The Learning & Skills Office (laso.ac)
Data Protection, Privacy and Cookie Policy

Updated and revised version: September 2026

1. Introduction

This Policy outlines how laso.ac collects, uses, stores, and protects personal information when individuals access the laso.ac website, use the learning and assessment Platform, register an account, complete professional development activities, or communicate with laso.ac.

The Learning & Skills Office Limited ("LASO", "laso.ac", "we", "us" or "our") is committed to protecting personal privacy, maintaining data security, and ensuring full transparency regarding data processing practices. laso.ac processes personal information in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

  • "laso.ac" means The Learning & Skills Office
  • "Member centre" means the member centre with an active membership of The Exams Office. This may be an education provider, school, college, academy trust, or any centre with an active entitlement to access laso.ac services
  • "User" means an individual authorised by a Member Centre to access the Platform
  • "Centre Administrator" means the individual designated by a Member Centre to administer access rights and manage User accounts
  • "Platform" means the laso.ac learning, assessment and professional development platform, website, applications and associated services
  • "Services" means all content, assessments, learning resources, certifications, professional standards frameworks, communications and Platform functionality provided by laso.ac

2. Who We Are and Data Controller/ Data Processor Roles

The Learning & Skills Office Limited is a company registered in England and Wales (Company Registration Number: 15241489), with its registered office at Fernbank House, Springwood Way, Tytherington Business Park, Macclesfield, SK10 2XA

Email: contact@laso.ac.

Data Protection Roles:

laso.ac acts as a Data Controller for personal information processed in connection with website administration, account registration, User communications, platform security and overall service management.

laso.ac acts as a Data Processor on behalf of Member Centres (schools, colleges, academy trusts, or other education providers) regarding staff training records, assessment progress, and the Exams Officer Professional Standards tracking carried out on the Platform

3. Personal Information Collected

laso.ac collects and processes personal information provided directly by Users or their authorised Member Centre representatives, this may include:

  • Identity Information: Full name, job role or professional position, Member Centre name
  • Contact Information: Professional email address, telephone number, postal address
  • Account Information: Username, account identifier, encrypted passwords, login records
  • Professional Development Information: Training module progress, assessment results, Exams Manager/Officer Professional Standards tracking, completion records, certificates
  • Technical Information: IP address, device type, browser type, operating system, server log files, security logs
  • Website & Platform Usage Information: Activity logs, pages visited, platform interaction
  • Transaction Information: Membership records

4. How Personal Information is Collected

Information is collected through three primary routes:

Directly from individuals:

  • When users register an account, complete training modules, undertake assessments, request certificates, subscribe to communications, or contact laso.ac directly
  • Through authorised Member Centres: When a designated Centre Administrator or representative submits User details to set up or manage platform access rights for staff members

Automatically:

When individuals navigate the website or Platform, technical data is gathered via server logs, and security monitoring systems.

5. Legal Bases for Processing

Under UK GDPR, laso.ac relies upon one or more of the following lawful bases:

  • Contract: Processing is necessary to provide memberships, fulfil Platform access, deliver learning resources, assessments and certifications.
  • Legitimate Interests: Processing is necessary for operating and securing the Platform, preventing fraud, maintaining service quality, and communicating administrative updates, provided individual privacy rights are protected
  • Legal Obligation: Processing is necessary to satisfy legal, statutory, accounting, or regulatory requirements
  • Consent: Where required by law, such as specific marketing communications. Individuals may withdraw consent at any time
  • Public Task: Where processing is necessary to support public functions carried out by educational organisations or regulatory activities where applicable

6. How Personal Information is Used

laso.ac may use personal information to:

  • Verify centre membership eligibility and administer User accounts
  • Provide access to CPD modules, resources, assessment and certification, and maintain learning records
  • Maintain platform security, investigate Terms breaches, deliver technical support, monitor platform performance
  • Communicate service updates, respond to enquiries, administrative notices, and operational developments
  • Improve products and services
  • Comply with statutory and legal obligations

7. Sharing Personal Information

laso.ac only shares personal information where lawful and necessary. Information may be shared with:

  • Subscribing Member Centres and designated Centre Administrators to report user activity and certification progress
  • Key operational partner organisations, specifically The Exams Office Limited and the National Association of Examinations Officers (NAEO), for the delivery and verification of membership benefits and the Exams Manager/Officer Professional Standards
  • Approved third-party technology providers, cloud hosting services, and technical contractors working under strict confidentiality and data processing contracts
  • Legal authorities, regulators, or courts where required by applicable law

laso.ac does not sell personal information to third parties.

8. International Data Transfers

laso.ac stores and processes personal information primarily within the United Kingdom.

Where personal data is transferred outside the UK to third-party infrastructure or service providers, laso.ac ensures appropriate safeguards are implemented in compliance with UK GDPR, such as standard contractual clauses, International Data Transfer Agreements (IDTA), or UK adequacy regulations.

9. Information Security

laso.ac maintains technical and organisational security measures to protect personal data against unauthorised access, disclosure, loss, alteration, or destruction.

Security measures include encryption, secure cloud hosting, access controls, password hashing, and continuous monitoring.

Users remain responsible for maintaining the confidentiality of their login credentials and must inform laso.ac immediately if security is compromised.

10. Data Retention

Personal information is retained only for as long as necessary to fulfill the operational, legal, and regulatory purposes for which it was collected.

Upon account closure or membership expiration, user records are securely anonymised or deleted in accordance with statutory retention schedules and legitimate administrative requirements.

11. Individual Rights

Under UK GDPR, individuals hold the following rights regarding their personal data:

  • Right of Access: Request a copy of personal information held by laso.ac
  • Right to Rectification: Request correction of inaccurate or incomplete records
  • Right to Erasure: Request deletion of personal data where legal grounds apply
  • Right to Restrict Processing: Request limits on data processing under specific conditions
  • Right to Object: Object to processing based on legitimate interests or direct marketing
  • Right to Data Portability: Request transfer of personal data in a structured machine-readable format
  • Rights Regarding Automated Decision-Making: Request human review of automated decisions where applicable

Rights requests should be submitted in writing to contact@laso.ac. laso.ac responds to all valid requests within one calendar month.

12. Data Processing Agreement (DPA)

Where laso.ac processes personal data on behalf of a Member Centre (e.g., tracking employee CPD or compliance data), the Member Centre acts as the Data Controller and laso.ac acts as the Data Processor.

In its capacity as a Data Processor, laso.ac commits to:

  • Process personal data only on documented instructions from the Member Centre
  • Ensure all personnel authorised to process personal data are subject to confidentiality obligations
  • Maintain appropriate technical and organisational security measures
  • Assist Member Centres in responding to data subject rights requests and breach notification duties
  • Securely return or delete personal data upon termination of services unless statutory retention applies

13. Personal Data Breaches

laso.ac maintains a documented breach response procedure. In the event of a confirmed personal data breach likely to pose a risk to individual rights and freedoms, laso.ac will notify affected Member Centres, individuals, and the Information Commissioner's Office (ICO) without undue delay in accordance with UK GDPR requirements

14. Marketing Communications

laso.ac may send information regarding learning programmes, CPD modules, the Exams Manager/Officer Professional Standards updates, and membership features. Where required under PECR, marketing emails are sent only with prior consent, and recipients may unsubscribe at any time via the link provided in the communication or by contacting contact@laso.ac

15. Cookie Policy

We only use strictly necessary cookies that are essential for website navigation, user authentication, session security, and core platform operation. We do not use analytics cookies.

16. Policy Revisions

laso.ac reserves the right to update this Policy periodically to reflect operational, technical, or legal changes. Revised versions will be published on the website with an updated effective date.

17. Contact Information and Complaints

For questions, data protection enquiries, or rights requests, contact:

The Learning & Skills Office Limited (laso.ac) Fernbank House, Springwood Way, Tytherington Business Park, Macclesfield, SK10 2XA

Email: contact@laso.ac

Individuals who are dissatisfied with how laso.ac handles personal data have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Telephone: 0303 123 1113 | Website: https://ico.org.uk

Choose

Select to link to this :