Our Privacy Notice

This Privacy Notice contains all the information you need to know about how and why we collect, use, store, transfer, and keep secure personal data about you which relates to your relationship with us as a Client or Learner (‘Data’). It also explains your rights and obligations in relation to your Data.

We are committed to protecting the privacy and security of your Data in accordance with the General Data Protection Regulation (GDPR) and relevant UK law.

This Privacy Notice should be read in conjunction with our Data Protection Policy and Data Retention Policy.

It is in your interest to read this privacy notice as it contains important information on how and why we are using your data and what we will do with it even after you have stopped using our services.

This Privacy Notice may be updated by us at any time.

GDPR Data Protection Principles

We comply with UK data protection law and GDPR. This says that any Data we hold about you must be:

Used lawfully, fairly, and in a transparent way.
Collected only for valid purposes that we have clearly explained to you and not used in any other way.
Relevant to the purposes we have told you about and limited only to those purposes.
Accurate and kept up to date.
Kept only as long as necessary for the purposes we have told you about.
Kept securely.

These principles apply to Data about you, from which you can be identified. It does not include data where your identity has been removed (anonymous data).

The Different Types of Data We Hold and Why We Hold Them

Types of Data We May Hold About You:

Type of personal data	Details of personal data
DATA THAT MAY BE ENTERED INTO PROCESSOR-SPECIFIC FIELDS
Contact / Personal Data	• Personal home and work contact details • Gender • Job title
General contract for delivery of services Data	• Contract data including details of role, job location • Annual leave data
Training Data	• Qualification and skills data • Training data
DATA THAT MAY BE HELD BY THE COMPANY AS CONTROLLER IN DOCUMENTS / FILE NOTES, INCLUDING ON PAPER
File Notes	• Any Data included in File Notes

Purpose for Processing:

Type of Personal Data	Purpose for Processing
Contact / Personal Data	To enable us to contact you
General Contract Data and Documents	To enable us to manage effectively the delivery of our contract for services
Training Data	To enable us to manage effectively the delivery of our contract for services
File Notes	To make general notes about situations related to the delivery of our contract for services, and explain documents being stored

Legal Basis for Processing:

Under the GDPR, we need to have a legal basis for processing your Data. There are six acceptable reasons why we are allowed to hold your Data. Mostly we rely on three of these:

Where we need it to perform the delivery of our contract for services.
Where we need it to comply with a legal obligation.
Where it is necessary for our legitimate interests (or those of a third party), and where your interests and fundamental rights do not override those interests.

Occasionally we may need to rely on two further reasons:

Where we need it to protect your vital interests or someone else’s (such as when there are serious Health and Safety issues).
Where it is needed in the public interest.

If none of these reasons apply, we will ask for your consent to hold Data. (see below under section 3.7)

And here’s how these reasons relate to the Data we may hold about you:

Type of Personal Data	Legal Basis for Processing
Contact / Personal Data	Delivery of our contract for services, compliance with legal obligations, legitimate interests of a service provider
General Contract Data and Documents	Delivery of our contract for services and compliance with legal obligations
Training Data	Delivery of our contract for services, compliance with legal obligations, and legitimate interests of a service provider
File Notes	Delivery of our contract for services, compliance with legal obligations, and legitimate interests of a service provider

Special Category Data:

A small amount of the Data we may collect from you can be classified as ‘Special Category Data’. Understandably, we have to be especially careful with this data, and we have to be satisfied that there are additional lawful reasons for holding it. This is Data that reveals:

Racial or ethnic origin,
Political opinions,
Religious and philosophical beliefs,
Trade union membership,
Genetic data,
Biometric data,
Health data, or
Sex life and sexual orientation.

Within the categories of information which we have listed above in section 3.1, we may receive/collect the following Special Category Data, and have outlined the lawful reasons for processing it:

Other information about your physical, mental health, or disability status, to ensure your health and safety in the workplace, to provide appropriate adjustments.
Your native language and language background to provide a suitable language training service.

If we need to hold any other Special Category Data, we will ask for your explicit consent to hold it. (see below under section 3.7)

Criminal Convictions Data:

Not applicable

Consent:

Here’s what you need to know about the limited circumstances in which we may need your explicit, written consent to process specific elements of your Data:

Special Category Data: In the limited circumstances where we are relying on your consent to provide us with either additional health or other Special Category Data, we will provide you with full details of the information we wish to collect and the reason we need it so that you can carefully consider whether you wish to consent. It is not a condition of our contract for services with you that you will agree to such a request.

You have the right to withdraw your consent in relation to processing under (a) above at any time. To withdraw your consent, please contact your Account Manager. Once we have received your withdrawal of consent, we will no longer process your information for the purposes you originally agreed to, unless we have another legal basis for doing so which we will advise you of at the time.

Data Sharing

We will only share your personal information with third parties where required by law, where it is necessary to carry out our delivery of service to you (such as book suppliers), or where we have another legitimate interest in doing so.

Third parties will only process your Data on our instructions and where they have agreed to treat the Data confidentially and to keep it secure. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

Data Security

We have put in place measures to limit access to your Data through our policies. In addition, we limit access to your Data to those employees, agents, contractors, and other third parties who have a business need to know.

We have put in place appropriate security measures to prevent your Data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. Further details about the security of your Data can be found in the Privacy Policy on our website.

All our third-party service providers are required to take appropriate security measures to protect your Data in line with our policies.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data Retention

We also don’t want to keep your data for any longer than is necessary. We have created a Data Retention Policy, using the same categories of Data that are used in this Privacy Notice, and defined a retention period for each category. In situations where we are able to anonymise your Data, we may continue to process the anonymised data without reference to the Data Retention Policy.

Please refer to the Data Retention Policy for full details of our retention periods and how Data will be deleted at the end of that time.

Your Rights in Relation to Your Data

It is important that you know what rights you have in relation to your Data.

Right to Request Access

You have the right to request – through a Subject Access Request – that we provide you with a copy of the Data we hold about you and to check that we are lawfully processing it.

Right to Request Correction

You have the right to request that inaccurate or incomplete Data be corrected. We rely on you to ensure that you provide us with details of any changes in your personal circumstances.

Right to Object to Processing

Where we are processing Data only on the basis that it is necessary for our legitimate interests (or those of a third party) (see above section 3.4), you have the right to object to that processing and it is then for us to establish whether your interests and fundamental rights override those interests.

Right of Erasure (the ‘Right to be Forgotten’)

You have the right to request that we delete your Data where there is no good reason for us continuing to process it. You will appreciate that much of your Data is essential for you and us to be able to work effectively. For instance, we may not be able to perform the contract we have entered into with you (such as delivering our service), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers). This right mainly applies when you have objected to processing (see section 7.3 above) or you are withdrawing your consent.

Right to Restrict Processing

You have the right to ask us to suspend processing your Data whilst its accuracy or reason for processing is established. However, there may be certain circumstances where we cannot suspend processing if it prevents us from complying with a legal obligation, or without impacting our ability to continue to deliver our service to you. If this situation occurs, we will advise you at the time the reason why we cannot suspend processing.

Right of Data Portability

In certain limited circumstances, you have the right to request the transfer of your Data to another party.

How to Exercise Your Rights

To exercise any of these rights, please contact your Account Manager in writing. There is no fee for these requests unless they are unfounded or excessive, in which case a reasonable fee may apply.

Data Protection Contacts

We have appointed a Data Protection Officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your Data, please contact the DPO

Automated Processing (including profiling) and Automated Decision-Making

We can confirm that your Data is not subject to any automated processing including profiling, or any automated decision-making.

We need to check that you have read and understood this Privacy Notice

If you have any questions on this Privacy Notice, please direct them to your Account Manager or our Data Protection Officer (Contact our DPO), who has overall responsibility for data protection.

Further Information

If you would like more information or to review our Data Protection Policy and/or Information Technology Security Policy, please do not hesitate to contact us.

Changes to our privacy policy

Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy policy.

Updated 29 July 2024