Who we are
WorkReady is a workforce training and compliance platform operated by Fundisa Productions Ltd, registered in England and Wales. This policy explains what personal data the platform handles and how we protect it.
- Your employer is the controller for learner records — names, training progress, assessment results and completion evidence. They decide who is enrolled and what training is required.
- We are the processor for that data: we hold and process it only on their documented instructions, under a data processing agreement.
- We are the controller for our own account, billing and enquiry contacts, and for security logs we keep to protect the service.
What we collect
We collect only what the platform needs to deliver training and produce reliable compliance evidence. We do not ask for special category data, and learners should never enter health, biometric or financial details into the platform.
| Category | Examples | Why we hold it |
|---|---|---|
| Account details | Name, work email, organisation, department, role | To create the account and scope what each person can see |
| Training activity | Courses and site walkthroughs assigned, lesson progress, video watch position, assessment scores and attempts | To deliver the course, resume where someone left off, and prove genuine completion |
| Compliance records | Completion dates, acknowledgements, review/renewal dates, certificates | To evidence training to auditors, clients and regulators |
| Security and audit logs | Sign-in events, privileged administrator actions, IP address, browser and device type | To detect misuse, investigate incidents and keep an audit trail |
| Content you upload | Course media, site induction videos, images and documents added by administrators | To host and stream your organisation's training content |
Why we process it, and our lawful basis
- Performance of a contract — providing the platform to your organisation and to you as a named user under it.
- Legitimate interests — keeping the service secure, preventing misuse, maintaining audit trails, and improving course quality using aggregated, non-identifying training analytics.
- Legal obligation — where your employer must retain training and induction records to satisfy health, safety or sector regulation.
- Consent — only where we ask for it separately, for example marketing emails to prospective customers. You can withdraw it at any time.
What we never do
- We never sell, rent or share personal data for advertising.
- We never use learner data to train third-party AI models, and course content stays inside your organisation.
- We never profile individuals beyond their assigned training progress — there is no automated decision-making with legal or similarly significant effects.
- We never let one organisation see another organisation's people, courses, sites or reports.
How long we keep it
- Account and training records: for the duration of your organisation's subscription.
- Completion evidence and certificates: retained while the record is needed as compliance proof, and in line with your organisation's retention instructions.
- Security and audit logs: typically 12 months.
- After a contract ends: we provide an export on request, then delete or irreversibly anonymise the organisation's data within 90 days, unless the law requires us to keep it longer.
Backups are cycled out on their own schedule, so deleted data may persist in encrypted backups for a short period before it is overwritten.
Your rights
Under UK and EU GDPR you have the right to access your data, correct it, have it erased, restrict or object to processing, and receive a portable copy.
- If you are a learner, please contact your organisation's manager or data protection contact first — they control your training record. We will support them in responding.
- You can also write to us at info@fundisa.co.uk. We respond to requests within one month.
- If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).
Where your data lives
Platform data is hosted in the United Kingdom and European Economic Area. Where a supplier processes data outside the UK/EEA, we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with technical safeguards such as encryption. Full detail is on our security page.
Contact and changes
Data protection enquiries: info@fundisa.co.uk. Postal address and company registration number are available on request and in our contracting documents.
If we make a material change to this policy we will notify organisation administrators before it takes effect, and update the date at the top of this page.