Privacy Policy

1. Who we are

Pathway Skills is a Functional Skills assessment and learning platform operated by Pathways+ Limited, a company registered in England and Wales under company number 16968898, with its registered office at 24 Beaumaris Close, Dudley, England, DY1 3LX.

Pathways+ Limitedis the "data controller" for the personal information we hold about you under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

You can contact our Data Protection Officer by email at help@pathway-skills.com or by post at the registered office address above.

2. The personal data we collect

When you or your training provider use Pathway Skills, we collect:

• Account information — your name, email address or username, hashed password, role (student, teacher, organisation manager), the training-provider organisation you belong to, and optional profile details.
• Learning activity — Initial Assessment and Diagnostic Assessment responses, practice-question attempts, topic test scores and the answers you give on a topic test (which the teachers in your organisation can review with you, question by question), mock exam attempts, Individual Learning Plan (ILP) progress, and timestamps of your activity.
• Course and enrolment data — the courses you are enrolled on, the groups you belong to, and the teachers assigned to you.
• Technical data — IP address, browser, device information, and session cookies necessary to keep you signed in. See section 9 for cookie detail.
• Support correspondence — any messages you send us at help@pathway-skills.comor through the platform's messages feature.

3. How we use your data and our lawful basis

We only process your personal data when we have a lawful basis under UK GDPR Article 6:

• Contract (Article 6(1)(b)) — to provide the Pathway Skills service to you and your training provider, including account creation, assessment delivery, progress tracking, and support.
• Legal obligation (Article 6(1)(c)) — to meet record-keeping obligations that apply to your training provider under its funding contract with the Department for Education (DfE). The Education and Skills Funding Agency closed on 31 March 2025 and its functions moved to the DfE.
• Legitimate interests (Article 6(1)(f)) — to secure the platform, prevent abuse, and improve our service. We balance these interests against your rights.
• Consent (Article 6(1)(a)) — for non-essential cookies or any optional marketing communications. You can withdraw consent at any time.

4. How long we keep your data

We keep your learning records for as long as you are actively enrolled with your training provider. After that, how long we keep them depends on how your learning was funded.

If your learning is funded by the DfE — which covers most Functional Skills and apprenticeship delivery — your training provider is required by its funding contract to keep your learner record and evidence pack for at least six years from the end of the DfE financial year (which ends on 31 March) in which the final payment for your learning was made, and for at least six years after the end of the contract you were funded under. Because that six-year clock only starts at a year end, a record can in practice still be held for up to seven years in total before it becomes due for deletion. We keep your records for that whole period so your provider can meet its obligation, and we cannot delete them on request while it runs.

If your learning was part-funded by the 2014 to 2020 European Social Fund, the funding contract requires records to be kept until at least 31 December 2034.

If your learning is not DfE-funded, we keep your records for six years after your enrolment ends. That matches the six-year limitation period for contractual claims under section 5 of the Limitation Act 1980, so that we can deal with any dispute that arises about the service.

Technical logs (IP address, security events) are kept for up to 12 months. Support email correspondence is kept for up to 3 years. Backups that include your data are held for up to 35 days after deletion, after which they are overwritten.

If you ask us to delete your account, we tombstone your record immediately so no-one can use your email or username again, and purge the underlying personal data at the next scheduled cleanup cycle unless we are legally required to retain it.

5. Who we share your data with

Your training provider and the teachers assigned to you can see your progress, assessment results, and account details — that is the point of the platform.

A small number of Pathway Skills staff can see your account when they need to: to help your training provider with a support request, to follow your provider's instructions (for example moving your account), to investigate a security problem, to fix a fault in the platform or its data, or because the law or a regulator requires it. They have to choose one of these reasons and explain it before they can see anything. Their access lasts up to 60 minutes at a time. They can look but not change anything, apart from a few things you or your provider ask for, like sending you a password reset. They never see or set your password: the reset link goes to your own email address. Each time, we record who looked, when and why, and your training provider can see that record.

We do not sell your data. We share personal data with our own processors, listed below, strictly to run the service:

• Hosting — Vercel Inc. hosts the application on Vercel London (lhr1 edge).
• Database — Neon Inc. stores the underlying data on Neon Postgres (AWS Europe West 2, London). A sub-processor list is available on request.
• Email delivery — Resend, Inc. sends transactional emails (password reset, welcome, notifications).
• Error monitoring — Functional Software, Inc. trading as Sentry (opt-in) collects error reports to help us diagnose issues.
• Product analytics — Plausible Insights OÜ (EU-hosted, privacy-friendly). No cookies used. Your IP address and browser details are used briefly to count unique visits and are not stored.
• AI tutor inference— Anthropic, PBC (United States) processes free-text messages you send to the Miles Socratic tutor, together with the topic name and lesson context, to generate the tutor’s response. Messages are processed in transit only; Anthropic does not train its models on this data under our zero-retention API agreement. See section 6 for the international-transfer safeguard.

Each processor is bound by a data processing agreement that requires them to protect your data and only use it on our instructions.

Your training provider's own systems. Your training provider can ask us to send some of your details to its own systems, like HubSpot or Salesforce. This could include your name, contact details, course and progress. Your training provider decides this and looks after your details there. Some of these systems store data outside the UK. Ask your tutor which systems your training provider uses.

Safeguarding alerts from Miles.When you chat with Miles on a topic page, it checks your messages for signs you may not be safe. For example, that you're thinking about suicide or hurting yourself, that someone is hurting you, or that you haven't eaten or have nowhere to live. It also checks its own replies, in case a reply has had to point you to support. If either check is triggered, Miles stops the study help. It points you to your tutor or your provider's safeguarding lead. We mark the conversation for your training provider to review. We keep a record that the check was triggered: when, which check and which conversation. The record does not include your message. For the check on Miles's reply, the record keeps the start of that reply. If your provider has given us a safeguarding email address, we email that person. The email has your name, the topic you were studying and a link to the conversation. It does not include what you wrote. Resend, our email service, sends it for us.

Miles is a computer program. It only recognises some clearly worded messages and will miss others, and it sometimes pauses a conversation that didn't need it. It doesn't check answers it marks (in practice, tests or mock exams) or messages to tutors. It is never a substitute for talking to a person.

Managers at your training provider, and the tutors assigned to you, can open the conversation. Nothing is decided about you automatically. A person at your provider decides what, if anything, happens next. The first check runs before your message leaves Pathway Skills. If it doesn't spot a worry, your message goes to Anthropic so Miles can reply, as described above. If you email us about a worry, we pass it to your provider.

We do this to keep learners safe and to help your provider meet its safeguarding duties. Our lawful basis is legitimate interests (Article 6(1)(f)) [DPO: plus vital interests, Article 6(1)(d), where a life may be at risk]. An alert can reveal information about your health, or about a crime against you. So we also rely on the "safeguarding of children and of individuals at risk" condition in the Data Protection Act 2018 (Schedule 1, paragraph 18). Our appropriate policy document explains how, and you can ask us for a copy. We don't ask for your consent first, because waiting for it could delay help.

We keep a flagged conversation, and the record of the alert, for as long as we keep your learner record (section 4). This is because your provider may need them for its own safeguarding records. [DPO: retention period for other Miles conversations. Publish it only once deletion actually runs.] You can ask for a copy of this information in the same way as any other (section 7).

6. International data transfers

Most of our processors host your data in the UK or EU. Where a processor processes data in the United States — currently Anthropic, PBC (Miles AI tutor inference) and Functional Software, Inc. trading as Sentry (opt-in error monitoring) — we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses as the safeguard.

8. Security

Passwords are stored as salted bcrypt hashes; we never see or store the password itself. All traffic is encrypted in transit with TLS. Administrative access to production data is restricted and logged. We review our security measures regularly.

9. Cookies

Pathway Skills uses strictly necessary cookies to keep you signed in and to protect against cross-site request forgery (for example, our NextAuth session cookie). These cookies are set automatically because the service cannot function without them.

Non-essential technologies (for example, page-visit analytics) run only with your consent, captured via our cookie banner at first visit. Your choice is stored in your browser's local storage, not in a cookie, and is never sent to us.

You can change or withdraw that consent at any time, as easily as you gave it — select Cookie settings here or in the footer of any page to re-open the banner with your current choice, change it, and save.

10. Learners under 18 and the AADC

Pathway Skills is intended for learners aged 16 and over studying Functional Skills with a registered UK training provider. If you believe a child under 16 has an account set up without parental consent, please contact help@pathway-skills.com and we will investigate.

Some learners on the platform are 16 or 17. The Information Commissioner's Office (ICO) Age Appropriate Design Code (the "Children's Code") applies to any online service likely to be accessed by under-18s.

What this means in plain English:

• No advertising. Ever. Your training provider pays for Pathway Skills. We do not sell your data, share it with advertisers, or build profiles for ad targeting.
• No engagement tricks.We don't use countdown timers on consent dialogs or dark-pattern friction on privacy settings.
• You're in charge. You can see your data, correct it, take a copy with you, or ask us to delete it. See section 7 above and our Security and trust page for the full list. If you're not sure about anything, ask your tutor — there's no wrong question.

Our full AADC self-audit covering all 15 standards is available on request alongside our Data Processing Agreement. Contact help@pathway-skills.com to ask for a copy.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified to you in-app or by email. The version date at the top of this page always reflects the current edition.