Opticare Training Academy

Opticare Training Academy – Staff Privacy Notice

INTERIM NOTICE — confirmed information is provided below. Items marked “Awaiting confirmation” are still being resolved; this notice is not presented as a completed privacy review.

Who is responsible?

The data controller is Opticare (Midlands) Ltd, 3 Paxtons Court, NG24 1DH. For privacy questions and rights requests, contact directors@opticareoptician.co.uk. [Awaiting confirmation: whether a Data Protection Officer is appointed.]

Information recorded and where it comes from

• Account information: name, email address, username, assigned job titles, course enrolments, account status and securely hashed authentication credentials. The initial authorised roster came from the staff Google group and management-confirmed roles; additional information comes from you and administrators.
• Training records: lessons and activities accessed, completion/progress, assessment attempts and results, assignment submissions, feedback and manager sign-offs where used.
• Security and access records: login/activity timestamps, IP addresses, events and technical request information recorded by Moodle and the hosting server.
• Policy records: policy version, acknowledgement status and time, and associated audit events.

Do not include identifiable patient information or unnecessary sensitive personal information in training submissions. [Awaiting confirmation: any additional profile fields, recordings, analytics, integrations, cookies and server log fields actually used.]

Why we use it and our lawful basis

We use relevant information to administer authorised accounts, deliver and evaluate training, support staff, record competence and completion, and maintain security and investigate misuse. [Awaiting confirmation separately for each purpose: applicable UK GDPR lawful basis, any specific legal obligation relied on, and any legitimate interests assessment. Confirm whether and how results inform employment or performance decisions.]

Acknowledgement of this notice records that it has been provided. It is not consent to employee monitoring or a substitute for a lawful basis for processing.

Who can see it?

Staff can access their own learning records. Directors and authorised Managers can access staff progress, assessment results and sign-off records for training supervision within their assigned scope. Technical access logs and backups are restricted to Directors, with administration performed by authorised technical support as necessary. The confirmed Directors are Amar-Kaash Gandecha, Shaimil Shah and Shaishav Shah. [Awaiting confirmation: technical support recipients and contractual restrictions; no extra provider or agent access is authorised by this notice.] GoDaddy provides the hosting infrastructure. [Awaiting confirmation: all processors/subprocessors, contractual safeguards, hosting/backup locations and any international transfers and safeguards.]

Retention and deletion

The approved retention policy is to keep training records for up to two years after employment ends. The process for implementing this limit is still being finalised. [Awaiting confirmation: the deletion process and owner, how employment end dates are recorded, treatment of legal holds, and retention periods or decision criteria for accounts, policy acknowledgements, Moodle activity logs, web/server logs and backups. The training-record rule does not define log or backup retention.]

The configuration reviewed on 13 November 2026 has Moodle standard activity-log lifetime set to “never delete”. A suitable approved retention schedule and its technical implementation are still required; this notice does not claim a fixed deletion period.

Your rights and questions

Depending on the circumstances and lawful basis, you may request access to your personal information, correction, erasure or restriction, object to processing and, where applicable, data portability. Rights are subject to legal conditions and are not absolute. If processing relies on consent, you may withdraw that consent without affecting earlier lawful processing. Contact directors@opticareoptician.co.uk to make a request. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/.

[Awaiting confirmation: whether information is mandatory, the consequences of not supplying it, whether any solely automated significant decisions/profiling occur, and arrangements for communicating changes to this notice.]