Privacy Policy

This Privacy Policy explains how the Peel Professional platform (“we”, “us”, “our”) collects, uses, stores, and protects your personal data. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data controller

The data controller is Peel Professional.
Contact: postmaster@peelprofessional.uk

Where the platform is provided to you through an employing organisation or training provider, that organisation is a joint or independent controller of your assessment records for its own purposes. This policy describes the processing carried out by the platform itself.

2. Personal data we collect

a. Data you provide

• Account data: name, email address, username, password (stored as a bcrypt hash — never in plain text), phone number, department, profile image.
• Portfolio and evidence data: files, images, video, documents and text you upload as evidence or assignment submissions; any personal data contained within your uploads.
• Assessment data: examination answers, assignment submissions, grades, feedback received.
• Communications: messages sent via the built-in messenger, support requests sent by email.
• Consent records: your acceptance of our data processing agreements, with timestamp and IP address.

b. Data collected automatically

• Session data: a session identifier linked to your user account, stored securely in the database.
• Activity logs: see Section 5 for full details of what is recorded on every action.
• Login attempt data: timestamp, IP address and outcome (success or failure) of every login attempt, used to detect and prevent unauthorised access.
• Technical data: IP address, browser type, operating system and user agent string, collected as part of session and audit logging.

We do not collect payment data. The platform does not have payment functionality.

3. How we use your personal data

Purpose	Lawful basis (UK GDPR)
Providing and managing your user account	Contract performance (Article 6(1)(b))
Hosting, storing and processing your portfolio submissions and assessments	Contract performance (Article 6(1)(b))
Enabling communication between users via the messenger	Contract performance (Article 6(1)(b))
Sending email notifications about your account and assessments	Contract performance / Legitimate interests (Article 6(1)(f))
Maintaining security, detecting unauthorised access and preventing fraud	Legitimate interests (Article 6(1)(f))
Comprehensive activity logging for audit, accountability and investigation	Legitimate interests (Article 6(1)(f))
Managing GDPR rights requests and consent records	Legal obligation (Article 6(1)(c))
Complying with educational record-keeping requirements	Legal obligation (Article 6(1)(c))

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Sharing your personal data

We share personal data only in limited, necessary circumstances:

• Other users within the platform: tutors, assessors and administrators can view your portfolio, submissions and progress data as required to deliver your learning programme. Administrators can view activity logs.
• Hosting infrastructure: the platform runs on a web server and database operated under appropriate data processing arrangements.
• Email delivery: notifications are sent via a configured SMTP service.
• Antivirus scanning: uploaded files may be scanned using ClamAV (local) or VirusTotal (cloud-based, if configured). If VirusTotal is used, file hashes or contents may be transmitted to VirusTotal's servers. Refer to VirusTotal's Privacy Policy for details.
• Bot protection: the login page may use Cloudflare Turnstile. Refer to Cloudflare's Privacy Policy.
• Legal requirements: we may disclose data to law enforcement, regulators (including the ICO) or courts where legally required.

We do not sell personal data or share it for marketing purposes. If data is transferred outside the UK, we use appropriate safeguards (adequacy decisions or standard contractual clauses).

5. System activity logging

To maintain the security and integrity of the platform, we automatically record a log of all activity within your account. This applies to all users. The following is recorded on every action:

• Your user account identifier
• The date and time of the action (to the millisecond)
• Your IP address at the time of the action
• Your browser and device information (user agent string)
• The page or function accessed (URL and HTTP method)
• The type of action performed (e.g. login, file upload, evidence submission)
• File moderation actions (for example: file quarantined, quarantine released, file deleted)
• Whether the action succeeded or failed
• A risk classification (low, medium, high or critical) assigned to the action type
• The session identifier associated with the action

Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)) — maintaining platform security, detecting and investigating unauthorised access, preventing fraud and ensuring accountability.

Retention: Activity logs are retained for 90 days in active storage, then archived automatically. See our Data Retention Policy for full details.

Access: Logs are accessible only to users with administrator-level permissions and are not visible to other users. Logs may be disclosed to law enforcement or the ICO where legally required.

Your rights: You may request a copy of the activity logs recorded against your account as part of a Subject Access Request.

6. Data retention

We retain personal data only for as long as necessary. Full details are in our Data Retention Policy. In summary:

• Educational records (portfolio, evidence, assessment data): 7 years after programme completion
• Account data: duration of account, deleted within 30 days of a confirmed erasure request
• Activity and security logs: 90 days active, then archived
• Database backups: 90 days, then deleted automatically

7. Security

We implement technical and organisational measures to protect personal data, including:

• Bcrypt password hashing (cost factor 12)
• CSRF token protection on all forms
• Session cookies set with HttpOnly and SameSite=Strict flags
• Role-based access control with over 100 granular permissions
• Antivirus scanning of all uploaded files
• Encryption of uploaded files at rest (AES-256-GCM) when encryption is enabled by system configuration
• Rate limiting on login attempts (lockout after 5 failures for 15 minutes)
• Encrypted database backups (AES-256-GCM)
• Comprehensive audit logging

No online system can guarantee absolute security. In the event of a personal data breach, we will notify the ICO within 72 hours where required and affected individuals without undue delay.

8. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data (subject to legal retention obligations)
• Restriction: request that we limit processing in certain circumstances
• Portability: receive your data in a machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent

To exercise any right, contact postmaster@peelprofessional.uk. We will respond within one month (extendable to three months for complex requests). You may also lodge a complaint with the Information Commissioner's Office at ico.org.uk.

9. Third-party data in uploads

If your uploads contain personal data about other individuals (for example, names or contact details of clients or colleagues included as professional practice evidence), you are responsible for ensuring you have a lawful basis for including that data. We process it solely to provide the platform to you.

10. Age restriction

The platform is intended for adult users (18 and over) in a professional or educational context. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us immediately.

11. Changes to this policy

We may update this Privacy Policy. Material changes will be communicated via the platform or by email. Continued use after notification constitutes acceptance. Where required, we will seek fresh consent.