Privacy policy

Creative Process Digital ("we", "us", "our") is a Brighton-based training provider. We are the data controller for the personal information described on this page, which we collect through our website, our application and enrolment processes, and the funded training programmes we deliver. This notice explains what we collect, why, how long we keep it, and your rights under the UK GDPR and the Data Protection Act 2018.

Last updated: 30 May 2026. Reviewed annually.

Who we are

Creative Process Digital is the data controller. Our office is at 8th Floor, Telecom House, 125–135 Preston Road, Brighton BN1 6AF. We deliver apprenticeships, bootcamps and skills accelerators — much of it funded by the Education and Skills Funding Agency (ESFA) or the Department for Education. Funded provision comes with statutory record-keeping duties that shape several decisions in this notice.

What we collect

• Contact details: name, email, phone, employer (if relevant), and the message you send us.
• Eligibility data for funded courses: date of birth, National Insurance number, postcode, residency, employment status, benefits status, prior qualifications, and — for employer-funded routes — employer name and PAYE scheme number. We only collect what the funding rules require.
• Application and enrolment data: the answers you provide on application forms, references, ID evidence, learner agreements.
• Attendance and outcome records: attendance, progress, assessments, qualifications awarded, and (for some courses) destination outcomes after you finish.
• Website data: aggregated analytics via Google Analytics 4 (pages viewed, device type, referrer) and consent state for non-essential cookies. See our cookie policy.
• Marketing data: if you opt in — name, email and topic preferences for our newsletter.

Why we collect it — our lawful bases

Under UK GDPR Article 6 we rely on:

• Contract: to deliver the training you've enrolled on and to administer your place.
• Legal obligation: to meet ESFA / DfE funding-rule reporting, record-keeping and audit duties, and other statutory requirements that apply to a registered training provider.
• Legitimate interests: to respond to enquiries, run our website and analytics, prevent fraud, and improve our courses — balanced against your rights and freedoms.
• Consent: for marketing emails and for non-essential cookies. You can withdraw consent at any time.

For special-category data — for example equality-monitoring information — we rely on UK GDPR Article 9(2)(g) (substantial public interest) read with Schedule 1, Part 2 of the Data Protection Act 2018. We may process this data without your specific consent only where the law permits.

Who we share it with

We share personal data only where we need to. Recipients include:

• The Education and Skills Funding Agency and the Department for Education (statutory reporting for funded provision).
• Awarding organisations and End-Point Assessment organisations, for qualifications and apprenticeship endpoint assessments.
• Employer-sponsors, where you are on an employer-funded route.
• Local authorities and partner referral agencies, where you've been referred to us by one (for example a Job Centre).
• Our service providers (data processors), all bound by written contracts: Google Workspace, Eventbrite, Mailchimp, HubSpot, Vercel and our CRM provider.

The law also lets us disclose personal data without your consent in a small number of situations — for example to meet a legal duty, to protect someone's vital interests, to obtain legal advice, or to monitor equality of opportunity. We will only do so where the law permits and we keep a record of any such disclosure.

We do not sell personal data.

How long we keep it

• Enquiries that don't lead to enrolment: 24 months from your last contact.
• Active and former learners on funded courses: for the period required by ESFA funding rules — currently a minimum of 7 years after the end of the funding year in which you finished.
• Marketing list: until you unsubscribe or ask us to remove you.
• Website analytics: in line with the GA4 retention setting for our property.

When the retention period expires we delete or anonymise the data. Where computers or storage media leave our control we make sure personal data on them cannot be recovered.

How we keep it secure

We hold personal data securely and limit access to authorised staff. Everyone who handles personal data is trained, supervised and contractually responsible for following our data-protection procedures. We use technical and organisational measures appropriate to the data — including access controls, encryption in transit, secure cloud hosting, and processor contracts. We review our procedures at least annually.

Your rights

Under UK GDPR you have the right to:

• Be told what data we hold about you and get a copy (subject access).
• Have inaccurate data corrected.
• Ask us to delete data we no longer need to keep.
• Ask us to restrict how we use your data while we look into a concern.
• Receive certain data in a portable format.
• Object to processing based on legitimate interests, or to direct marketing at any time.
• Withdraw consent where consent is the lawful basis.

To exercise any of these, email dpo@creativeprocessdigital.com. We respond within one month. If you're not happy with how we've handled a data-protection issue, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies

Full details of the cookies we set and how to control them are on our cookie policy page.

Contact

Data Protection Officer
Creative Process Digital
8th Floor, Telecom House, 125–135 Preston Road, Brighton BN1 6AF
Email: dpo@creativeprocessdigital.com
General enquiries: info@creativeprocessdigital.com
Phone: 01273 232273

Updates to this notice

We review this notice at least once a year and whenever we change how we handle personal data. The "last updated" date at the top of the page shows when we last revised it.