Last updated: August 2026

1. Who we are

Insight Optical Training Limited is responsible for the personal data described in this Privacy Notice.

Company number: 10590199
Address: Devonwood, Spekes Road, Hempstead, Gillingham, Kent, ME7 3RT
Email: info@insight-optical.co.uk
ICO registration number: ZA466897

This Privacy Notice explains how we collect, use, store and share personal data when you use our websites, make an enquiry, enrol on or participate in training, use MyIOTA, undertake an examination, attend CPD or otherwise interact with us.

2. Personal data we collect

Depending on your relationship with us, we may collect:

• your name and contact details;

• date of birth;

• employer, organisation and job-role information;

• information provided when you enquire about or apply for a course;

• enrolment and registration information;

• information about your learning, progress and engagement;

• coursework, assignments and assessment information;

• examination bookings, results and related assessment records;

• communications between you and Insight Optical Training;

• invoicing, payment and transaction information;

• information about additional learning needs or reasonable adjustments;

• CPD and event registration and attendance information;

• marketing preferences;

• information you provide through forms, surveys or feedback; and

• technical information relating to your use of our websites and online learning systems.

Special-category personal data

Some information we process may be classed as special-category personal data under UK data-protection law. This may include information concerning ethnicity, health or disability.

We only collect and use this information where it is necessary and where we have an appropriate lawful basis and additional legal condition for doing so.

Where information about health, disability or additional needs is provided to us so that we can consider reasonable adjustments or provide appropriate learner support, we will only use it for relevant purposes and restrict access to those who need the information.

Ethnicity and NCFE registration

Where you undertake an NCFE qualification, we are required to register you with NCFE and provide the learner information required for that registration. This includes an ethnicity field used by NCFE for monitoring and reporting purposes.

Ethnicity is special-category personal data.

Insight Optical Training collects the ethnicity information required for the NCFE registration process and transfers it to NCFE.

Insight Optical Training does not retain your ethnicity information in its own learner records after the NCFE registration process has been completed.

NCFE is responsible for its subsequent processing and retention of this information in accordance with its own data-protection responsibilities and privacy information.

3. How we obtain personal data

We normally obtain personal data directly from you.

We may also receive personal data from:

• your employer, where they arrange or fund your training;

• NCFE;

• Eventbrite;

• examination or assessment services;

• professional or regulatory organisations; or

• other organisations where you have authorised, or would reasonably expect, information to be shared with us.

Where appropriate, we will provide additional privacy information if we obtain personal data about you from another source.

4. Why we use your personal data and our lawful bases

We must have a lawful basis for processing personal data. The basis we use depends upon why the information is being processed.

Where we rely upon legitimate interests, those interests may include operating and improving our education and training services, maintaining appropriate records, protecting our systems, communicating appropriately with learners and customers, and protecting our legal and business interests.

We consider whether our interests are necessary and proportionate and balance them against the rights and interests of the people whose information we process.

Where we rely on consent, you may withdraw your consent at any time.

Where special-category personal data is processed, we also identify and document an appropriate additional condition for processing as required by data-protection law.

5. NCFE and awarding-organisation registration

Learners undertaking relevant NCFE qualifications are registered with NCFE.

To register you and administer your qualification, we provide NCFE with information required for the relevant registration and qualification process. Depending on the qualification and requirements, this may include:

• name;

• date of birth;

• learner-identification information;

• the ethnicity response required as part of the NCFE registration process;

• qualification and unit registrations;

• assessment and achievement information; and

• other information required to administer or certificate the qualification.

As explained above, Insight Optical Training does not retain the ethnicity information collected for NCFE registration after the registration process has been completed.

NCFE processes information provided to it in accordance with its own data-protection responsibilities and privacy information.

6. MyIOTA and website hosting

Our website and MyIOTA online learning platform are hosted on servers managed for us by Awards LS.

Awards LS may therefore process or have technical access to personal data where necessary to provide hosting, maintenance, technical support, security and related services.

Where Awards LS processes personal data on our behalf, it is required to handle that information appropriately and in accordance with applicable data-protection requirements.

7. Examinations and TestReach

We use TestReach to deliver online examinations.

Where you are registered to take an examination, we provide TestReach with the information necessary to create and administer your examination account. This currently includes your:

• name; and

• email address.

Information about your examination activity and results may also be processed through TestReach as part of the examination and assessment process.

8. Peer Review CPD, Eventbrite and Zoom

We use Eventbrite to advertise and administer registrations and payments for some Peer Review CPD sessions and other events.

When you register through Eventbrite, Eventbrite may collect information including your name, contact details, booking information and payment information.

Information necessary to administer your booking and attendance is made available to Insight Optical Training.

Payments made through Eventbrite are processed through Eventbrite and its associated payment services. Insight Optical Training does not receive your full payment-card details.

Our live Peer Review CPD sessions are normally delivered using Zoom.

When you participate in a Zoom session, Zoom may process information such as your name, email address, IP address, device information and information associated with your participation in the session.

Eventbrite and Zoom also process personal data in accordance with their own privacy arrangements.

9. Payments, invoicing and QuickBooks

Payments for Insight Optical Training courses and examinations are not normally processed through our website.

We use QuickBooks to prepare and manage invoices. Invoices are normally provided to the relevant customer or practice and payment is generally made by bank transfer.

We retain appropriate invoicing, payment and accounting records where necessary to administer our accounts and meet our legal, accounting and tax obligations.

Payments for events booked through Eventbrite are processed through Eventbrite and its associated payment services as described above.

10. Sharing personal data

We do not sell personal data.

Where necessary and lawful, we may share personal data with:

• NCFE;

• Awards LS;

• TestReach;

• Eventbrite;

• Zoom;

• QuickBooks/Intuit;

• your employer, where appropriate and where there is a lawful basis for doing so;

• professional, regulatory or awarding organisations where necessary;

• banking, accounting and professional advisers;

• technology, email, hosting and IT service providers;

• regulators, public authorities or law-enforcement bodies where required by law; and

• other suppliers acting on our behalf.

We only share personal data that is reasonably necessary for the relevant purpose.

11. Employer-funded training

If your employer pays for or arranges your training, this does not automatically mean that all information about your studies will be shared with them.

We will only share information about your progress, assessment or other personal data where there is an appropriate lawful basis for doing so.

Where appropriate, we will explain what information may be shared and why.

12. How long we keep personal data

We do not keep personal data indefinitely.

Learner records may be retained for up to 10 years after completion, withdrawal or the end of the relevant learner relationship where this is reasonably necessary for purposes including:

• confirming qualifications or achievement;

• managing historical assessment or certification queries;

• meeting awarding-organisation or quality-assurance requirements;

• responding to complaints, appeals or disputes; and

• maintaining appropriate business and educational records.

Ethnicity information collected for NCFE registration is not retained by Insight Optical Training after the NCFE registration process has been completed.

Other types of information may be retained for shorter periods depending upon why it was collected.

Financial and accounting records are retained for the period necessary to meet applicable accounting, tax and legal requirements.

We periodically review the information we hold and securely delete or anonymise information when it is no longer required.

13. International processing

Some of the organisations and technology services we use may process personal data outside the United Kingdom.

Where personal data is transferred internationally, we take appropriate steps to ensure that the transfer complies with UK data-protection law.

Depending upon the circumstances, this may include relying upon applicable UK adequacy regulations or appropriate safeguards, such as approved international data-transfer arrangements.

14. Marketing communications

We may send marketing communications where you have consented to receive them or where we are otherwise permitted to do so under applicable data-protection and electronic-marketing law, including the Privacy and Electronic Communications Regulations (PECR).

Where PECR requires consent for electronic marketing, we will obtain appropriate consent before sending it. Where the law permits another approach, we will ensure that an appropriate lawful basis applies.

We may use an email-marketing service provider to help manage our communications.

Marketing emails provide a way to unsubscribe or manage your preferences.

You may object to the use of your personal data for direct marketing at any time.

Unsubscribing from marketing will not prevent us from sending service communications that are necessary in connection with a course, examination, booking or other service you are using.

15. Cookies and website analytics

Our websites use cookies and similar technologies. Some are necessary for the website and MyIOTA to function, while others may support features or services provided through the website.

We use Burst Statistics to help us understand how visitors use our website, such as the number of visits and which pages are most frequently viewed.

Burst is configured in cookieless mode. It does not use analytics cookies or browser fingerprinting to recognise visitors and uses privacy-focused methods to provide aggregate website statistics.

We have also configured our analytics to respect browser Do Not Track requests.

We do not currently use Google Analytics.

We use Complianz to manage cookie consent and provide information about cookies and similar technologies used by our website.

Where consent is legally required for a cookie or similar technology, it will only be used after you have made the relevant choice through our cookie-management system.

You can review or change your cookie preferences using the cookie-management tool available on our website.

Further information about cookies and services used on our website is available in our Cookie Policy.

16. Keeping your information secure

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

Access to personal data is restricted to people and service providers who need it for legitimate purposes.

We also expect organisations processing personal data on our behalf to apply appropriate security and data-protection measures.

17. Your data-protection rights

Depending upon the circumstances, you may have rights including:

• the right to be informed about how your personal data is used;

• the right to access your personal data;

• the right to have inaccurate information corrected;

• the right to request deletion of your information in certain circumstances;

• the right to restrict processing in certain circumstances;

• the right to data portability where applicable;

• the right to object to certain processing, including direct marketing; and

• rights relating to certain automated decision-making.

Not every right applies in every situation.

To exercise a data-protection right, contact:

info@insight-optical.co.uk

We may need to confirm your identity before responding to a request.

18. Complaints

If you have concerns about how we use your personal data, please contact us first so that we have an opportunity to investigate and respond.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data-protection regulator.

Information about making a complaint and your data-protection rights is available from the ICO.

19. Changes to this Privacy Notice

We will review this Privacy Notice regularly and update it where our activities, suppliers, systems or legal requirements change.

Where a significant change affects how we use personal data, we will take reasonable steps to bring the change to the attention of affected individuals.

20. Contact us

For questions about this Privacy Notice, our use of personal data or your data-protection rights, please contact:

Insight Optical Training Limited
Devonwood, Spekes Road
Hempstead, Gillingham
Kent, ME7 3RT

Email: info@insight-optical.co.uk