights
You can ask for a copy of the data we hold, ask us to correct it, or ask us to delete it where the awarding-body rules do not require us to keep it. Contact privacy@siteticket.co.uk. The full privacy policy lists every right.