Privacy Policy

1. Who we are

NSTN Ltd (“NSTN”, “we”, “us”) operates the Prevent Quality Mark training platform. This policy covers the platform itself, where school staff hold accounts and complete training.

• Registered company name: NSTN Ltd
• Company number: 15903464
• Email: admin@nstn.co.uk
• Registered with the Information Commissioner's Office, registration number: ZB743458

If you have any question about this policy, or about how we handle your information, email us at admin@nstn.co.uk.

2. Who decides how your information is used

Your school or organisation decides who gets an account and what training they are asked to complete. For your account details and your training records, your school is the data controller and we act on its instructions.

For the AI tutor, for keeping the platform secure, and for improving how the platform works, we make those decisions ourselves, and for those we are the controller.

This policy covers the platform. It does not cover the NSTN website at nstn.co.uk, which has its own privacy policy, and it does not cover other websites we link to.

3. The information we collect

Your account

Accounts are created by your school, or by us at your school's request. An account holds:

• Your first and last name
• The email address your account was created with
• Your role on the platform, and your job title where given
• The school or organisation you belong to
• A phone number and a profile picture, both optional

We do not collect a date of birth or a year group, and we do not ask for a personal email address.

Your training records

As you work through a course the platform records which courses you start and finish, how far through each one you are, your quiz results, and the certificates you earn with the date of each.

AI tutor conversations

If you use the AI tutor, the questions you ask and the answers it gives are saved against your account. Section 6 explains what happens to them.

Technical information

When you sign in we record the time, your IP address and your browser and device type, so that we can keep accounts secure and show you where your account has been used. We record the same details when you accept these terms, so that we have a record of what was agreed and when.

Information we do not ask for

We do not ask for special category information, which includes information about health, religion, ethnicity, political opinions, trade union membership, sex life or sexual orientation, or biometric or genetic data. Please do not include information of that kind in a message to the AI tutor.

The platform is not a route for raising safeguarding concerns. If you need to raise one, contact your own organisation's designated safeguarding lead and, where appropriate, your local authority. Do not use the AI tutor for that purpose.

4. Why we use your information, and our lawful basis

Where we rely on legitimate interests, we have considered whether our interest is outweighed by the effect on you. If you disagree with that assessment you can object, and section 10 explains how.

We do not use your information for advertising, we do not sell it, and we do not use your AI tutor conversations to build a profile of you.

We do not make any decision about you by automated means alone. Course completion is determined by whether you watched the material and passed the quiz, which are the rules your school agreed to, not a judgement the platform makes about you.

5. Keeping the sign-in page secure

The sign-in and registration pages are protected by Cloudflare Turnstile, which helps us tell the difference between a person and an automated script. It is the invisible kind, so there is no puzzle to solve.

Because your browser connects to Cloudflare directly, Cloudflare will see your IP address as part of that connection. Cloudflare handles what it collects under its own terms.

6. The AI tutor

When you type a question to the tutor, that question and the relevant course material are sent to Google Vertex AI Search to generate an answer. The processing takes place in the European Union.

The tutor is limited to the course you are studying. It searches only that course's materials, so a question about anything else returns nothing useful. It is not a general chatbot.

Your questions and the tutor's answers are saved on our side against your account, as described in section 3. We use them to see which parts of a course people find difficult, and to check that the tutor is behaving.

The tutor answers questions about course content. It is not a counselling service, it is not a safeguarding reporting route, and it can be wrong. If you are worried about your own or someone else's safety, speak to your designated safeguarding lead, not the tutor.

7. Who else sees your information

We do not sell your information, and we do not share it for anyone else's marketing.

Your school. Your school administrator can see your account details, the courses you have been assigned, your progress and results, and the certificates you have earned. They can also see which questions are being asked of the AI tutor across their school, and any question the platform has flagged for review.

Our team. Members of the NSTN team can access records where they need to, to fix a fault or investigate a security problem. That access is logged.

Beyond that, your information reaches the following, and only so far as is necessary:

• Amazon Web Services. AWS hosts the platform, its database and its course videos.
• Google. Google provides the AI tutor, as described in section 6.
• Cloudflare. Cloudflare protects the sign-in page, as described in section 5.
• Stripe. Stripe processes card payments when a school buys or renews a licence. Card details are handled by Stripe and are never stored on our systems.
• Our professional advisers, for example our accountants or legal advisers, where they need the information to advise us.
• Anyone we are legally required to share information with, including a regulator, a court, or a public authority where the law requires it.

These providers act under contracts that require them to keep your information secure and to use it only as we instruct.

8. Where your information is stored

The platform, its database and its course videos are hosted on Amazon Web Services in its London region. Backups are held in AWS's Ireland region.

The AI tutor processes questions in the European Union.

Where information is transferred outside the UK, we rely on either an adequacy decision made by the UK government, or on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with any further safeguards the transfer needs. Our providers publish the terms they apply to these transfers as part of their data processing terms.

9. How long we keep your information

When your school's contract ends we delete or return the records on its instruction.

10. Your rights

Under UK data protection law you have the right to:

• Be told how your information is used, which is what this policy does
• Ask for a copy of the information we hold about you
• Ask us to correct information that is wrong or incomplete
• Ask us to delete information, where there is no good reason for us to keep it
• Ask us to restrict how we use it while a question about it is resolved
• Object to us using it where we rely on legitimate interests
• Ask us to transfer information you gave us to another organisation, where that right applies
• Withdraw consent at any time, where we rely on consent

If your account was created by your school, ask your school first, because for most of your records the school decides. For your AI tutor conversations, ask us directly at admin@nstn.co.uk.

Exercising any of these rights is free, and you do not have to give a reason. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you if that happens and why. We may ask you to confirm your identity before we act, so that we do not disclose your information to somebody else.

11. How to complain

If you are unhappy with how we have handled your information, please tell us first at admin@nstn.co.uk so that we can put it right.

You also have the right to complain to the Information Commissioner's Office at any time, at ico.org.uk/make-a-complaint, or on 0303 123 1113.

12. Keeping your information secure

We take appropriate technical and organisational measures to protect your information against loss, misuse and unauthorised access.

All traffic between your browser and the platform is encrypted using HTTPS. The database and the file and video storage are encrypted. Course videos are served through links that expire, so a link copied out of the browser stops working.

Access to the platform is limited by role: you see your own records, a school administrator sees their own school's, and every action that changes an account, a licence or a seat is logged.

No transmission over the internet is completely secure. If you need to send us something sensitive, contact us first and we will agree a safer route.

13. Who this platform is for

The platform is intended for adults working in education and safeguarding, including teachers, designated safeguarding leads and Prevent leads. Accounts are issued by your school or organisation, and your school decides who receives one.

We do not create accounts directly for members of the public, and we do not market the platform to children. If your school chooses to give an account to somebody under 18, your school remains responsible for that decision and for any consent it requires.

14. Changes to this policy

We review this policy annually and whenever we change how we handle personal information. The version and date at the top show which version you are reading. Where a change is significant we will ask you to accept the new version the next time you sign in.