Trust & Compliance Centre

Talent Cloud helps organisations design, deliver, govern and measure workforce programmes.

Workforce programmes involve people, personal information, assessments, employers, programme evidence and decisions that can materially affect individuals.

Trust therefore needs to be designed into how the platform operates, how information is governed and how technology is used.

This Trust & Compliance Centre brings together our public position on privacy, data governance, security, responsible technology, accessibility and platform governance.

It also explains the boundaries of our role and directs users, customers, partners and procurement teams to the more detailed documents that apply.

1. What This Centre Is

This Centre provides an overview of Talent Cloud's public trust and governance position.

It is intended to help people understand:

• how we approach privacy and personal information;
• how we govern programme information;
• how assessments and technology-assisted processing work;
• our public security position;
• how international processing is approached;
• how we think about information retention;
• how security concerns can be reported;
• our approach to accessibility;
• where to find our detailed governance documents; and
• how customers can obtain additional assurance information.

This Centre is a transparency and navigation resource.

It does not replace:

• our Privacy Notice;
• contractual data-processing terms;
• customer agreements;
• security schedules;
• programme-specific terms;
• Learner Terms;
• Admin Platform Terms; or
• other agreements that apply to a particular service or relationship.

Where an applicable signed agreement creates specific obligations concerning a matter within its scope, that agreement governs those obligations.

2. Privacy and Data Protection

Talent Cloud processes personal information across our websites, platform and workforce programme services.

Our legal role can differ depending on the processing involved.

For activities where Talent Cloud determines why and how personal information is processed, such as operating our corporate website and managing our own business relationships, Talent Cloud may act as the relevant controller or responsible party.

For customer-directed workforce programme processing, the customer or relevant programme organisation may ordinarily determine the purposes of processing, with Talent Cloud processing information on its instructions where applicable.

Multiple organisations may therefore have different responsibilities within the same programme ecosystem.

Depending on the service and programme, our platform may process information relating to:

• identity and contact details;
• education and employment;
• workforce programmes;
• enrolment and participation;
• assessments and readiness;
• evidence and progress;
• employer engagement;
• interviews;
• placements and outcomes;
• technical and security activity; and
• demographic, protected or other special personal information where relevant and lawfully processed.

Our Privacy Notice explains our approach in greater detail, including:

• our different processing roles;
• categories and sources of personal information;
• purposes of processing;
• special personal information;
• international processing;
• retention;
• children's information;
• technology-assisted processing; and
• privacy rights.

Read our Privacy Notice

3. Data Governance and Provenance

Workforce programmes can involve information from multiple people, organisations and systems.

Information within Talent Cloud may originate from sources including:

• learners and participants;
• training and delivery partners;
• employers and workplace hosts;
• assessors;
• moderators;
• programme managers;
• quality-assurance professionals;
• certification providers;
• learning systems;
• assessment providers; and
• other authorised systems or organisations.

Data provenance matters.

Where information originates from an assessor, employer, learning system, certification provider or another authoritative source, Talent Cloud aims to preserve the source and context of that information rather than represent every record as a Talent Cloud determination.

For example:

• an assessor remains the source of a human assessment judgement;
• an external certification provider remains the source of a certification it issues;
• an employer remains responsible for an employment decision it makes;
• an integrated assessment provider may remain responsible for its underlying assessment methodology; and
• a programme organisation remains responsible for programme decisions within its authority.

Talent Cloud can connect these records and help organisations govern the programme around them without unnecessarily replacing the specialist systems or accountable actors that own the underlying function.

This distinction supports clearer accountability, auditability and programme assurance.

4. South African Workforce Programmes and International Processing

Talent Cloud Global Ltd is registered in England and Wales and provides the Talent Cloud platform for our South African workforce programme activities.

Our core South African platform infrastructure uses an AWS South Africa environment.

This does not mean that all access to or processing of personal information occurs exclusively within South Africa.

Depending on the service and authorised operational requirements:

• authorised administration or support access may occur from the United Kingdom;
• authorised individual developers may access relevant environments from India;
• approved technology or service providers may process information in other jurisdictions; and
• international processing may occur even where primary programme infrastructure is located in South Africa.

International access does not remove the requirement to apply appropriate privacy, confidentiality, security and contractual controls.

Where international processing is relevant, it is governed according to applicable data-protection requirements and the circumstances of the relevant processing.

Further information is available in our Privacy Notice.

5. Information Retention and Lifecycle

Different categories of workforce programme information may need to be retained for different purposes and periods.

Retention can depend on matters such as:

• the nature of the information;
• the programme;
• the organisation responsible for the information;
• programme assurance and evidence requirements;
• assessment or certification requirements;
• contractual obligations;
• legal or regulatory requirements;
• disputes or investigations;
• security requirements; and
• whether information remains necessary for the purpose for which it is held.

Programme closure, learner withdrawal, account deactivation or the end of a customer relationship does not necessarily result in immediate deletion of all associated information.

Depending on the circumstances, information may need to be:

• retained;
• archived;
• returned;
• anonymised;
• restricted; or
• securely deleted.

We do not describe programme or customer information as automatically deleted at the end of a programme or relationship where that does not reflect the actual lifecycle of the information.

Our Privacy Notice provides further information about retention.

Customer-specific retention requirements may also be addressed through applicable contractual arrangements.

6. Assessments, Readiness and Responsible Technology

Not every automated process in Talent Cloud is artificial intelligence.

Our platform distinguishes between:

• human assessment;
• deterministic calculations;
• technology-assisted matching;
• third-party AI-assisted services; and
• programme reporting and analytics.

Understanding these differences is important because the technology, purpose, limitations and role of human judgement differ between them.

Human Assessment

Within academy and learnership workflows, authorised human assessors may determine assessment outcomes such as whether a learner is competent or not yet competent.

The platform can record, organise, display and use those results without turning the underlying human assessment judgement into an AI decision.

The assessment judgement remains attributable to the authorised assessor.

Readiness

Authorised assessors may evaluate defined readiness criteria.

The platform can calculate an overall readiness indicator from assessor-entered scores.

That calculation is intended to summarise readiness information.

It does not independently make an employment, placement or programme decision.

Matching

Where enabled, Talent Cloud matching may combine:

• programme and cohort rules;
• eligibility filters;
• skills and qualifications;
• profile and opportunity information;
• semantic comparison;
• employment and availability information; and
• configurable weighting.

A match score measures configured relevance.

It does not measure human worth, overall employability or overall candidate quality.

Matching outputs are intended to support authorised human decision-making.

Third-Party AI

Some workforce workflows may use approved third-party technology providers.

Where enabled, this may include AI-assisted interview analysis through JobMojito.

Third-party AI interview analysis should not be assumed to operate across every Talent Cloud product, assessment or programme workflow.

Reporting

Many Talent Cloud programme reports and indicators are generated through database queries, business rules and deterministic calculations.

The fact that software produces a report or calculation does not mean that the process uses generative AI.

Human Accountability

Our current operating model is designed to preserve meaningful human responsibility for material programme, placement and employment decisions.

The current platform design does not use its technology-assisted processes to automatically:

• reject a learner from a programme;
• remove a learner from a programme;
• change a learner's programme status solely through AI;
• assign a learner to an employer;
• make a final hiring decision;
• make a final employment decision; or
• make a final placement decision.

Our AI & Assessment Transparency Statement explains these processes in greater detail, including their limitations, the responsibilities of organisations using them and how an individual can raise concerns about a relevant output.

Read our AI & Assessment Transparency Statement

7. Security

We take a practical, engineering-led approach to security.

Security controls are considered according to the system, information and operational context involved.

Our current platform controls include measures such as:

• authenticated access;
• role and permission controls;
• password protection and hashing;
• HTTPS for protected communications;
• relevant audit logging;
• controlled service-to-service access;
• cloud infrastructure controls; and
• restricted production access.

No internet or cloud service can eliminate security risk completely.

We therefore do not describe security as an absolute guarantee.

We also do not claim to hold ISO 27001, SOC 2, Cyber Essentials or another security certification unless that status is expressly confirmed as current.

Our security environment continues to develop alongside the platform.

Customer-specific security requirements can be addressed through appropriate procurement, due-diligence and contracting processes.

Read our Security Statement

8. Security Incidents

Security incidents and vulnerability reports are related but different matters.

Where we become aware of a suspected security compromise, we assess the circumstances and take appropriate steps according to the nature and significance of the incident.

These may include:

• investigation;
• containment;
• preservation of relevant evidence;
• assessment of affected systems and information;
• remediation;
• engagement with relevant service providers;
• consideration of contractual notification requirements; and
• consideration of applicable legal or regulatory notification requirements.

The response required depends on the circumstances.

We do not assume that every technical event is a personal-information breach, nor do we wait for certainty where applicable law or an agreement requires action based on an appropriate level of awareness or reasonable suspicion.

9. Responsible Disclosure

We welcome responsible reporting of suspected security vulnerabilities.

If you identify a potential security issue affecting a Talent Cloud website or service, please report it privately to:

[support@talentcloudglobal.com](mailto:support@talentcloudglobal.com)

Our Responsible Disclosure guidance explains how to report a concern and the conduct we ask security researchers and other reporters to follow.

We ask reporters not to:

• access information that is not their own;
• alter information without authorisation;
• retain personal or confidential information obtained without authorisation;
• intentionally disrupt our services; or
• publicly disclose a vulnerability before we have had a reasonable opportunity to investigate it.

Read our Responsible Disclosure guidance

10. Cookies and Website Technologies

Our public website may use cookies, browser storage and similar technologies.

Necessary technologies may be used to support functions such as:

• security;
• website operation;
• preference management; and
• other essential functionality.

Where optional analytics technologies require consent, they should not be activated until the relevant choice has been made.

We do not treat:

• acceptance of website terms;
• programme enrolment;
• platform activation;
• acceptance of platform terms; or
• presentation of a privacy notice

as consent to optional analytics or electronic direct marketing.

Our Cookie Policy explains the technologies used on our public website and how preferences can be managed.

Read our Cookie Policy

Manage Cookie Preferences

11. Accessibility

We aim to make our public website and platform experiences usable by as many people as reasonably possible.

Our approach includes consideration of matters such as:

• semantic structure;
• keyboard interaction;
• focus behaviour;
• colour contrast;
• labels;
• responsive layouts; and
• relevant WCAG AA criteria.

Accessibility is an ongoing engineering and design responsibility.

We do not claim formal or complete conformance with a particular accessibility standard unless that status has been appropriately established.

If you experience an accessibility problem when using a Talent Cloud service, please contact us so that we can understand the issue and consider appropriate support or remediation.

Read our Accessibility Statement

12. Website Governance

Our public website provides information about Talent Cloud, our products, our approach and our governance.

Public website information does not replace customer-specific contractual commitments.

Our Website Terms of Use explain:

• the conditions applying to use of our public website;
• the distinction between public information and authenticated platform services;
• acceptable use;
• intellectual property;
• automated access and data extraction;
• website availability;
• third-party links;
• procurement and due-diligence information; and
• the relationship between website content and signed commercial agreements.

Where there is a conflict between general website content and an applicable signed customer, partner or other commercial agreement concerning the same subject matter, the signed agreement governs that subject matter.

Read our Website Terms of Use

13. Learners and Platform Users

The public website is not the contractual framework governing participation in a Talent Cloud-supported workforce programme.

Different terms and notices apply to authenticated platform users.

Depending on the user's role and programme, these may include:

• Learner Terms of Use;
• Admin Platform Terms;
• privacy information;
• assessment and technology-assisted processing information;
• acceptable-use requirements; and
• customer or programme-specific requirements.

Learners should receive relevant privacy information and applicable terms through the appropriate platform activation or user journey.

Acceptance of platform terms should not be treated as blanket privacy consent.

Presentation or acknowledgement of a Privacy Notice should not automatically be treated as consent to all processing.

Programme enrolment or platform activation should not automatically be treated as consent to direct marketing.

14. Children and Younger Participants

Talent Cloud may support workforce programmes involving participants under the age of 18 where appropriate.

Processing children's personal information and using assessments or technology-assisted processes involving children require additional care.

Where a programme includes children, the organisation responsible for the relevant processing must ensure that appropriate:

• legal authority;
• safeguards;
• transparency;
• access controls;
• programme governance; and
• human responsibility

are established for the relevant activity.

We do not assume that an assessment, matching process or technology-assisted workflow suitable for an adult programme is automatically appropriate for children.

Further information is available in our Privacy Notice and AI & Assessment Transparency Statement.

15. Procurement and Customer Due Diligence

We recognise that customers may require information about our governance, security, privacy and technology before deploying Talent Cloud.

This Trust & Compliance Centre provides our public baseline.

Depending on the proposed service, customer requirements, confidentiality arrangements and appropriate scope, additional due-diligence information may be available concerning matters such as:

• platform architecture;
• hosting;
• data processing;
• international processing;
• security controls;
• access controls;
• technology and service providers;
• assessments and AI-assisted processing;
• incident governance;
• data retention;
• business continuity;
• contractual protections; and
• other relevant customer requirements.

Public trust information is not a substitute for a customer-specific:

• security questionnaire;
• data-processing agreement;
• security schedule;
• service description;
• order form; or
• other contractual commitment

where one is required.

Statements about laws, standards, frameworks or good practice should not be interpreted as claims that Talent Cloud holds a certification, accreditation or regulatory approval unless we expressly confirm that status as current.

16. Current Assurance Position

Talent Cloud's governance, privacy and security environment continues to mature alongside the platform.

We distinguish between three important categories.

Implemented Controls

These are controls, functionality or operational arrangements that currently operate within the relevant platform or organisation and can be described on the basis of available evidence.

Governance Requirements

These establish how we expect information, technology and operational activities to be managed.

A governance requirement may create an internal standard or implementation expectation without implying that every possible technical control has already reached its final maturity state.

Customer-Specific Commitments

These are commitments agreed with a particular customer through an applicable contract, order form, data-processing agreement, security schedule or other agreed document.

Customer-specific commitments should not be inferred merely from general public website language.

Claims Discipline

We aim to distinguish between what exists today, what our governance requires and what may be developed in future.

We do not present planned controls as though they are already implemented.

Similarly, we do not claim a certification, technical capability, security control or compliance status unless there is an appropriate basis for that claim.

17. Our Governance Principles

Our public governance approach is guided by the following principles.

Evidence and Provenance

Important programme information should remain attributable to its appropriate source.

Technology should help connect and govern evidence without obscuring where it originated.

Human Accountability

Technology can support judgement.

It should not obscure who is responsible for a material assessment, programme, placement or employment decision.

Transparency

People should receive meaningful information about important processing and technology-assisted activities affecting them.

Purpose Limitation

Information and technology-assisted outputs should be used for defined and appropriate purposes rather than automatically reused simply because they are available.

Security and Privacy by Design

Privacy and security considerations should form part of product, architecture and operational decision-making rather than being treated only as documentation exercises after implementation.

Specialist Systems Remain Authoritative

Where another system, assessor, certification provider or specialist service owns an authoritative function, Talent Cloud should preserve the source and provenance of that information rather than misrepresent it as a Talent Cloud determination.

18. Governance Document Map

Our public governance framework is designed so that each document has a clear purpose.

Privacy Notice

Purpose: Personal information and privacy.

It explains:

• what personal information may be processed;
• where it comes from;
• why it is processed;
• the different legal roles organisations may have;
• special personal information;
• international processing;
• retention;
• children's information; and
• privacy rights.

Read our Privacy Notice

AI & Assessment Transparency Statement

Purpose: Assessments and technology-assisted processing.

It explains:

• human assessment;
• readiness indicators;
• technology-assisted matching;
• third-party AI-assisted services;
• programme reporting;
• limitations;
• human oversight;
• responsible use; and
• routes for challenging relevant outputs.

Read our AI & Assessment Transparency Statement

Security Statement

Purpose: Our public security position.

It explains the security approach and controls that we can appropriately describe publicly, together with the boundaries of our security claims.

Read our Security Statement

Cookie Policy

Purpose: Cookies, browser storage and similar public website technologies.

It explains which technologies may be used, why they are used and how relevant preferences can be managed.

Read our Cookie Policy

Website Terms of Use

Purpose: Rules governing the public Talent Cloud website.

They explain acceptable use, intellectual property, website availability, automated access, public information and the relationship between website content and separate commercial agreements.

Read our Website Terms of Use

Accessibility Statement

Purpose: Accessibility.

It explains our approach to making Talent Cloud website and platform experiences usable and how accessibility issues can be raised.

Read our Accessibility Statement

Responsible Disclosure

Purpose: Security vulnerability reporting.

It explains how suspected security vulnerabilities should be reported responsibly.

Read our Responsible Disclosure guidance

19. Contractual and Product-Specific Documents

Our public governance documents do not replace agreements that apply to specific users, customers or relationships.

Depending on the circumstances, additional documents may include:

• Learner Terms of Use;
• Admin Platform Terms;
• Acceptable Use requirements;
• customer agreements;
• order forms;
• programme schedules;
• data-processing agreements;
• security schedules;
• partner agreements; and
• other customer or programme-specific terms.

These documents may create additional obligations.

Where an applicable signed agreement conflicts with general public website information concerning a matter within the agreement's scope, the signed agreement governs that matter.

20. Contact Us

For privacy, legal, security, platform-support or trust enquiries:

Talent Cloud Global Ltd

Suite A 82 James Carter Road Mildenhall Suffolk IP28 7DE United Kingdom

Registered in England and Wales Company number: 16914164

Email: support@talentcloudglobal.com