GDPR Policy

LRS Privacy Notice

Privacy notice for pupils, students, learners and trainees

Tier 1 privacy notice

The information you supply is used by the Education and Skills Funding Agency, an executive agency of the Department for Education (DfE), to issue you with a Unique Learner Number (ULN) and to create your Personal Learning Record, as part of the functions of the DfE. For more information about how your information is processed, and to access your Personal Learning Record, please refer to: https://www.gov.uk/government/publications/lrs-privacy-notices

Tier 2 privacy notice

The Education and Skills Funding Agency (ESFA) is an executive agency of the Department for Education (DfE). This privacy notice explains how we use your personal information. For the purposes of relevant data protection legislation, the DfE is the data controller for personal information processed.

How we (LRS) use your personal information

The Learning Records Service (LRS) is operated by the ESFA. The LRS collects information about learners registering for relevant post-14 qualifications, for example:

• GCSEs and A-Levels

• Entry to Employment Certificates

• Regulated Qualifications Frameworks

• Welsh Baccalaureate and associated units

The LRS uses your information to:

• Issue you with a Unique Learner Number (ULN)

• Create your Personal Learning Record (PLR)

The ULN enables education and training sector organisations, and Awarding Organisations regulated by Ofqual in England, Qualifications in Wales (QiW) in Wales and CCEA in Northern Ireland, to share information about participation and achievement in a consistent and approved manner, promoting good information management practice, and helping to improve accuracy and efficiency. It benefits you through enhancing the application processes to Awarding Organisations, learning providers, learning advisors and other third parties.

The PLR stores your education and training participation and achievement information collected directly from educational institutions and other bodies.

How we collect your personal information The ESFA collects information from:

• DfE, schools and training / learning providers

• Information provided by you when enrolling with the training/learning provider

• Qualification/unit data held by Ofqual and Qualifications in Wales (QiW)

• Participation and achievement data held by the Welsh Government

• Accredited achievement data supplied by awarding organisations

How we share your personal information:

All organisations that have control of personal data about you and that we store in the LRS are required to register with the Information Commissioner’s Office and to handle your information in accordance with the latest data protection legislation.

The LRS is accessible by organisations under agreement with the DfE. Your personal information is only accessed through the LRS by organisations linked to your education and training, including those organisations specified in Regulations made under section 537A of the Education Act.

Awarding organisations are able to access limited achievement data that we hold about you, in order to verify its accuracy.

How long we will keep your personal information:

We will only keep your personal information for as long as we need it after which it will be securely destroyed. Your personal information stored in the Personal Learning Record is retained for 66 years. We may need to keep your other personal information were held indefinitely for research and statistical purposes.

Your data protection rights

You have the right:

• To ask us for access to information about you that we hold

• To have your personal data rectified, if it is inaccurate or incomplete

• To request the deletion or removal of personal data where there is no compelling reason for its continued processing

• To restrict our processing of your personal data (i.e., permitting its storage but no further processing)

• To object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics

• Not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you.

If you need to contact us regarding any of the above, please do so via the DfE site https://www.gov.uk/contact-dfe

Contacting us about your information

If you would like:

• More information about how we process your personal information or your data protection rights

• To make a request about your information – for example to request a copy of your information or to ask for your information to be changed

Please follow the guidance on the how to access your personal learning record. https://www.gov.uk/guidance/how-to-access-your-personal-learning-record.

If you wish to complain about our handling of your information or contact our Data Protection Officer, you can use our secure online contact form or write to:

Ministerial and Public Communications Division

Department for Education

Piccadilly Gate

Store Street

Manchester

M1 2WD

Online privacy statement

Personal data

Under the EU’s General Data Protection Regulation (GDPR) personal data is defined as:

“Any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

How we use your information

This privacy notice tells you, how we, Elev8 Training, will collect and use your personal data for;

• Creating a ULN

• Creating a PLR

• Checking programme and funding eligibility

• Processing personal data captured at Initial Assessment

• Processing personal data obtained in the Enrolment and Learning Agreement form

• Obtaining participation/ retention and achievement data

• Funding and contractual requirements

• Complying with statutory requirements, for e.g. monitoring of equal opportunities, processing and responding to subject access requests and information requests

• Provision of administration, IAG and programme guidance in relation to education, training, employment and wellbeing

• Processing referral data (from referral sources organisations such as DWP)

• Processing personal data to match learner preferences to apprenticeship and job vacancies

• Providing support to learners such as additional learning support

• Monitoring learner progress

• Capturing ‘Learner Voice’ and assessing the quality of our services

• Promoting services and developing marketing materials, including displaying learner ‘good news’ stories and case studies (where appropriate) on our website, including taking photographs or films on Elev8 Training premises / at events

• Safeguarding and promoting the welfare of learners

• Dealing with complaints

• Carrying out audits

• Registering with Awarding Organisations for qualifications undertaken

• To comply with the law regarding data sharing

Why does Elev8 Training need to collect and store personal data?

In order for us to provide you with the services as outlined in the paragraph above, we need to collect personal data for your education and training related services which includes enrolment, programmes and qualification undertaken, funding routes, examinations, support needs, compliance requirements and contractual obligations. In any event, we are committed to ensuring that the information we collect and use is appropriate for this purpose, and does not constitute an invasion of your privacy. In terms of being contacted for marketing purposes would contact you for additional consent. The ICO have produced guidance on marketing (Elev8 Training see the Guide to PECR – Privacy and Electronic Communications Regulations), this can be accessed at: https://ico.org.uk/for-organisations/guide-to-pecr

Will Elev8 Training share my personal data with anyone else?

We may pass your personal data on to third-party service providers contracted to Elev8 Training in the course of dealing with you. Any third parties that we may share your data with are obliged to keep your details securely and to use them only to fulfil the service they provide you on our behalf (the processing of learner funding, achievement data, examinations and certification). When they no longer need your data to fulfil this service, they will dispose of the details in line with their procedures. If we wish to pass your sensitive personal data onto a third party we will only do so once we have obtained your consent, unless we are legally required to do otherwise.

How will Elev8 Training use the personal data it collects about me?

Elev8 Training will process (collect, store and use) the information you provide in a manner compatible with the EU’s General Data Protection Regulation (GDPR). We will endeavour to keep your information accurate and up to date, and not keep it for longer than is necessary. Elev8 Training is required to retain information in accordance with the law, such as information needed for audit purposes. How long certain kinds of personal data should be kept may also be governed by specific educational requirements and agreed practices. Personal data may be held in addition to these periods depending on individual business needs.

Under what circumstances will Elev8 Training contact me?

Our aim is not to be intrusive and we undertake not to ask irrelevant or unnecessary questions. Moreover, the information you provide will be subject to rigorous measures and procedures to minimise the risk of unauthorised access or disclosure.

Can I find out the personal data that Elev8 Training holds about me?

Elev8 Training at your request, can confirm what information we hold about you and how it is processed. If Elev8 Training does hold personal data about you, you can request the following information:

• Identity and the contact details of the person or organisation that has determined how and why to process your data. In some cases, this will be a representative in the EU.

• Contact details of the data protection officer, where applicable.

• The purpose of the processing as well as the legal basis for processing.

• If the processing is based on the legitimate interests of Elev8 Training or a third party, information about those interests.

• The categories of personal data collected, stored and processed.

• Recipient(s) or categories of recipients that the data is/will be disclosed to.

• If we intend to transfer the personal data to a third country or international organisation, information about how we ensure this is done securely. The EU 14 has approved sending personal data to some countries because they meet a minimum standard of data protection. In other cases, we will ensure there are specific measures in place to secure your information.

• How long the data will be stored.

• Details of your rights to correct, erase, restrict or object to such processing.

• Information about your right to withdraw consent at any time.

• How to lodge a complaint with the supervisory authority.

• Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.

• The source of personal data if it wasn’t collected directly from you.

• Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

What forms of ID will I need to provide in order to access this?

Elev8 Training accepts the following forms of ID when information on your personal data is requested:

• Valid and in date passport

• Driving Licence

• Birth Certificate

• Utility bill (dated within the last 3 months)

Document Owner and Approval:

Elev8 Training’s Data Protection Officer/ GDPR Owner is the owner of this document and is responsible for ensuring that this procedure is reviewed in line with the review requirements of the GDPR.

A current version of this document is available to all members of staff on Elev8 Training’s main server (G Drive) and is accessible to learners on the company website, www.elev8training.com.