Privacy Policy

SkillProof is a B2B SaaS platform used by organisations to manage workforce training records, competencies, assessments, evidence, certificates and compliance status.

It also supports appraisal records, CPD records, development actions, professional registrations and checks.

Customer organisations decide what staff and training data they enter into SkillProof.

In most cases, the customer is the controller of that data and SkillProof acts as a processor.

SkillProof may process organisation names, user names, work contact details and staff records.

It may also process training, competency, assessment, appraisal, CPD and development action records.

Other data can include evidence uploads, certificates, professional registration or check details, compliance status, audit history and billing status.

SkillProof does not need customers to upload unnecessary special category data.

Customers should only upload evidence and records needed for legitimate training, competency and compliance purposes.

Data is used to provide the SkillProof service, maintain account access and show compliance status.

It is also used for reporting, support requests, subscription management, and improvements to the platform's security and reliability.

Website enquiry forms are used to respond to trial, demo and partner requests. Payment and subscription billing is handled by Stripe.

For limited business-to-business partner outreach, SkillProof may use publicly available organisation names, websites and professional contact details.

This is used to contact relevant UK companies and incorporated consultancies about the SkillProof partner or Consultancy offer.

SkillProof records the public source, collection date, eligibility review and contact history.

This route is not used for indiscriminate consumer marketing.

Business contact information used for partner outreach may come from the organisation's own website, Companies House or another clearly identified public business source.

Where a documented assessment supports it, SkillProof may rely on legitimate interests to develop relevant business partnerships.

This is balanced against the contact's rights and reasonable expectations.

Every recipient may object or ask not to be contacted.

SkillProof records that request in a suppression register and stops further partner outreach to the address.

Use the SkillProof Contact page to object, ask where contact details came from or exercise a data protection right.

Where a client Owner approves Consultancy access, SkillProof processes the connection, named-user grants, access scope and review date.

It also processes the audit events needed to provide and secure that access.

Consultancy users can access only the client organisations and scope approved for them. Client ownership, billing and data remain separate, and the client Owner can change or remove access.

The client and Consultancy are responsible for determining their own data protection roles, authority and agreement for the Consultancy's services.

The public website may include an AI assistant to answer general SkillProof product questions.

It can also help visitors find trial, demo, pricing or training matrix review routes.

The assistant is not designed for sensitive staff, health, certificate, professional registration or customer account data. Visitors should not enter sensitive personal information or paste training matrices into the chat.

In this version, SkillProof does not store chat transcripts in the product database.

If a visitor asks the SkillProof team to follow up, the lead form details are handled through the normal website enquiry process.

Optional analytics and advertising storage remain denied until a public-site visitor makes the relevant choice. On approved public-site pages, a Google tag may load in denied Consent Mode before that choice without setting optional measurement cookies.

If analytics is accepted, SkillProof may process a pseudonymous visit identifier, first consented landing page, page path and device category. SkillProof may also process a privacy-safe referrer source, standard UTM attribution and interaction events. Referrer paths and query details are not retained for attribution.

This data is used to understand and improve the website.

If marketing measurement is also accepted, SkillProof enables the Google tag for the consented measurement purposes described below.

It may process advertising-specific and SkillProof campaign identifiers, limited page-view data and the successful trial destination through Google Analytics and Google Ads.

If analytics is accepted, Microsoft Clarity may process masked public-page interactions, device and browser information for session recordings, heatmaps and usability analysis. SkillProof masks the public page body and does not load this integration on private customer application routes.

SkillProof configures Google ad personalisation as denied and does not enable remarketing through the Google tag.

SkillProof does not include form contents, names, email addresses, telephone numbers, staff records, uploaded evidence or customer workspace data in browser or server analytics events.

Visitors can reject optional tracking or change their choice at any time through Cookie preferences in the website footer.

Necessary operational records created when someone submits a trial, demo, partner or contact request are handled separately from optional behavioural analytics.

SkillProof uses Cloudflare Turnstile on public account-creation forms to distinguish genuine visitors from automated abuse.

Turnstile may process security signals including the visitor IP address, browser or user-agent information, TLS characteristics, the site key and the website origin.

This check is used only to protect account creation and service security.

The verification token is checked on the SkillProof server before an account is created and is not used for advertising.

Cloudflare Turnstile Privacy Addendum

Customer records are retained while an account is active and for a reasonable period after cancellation or trial expiry.

A shorter retention period may be agreed, and customers can request deletion sooner.

Customers can request export, deletion or offboarding support by contacting SkillProof. Some audit records may need to be retained where legally or operationally appropriate.

The public website stores the current optional-cookie choice for up to 180 days.

Provider-controlled retention may vary. The Cookie Policy explains how to withdraw the choice and stop future optional tracking.

Unconverted partner applications and business outreach records are reviewed for deletion after 12 months.

A limited record may be kept when an active conversation, legal obligation or suppression record requires it.

Active suppression records are retained so the objection continues to be respected.

Individuals may have rights to access, correct, delete or restrict the use of their personal data under UK GDPR and applicable data protection law.

Where SkillProof processes data on behalf of a customer organisation, requests may need to be handled through that organisation.

For privacy questions, data requests or customer offboarding support, contact the privacy team through the SkillProof Contact page.