Introduction

Prospect Digital (Gloucester) Ltd collects and uses certain information about learners and apprentices to deliver its services. This document describes how we process your personal and sensitive data in accordance with the General Data Protection Regulations (GDPR). It also contains information about your rights and how to contact us.

Our lawful basis for holding and processing your data

When you supply your personal information, it may be stored and processed for one or more of the following reasons:

1. Your information is collected, stored and used for the legitimate interests of administrating the services we are contracted to deliver on behalf of the ESFA/ESF. The information we collect includes your full name, address, date of birth, National Insurance Number and other information relevant to the services we deliver.

2. Where you have provided consent, you have allowed us to use your personal data for direct marketing purposes about new products, promotions, special offers, further training opportunities, and to track your progress upon completion of your programme.

Information we collect about you

• Personal and contact information when you are allocated, referred or transferred to us. This includes your name, address, court records that include your identity and that of any other person involved in the case, email address, telephone number(s), date of birth, nationality, ethnicity (if provided), conviction details and health information (if provided). We may collect or generate additional information about you during the induction and subsequent meetings, such as CCTV or video recordings.
• Details (and copies) of your communications and interactions with us, including emails, telephone conversations, voice recordings and post.
• Copies of documents that prove your identity (including driving licence and passport) when you are initially referred to us, or where there is a legal reason to request this from you.
• Information about how you use our website, and which websites you came to ours from.
• We may also receive personal data directly from you or public sources, including social media channels (if you interact with us through those) or other third parties, including the media.

Data collection

Propsect Digital will ensure that the learner or apprentice:

• Understands why their information is needed.
• Understands what their data will be used for and the consequences of not giving their consent to sharing.
• Is given the opportunity, where applicable, to give consent for their data to be shared.
• Has received sufficient information on why their data is needed and how it will be used.

How do we use your personal data?

We may use your information to:

• Register you onto our client management and recruitment database.
• Verify your identity, address and eligibility for our courses.
• Manage our relationship with you to:
  • Notify you about appointments.
  • Contact you in response to any query, request, or complaint you may have.
• Train our staff.
• Help you complete your action plans and assessments.
• Support your progression on your course.
• Keep as evidence of our interactions.
• Contact you about our other programmes.
• Register your employer as one of our partners.
• Progress you through each stage of our recruitment process.
• Conduct vetting and background checks as required by the role you applied for.
• Deal with your enquiry.
• Provide a better service to you and our learners.

Why do we use your personal data?

We will use your data to:

• Deliver mandatory or voluntary services to you.
• Comply with a legal or contractual obligation.
• Keep our records updated and keep evidence of your interactions with Prospect Digital.
• Provide you with the best services.
• Help you achieve your contract's performance goals.
• Make the most of your learning.
• Send you marketing information (this is if you have explicitly consented to receive these. You have a right to withdraw at any time).
• Register the business you are working with as a partner of Prospect Digital.
• Process your application for a vacancy.
• Help you answer any of your questions.

Accuracy of data

Prospect Digital will take responsible steps to ensure that your information is kept up to date by asking learners and apprentices whether there have been any changes.

Prospect Digital will ensure that:

• It has a Data Protection Officer with specific responsibilities for ensuring compliance with GDPR.
• Any staff members that process personal information understand that they are contractually responsible for complying with the requirements of GDPR and are appropriately trained.
• It deals promptly and courteously with any queries regarding the processing of personal information.
• It describes how and why information is processed clearly.
• It will regularly review and audit how it holds, manages, and uses personal data.

Processing of information

Prospect Digital abides by the following principles when collecting, storing and processing your personal information, which shall be:

• Processed fairly and lawfully for limited purposes.
• Adequate, relevant and not excessive.
• Accurate and up to date.
• Kept no longer than necessary.
• Processed per the data subject's rights.
• Kept secure.

Your data will not be transferred to other countries without adequate protection.

Access to your personal information

You have the right to access the information that Prospect Digital holds about you. You may request details of personal information under the General Data Protection Regulation (GDPR) 2018, which is known as a Subject Access Request. You can ask for this in writing or email to enquiries@prospect-training.org.uk or C4 Brunel Court, Waterwells Business Park, Quedgeley, Gloucester, GL2 2AL.

If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible at the above address. We will promptly amend any information found to be incorrect.

If you have agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by writing to or emailing us at enquiries@prospect-training.org.uk or C4 Brunel Court, Waterwells Business Park, Quedgeley, Gloucester, GL2 2AL.

You have the right to withdraw your consent for us to share your information at any time, providing that this does not conflict with our legal obligations (see Disclosure of Information below).

Disclosure of information

Learners and apprentices will be made aware of whom their information will be shared. However, there are circumstances where the law requires and allows Prospect Digital to disclose information without the data subject's consent.

These include:

• Carrying out a legal duty or as authorised by the police.
• Protecting the vital interest of a participant or other person.
• The conduction of any legal proceedings, obtaining legal advice or defending any legal rights.
• Data Storage and Retention.

How long do we keep your information?

Information and records relating to learners and apprentices will be stored securely and accessible to authorised personnel. Information will be stored for only as long as it is needed or required by contract and will be destroyed appropriately.

There are specific rules that apply to the retention of documents for the European Social Fund's (ESF) co-financed programmes. Documents must be retained until at least 31st December 2030, although this could be changed at any stage in the future, as required and updated by the ESF.

How we protect your personal data

We have put various technical and organisational measures in place to protect your personal data:

• We are independently certified to several industry recognised standards, including ISO27001:2013, which helps us maintain the highest levels of security across our entire business.
• Our online security controls maintain confidentiality at all times.
• Our entire site is accessed using https rather than http. All information sent and received is encrypted for additional information. You can see this in the address bar of your browser.
• As described in this Privacy Notice, we may disclose your personal data to third parties in some instances. Where we do, we require that the third party have appropriate technical and organisational measures in place to protect your data. However, in some instances, we may be compelled by law to disclose your data to a third party and have limited control over how that party protects it.
• An independent auditor regularly audits our website and technical security controls to maintain our security accreditations.
• Your personal data is not processed or transferred outside the European Economic Area (EEA). For DWP and ESF programmes, your data is not transferred or processed outside of the UK.

Discarding data

At Prospect Digital, we follow strict guidelines for disposing of data with the companies that issue the appropriate certificate.

Document review

This privacy notice will be updated regularly to ensure compliance with any changes or amendments to the GDPR and future legislation.

Your rights to:

• Access your personal information — You have the right to ask us for copies of your personal information. However, there are some exemptions where you may not receive all the information we process. Click here to learn more.
• Rectification — You can ask us to amend any information you think is inaccurate and/or incomplete. You can read more about this here.
• Erasure — We can erase your personal information in certain circumstances if you have consented to us to do so. To learn more, click here.
• The restriction of processing — You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this here.
• Data portability — This only applies to the information you have given us, but you can ask us to transfer your information from one organisation to another or give it to you. The right only applies if you have consented to us processing your information.

Get in touch with us

For more information or queries on the Privacy Policy, please contact our Data Protection Officer via the details below:

If you would like a copy of Prospect Digital's personal data on you, please send your request in writing to our Data Protection Officer at the above address. To verify your identity, we may ask you to provide us with the following information:

• Your full name.
• The data you are requesting.
• A valid ID photo (e.g. your passport).
• Proof of your address (e.g. a household bill).
• The date of your request.