Data Subject Access Request (DSAR) Policy
Trading Name: Vocational Training Hub
1. Introduction
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act), individuals have a statutory right to access the personal data that organisations hold about them. This process is known as a Data Subject Access Request (DSAR).
This learning platform, underlying system and technical infrastructure are owned by The Gtg Global Limited (Company Number: 15026292). All training data is processed in connection with services facilitated and delivered by TTH Group Limited (trading as Vocational Training Hub). Vocational Training Hub acts as the data controller and is committed to processing all DSARs in a lawful, transparent and timely manner.
2. Who Can Make a DSAR?
The right of data access belongs entirely to the individual learner, not their employer or sponsor. Any learner who has registered or completed training with Vocational Training Hub can submit a DSAR, regardless of:
Who funded the training (e.g., corporate or employer-funded).
Whether they are still employed by the organisation that purchased the training.
Whether their platform account is active, inactive or archived.
3. Scope of Personal Data & Search Limits
You may request access to the personal data we actively process about you, which typically includes:
Certificates and proof of course completion.
Training history, module progress and course enrolments.
Assessment results, grading sheets and module scores.
Core account information (e.g., name, email, system login activity).
Correspondence logs directly relating to your training profile.
Statutory Search Limitations: In accordance with UK law, our obligation to locate and extract data is limited to conducting a reasonable and proportionate search of our active electronic systems. We are not required to provide:
Any records from accounts that have been permanently erased in line with our 24-month data retention policy.
Information identifying or compromising the privacy of other learners.
Internal business management notes or documents that do not constitute your personal data.
4. How to Submit a DSAR
To request your data, please contact us using the details below. To avoid processing delays, please provide the following details to help us pinpoint your records:
Email: support@vocationaltraininghub.com
Required Details: Full name used during training, the email address linked to the learning platform, approximate dates of training and the name of your employer at the time (if applicable).
5. Identity Verification
To prevent identity theft and the unauthorised disclosure of personal information, we must verify your identity before releasing any data. We may request a confirmed piece of identification (e.g., a utility bill, driving licence or passport) or verification of specific account security questions. The statutory response window will not begin until your identity has been successfully verified.
6. Timeframes & "Stopping the Clock"
Standard Timeline: We will respond to your verified request within one calendar month.
Clarification ("Stopping the Clock"): If your request is broad, or if we process a large volume of data, we may contact you to clarify the specific scope of your request. Under UK law, this stops the response clock. The countdown will pause on the day we request clarification and will resume only once you provide the necessary details.
Complex Requests: If a request is highly complex, we may extend the final deadline by up to an additional two months. We will notify you within the first month if an extension is necessary, providing clear reasons for the delay.
7. Fees
DSARs are provided completely free of charge. However, we reserve the right to charge a reasonable administrative fee if you request multiple physical copies of the same information, or if a request is legally deemed manifestly unfounded or excessive.
8. Withholding Data & Refusals
We may refuse to comply with a request, or withhold specific data fields, where permitted by data protection legislation (e.g., where a request is manifestly unfounded or repetitive, or where data is protected by legal professional privilege).
If we withhold data or refuse a request:
We will issue a formal response explaining the specific legal exemption or reason relied upon.
We will notify you of your right to utilise our Internal Data Protection Complaints Procedure or escalate the matter externally.
9. Delivery of Data
To maintain data security, your records will be compiled electronically into a secure, encrypted digital format (such as a password-protected PDF) and sent directly to your verified email address.
10. Internal Complaints & ICO Escalation
If you are dissatisfied with how your DSAR was handled, or if you wish to dispute a decision regarding withheld data, you have a statutory right to lodge an internal complaint with us.
Our Process: We will formally acknowledge your complaint within 30 days and provide a comprehensive outcome review without undue delay.
Escalating to the Regulator: If you remain unsatisfied with our final internal review, or if we fail to respond to your complaint within a reasonable timeframe, you have the right to escalate your concern to the UK supervisory authority, the Information Commissioner's Office (ICO).
The Vocational Training Hub is fully registered as a data controller with the ICO under registration name Vocational Training Hub and registration number: ZC181649.
Website: www.ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Please direct all initial DSAR applications, queries, or internal data protection complaints to our team: