Privacy Policy – Duty Blue

This Privacy Policy explains how the Portfolio Management System operated by peelpot.co.uk ("we", "us", "our") collects, uses, stores, and protects your personal data. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller is Darren Bassett, peelpot.co.uk.
Contact: dnbassett@peelpot.co.uk

2. Personal Data We Collect

a. Data You Provide

Account data: name, email address, username, password (stored as a bcrypt hash — never in plain text), phone number, department, profile image
Portfolio and evidence data: files, images, video, documents, and text you upload as evidence or assignment submissions; any personal data contained within your uploads
Assessment data: examination answers, assignment submissions, grades, feedback received
Communications: messages sent via the built-in messenger, support requests sent by email
Consent records: your acceptance of our data processing agreements, with timestamp and IP address

b. Data Collected Automatically

Session data: a session identifier linked to your user account, stored securely in the database
Activity logs: see Section 5 for full details of what is recorded on every action
Login attempt data: timestamp, IP address, and outcome (success or failure) of every login attempt, used to detect and prevent unauthorised access
Technical data: IP address, browser type, operating system, and user agent string, collected as part of session and audit logging

We do not collect payment data. The System does not have payment functionality.

3. How We Use Your Personal Data

Purpose	Lawful Basis (UK GDPR)
Providing and managing your user account	Contract performance (Article 6(1)(b))
Hosting, storing, and processing your portfolio submissions and assessments	Contract performance (Article 6(1)(b))
Enabling communication between users via the messenger	Contract performance (Article 6(1)(b))
Sending email notifications about your account and assessments	Contract performance / Legitimate interests (Article 6(1)(f))
Maintaining security, detecting unauthorised access, and preventing fraud	Legitimate interests (Article 6(1)(f))
Comprehensive activity logging for audit, accountability, and investigation	Legitimate interests (Article 6(1)(f))
Managing GDPR rights requests and consent records	Legal obligation (Article 6(1)(c))
Complying with educational record-keeping requirements	Legal obligation (Article 6(1)(c))

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Sharing Your Personal Data

We share personal data only in limited, necessary circumstances:

Other users within the System: tutors, assessors, and administrators can view your portfolio, submissions, and progress data as required to deliver your learning programme. Administrators can view activity logs.
Hosting infrastructure: the System runs on a web server and database; these are operated under appropriate data processing arrangements.
Email delivery: notifications are sent via a configured SMTP service.
Antivirus scanning: uploaded files may be scanned using ClamAV (local) or VirusTotal (cloud-based, if configured). If VirusTotal is used, file hashes or contents may be transmitted to VirusTotal's servers. Refer to VirusTotal's Privacy Policy for details.
Cloudflare Turnstile: the login page uses Cloudflare Turnstile for bot protection. Refer to Cloudflare's Privacy Policy.
Legal requirements: we may disclose data to law enforcement, regulators (including the ICO), or courts where legally required.

We do not sell personal data or share it for marketing purposes.

If data is transferred outside the UK, we use appropriate safeguards (adequacy decisions or standard contractual clauses).

5. System Activity Logging

To maintain the security and integrity of the System, we automatically record a log of all activity within your account. This applies to all users. The following is recorded on every action:

Your user account identifier
The date and time of the action (to the millisecond)
Your IP address at the time of the action
Your browser and device information (user agent string)
The page or function accessed (URL and HTTP method)
The type of action performed (e.g. login, file upload, evidence submission)
File moderation actions (for example: file quarantined, quarantine released, file deleted)
Whether the action succeeded or failed
A risk classification (low, medium, high, or critical) assigned to the action type
The session identifier associated with the action

Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)) — maintaining platform security, detecting and investigating unauthorised access, preventing fraud, and ensuring accountability.

Retention: Activity logs are retained for 90 days in active storage, then archived automatically. See our Data Retention Policy for full details.

Access: Logs are accessible only to users with administrator-level permissions and are not visible to other users. Logs may be disclosed to law enforcement or the ICO where legally required.

Your rights: You may request a copy of the activity logs recorded against your account as part of a Subject Access Request.

6. Data Retention

We retain personal data only for as long as necessary. Full details are in our Data Retention Policy. In summary:

Educational records (portfolio, evidence, assessment data): 7 years after programme completion
Account data: duration of account, deleted within 30 days of a confirmed erasure request
Activity and security logs: 90 days active, then archived
Database backups: 90 days, then deleted automatically

7. Security

We implement technical and organisational measures to protect personal data, including:

Bcrypt password hashing (cost factor 12)
CSRF token protection on all forms
Session cookies set with HttpOnly and SameSite=Strict flags
Role-based access control with over 100 granular permissions
Antivirus scanning of all uploaded files
Encryption of uploaded files at rest (AES-256-GCM) when encryption is enabled by system configuration
Rate limiting on login attempts (lockout after 5 failures for 15 minutes)
Encrypted database backups (AES-256-GCM)
Comprehensive audit logging

No online system can guarantee absolute security. In the event of a personal data breach, we will notify the ICO within 72 hours where required and affected individuals without undue delay.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Access: request a copy of the personal data we hold about you
Rectification: request correction of inaccurate data
Erasure: request deletion of your data (subject to legal retention obligations)
Restriction: request that we limit processing in certain circumstances
Portability: receive your data in a machine-readable format
Objection: object to processing based on legitimate interests
Withdraw consent: where processing is based on consent

To exercise any right, contact: dnbassett@peelpot.co.uk. We will respond within one month (extendable to three months for complex requests).

You may also lodge a complaint with the Information Commissioner's Office at ico.org.uk.

9. Third-Party Data in Uploads

If your uploads contain personal data about other individuals (for example, names or contact details of clients or colleagues included as professional practice evidence), you are responsible for ensuring you have a lawful basis for including that data. We process it solely to provide the System to you.

10. Age Restriction

The System is intended for adult users (18 and over) in a professional or educational context. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated via the System or by email. Continued use after notification constitutes acceptance. Where required, we will seek fresh consent.