We use personal data to answer enquiries and provide training. This notice also describes our proposed arrangements for Police Station Representatives Accreditation Scheme (PSRAS) accreditation assessments.
AccrediLaw is not currently an authorised PSRAS assessment organisation. We do not accept accreditation assessment registrations or bookings before we receive authorisation and the assessment regulations are approved. We do not deliver accreditation assessments before then either. Buying training or submitting the website registration form does not register you for an accreditation assessment.
Identity verification is already in use. The assessment arrangements described below are proposed arrangements unless this notice expressly says otherwise.
Who we are#
We are ACCREDILAW LTD, company number 16903553. We are the controller responsible for the personal data described in this notice.
Our registered office is 2nd Floor College House, 17 King Edwards Road, Ruislip, London, HA4 7AE.
Quality and Compliance handles data protection. We have not appointed a statutory data protection officer.
For general enquiries, email info@accredilaw.co.uk or call 0330 190 1261. For candidate and assessment data requests, email assessments@accredilaw.co.uk.
Website enquiries and registration#
Our contact form collects your email address and message. Your name is optional.
Our registration form collects your first and last name, email address, phone number, where you are on your police station representative (PSR) journey, your background and how you heard of us. It also collects anything else you choose to tell us.
Website enquiries are sent to Bitrix24 through a webhook. Cloudflare handles the form submission in transit. The website is also configured to send an alert containing the submitted details through Resend to info@accredilaw.co.uk, with your email address as the reply address. We have not confirmed whether that alert service is enabled in production. The hidden bot-trap field is discarded.
We use these details to deal with your enquiry or registration request.
Training and assessment#
Our learning platform at learn.accredilaw.co.uk uses Moodle. It holds your account details, course progress, training work and marks. Identity verification is already in use. Under the proposed assessment arrangements, Moodle would also hold assessment work and marks, Critical Incidents Test (CIT) audio recordings, identity verification records, and your Legal Aid Agency (LAA) registration status and date.
The proposed assessment record also includes date of birth, contact address, relevant employer and supervising solicitor details, exemption claims and qualification evidence, bookings and payments, adjustment applications and decisions, moderation records, Assessment Board decisions and reasons, and claims, complaints and appeals. CIT session records include device IP address and browser information.
Under the proposed rules, you would take the CIT alone in a suitable room, with your webcam and microphone active throughout. The CIT would be recorded. The recording would be the evidence on which your marks rest.
The proctoring or invigilation arrangements for the proposed written examination are not yet settled. We have not decided whether a person would supervise it, whether it would be recorded, whether a third party would provide the service or whether any proctoring record would be kept. The current platform shows you your own camera image during the written examination. Nothing from the camera is recorded, transmitted or observed by anyone else.
If we adopt a proctoring product that records video, audio or images, we will update this notice before it is used. We will say what is kept and for how long.
Under the proposed assessment arrangements, we would use assessment data to register you, verify your identity, deliver and mark assessments, and issue results. We would also use it to handle adjustments, claims, complaints and appeals, and meet our obligations to the Solicitors Regulation Authority (SRA) and the LAA. We would not use assessment data for any other purpose.
Assessors would see your candidate number rather than your name. The training team would not see marked work.
Payments#
Stripe takes card payments and receives your payment and billing details. We do not see or store your card number.
We use payment information to take payment for the services you buy.
Phone calls and email#
Calls to 0330 190 1261 are routed through Telnyx. Callers hear a recording notice, and voicemail is available outside office hours. We have not established whether conversations are recorded, which recordings are retained or their retention rules.
We record the caller’s phone number and a note of each inbound call in Twenty CRM, which is self-hosted by the owners. We use these records to handle the enquiry and follow-up. Hosting location and access arrangements have not yet been established.
We use Google Workspace for email at accredilaw.co.uk. It processes email addresses, messages and attachments. We use correspondence to answer you and deal with the matter you have raised.
Lawful bases and legitimate interests#
Our draft assessment policy identifies Article 6(1)(b), processing necessary to perform a contract, for candidate registration, identity verification, assessment entry, delivery, marking, moderation, confirmation of results and notification of results.
It identifies Article 6(1)(f), legitimate interests, for quality assurance, moderation sampling, audit trails, detecting assessment offences, defending challenges and reporting to the SRA and the LAA. The interests identified are operating a defensible assessment and meeting the conditions of assessment organisation authorisation.
These are draft assessment arrangements. We have not confirmed their adoption and application to each activity.
We have not yet recorded a complete lawful basis map for website enquiries and registration requests, training, payments, phone calls and call records, email correspondence, equality monitoring and other processing described in this notice. Identity verification is already in use, so its applicable basis must be confirmed now.
To rely on a legal obligation under data protection law, we must establish that the processing is necessary to comply with that obligation. A Scheme requirement alone is not enough.
You can ask Quality and Compliance, using the contact details below, which basis applies to your data.
The ICO’s guidance on lawful bases explains the requirements.
Sensitive information and criminal offence data#
Equality monitoring answers are voluntary, and every question has a “prefer not to say” option. Some answers are special category data.
Our draft assessment policy identifies a proposed basis for using sensitive information for qualifying equality monitoring. It identifies Article 9(2)(g) and the equality of opportunity or treatment condition in Schedule 1 to the Data Protection Act 2018. We have not confirmed which Article 6 lawful basis applies. We have also not confirmed whether the required appropriate policy document is in place.
Adjustment applications and mitigating circumstances claims may contain health information and other special category data. Our draft policy proposes explicit consent for this processing. We have not confirmed that this condition is valid for each use or recorded the complete Article 6 basis.
Under our draft policy, an assessor, role player or invigilator would be told what to do for an adjustment, but not why it was given, so the health reason would stay with the people deciding it. Equality declarations would be kept separate from the assessment entry, and no assessor, moderator or Assessment Board member would see an individual’s declaration.
We must settle these matters before carrying out the affected processing. Choosing not to answer equality monitoring questions does not prevent you from requesting a service.
Proposed portfolio assessments involve reports about real police station cases. Client names must not appear, but file references and case details may still identify people. These reports contain personal data about alleged offences and criminal proceedings concerning people other than the candidate.
We have not yet established the domestic law condition authorising AccrediLaw to process this criminal offence data. Removing names does not resolve that requirement. This processing must not begin until the applicable lawful basis, statutory condition and safeguards are established.
This notice does not describe a DBS checking service. The information available for this notice does not establish that AccrediLaw collects candidates’ criminal records or DBS certificates.
Who receives your data#
Bitrix24 receives the details you submit through the website contact and registration forms.
Our website forms send information to a Bitrix24 instance used by SailChecker and shared with another business owned by the same owners. We have not established which users or businesses can access AccrediLaw enquiries there.
A learning platform plugin sends enrolment events to another CRM destination. That destination and its recipients have not yet been established.
For proposed assessments, authorised assessors, moderators, the Assessment Board, complaint investigators and appeal reviewers would receive information needed for their roles. The SRA and its appointed External Examiner may also receive or inspect assessment information under the Scheme.
The website is configured to send form alert emails through Resend to info@accredilaw.co.uk. We have not confirmed whether these alerts are enabled in production.
Cloudflare hosts and delivers the website. It processes IP addresses, request logs and the information submitted through our forms.
Unsplash receives your IP address and browser details when an image loads on a page.
Stripe receives payment and billing details when you pay by card.
Hetzner hosts the Moodle server in Finland. The server holds the learning platform records described above.
Telnyx handles calls, the recording notice and voicemail. Twenty CRM holds your phone number and our note of the call.
Google Workspace processes our email correspondence, including messages and attachments containing personal data.
Under the proposed arrangements, external speech-to-text and AI language model providers would process CIT responses as described below. We have not yet recorded their names here.
Under the proposed arrangements, we would share assessment data with the SRA and the LAA where the Scheme requires. Providers processing assessment data would act on our instructions. We would share assessment data with nobody else beyond the recipients described above unless you consent or the law requires it.
Under the proposed assessment arrangements, the Assessment Board would report a candidate to the SRA if it considered that an assessment offence had a bearing on their character and suitability to be a police station representative. The SRA may pass the details to the LAA. This could ultimately lead to temporary or permanent suspension from the representatives register. We would tell the candidate when a report was made and what it said. Our proposed process for recording and reporting malpractice to the SRA would also cover staff and assessors.
Critical Incidents Test marking and automated decisions#
The proposed CIT arrangements use an external speech-to-text service to transcribe recorded responses and an external AI language model service to suggest scores and reasons against Control, Confidence and Content.
Responses are referenced by question and response identifiers. We do not send candidate names or contact details with them. We retain the link to the candidate, so the recordings and transcripts remain personal data.
Under our draft policy, a human assessor listens to the recording and confirms, adjusts or replaces every mark. No result is issued on a machine score. The machine pre-mark records the model version and prompt used.
The Assessment Board decides whether a candidate has passed. An assessor’s mark is a recommendation until the Board confirms it. Any result issued before Board confirmation is provisional.
Our draft policy requires providers not to use candidate assessment data to train, tune, evaluate or improve products or models, retain it after the transaction, or disclose it onward. Provider identities, contractual compliance and processing locations remain unresolved.
Transfers outside the UK#
Hetzner hosts the Moodle server in Finland. Finland is covered by UK adequacy regulations.
We have not yet completed the assessment of processing countries, overseas access, onward transfers and applicable safeguards for Cloudflare, Bitrix24, Resend, Stripe, Google Workspace, Telnyx, Twenty CRM or Unsplash.
The identities and processing locations of the proposed CIT speech-to-text and AI language model providers are also unresolved. We have not established which transfer mechanism would apply to either service.
We cannot currently provide a complete account of international transfers or copies of safeguards. These arrangements must be established before any transfer requiring them takes place.
How long we keep data#
Our draft assessment policy requires CIT recordings, both transcripts and machine pre-marks to be destroyed when the assessment appeals process expires. It defines expiry by reference to the end of the appeal deadline where no appeal is lodged, or notification of the appeal outcome, including any Assessment Board decision, where an appeal is lodged. If an associated complaint or mitigating circumstances claim is still open, the policy requires us to keep your data until those complaint or claim routes have finished. Destruction covers every copy, including processor copies.
Identity documents are intended to be held only for verification and any subsequent challenge. The deletion point for scans and photographs has not been settled. The retained verification record contains the document type and number, name, date of birth, reviewer, decision date and outcome.
We have not established complete retention periods or sufficiently specific retention criteria for the other records described in this notice. We will not publish a period that we cannot apply consistently.
Your rights#
Subject to the conditions and exceptions in data protection law, you can ask for access to your personal data, correction of inaccurate or incomplete data, erasure, restriction of processing and data portability.
Portability applies to personal data you have provided where processing is automated and based on consent or a contract.
Where processing relies on consent, you can withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal.
You can object, for reasons relating to your circumstances, to processing based on legitimate interests. We must stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the processing for legal claims. You can object to direct marketing at any time without giving a reason.
You also have rights concerning significant decisions based solely on automated processing. Our proposed CIT process includes human marking and an Assessment Board decision, as explained above.
We consider erasure requests individually. A result record is not automatically exempt from erasure. We will explain any applicable ground for retaining it. Erasing an identity document does not remove a necessary identity verification requirement.
Send candidate and assessment requests to assessments@accredilaw.co.uk and other requests to info@accredilaw.co.uk. You may also contact us by telephone or post. You do not need to use a particular form or legal wording.
We normally respond without undue delay and within one month. Where the law permits an extension because of complexity or the number of requests, we may extend by up to two further months and will explain this within the initial month. Paragraph 25 of Part 4 of Schedule 2 to the Data Protection Act 2018 exempts information recorded by candidates during an examination from the right of access. It also changes the time limit for responding to requests for examination marks. Under our draft policy, we propose to apply the exemption to written examination scripts. We would not treat it as automatically covering a CIT recording. We would take advice before refusing access to a CIT recording on that ground.
Under the proposed assessment arrangements, we would not return the question paper to candidates, in whole or in part, including through feedback or appeals. It is confidential assessment material.
Requests are normally free. We may charge a reasonable fee or refuse a request only where the law permits. If we reasonably doubt your identity, we may ask for information necessary to confirm it.
If we refuse a request, we will explain the reasons and your rights to complain to the ICO and seek a judicial remedy.
Whether you have to provide data#
Your name is optional on the contact form. We need an email address to reply by email. The website registration form submits an enquiry and does not register you for an accreditation assessment.
Our proposed assessment regulations require account details, identity verification, relevant eligibility and exemption evidence, assessment work and payment information as applicable to the assessment contract. Without necessary information, registration, verification, booking or assessment cannot be completed.
An additional passport style photograph is optional under the proposed registration identity process.
Equality monitoring answers are voluntary. Every question offers “prefer not to say”.
We have not identified in this notice a statutory requirement requiring you to provide particular information directly to AccrediLaw. Scheme requirements and contractual requirements are not automatically statutory requirements.
Where your data comes from#
We receive information directly from you through forms, the learning platform, payments, calls and email.
The proposed assessment process also creates information about you, including verification decisions, marks, moderation records and Assessment Board decisions. Portfolio submissions include supervising solicitor feedback and certification.
Under the proposed assessment arrangements, candidates would provide details of their supervising solicitor and employer. We would receive personal data about supervising solicitors from candidates and their portfolio submissions, rather than from the solicitors themselves. We would use it to check portfolio certification and eligibility. We have not yet settled whether or how we would give supervising solicitors privacy information, or whether we would rely on an exception under Article 14(5).
Portfolio case reports contain information about clients and other people involved in real cases. AccrediLaw receives that information through the candidate’s submission. It can include case references, alleged offences, police station details, dates and accounts of advice and interviews.
We have not completed our record of other indirect sources, including information returned by payment services or obtained when checking qualifications and LAA registration. We have not established whether any source is publicly accessible.
Before accepting portfolio case reports, we must establish how we will provide privacy information to the people described in them, or establish and document an applicable exception.
Cookies and similar technologies#
This section applies to accredilaw.co.uk. The website sets no cookies and uses no analytics or advertising trackers or chat widget.
Cloudflare processes IP addresses, request logs and form submissions. Images load from Unsplash, which receives the visitor’s IP address and browser details when an image is requested.
This section does not describe the separate learning platform or third party payment pages.
Data breaches#
We notify the Information Commissioner’s Office (ICO) within 72 hours where required. We tell affected people where the risk to them is high.
Complaints#
You can complain to Quality and Compliance about how we handle your personal data. Email info@accredilaw.co.uk or write to ACCREDILAW LTD, 2nd Floor College House, 17 King Edwards Road, Ruislip, London, HA4 7AE. Candidate and assessment complaints about personal data can also be sent to assessments@accredilaw.co.uk.
You also have the right to complain to the ICO. Visit ico.org.uk or call 0303 123 1113.
Arrangements still to be completed#
The assessment arrangements described here are drawn from draft policies and regulations. They are not evidence that accreditation assessments are operating or that every control has been implemented.
We must resolve the gaps affecting services already in use now. These include lawful bases, access arrangements, international transfers and retention rules. Before the proposed assessment processing begins, we must also complete the relevant sensitive data decisions, processor checks and assessment data protection impact assessment. Our ICO fee registration or exemption position remains to be confirmed.
Changes to this notice#
We will update this notice when our processing arrangements change or missing details are settled. The date at the top shows when it was last updated.
Before using your personal data for a different purpose, we will tell you the new purpose and give you the relevant additional privacy information.
Contact us#
Quality and Compliance, ACCREDILAW LTD, 2nd Floor College House, 17 King Edwards Road, Ruislip, London, HA4 7AE.
General enquiries and data protection requests: info@accredilaw.co.uk.
Candidate and assessment data requests: assessments@accredilaw.co.uk.
Phone: 0330 190 1261.
About this notice, contact Quality and Compliance at info@accredilaw.co.uk or call 0330 190 1261.