Overview
This Privacy Policy describes how we collect, use and process your personal data and how we are in compliance with applicable data protection law, in particular the General Data Protection Regulation (EU) (GDPR). Your privacy is important to us and we are committed to protecting and safeguarding the data privacy rights of our clients, apprentices, suppliers, third parties, employers, trainees and users of our website. We will ensure that your information is only used for the purposes set out in this policy.
Please read with Policy carefully as it contains important information on who we are, how and why we collect, store and share personal data. It will also explain your rights in relation to your personal data, how to contact us and supervisory authorities if you would like to report a concern about the way in which we process your data.
What personal data do we collect?
Type of Information:
- Employers
- Apprentices
- Training Providers
- Third Parties
- Employees
- Name
- Telephone/ Mobile
- Address
- Date of Birth
- Education
- Qualifications
- Learning Difficulties
- Photo ID
- Bank Details
- Next of Kin
How we collect your data:
- Register on our online platform
- Complete a form on our website
- Correspond with us by phone, email or in writing
- Report a problem
- Sign up to receive our newsletter
- Enter into a contract with us to receive products and/or services
Information we receive from other sources
If you are a tutor, apprentice, employer, assessor or trainer, we may receive information about you from your centre, training provider, or employer when they register to receive products and/or services from us. They may also register you onto our online platform.
Sensitive personal data
In certain limited cases, we may collect certain sensitive personal data from you (that is, information about your learning difficulties, photo ID and criminal records) However, we only do so if we say in a contract or have explicit consent.
How do we use your data?
All data is processed and stored securely, for no longer than is necessary in light of the reasons for which it was first collected. We will always comply with our obligations and safeguard your rights under the GDPR.
Our use of your personal data will always have a lawful basis, either because it is necessary for our performance of a contract with you, because you have consented to our use of your personal data, or because it is in our legitimate interests. Specifically, we may use your data for the following purposes:
- Research
- Replying to an email from you
- Responding to an enquiry you made through our website
- Managing your account
- Performing an End-Point Assessment
- Audit purposes
How and where do we store your data?
We only keep your data for as long as we need to in order to use it as described above, and/or for as long as we have your permission to keep it for.
Your data will only be stored in the UK.
Do we share your data?
We only share your data with third party services that support our work, such as email management software and contractors working on our internal systems.
In certain circumstances we may be legally required to share certain data held by us, which may include your personal data, for example where we are involved in legal proceedings, whereby we are complying with legal obligations, a court order, or a governmental authority.
Children and vulnerable adults
Part of our organisation focuses on End-Point Assessment. We regularly process the personal data relating to young people who undertake one of our end-point assessments.
Information for parents/guardians
If your child is under the age of 18 or a vulnerable adult, we will seek permission to record any audio-visual communications. We take great care to protect and respect the rights of individuals in relation to their personal data, especially in the case of children and vulnerable adults.
How we safeguard personal data
We have in place appropriate technical and organisational measures designed to prevent unauthorised access to and misuse of your personal data. If you believe there is any misuse, loss or unauthorised access, please inform us immediately.
Individual rights
Please see below an overview of your individual rights. For further information please refer to the ICO’s website www.ico.org.uk Please keep us informed on any changes to your personal information during the time we hold your data for, so that we may keep it accurate and up to date. Contact details can be found at the end of this document.
Right to object
Should we be using your data as we see it necessary for our legitimate interests, but you do not agree, you can object. We will respond to this request within 30 days (unless there are extenuating circumstances). If you object to processing your data for your legitimate interests, we must stop unless our grounds for processing override your interests or where there is a legal reason for doing so. We must stop if you object to marketing correspondence.
Right to withdraw consent
You have this right if we obtained your explicit consent to process your personal data and may withdraw consent at any time.
Data subject access requests
You can ask us what information we hold about you at any time and there is no charge for doing so unless there are extenuating circumstances. Requests will be actioned within 30 days (unless excessive or unfounded). We have the right to decline your request and will explain why, should this situation arise. We may ask you to verify your identity before doing so.
Right to erasure
The data may no longer be necessary for the original purpose of collecting it. You may have withdrawn your consent to us holding/ processing your data, the data has been unlawfully processed or is necessary due to our legal obligations or we may have no overriding legitimate reasons for processing. Response to such a request will be within 30 days although this time frame may be extended depending on circumstance. Of course, if we agree with the request your data will be deleted.
Right to restrict processing
Should you dispute the accuracy of the data we hold on you, processing will be restricted until this can be rectified. Should you object to the processing of your data under legitimate interests, processing would be restricted until we can confirm these grounds. If our processing is unlawful, we would need to restrict processing your data rather than erasing it. Your data will be held until you consent, or processing is legally necessary. We will notify clients, employees and third parties where appropriate of this restriction unless the effort in doing so is disproportionate.
Right to rectification
You can ask us to rectify inaccurate or incomplete data and update clients, employees or third parties as appropriate unless this would be a disproportionate effort.
Right of data portability
You can transfer your data from us to another data controller. This can either be sent, password protected, directly to the other controller or to you in a commonly used format. This is applicable to data that you have provided to us and personal data we process based on your consent.
Please note that there are exceptions to the rights above and, though we will always try to respond to your satisfaction, there may be situations where we are unable to do so.
Legal basis for processing your data
We only ever use your personal data with your consent, or where it is necessary to: enter into, or perform, a contract with you; comply with a legal duty; protect your vital interests; this means, for example, keeping you safe from harm for our own (or third party’s) lawful interests, provided your rights don’t override these.