Privacy Notice

TSSG Academy learning platform (learn.tssgbarbados.com)

Version 0.2 (draft) · Last updated 13 July 2026

1. Who we are (data controller)

The data controller for this platform is T.S.S.G. (Barbados) Ltd, #22 2nd Avenue, Bella Vista Terrace, Mount Wilton, St. Thomas BB22069, Barbados. For any privacy query, contact academy@tssgbarbados.com.

2. Personal data we collect

• Your name, email address, telephone number, and student number.
• Your learning activity: course progress, assignment submissions, grades, and certificates.
• Identity verification: we store only a one-way SHA-256 hash of your government identification number plus its last four digits, together with the type of identification presented. Your full identification number is never stored anywhere in plain text.
• Technical records needed to operate the service securely, such as sign-in events and, where you give consent, the date, time and device details of that consent.

3. Lawful basis for processing

We process your personal data on the basis of your consent (Data Protection Act 2019, section 6, indicative and pending verification), the performance of our training agreement with you, and our legitimate interest in maintaining accurate training and certification records for accreditation.

4. How we use your data

To deliver training, mark and moderate assessments, issue certificates, keep regulatory and accreditation records, and communicate with you about your studies.

5. Automated marking and human review

Some assignments receive an initial, computer-assisted assessment with the help of an artificial intelligence service (Anthropic) to speed up feedback. This is never the final word. A qualified TSSG Academy instructor always reviews the work and is responsible for your final grade. You will not be subject to a decision that affects your certification based solely on automated processing, and you may ask us to have any automated assessment reviewed by a person. If you would like to understand how an assessment was reached, email academy@tssgbarbados.com.

6. How long we keep it

Training and certification records are retained in line with Barbadian record-keeping requirements for accredited education and the needs of our accreditation bodies. Specific retention periods are being confirmed and will be stated here once finalised.

7. Service providers who process data on our behalf

We use the following processors to run the platform. Some are located outside Barbados; see section 8 for how we protect any transfer of your data across borders.

• Cloudflare (hosting, database and content delivery).
• Google Workspace (document, calendar and spreadsheet storage).
• Anthropic (assists with initial assignment marking, subject to section 5).
• FAL.ai (learning video generation).
• Resend (email delivery, including sign-in codes).
• Certifier.io (certificate issuance).
• Fygaro (payment processing).

8. International transfers of your data

Because several of the service providers above operate outside Barbados, some of your personal data is transferred to, and processed in, other countries. Where we do this, we take steps intended to ensure your data continues to enjoy a level of protection consistent with the Data Protection Act 2019, including relying on appropriate safeguards such as standard or contractual data protection clauses with our providers. The specific safeguards for each provider are being confirmed and will be stated here once finalised. You can ask us for more detail about these safeguards by emailing academy@tssgbarbados.com.

9. Your rights

Under the Data Protection Act 2019, you have the right to:

• ask for access to the personal data we hold about you;
• ask us to correct data that is inaccurate or incomplete;
• ask us to erase your data in certain circumstances;
• ask us to restrict how we process your data in certain circumstances;
• object to certain processing of your data;
• ask us to provide your data in a portable format; and
• withdraw your consent at any time, without affecting processing that took place before you withdrew it.

To exercise any of these rights, email academy@tssgbarbados.com. We will respond within the timeframes required by law.

10. Children and young people

The TSSG Academy platform is intended for learners aged 18 and over. Under the Data Protection Act 2019, a child is a person under the age of 18, and the personal data of a child may only be processed with the consent of a parent or guardian. Where we enrol a learner under 18, we will require verifiable parental or guardian consent before processing their data, take reasonable steps to confirm that consent, and limit our use of that data to what is necessary to deliver and certify the training.

11. If there is a data breach

We take the security of your data seriously and use measures such as one-way hashing and encryption to protect it. If a personal data breach were to occur and it is likely to put your rights at high risk, we will:

• notify the affected learners without undue delay and, where feasible, within 72 hours of becoming aware of it;
• explain in clear, plain language what happened, what data was involved, and the likely consequences;
• describe the steps we have taken to contain the breach and to protect you, and give you practical guidance on any protective measures you can take; and
• notify the Barbados Data Protection Commissioner where the law requires.

Where the affected data had already been rendered unintelligible to others (for example through encryption or hashing), individual notification may not be necessary, but we will still act to contain the incident and keep a record of it.

12. Changes to this notice

We may update this notice from time to time. Each version carries a version number and a "last updated" date at the top of this page so you can see when it last changed. Where a change is material, we will ask you to review and accept the updated notice the next time you sign in.

13. Contact and complaints

For questions or complaints, contact the data controller at academy@tssgbarbados.com. You also have the right to lodge a complaint with the supervisory authority for Barbados, the Data Protection Commissioner (contact details to be confirmed and added here).