Privacy Policy

1. Who we are

Pathway Skills is a Functional Skills assessment and learning platform operated by Pathways+ Limited, a company registered in England and Wales with its registered office at 24 Beaumaris Close, Dudley, England, DY1 3LX.

Pathways+ Limitedis the "data controller" for the personal information we hold about you under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

You can contact our Data Protection Officer by email at help@pathway-skills.com or by post at the registered office address above.

2. The personal data we collect

When you or your training provider use Pathway Skills, we collect:

• Account information — your name, email address or username, hashed password, role (student, teacher, organisation manager), the training-provider organisation you belong to, and optional profile details.
• Learning activity — Initial Assessment and Subject Knowledge Assessment responses, practice-question attempts, topic test scores, mock exam attempts, Personal Learning Plan progress, and timestamps of your activity.
• Course and enrolment data — the courses you are enrolled on, the groups you belong to, and the teachers assigned to you.
• Technical data — IP address, browser, device information, and session cookies necessary to keep you signed in. See section 9 for cookie detail.
• Support correspondence — any messages you send us at help@pathway-skills.comor through the platform's messages feature.

3. How we use your data and our lawful basis

We only process your personal data when we have a lawful basis under UK GDPR Article 6:

• Contract (Article 6(1)(b)) — to provide the Pathway Skills service to you and your training provider, including account creation, assessment delivery, progress tracking, and support.
• Legal obligation (Article 6(1)(c)) — to meet our obligations under education-funding rules where the provider is delivering an apprenticeship (e.g. ESFA record-keeping requirements).
• Legitimate interests (Article 6(1)(f)) — to secure the platform, prevent abuse, and improve our service. We balance these interests against your rights.
• Consent (Article 6(1)(a)) — for non-essential cookies or any optional marketing communications. You can withdraw consent at any time.

4. How long we keep your data

We keep your learning records for as long as you are actively enrolled with your training provider, and then retain them for up to six years after your enrolment ends. This retention period reflects funding-audit requirements for UK apprenticeship and Functional Skills delivery, and the general limitation period for contractual claims under English law.

Technical logs (IP address, security events) are kept for up to 12 months. Support email correspondence is kept for up to 3 years. Backups that include your data are held for up to 35 days after deletion, after which they are overwritten.

If you ask us to delete your account, we tombstone your record immediately so no-one can use your email or username again, and purge the underlying personal data at the next scheduled cleanup cycle unless we are legally required to retain it.

5. Who we share your data with

Your training provider and the teachers assigned to you can see your progress, assessment results, and account details — that is the point of the platform. We do not sell your data. We share personal data with the following categories of processors strictly to run the service:

• Hosting — Vercel Inc. hosts the application on Vercel London (lhr1 edge).
• Database — Neon Inc. stores the underlying data on Neon Postgres (AWS Europe West 2, London). A sub-processor list is available on request.
• Email delivery — Resend, Inc. sends transactional emails (password reset, welcome, notifications).
• Error monitoring — Functional Software, Inc. trading as Sentry (opt-in) collects error reports to help us diagnose issues.
• Product analytics — Plausible Insights OÜ (EU-hosted, privacy-friendly). No cookies used; no personal data is sent.
• AI tutor inference— Anthropic, PBC (United States) processes free-text messages you send to the Dr Clive Socratic tutor, together with the topic name and lesson context, to generate the tutor’s response. Messages are processed in transit only; Anthropic does not train its models on this data under our zero-retention API agreement. See section 6 for the international-transfer safeguard.

Each processor is bound by a data processing agreement that requires them to protect your data and only use it on our instructions.

6. International data transfers

Most of our processors host your data in the UK or EU. Where a processor processes data in the United States — currently Anthropic, PBC (Dr Clive AI tutor inference) and Functional Software, Inc. trading as Sentry (opt-in error monitoring) — we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses as the safeguard.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you (a "Subject Access Request").
• Rectify inaccurate or incomplete data.
• Have your data erased ("right to be forgotten"), subject to retention obligations in section 4.
• Restrict or object to our processing.
• Receive your data in a portable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email help@pathway-skills.com. We will respond within one calendar month.

If you are not satisfied with our response you have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.

8. Security

Passwords are stored as salted bcrypt hashes; we never see or store the password itself. All traffic is encrypted in transit with TLS. Administrative access to production data is restricted and logged. We review our security measures regularly.

9. Cookies

Pathway Skills uses strictly necessary cookies to keep you signed in and to protect against cross-site request forgery (for example, our NextAuth session cookie). These cookies are set automatically because the service cannot function without them.

Non-essential cookies (for example, anonymous usage analytics) are only set with your consent, captured via our cookie banner at first visit. You can change your preferences at any time by clearing the cookie banner setting and reloading the page.

10. Learners under 18 and the AADC

Pathway Skills is intended for learners aged 16 and over studying Functional Skills with a registered UK training provider. If you believe a child under 16 has an account set up without parental consent, please contact help@pathway-skills.com and we will investigate.

Some learners on the platform are 16 or 17. The Information Commissioner's Office (ICO) Age Appropriate Design Code (the "Children's Code") applies to any online service likely to be accessed by under-18s. We follow it.

What this means in plain English:

• One standard for everyone.The privacy protections we put in place for under-18s apply uniformly to all learners. We don't switch them on only when you tell us your age — they're the default.
• No advertising. Ever. Your training provider pays for Pathway Skills. We do not sell your data, share it with advertisers, or build profiles for ad targeting.
• No engagement tricks.Study reminders are tied to your actual session schedule. We don't use countdown timers on consent dialogs, dark-pattern friction on privacy settings, or streaks designed to make you anxious about missing a day.
• When your training provider gives us your date of birth — typically at enrolment — we apply additional defaults specifically for under-18 learners (engagement notifications default off; progress-sharing is opt-in rather than opt-out; weekly digest cadence is reduced). You can change any of these on your settings page at any time.
• You're in charge. You can see your data, correct it, take a copy with you, or ask us to delete it. See section 7 above and our Security and trust page for the full list. If you're not sure about anything, ask your tutor — there's no wrong question.

Our full AADC self-audit covering all 15 standards is available on request alongside our Data Processing Agreement. Contact help@pathway-skills.com to ask for a copy.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified to you in-app or by email. The version date at the top of this page always reflects the current edition.