Consent Notices

1. Purpose of This Document

This document sets out the consent language, checkbox mechanics, and corporate consent form that DFT Academy uses to collect valid, specific consent from data subjects, in support of the Privacy Policy and Terms and Conditions. It is intended for internal and developer use when building or auditing registration, checkout, and enrolment flows on the Platform.

2. General Principles

• Consent for marketing must be a separate, unticked checkbox, never bundled with account creation or course purchase.
• Acceptance of the Terms and Conditions and Privacy Policy is a condition of using the Platform (contractual necessity), confirmed by a mandatory checkbox. This is acknowledgment of terms, not "consent" in the strict DPA sense, since the lawful basis for that processing is contract performance.
• Every consent checkbox is unticked by default, with no pre-ticked boxes.
• Learners must be able to withdraw consent as easily as they gave it.
• We keep a record of consent: what was agreed to, the date and time, and the version of the notice presented.

3. Individual Registration Flow

3.1 Mandatory acknowledgment (Terms and Privacy Policy)

3.2 Marketing communications consent (optional, separate checkbox)

4. Cookie Consent Banner

Displayed on first visit to the Platform, before any non-essential cookies are set:

Buttons and toggle options:

• Button 1: "Accept all"
• Button 2: "Reject non-essential"
• Button 3: "Manage preferences" — opens a toggle list:

5. Corporate Client Data-Sharing Consent Form

For use when a Corporate Client (employer or regulated institution) enrols its staff in bulk. This form should be signed once by the Corporate Client's authorised representative before bulk enrolment begins, and covers the sharing of staff training data between DFT Academy and the Corporate Client for the duration of the engagement.

Authorisation

The undersigned confirms that they are duly authorised to act on behalf of the above organisation (the "Corporate Client"), and to provide the following authorisations and consents to DFT Academy for the purpose of enrolling the Corporate Client's staff in training Courses on the Platform.

The Corporate Client confirms and agrees that:

• It will provide DFT Academy with the names, work email addresses, and job roles of staff to be enrolled, and has its own lawful basis for sharing this data with DFT Academy (for example, an employment contract, internal policy, or employee consent obtained by the Corporate Client).
• It has informed enrolled staff that their course progress, assessment results, and completion certificates will be visible to the Corporate Client's designated training administrator(s).
• DFT Academy will act as a data processor for enrolled staff data, processing it solely to deliver training and report completion, and not for its own independent purposes (such as marketing to staff without separate consent).
• The Corporate Client remains the data controller for its employees' personal data, and is responsible for responding to data subject requests from its own staff regarding that data; DFT Academy will reasonably assist where needed.
• Staff data will be retained by DFT Academy for the duration of the engagement plus 12 months thereafter, unless earlier deletion is requested in writing.

Signature

Signed for and on behalf of the Corporate Client:

6. Withdrawal of Consent

Learners may withdraw marketing consent at any time via the unsubscribe link or account settings. Corporate Clients wishing to withdraw or amend the data-sharing authorisation in Section 5 should notify DFT Academy in writing; withdrawal takes effect for future processing, but does not affect the lawfulness of processing carried out before withdrawal, and does not by itself remove records DFT Academy is required to retain for regulatory, certification, or audit purposes.

7. Record-Keeping

For audit purposes, the Platform logs, for each consent event: the data subject's identifier, the exact wording and version of the notice presented, the checkbox state selected, and the date and time. This log is retained for as long as the related personal data is retained.