iO-Sphere Privacy Policy

At a glance

This notice explains how iO-Sphere Limited uses personal data collected through our website and in our dealings with people who enquire about or apply for our programmes. The detail follows below.

• We are iO-Sphere Limited, a UK training provider. We are the controller of the personal data described in this notice.
• We use your data to respond to enquiries, assess and manage applications, sell and deliver courses, send you information you have asked for, market our courses where the law allows, measure how our advertising performs, run our website securely, and meet our legal and funding obligations.
• Some of the technology we use is provided by suppliers in the United States, including HubSpot, Meta, TikTok, Google, Stripe, DocuSign, Slack, Otter and Anthropic. Where personal data goes outside the UK, we use the safeguards described in section 8.
• Some applications are closed automatically when the answers show the applicant does not meet a programme's eligibility or commitment requirements. You can ask a person to review the decision (section 12).
• When you arrive from an advert or fill in a form, our servers send limited details to Meta and TikTok to measure our advertising, even if you reject cookies (section 10).
• You have rights over your data, including to access it, correct it, object to direct marketing and complain. You can complain to us directly, and to the Information Commission.
• Contact us about anything in this notice at dpo@io-sphere.io, or by post to 102 Middlesex Street, London, E1 7EZ.

1. Who we are and how to contact us

iO-Sphere Limited (company number 14356607) is the controller of your personal data. Our registered address is 102 Middlesex Street, London, E1 7EZ. We are registered with the Information Commission under reference ZB615776. In this notice we refer to ourselves as "iO-Sphere", "we", "us" or "our".

Our Data Protection Lead is our Head of IT and Operations. We are not required to appoint a statutory Data Protection Officer under Article 37 of the UK GDPR. Our Data Protection Lead is responsible for data protection across the business.

If you have a question or concern about how we handle your personal data:

• Email: dpo@io-sphere.io
• Post: Data Protection Lead, iO-Sphere Limited, 102 Middlesex Street, London, E1 7EZ

You also have the right to complain to the Information Commission, the UK data protection regulator (ico.org.uk). We would appreciate the chance to put things right first.

2. What this notice covers

This notice applies to personal data we collect through:

• our website at io-sphere.io, including its forms, application questionnaires and course checkout
• skills assessments we ask applicants to take for some programmes
• emails, calls and messages with us about our programmes
• events, webinars and information sessions you sign up to
• our dealings with people who work for employers and partner organisations

Once you enrol as a learner, our Learner Privacy Notice gives you more detail about your time with us. If you apply for a job with us or join our coach register, our Applicant Privacy Notice applies instead of this one.

3. The personal data we collect

• Identity data: first name, surname, title, and date of birth where it matters for eligibility.
• Contact data: email address, telephone number, postal address.
• Profile data: your qualifications, work history and job title, your CV if you choose to upload it, your answers to our application questionnaires, your skills assessment results, and any feedback or survey responses.
• Eligibility data: what we need to check whether you can join a funded programme, such as your residency and right to work, where you live or work, prior qualifications and employment status.
• Transaction data: when you buy a course, what you bought and whether payment succeeded. Card payments are taken by Stripe; we do not see your full card details.
• Technical data: IP address, browser and device information, operating system, referrer, and similar information collected when you visit our website.
• Usage data: pages viewed, clicks, scrolls, and how you interact with our content.
• Marketing and communications data: your preferences for receiving marketing from us.

You do not have to give us your personal data, but we need some of it. If you apply for a funded programme, we need your identity and eligibility details because the funder requires them; without them we cannot consider your application. If you buy a course, we need your contact and payment details to complete the sale.

We also produce aggregated data (statistics that cannot identify you) from the categories above, and use it to understand and improve what we do.

Special category data. We do not generally collect special category data (such as health, ethnicity or disability) through our website. Where you choose to give us your ethnicity or other details for equal opportunities monitoring, or tell us about adjustments you need, we rely on your explicit consent and you can choose not to answer. Enrolled learners' special category data is covered by the Learner Privacy Notice.

4. Where we get your data from

• Directly from you: when you fill in a form or questionnaire on our website, buy a course, contact us by email or phone, sign up to our emails or an event, or apply for a programme.
• Automatically: as you use our website we collect technical and usage data. See sections 9 and 10.
• From third parties: we may receive limited information about you from advertising platforms (Meta, TikTok, Google), such as which advert you clicked; from skills assessment providers we ask you to use; and from employers who refer their staff to our programmes.
• For people at employers and partner organisations: your name, job title and work contact details may come from your organisation's website, LinkedIn or a colleague who introduced us.

5. How and why we use your personal data

We only use your personal data when the law allows us to. The bases we rely on most are: performance of a contract with you, our legitimate interests (where your rights do not override them), our legal obligations, and your consent.

Purpose	Data used	Lawful basis
Responding to enquiries and managing applications	Identity, Contact, Profile, Eligibility	Article 6(1)(b), steps before entering a contract. Article 6(1)(f), our legitimate interest in following up enquiries we receive.
Checking eligibility for funded programmes and deciding who to invite to interview	Identity, Contact, Profile, Eligibility	Article 6(1)(b), steps before entering a contract. Article 6(1)(f), our legitimate interest in meeting the conditions of our funding contracts.
Assessing and prioritising enquiries, including with automated tools and AI (section 12)	Identity, Contact, Profile	Article 6(1)(f), our legitimate interest in handling enquiries efficiently and measuring our advertising.
Selling you a course and taking payment	Identity, Contact, Transaction	Article 6(1)(b), performance of a contract.
Sending information you have asked for (brochures, course details, event invitations)	Identity, Contact, Marketing	Article 6(1)(b) where you asked for it; Article 6(1)(a), consent, where you opted in to general marketing.
Email and text marketing	Identity, Contact, Marketing, Usage	Article 6(1)(a), consent, or the soft opt-in under PECR regulation 22(3) where it applies.
Contacting people at employers and partner organisations about our programmes	Identity, Contact, job title and organisation	Article 6(1)(f), our legitimate interest in offering our programmes to organisations.
Running advertising (Meta, TikTok, Google) and measuring how it performs	Technical, Usage, Identity (hashed where shared with platforms)	Article 6(1)(a), consent, for advertising cookies and pixels. Article 6(1)(f), our legitimate interest in measuring our own advertising using server-side data (section 10).
Running and securing our website, including bot filtering and fraud prevention	Technical, Usage	Article 6(1)(f), our legitimate interest in running and protecting our services.
Improving our website, content and courses through analytics	Technical, Usage	Article 6(1)(f), our legitimate interest in improving our services.
Meeting our legal and regulatory obligations (for example to HMRC, Ofsted and Ofqual) and reporting to our funders (the Department for Education, Skills England and the GLA)	Whatever the obligation requires	Article 6(1)(c) where the law requires it. Article 6(1)(f), our legitimate interest in meeting our funding contracts, for reporting to funders.
Defending or bringing legal claims	Whatever the matter requires	Article 6(1)(f), our legitimate interest in protecting the business and our staff.

Where we rely on legitimate interests, we have considered whether your rights outweigh them. You can ask us about this at dpo@io-sphere.io.

6. Marketing

We only send marketing where the UK GDPR and the Privacy and Electronic Communications Regulations 2003 (PECR) allow it. This means:

• We email or text you about our courses where you have opted in, or where you have enquired about something similar and have not opted out (the "soft opt-in").
• If you work for an employer or partner organisation, we may email or call you at work about our programmes for your organisation, relying on our legitimate interests. You can ask us to stop at any time.
• We do not share your data with third parties for their own marketing without your explicit consent.
• Every marketing message includes an easy way to opt out. You can also email dpo@io-sphere.io to opt out at any time.

Opting out of marketing does not stop us sending information we have to send, such as important changes to a programme you have joined.

7. Who we share your data with

Recipient	What for	Data	Location and transfer safeguard
HubSpot, Inc.	Customer records, website forms, applications and email marketing	Identity, Contact, Profile, Eligibility, Marketing	EU data centre, with US access. UK Addendum to standard contractual clauses.
Google (Google Cloud Platform)	Hosting our website, our data warehouse (BigQuery) and some internal applications	All categories collected through the website	London region. Any US support access under the UK Addendum to standard contractual clauses.
Meta Platforms (Facebook, Instagram)	Advertising delivery and measurement, including the Conversions API	Technical, Usage, hashed Identity	Ireland and US. UK Addendum to standard contractual clauses. Pixel only with consent; server-side events as in section 10.
TikTok	Advertising delivery and measurement, including the TikTok Events API	Technical, Usage, hashed Identity	Ireland, US and Singapore. UK Addendum to standard contractual clauses. Pixel only with consent; server-side events as in section 10.
Stripe	Taking card payments for courses	Identity, Contact, Transaction, card details	Ireland and US. UK Addendum to standard contractual clauses.
Century Tech	Skills assessments for applicants to some programmes	Identity, Contact, assessment results	UK and EEA (AWS UK). No transfer outside the UK and EEA.
DocuSign, Inc.	Electronic signature of agreements and forms	Identity, Contact, Transaction	US. UK Addendum to standard contractual clauses.
Anthropic PBC (Claude)	AI used by our staff and internal tools to draft, summarise and assess information (section 11)	Identity, Contact, Profile, only where needed	US. UK Addendum to standard contractual clauses. Our terms do not allow our data to be used to train their models.
Microsoft Ireland Operations Ltd	Email, Teams and document storage (Microsoft 365)	Identity, Contact, Profile, internal records	UK and EU, with limited US support access. UK Addendum to standard contractual clauses.
Slack (Salesforce, Inc.)	Internal staff messaging, where enquiries are sometimes discussed	Identity, Contact (limited)	US. UK Addendum to standard contractual clauses.
Otter.ai, Inc.	Transcribing sales calls and meetings for notes and quality review	Identity, Contact, what is said on the call	US. UK Addendum to standard contractual clauses. When Otter is recording a call or meeting, it is visible as a participant.
CloudTalk s.r.o.	Business phone calls, including call recordings where enabled	Identity, Contact, call recordings	Slovakia (EU), with limited US sub-processors. UK adequacy for the EU; UK Addendum for any onward US transfer.
Funding and regulatory bodies	The Department for Education, Skills England, the Greater London Authority, Ofsted, Ofqual and other commissioners, where the law or a funded programme requires it	Identity, Contact, Profile, Eligibility, Transaction	UK.
Employers	Where you apply for an apprenticeship or funded training through your employer	Identity, Contact, Profile, Eligibility	UK.
Professional advisers	Lawyers, accountants, auditors and insurers, under duties of confidentiality	Whatever the matter requires	UK, occasionally EU or US with standard contractual clauses.

Most of the suppliers above process personal data only on our instructions, under terms that meet Article 28 of the UK GDPR. Some recipients also use data for their own purposes and are responsible for that use themselves: Meta and TikTok (to deliver and improve advertising, under their own privacy policies), Stripe (for fraud prevention and its legal duties as a payment provider), and funding bodies, employers and professional advisers.

8. International transfers

Some of the suppliers above are based in, or use infrastructure in, countries outside the UK, most often the United States. Where personal data leaves the UK we rely on one or more of these safeguards:

• Adequacy: the UK government has recognised the destination as giving adequate protection.
• UK extension to the EU-US Data Privacy Framework: the US recipient is certified under it.
• Standard contractual clauses with the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement: for suppliers not covered by the above, or alongside them.

You can ask for details of the safeguard we use for a particular supplier at dpo@io-sphere.io.

Our staff outside the UK. Some of our employees and contractors work outside the UK and may access personal data from there. We currently have people in Spain, Argentina and South Africa.

• Spain: covered by the UK's adequacy recognition of EEA countries.
• Argentina: covered by a UK adequacy decision.
• South Africa: no UK adequacy decision. Transfers are made under the UK International Data Transfer Agreement, supported by a documented transfer risk assessment. South Africa has its own data protection law (the Protection of Personal Information Act 2013) and regulator (the Information Regulator).

9. Cookies and similar technologies

Cookies are small files stored on your device when you visit a website. Our Cookie Notice lists every cookie we use, who sets it and how long it lasts. In short:

• Strictly necessary cookies make the site work, for example remembering your cookie choice. They cannot be switched off.
• Analytics: we do not use a third-party analytics tool such as Google Analytics.
• Advertising pixels from Meta and TikTok load only if you accept marketing cookies.
• Our own attribution cookies are set when you arrive from an advert or campaign link, whatever your cookie choice. They hold the ad click identifier and campaign tags from the link, so that we, and the ad platform that showed you the advert, can tell which advert brought you to us (section 10). They hold no other profile or content data.
• HubSpot cookies are set on pages that contain a HubSpot form, whatever your cookie choice. They let HubSpot recognise your browser, so forms you submit, and your visits to those pages, are linked to your record with us.

We also record basic page-view information on our own servers (the page, referrer, browser details and IP address) to understand how the site is used.

You can change your cookie choice at any time using the cookie banner, or clear cookies in your browser.

10. Server-side advertising measurement

As well as browser pixels, our servers share limited event data directly with Meta and TikTok, such as course page views, checkouts started and enquiries submitted, so we can measure and improve our advertising. This happens whether or not you accept cookies. An event can include the page, the ad click identifier from the link you followed, your IP address and browser details, and, where you gave them in a form, your email address and phone number in hashed form. Hashing turns them into a code so they are not sent as plain text, but Meta and TikTok can still match that code to an account you hold with them. We rely on our legitimate interest in measuring our own advertising. You can object at any time by emailing dpo@io-sphere.io.

11. Our use of AI tools

We are a data and AI training provider and we use AI in running our business. The main ways AI touches data covered by this notice are:

• Our staff use AI assistants (currently Claude, provided by Anthropic) to draft responses, summarise documents and prepare for calls.
• Our internal applications use AI services to produce summaries and drafts, and to assess how well an enquiry fits our programmes (section 12).
• Anthropic's business terms do not allow it to use our data to train its models. We do not use your personal data to train AI models.

Where AI plays a part in a decision with a significant effect on you, section 12 applies.

12. Automated decisions and profiling

Eligibility rules. Our funded programmes have eligibility and commitment requirements set by the funder or the programme, such as age, residency, right to work, where you live or work, whether your job fits the programme, and whether you can commit to the whole programme. Our application forms and questionnaires check these automatically. If your answers show you do not meet them, your application is closed and we tell you why.

Bootcamp questionnaire scores. We score answers to our Skills Bootcamp questionnaire using a fixed points system. A member of our team looks at the score and your answers before deciding who to invite to interview. If you are invited, the interviewer may use an AI-prepared summary of your application to prepare.

Assessing enquiries. We use automated tools, including AI, to assess how well an enquiry matches our programmes. It helps our team decide which enquiries to follow up first, and helps us measure our advertising. It does not decide whether you are eligible for a programme. You can object to it by emailing dpo@io-sphere.io.

Your rights. Where a decision about you is made by automated means alone and has a significant effect on you, you can:

• be told why
• ask a member of our team to review it, by emailing dpo@io-sphere.io or replying to the message we sent you
• give us more information that may change the outcome, such as a qualification we did not know about
• challenge the decision if you think a rule was applied wrongly

These reflect the safeguards in Articles 22A to 22D of the UK GDPR, as amended by the Data (Use and Access) Act 2025. Automated decisions on job applications are covered in our Applicant Privacy Notice.

13. How long we keep your data

We keep personal data only as long as we need it for the purposes above. How long depends on what the data is and why we have it:

• Applications for a programme that do not lead to a place: 36 months after the application process ends. If you ask us to delete yours sooner, we will, unless a funder requires us to keep it.
• Enquiries that do not lead to an application: while you are still in contact with us, or could still join the programme you asked about or a later intake of it. If you ask us to delete them sooner, we will, unless a funder requires us to keep them.
• Marketing: until you unsubscribe, plus a brief record of your opt-out, which we keep so we do not contact you again.
• Cookie choices: as set out in our Cookie Notice.
• Website and analytics data: while it is useful for comparing how our website and advertising perform over time.
• Records the law or our funders require us to keep: for the period the rule sets.

If you enrol with us, longer periods apply under our Learner Privacy Notice and data retention schedule. These reflect funding, audit and regulatory requirements.

14. Your rights

Your right	What it means
Be informed	To know how we use your personal data. This notice is how we do that.
Access	To ask for a copy of the personal data we hold about you. We respond within one month. If your request is complex, or you send us several, we can take up to two more months, and we will tell you within the first month if we need to. Our search will be reasonable and proportionate, and we may pause the clock while we confirm your identity or ask you to clarify a broad request.
Rectification	To ask us to correct inaccurate or incomplete data.
Erasure	To ask us to delete your data in some circumstances. We cannot always do this, for example where we must keep funding audit records.
Restriction	To ask us to pause using your data in some circumstances, for example while we check it is accurate.
Objection	To object to processing based on our legitimate interests, including the server-side measurement in section 10. Objections to direct marketing are always honoured.
Data portability	Where we process your data by automated means based on consent or a contract, to receive it in a structured, machine-readable format.
Withdraw consent	Where we rely on consent, to withdraw it at any time. This does not affect what we did before.
Automated decisions	The rights in section 12.
Complain to us	To complain to us directly about how we handle your personal data (section 15).
Complain to the regulator	To complain to the Information Commission at ico.org.uk.

To use any of these rights, email dpo@io-sphere.io. We do not usually charge a fee, but we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive. We may ask for information to confirm your identity first.

15. How to complain

You have a legal right to complain to us about how we handle your personal data (section 164A of the Data Protection Act 2018, in force since 19 June 2026). To complain:

• email dpo@io-sphere.io with "Data complaint" in the subject line, or
• write to the Data Protection Lead at the address in section 1.

We will acknowledge your complaint within 30 days, look into it, keep you informed and tell you the outcome without undue delay. If you are not happy with our response, you can complain to the Information Commission at ico.org.uk or on 0303 123 1113.

16. Adults only

Our programmes are for adults aged 18 and over, and our website is not aimed at children. We do not knowingly collect personal data from anyone under 18 through our website. If you think we have, email dpo@io-sphere.io and we will delete it.

17. How we protect your data

We use appropriate technical and organisational measures, including access controls and encryption, to protect your personal data. If a breach happens, we report it to the Information Commission and tell affected people where the law requires.

18. Changes to this notice

We update this notice when our processing, our suppliers or the law change. The date at the top shows when it was last updated. If we want to use your data for a new purpose that needs your consent, we will ask for it first.

19. Definitions

• UK GDPR: the United Kingdom General Data Protection Regulation, as amended, including by the Data (Use and Access) Act 2025.
• DPA 2018: the Data Protection Act 2018.
• PECR: the Privacy and Electronic Communications (EC Directive) Regulations 2003.
• Information Commission: the UK data protection regulator, which replaced the Information Commissioner's Office on 30 September 2026.
• Personal data: any information about an identified or identifiable living person.