Data Protection Privacy Notice

1. Collection and use of personal data

a. Purpose of processing and legal basis

We process personal data under one or more of the following lawful bases:

• Contract – to deliver training, assessment and certification services you have requested.
• Legal obligation – to comply with funding, awarding organisation, safeguarding and regulatory requirements.
• Legitimate interests – to administer training programmes, maintain learner records and improve our services.
• Consent – where you have agreed that we may contact you regarding future learning opportunities.

b. Categories of data

The Company may collect the following personal data on you:

Personal data:

• Name and Contact Details
• Name and Contact Details of your Next of Kin
• Photo ID
• Referees and end references
• Proofs of ID
• Proof of receiving benefits
• Proofs of Address
• Right to Work evidence if applicable
• National Insurance Number
• Qualifications

Special category personal data:

• Disability
• Criminal conviction
• Ethnicity
• Health Declaration
• Suitable Persons Declaration
• Disqualification for Caring for Children
• Children’s and Vulnerable Adults’ Barred List Details

c. Legitimate interest

Where the Company has relied on a legitimate interest to process your personal data our legitimate interests is/are as follows:

• To act as an educational business which provides educational services to learners

d. Recipient/s of data

We may share data with:

• Awarding organisations (including NCFE CACHE)
• Funding bodies and government agencies
• Learner management systems and e-portfolio providers
• Employers, where training is employer funded
• Regulatory bodies where required by law
• Professional advisers and IT service providers

e. International Transfers
We do not routinely transfer personal data outside the UK.

2. Data retention

The Company will retain your personal data only for as long as is necessary. We retain different categories of personal data for different periods, depending on legal, regulatory and funding requirements. Full details are available in our Data Retention Schedule, available on request.

Educate 2Gether will keep learners records on their internal database for at least three years from (a) the date of their creation or (b) after the date on which we last provide you with educational services.

Laser Learning e-portfolio will store all portfolio content for 7 years calculated from the learner end date added to the system.

Where the Company has obtained your consent to process your personal data for the purpose of contacting you for learning opportunities, we will do so for 1 year. Upon expiry of that period the Company will seek further consent from you. Where consent is not granted the Company will cease to process your data.

To ensure compliance with the Ncfe Regulations for Conduct of Controlled Assessments, Educate 2Gether is committed to securely retaining the following documents for a minimum of 3 years for all learners who have completed their assessment:

• Assessor feedback to learners
• IQA feedback to assessors
• IQA related records (such as meeting minutes)
• Documents created in relation to learners’ assessment achievements, including witness observation records.

3. Your rights

Please be aware that you have the following data protection rights:

• The right to be informed about the personal data the Company processes on you;
• The right of access to the personal data the Company processes on you;
• The right to rectification of your personal data;
• The right to erasure of your personal data in certain circumstances;
• The right to restrict processing of your personal data;
• The right to data portability in certain circumstances;
• The right to object to the processing of your personal data that was based on a public or legitimate interest;
• The right not to be subjected to automated decision making and profiling; and
• The right to withdraw consent at any time.

Educate 2Gether does not carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Where you have consented to the Company processing your personal data and special category personal data you have the right to withdraw that consent at any time by contacting Emma Kiernan, Educate 2Gether Ltd, Botanica Ditton Park, Office 20, Riding Court Road, Slough, SL3 9LL
Phone Number 01753 362197 and email info@educate2gether.co.uk

4. Source of the personal data

The Company sourced your personal data by the following means:

• From yourself directly
• Job Centre
• Job Fairs
• Worldwide Education Recruitment
• Other learners’ referrals
• Other partner Organisations (e.g. Fedcap, TCHC, Abri, etc.)

This information may come from a publicly accessible source.

5. Complaints or queries

If you are unhappy with how we use your information, we encourage you to contact us first so that we can resolve your concerns. You also have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

If you wish to complain about this privacy notice or any of the procedures set out in it please contact: Maria Pontillo, Data Protection Officer, Educate 2Gether Ltd, Botanica Ditton Park, Office 3, Riding Court Road, Slough, SL3 9LL
Phone Number 01753 362197 and email info@educate2gether.co.uk

6. Security measures

As an accredited entity under Cyber Essentials, Educate 2Gether Training Ltd has implemented rigorous technical and organisational measures to safeguard data security. Below are the key controls in place:

• Physical Access Controls: Physical access to our data Centres and office premises is restricted to authorised personnel only. Security measures include keycard systems, locked server rooms, and surveillance.
• System Access Controls: We utilise role-based access controls to restrict system access to only those with necessary privileges. Multi-factor authentication (MFA) is required for access to all critical systems.
• Data Access Controls: Access to sensitive data is limited by user roles and permission levels. Only authorised employees have access to confidential information, and this is monitored and audited regularly.
• Transmission Controls: All data transmission over the internet is secured through encryption protocols such as SSL/TLS. We ensure that all data exchanged between systems is encrypted to prevent interception.
• Input Controls: Systems are configured to log all user actions, including data entry and modification. Audit trails are maintained to ensure accountability and traceability of data processing activities.
• Data Backups: We perform regular backups of all critical data and store them in secure, off-site locations. Backups are encrypted and regularly tested to ensure data integrity and recovery capabilities.
• Data Segregation: We employ logical data segregation to ensure that customer data is isolated and protected. This prevents unauthorized access to data between different clients or systems.
• Cyber Essentials Accreditation: Our security practices are independently assessed and accredited by Cyber Essentials, ensuring compliance with best practices in cybersecurity. This certification demonstrates our commitment to safeguarding systems and data from common cyber threats.

7. Changes to this privacy notice

Any changes we may make to our privacy notice in the future will be posted on http://educate2gether.co.uk/privacy-notice/. Please check back frequently to see any updates or changes to our privacy notice.