Privacy Notice

This Privacy Notice applies to services operated by ECCTIS Ltd. ECCTIS Ltd operates services to individuals and organisations, including those branded as Ecctis and UK ENIC (and those services formerly provided under the trading name UK NARIC). This notice covers the services offered under the following web domains:

and the former web domain:

  • naric.org.uk

ECCTIS Ltd understands that your privacy is important to you and that you care about how your personal data is used and shared online. We respect and value the privacy of everyone who visits our website and uses our services. We will only collect and use your personal data in ways that are described here, and in a manner that is consistent with our obligations and your rights under data protection and other laws.

The notice is layered in order to help you find information that is relevant to the service or services you have used.

We will tell you:

  • What data we are collecting and how we obtain it;
  • What we are using it for;
  • Why we are able to process your data;
  • How long we store your data for;
  • Whether we share your data with anyone else, and in what circumstances;
  • Whether we transfer data to another country, and in what circumstances
  • Whether we do automated decision making or profiling (we do not).

Ecctis Ltd is a limited company registered in England with company number 2405026.

Our address is:

Ecctis Ltd
Suffolk House
68-70 Suffolk Road
Cheltenham
Gloucestershire
GL50 2ED
UNITED KINGDOM

Ecctis Ltd may operate as the controller of your data, or we may process your data on behalf of another controller. For more information on our role, please see the service specific information below, but generally the following applies:

We act as the controller of your personal data when you contact us regarding, or apply for, our individual services, including:

  • Statement of Comparability
  • English Language Assessment
  • Career Path Report
  • Industry Skills Statement (formerly Statement of Comparability for Construction Skills)
  • Early Years Service
  • UK Qualification Reference Statement

The exception to this rule is the Visas and Nationality Service. For this service, we operate as a processor on behalf of the Home Office, who tell us what to do with your data, and how. Please see the service specific information below for more detailed information.

Where we offer services to organisations, we may process information a) submitted directly to us by you in your capacity as an organisation representative, or b) submitted by your employer to allow you to access our services. In these circumstances we usually operate as a processor, with your employer being the Controller. Where this is not the case, we will let you know in the service specific information below.

Our Data Protection Officer is Lloyd Foulkes. You can contact him at [email protected] or via our postal address. Please mark postal communication with ‘Data Protection Officer’

Most of the personal information that we process is provided for one of the following reasons:

  • You have enquired about, and/or applied for, one of our services for individuals.
  • You or your employer has subscribed to one of our services for organisations and either you, or your employer, has submitted your data to us to allow you to access or make use of those services.
  • An organisation has submitted an application for one of our services for individuals on your behalf.

Where we do not receive information from you directly, we will endeavour to contact you to let you know we are processing your data unless to do so would be:

  • Disproportionate.
  • Prejudicial e.g. to law enforcement or national security.

Under data protection law, you have the following rights. These rights may or may not be applicable or available to you depending on our reasons for processing your information:

  • The right to be informed about our collection and use of personal data - this Privacy Notice is our way of complying with this.
  • The right of access - you have the right to ask us for copies of the information that we hold about you.
  • The right to rectification if any of the information we hold about you is inaccurate or incomplete.
  • The right to erasure - you can ask us to delete your information in certain circumstances.
  • The right to restrict (prevent) processing of your information in certain circumstances.
  • The right to object to us using your information for particular purposes e.g. direct marketing.
  • The right to data portability, in which case where appropriate, and technically feasible, we will provide your information in a commonly used, machine readable format.
  • Rights related to automated decision making and profiling - though please note that Ecctis Ltd does not perform any automated decision making or profiling.

To make a request related to any of these rights, please contact the Data Protection Officer, or one of our customer services team. We will respond within one month.

If you have any cause for complaint about our use of your personal data, please contact us using the details above and we will do our best to help.

Should you remain dissatisfied, you have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office.

We do not provide services directly to children, nor do we proactively collect children’s personal information. Anyone applying for our services must be over 16 years of age.

We may change this Privacy Notice from time to time (for example if the law changes, or our services change). Any changes will be immediately posted on our website, and changes will be deemed accepted each time you use our services.

Should there be a sale and/or transfer of control of all or part of our business, any personal data that we hold will, where it is relevant to any part of the business that is being transferred, be transferred along with that part of the business.

The new owner or newly controlling party will be permitted to use that data for the same purposes as those for which it was originally collected.

We may need to share your personal data with third parties in order to deliver a service to you. This might be for the following general reasons:

  1. Data processors who provide part of our IT infrastructure. This may include, for example, off-site back-up providers, telephone recording, web, WebChat and email servers.
  2. Data processors who perform elements of our services for us. These will usually depend on the service you have applied for and more information can be found in the service specific information provided below.
  3. Other third parties with whom we are required to share the information in order to deliver the service. Examples include organisations that issued your qualifications, or UK Government departments. Where this is the case, we will provide more information in the service specific information.
  4. Organisations to whom a Statement has been disclosed by you if they wish to confirm its authenticity - for more information see the section below entitled “Confirming the content of a statement to a third party”.
  5. Where we are obliged to share your data by law, for example where we are involved in legal proceedings, or where we are complying with legal requirements, a court order, or the orders of a government authority.

Where the party is a processor (points 1 & 2 above), we will have a contract in place with them to ensure that they cannot do anything with your personal data unless we have instructed them to do so. They will not share your data with anyone else unless we give them permission to do so. We will only give permission if we are satisfied that the sub-processors will also comply with our instructions.

We will not share your information with any third parties for the purposes of direct marketing.

Services for Individuals:

The following information relates to current services and applies where you apply directly to us via our website, or by post:

  1. Statement of Comparability (Including Fast Track services and Translation Waiver)

Our role

We are the controller of your information where you apply to us directly.

Purpose and Lawful Basis for Processing

We process your personal data for the purposes of delivering the service to you, including communicating with you.

 

We rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you - it is necessary for the performance of a contract that we have with you.

 

We retain your personal data for a period of time following delivery of the service, and we rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so. This is because it is the interests of you, us, and the general public to be able to re-issue statements and/or confirm the contents of our statements if necessary.

What information we need, and why we need it

We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, and communicate with you regarding your application.

 

We collect and process information relating to the reasons for your application (including refugee status) in order to ensure we are delivering the correct service to you and to optimise our services for your needs.

 

We collect and process information relating to your qualifications (including copies of documentation) in order to provide requested comparison services to you.

What we do with it

Your information is collected, stored, and used by staff to communicate with you, identify you from other applicants, and deliver our services to you.

How long we keep it

We keep your personal data for as long as we need it. For completed applications, this is usually for a period of 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period.

 

Scanned documents submitted in support of applications are deleted within 12 months of either the service being completed, or the last action on an account.

 

We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.

Who we share it with

We do not share your information with third parties except those mentioned in the section “Sharing your Information” above.
  1. 2. Industry Skills Statement with Skills Mapping (formerly Statement of Comparability for Construction Skills with Skills Mapping) / Industry Skills Statement for Academically Qualified Persons (formerly Statement of Comparability for Construction Skills for Academically Qualified Persons)

Our role

We are the controller of your information where you apply to us directly.

Purpose and Lawful Basis for Processing

We process your personal data for the purposes of delivering the service to you, including communicating with you. We also process your personal data for the purposes of verifying that the qualification information you provided us with is accurate.

 

We rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you - it is necessary for the performance of a contract that we have with you.

 

We retain your personal data for a period of time following delivery of the service and we rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so, since it is the interests of you, us, and the general public to be able to re-issue statements and/or confirm the contents of our statements if necessary.

What information we need and why we need it

We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, confirm the accuracy of information provided by you, and communicate with you regarding your application.

 

We collect and process information relating to the reasons for your application (including refugee status) in order to ensure we are delivering the correct service to you and to optimise our services for your needs.

 

We collect and process information relating to your qualifications (including copies of documentation) in order to provide requested comparison services to you.

What we do with it

Your information is collected, stored, and used by staff to communicate with you, identify you from other applicants, and deliver our services to you.

 

It is also used to check that qualification information provided by you is accurate, and that you hold the qualifications submitted to us for comparison.

How long we keep it

We keep your personal data for as long as we need it. For completed applications, this is usually for a period of 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period.

 

Scanned documents submitted to support applications are deleted within 12 months of either the service being completed, or the last action on an account.

 

We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.

Who we share it with, and international transfers

We share your information with third parties mentioned in the section “Sharing your Information” above.

 

We also share your personal data with the qualification issuing body that issued your qualification in order to confirm that the information provided is accurate.

 

This may be done directly by us, but often we use a third party “Primary Source Verification” provider. Currently we use Qualification Check. You can review their privacy notice at https://www.qualificationcheck.com/gdpr/.

 

You should note that minimal information will be transferred outside of the UK. Where an adequacy decision exists with the country of transfer, we will rely on this when making the transfer (Article 45 of the GDPR). Otherwise we will rely on Article 49(1)(b) of the GDPR, which allows the transfer if it is necessary for the performance of a contract with you.

 

The qualification issuing body will be a Controller of your information in their own right, and you will be asked to complete a “Letter of Authorisation” instructing them to provide us with the information necessary to confirm the accuracy of your qualification information.
  1. UK Qualification Reference Statement

Our role

We are the controller of your information where you apply to us directly.

Purpose and Lawful Basis for Processing

We process your personal data for the purposes of delivering the service to you, including communicating with you.

 

We rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you - it is necessary for the performance of a contract that we have with you.

 

We retain your personal data for a period of time following delivery of the service and we rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so, since it is the interests of you, us, and the general public to be able to re-issue statements and/or confirm the contents of our statements if necessary.

What information we need, and why we need it

We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, and communicate with you regarding your application.

 

We collect and process information relating to your qualifications (including copies of documentation) in order to provide the requested service to you.

What we do with it

Your information is collected, stored, and used by staff to communicate with you, identify you from other applicants, and deliver our services to you.

How long we keep it

We keep your personal data for as long as we need it. For completed applications, this is usually for a period of 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period.

 

Scanned documents submitted to support applications are deleted within 12 months of either the service being completed, or the last action on an account.

 

We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.

Who we share it with

We do not share your information with third parties except those mentioned in the section “Sharing your Information” above.
  1. Visas and Nationality Service

Our role

We act as a processor of your personal data. The Controller of your information is the Home Office. We act only on the instructions of the Home Office and your information is shared between the Home Office and us. There is a contract between the Home Office and us, which governs the agreement.

Purpose and Lawful Basis for Processing

These are determined by the Home Office - you should refer to their privacy notice: https://www.gov.uk/government/publications/personal-information-use-in-borders-immigration-and-citizenship/borders-immigration-and-citizenship-privacy-information-notice

What information we need and why we need it

This is determined by the Home Office, but it includes: Information including your name, contact details, date of birth and nationality in order to deliver the service to you, identify you, and communicate with you regarding your application.

 

We collect and process information relating to your qualifications (including copies of documentation) in order to provide the requested services to you on behalf of the Home Office.

What we do with it

This is determined by the Home Office - please refer to their Privacy Notice: https://www.gov.uk/government/publications/personal-information-use-in-borders-immigration-and-citizenship/borders-immigration-and-citizenship-privacy-information-notice

How long we keep it

This is determined by the Home Office and is up to 25 years from completion of the service.

 

We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.

Who we share it with

This is determined by the Home Office. Please refer to their Privacy Notice: https://www.gov.uk/government/publications/personal-information-use-in-borders-immigration-and-citizenship/borders-immigration-and-citizenship-privacy-information-notice
  1. VETASSESS

Our role

We are joint controllers with VETASSESS. This means that we are jointly responsible for why and how we process your personal data.

Purpose and Lawful Basis for Processing

We collect and process your information on behalf of VETASSESS in order to help you to apply for their services and to respond to any queries you might have in relation to ongoing services being delivered to you by them.

 

We also undertake checks with your UK employers or prior employers on behalf of VETASSESS.

 

We rely on Article 6(1)(f) of the GDPR as the lawful basis for providing these services, since it is the interests of you, us, and VETASSESS to provide this service to you.

What information we need and why we need it

We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, and communicate with you regarding your application.

 

We may also process information relating to your qualifications and/or employment history in order to deliver services and undertake employment checks.

What we do with it

Your information is accessed from VETASSESS servers and used by staff to communicate with you, identify you from other applicants, respond to enquiries and deliver services on behalf of VETASSESS.

How long we keep it

No information is stored by us. All data is stored on VETASSESS servers. VETASSESS determine how long they store your information for.

Who we share it with

All data can be jointly accessed via VETASSESS servers based in Australia. We have a contract with VETASSESS that governs this relationship and we rely on Standard EU Contractual Clauses to ensure transfers outside of the UK meet the requirements of data protection laws.

 

You can find the VETASSESS Privacy Notice here: https://www.vetassess.com.au/privacy

The following information (6, 7 and 8) relates to historical, discontinued services (which we no longer offer) and applies where you applied directly to us via our website, or by post:

  1. English Language Assessment

Our role

We are the controller of your information where you applied to us directly.

Purpose and Lawful Basis for Processing

We process your personal data for the purposes of delivering the service to you, including communicating with you.

 

We rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you - it is necessary for the performance of a contract that we have with you.

 

We retain your personal data for a period of time following delivery of the service and we rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so, since it is the interests of you, us, and the general public to be able to re-issue statements and/or confirm the contents of our statements if necessary.

What information we need and why we need it

We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, and communicate with you regarding your application.

 

We collect and process information relating to the reasons for your application (including refugee status) in order to ensure we are delivering the correct service to you and optimising our services for your needs.

 

We collect and process information relating to your qualifications (including copies of documentation) in order to provide requested comparison services to you.

What we do with it

Your information is collected, stored, and used by staff to communicate with you, identify you from other applicants, and deliver our services to you.

How long we keep it

We keep your personal data for as long as we need it. For completed applications, this is usually for a period of 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period.

 

Scanned documents submitted to support applications are deleted within 12 months of either the service being completed, or the last action on an account.

 

We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.

Who we share it with

We do not share your information with third parties except those mentioned in the section “Sharing your Information” above.
  1. Career Path Report

Our role

We are the controller of your information where you apply to us directly.

Purpose and Lawful Basis for Processing

We process your personal data for the purposes of delivering the service to you, including communicating with you.

 

We rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you - it is necessary for the performance of a contract that we have with you.

 

We retain your personal data for a period of time following delivery of the service and we rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so, since it is the interests of you, us, and the general public to be able to re-issue statements and/or confirm the contents of our statements if necessary.

What information we need and why we need it

We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, and communicate with you regarding your application.

 

We collect and process information relating to the reasons for your application (including refugee status) in order to ensure we are delivering the correct service to you and optimising our services for your needs.

 

We collect and process information relating to your qualifications (including copies of documentation) in order to provide requested comparison services to you.

What we do with it

Your information is collected, stored, and used by staff to communicate with you, identify you from other applicants, and deliver our services to you.

How long we keep it

We keep your personal data for as long as we need it. For completed applications, this is usually for a period of 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period.

 

Scanned documents submitted to support applications are deleted within 12 months of either the service being completed, or the last action on an account.

 

We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.

Who we share it with

We do not share your information with third parties except those mentioned in the section “Sharing your Information” above.
  1. Early Years Service

Our role

We are the controller of your information where you apply to us directly.

 

A limited amount of data will be shared with the Department for Education, who will be joint controllers of that data.

Purpose and Lawful Basis for Processing

We process your personal data for the purposes of delivering the service to you, including communicating with you.

 

We rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you - it is necessary for the performance of a contract that we have with you.

 

We retain your personal data for a period of time following delivery of the service and we rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so, since it is the interests of you, us, and the general public to be able to re-issue statements and/or confirm the contents of our statements if necessary.

 

We share limited information with the Department for Education in order to confirm the contents of a Statement presented to them. We also rely on Article 6(1)(f) for this purpose in that it is the interests of you, us, the Department for Education and the general public for the information to be shared for this purpose.

What information we need

We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, and communicate with you regarding your application.

 

We collect and process information relating to the reasons for your application (including refugee status) in order to ensure we are delivering the correct service to you and optimising our services for your needs.

 

We collect and process information relating to your qualifications (including copies of documentation) in order to provide requested comparison services to you.

What we do with it

Your information is collected, stored, and used by staff to communicate with you, identify you from other applicants, and deliver our services to you.

How long we keep it

We keep your personal data for as long as we need it. For completed applications, this is usually for a period of 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period.

 

Scanned documents submitted to support applications are deleted within 12 months of either the service being completed, or the last action on an account.

 

We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.

Who we share it with

We share your information with third parties mentioned in the section “Sharing your Information” above.

 

We also share your personal data with the Department for education for the purposes of verifying the content of the Statement. We share the minimum information necessary do this.

Services for Organisations:

Where we operate services for organisations, we may need to process personal data relating to representatives of those organisations. The following information sets out what we do with that data:

  1. Training and Events including Conferences

Our role

Where you apply to us for training or events, whether included in a membership package or paid for as a stand-alone service, we will be the controller of your data.

Purpose and Lawful Basis for Processing

We collect and process your personal data for the purposes of delivering the training or event to you, including communicating with you.

A contract will exist relating to the delivery of training or event to you. This may be either directly with you, or with your employer, or both.

Where the contract is with you, we rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you - it is necessary for the performance of a contract that we have with you.

Where we contract with your employer rather than you, we will rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so, since it is the interests of you, us, and your employer for us to process your data for this purpose.

What information we need

We collect and process information including your name, title, job title, the organisation you work for or represent and their address and your email address. This is in order to deliver the training or event to you, and to invoice your employer for payment.

What we do with it

Your information is collected, stored, and used by staff to communicate with you, coordinate and tailor training and events to your needs, and deliver the training or event to you. It is also used to invoice your or your employer and/or discharge any obligations we might have to you or them.

How long we keep it

We will keep your data for as long as we need it, and no longer. This may be a period of up to 6 years after the training or event has been completed or the contract with your employer has been fulfilled.

Who we share it with

We share your information with third parties mentioned in the section “Sharing your Information” above.

Your data may be collected via or shared with a third-party online booking provider, Participant UK. You can review their privacy information here: https://www.participant.co.uk/privacy.

Online training and events are delivered via a video conferencing platform. Currently we use Zoom, though we may use other providers from time-to-time. You can review their privacy information here: https://zoom.us/privacy/

For some events, we may use a third-party conference application provider to deliver conference information and allow you to interact with the conference. We currently use an application called Whova, though we may use other providers from time-to-time. You can review their privacy information here: https://whova.com/privacy/

Where training or event content is delivered by a third party, we may need to share your personal data with them in order that they can tailor content to your needs.

We may also share your data with your employer for the purposes of invoicing and/or discharging our contractual obligations to them.

We always share the bare minimum information necessary to provide the service to you.
  1. Open Badges for Training

Our role

We will be the controller of your data should you opt to receive an Open Badge on completion of a training module or event.

Purpose and Lawful Basis for Processing

Should you opt to receive an Open Badge, we will rely on Article 6(1)(a) of the GDPR as the lawful basis for doing so.

You can withdraw your consent at any point up to the issuance of the Open Badge.

What information we need

We will use and share your name, title, and email address to generate the badge.

What we do with it

Your information is uploaded to a third-party badge issuing platform who will issure the badge on our behalf and make it available to you.

How long we keep it

The badge will be issued to you directly and you can delete it at any time by logging in to their platform.

Who we share it with

We use a third party Open Badge issuing platform, openbadges.me. You can review their privacy information here: https://openbadges.zendesk.com/hc/en-us/articles/360002393154-Privacy-Policy

On occasion we will be asked to confirm that a Statement issued by us is genuine, and/or accurate. This might be, for example, where you have presented your statement to a third party whom you wish to be able to rely on the contents.

Where we are asked to do so, we will confirm whether or not the statement was issued, and whether or not the information contained in the statement is accurate.

Our role

We will be the controller of the data

Purpose and Lawful Basis for Processing

We will confirm whether or not information provided to us matches our records. We will never volunteer any personal data to anyone.

 

The lawful basis that we will rely upon in this instance will be Article 6(1)(f) of the GDPR since it is in the interests of us, you, and the general public for statements to be able to be relied upon and checked for accuracy.

What information we need and why we need it

No further information will be collected.

What we do with it

N/A

How long we keep it

N/A

Who we share it with

We will confirm with the enquirer whether or not information matches our records.

We may communicate with you in relation to general enquiries, or in relation to applications for our using the following electronic communication methods:

  1. Telephone

When you call our mail helpline we will:

  • Collect Calling Line Identification (CLI) information - this is the phone number you are calling from. This is to help us to identify you, to understand demand for our services, improve how we operate, and call you back if we need to. We keep this information for a maximum of 6 months before being permanently deleted
  • Record the audio of your telephone conversation. This is for training purposes, in order to improve the way in which our staff deal with enquiries and complaints. We rely on Article 6(1)(f) of the GDPR since it is in the interests of us, you, and the general public for our staff to provide training and improve the way in which our enquiries are managed. Recordings are kept for a maximum of 6 months before being permanently deleted.
  1. Live Chat

We offer the LiveChat facility as an alternative to telephoning us to:

  • Get general information about our services
  • Discuss an application you may have submitted to us (whether live or historical).

We use a third-party provider, Click4Assistance, to supply and support our live chat service. The following relates to the use of LiveChat:

Our role

It depends on the purpose of your enquiry:

· If it is a general enquiry, then we will be the controller of your personal data.

· If you are contacting us about an existing application for our services, then we will usually be the controller, unless we act as a processor for the service you have applied for.

Purpose and Lawful Basis for Processing

We will process your information for the purpose of dealing with your enquiry, whatever that may be. Usually this will fall into two categories:

· A general enquiry about our services, or;

· An enquiry relating to an existing application you have with us.

The lawful basis that we will rely upon will depend on the reason for your enquiry:

· For general enquiries we will rely on Article 6(1)(f) of the GDPR since it is in the interests of us and you to process such data as is necessary to deal with your enquiry.

· Where you are enquiring about an existing application, we will rely upon the legal basis relevant to the processing of that application. You should check the section of this document relevant to the service, but usually this will be Article 6(1)(b) of the GDPR - that we need to process the information to provide the service to you.

What information we need and why we need it

We will collect sufficient information to allow us to deal with your enquiry.

· For general enquiries, we may not need to collect any information that identifies you, though you should be aware that the software we use may collect information to identify your general location information (for statistical purposes) such as your IP address. A transcript of the conversation will also be recorded.

· For enquiries relating to an existing application, we may process any information relevant to your application and/or enquiry. For more information on what this may include, please see the information provided in this document that is relevant to the service you have applied for.

What we do with it

We will use the information to answer your enquiry and may record details of the enquiry on your file for future reference.

How long we keep it

Transcripts are kept for a maximum of 12 months before being permanently deleted.

Where enquiries relate to an existing enquiry, the transcript, or parts of it, may be transferred onto the permanent file associated with your application, and kept for the retention periods relevant to that service.

Who we share it with

Our LiveChat provider is Click4Assistance. Data is held on servers based in the European Union. Their privacy notice can be found here: https://www.click4assistance.co.uk/click4assistance-web-chat-software-cookie-policy

We will not send marketing communications to individuals unless we have consent to do so. You may be asked to opt-in to marketing emails.

We will not share your email address or any other personal information with any third party for the purposes of direct marketing save as mentioned in the table below.

Where we do send you marketing emails, you can withdraw your consent at any time. There will be a link in any marketing communications we send that will to allow you to do so easily.

The following relates to our direct email marketing activities:

Our role

We will be the controller of the data

Purpose and Lawful Basis for Processing

We may send marketing emails relating to services that might be useful for you.

The lawful basis that we will rely upon in this instance will be Article 6(1)(a) of the GDPR since you will have consented to our sending you marketing emails either by opting in via our website or in some other way, such as at an event.

What information we need and why we need it

Ordinarily we will already have collected your data, since you will have applied for one of our services.

Alternatively, you may have volunteered your email address in some other way, for example at an event.

What we do with it

We will use your email address to send you marketing emails relating to our services.

How long we keep it

Where you have applied for a service previously, we will keep your information for retention period relevant to that service.

Otherwise we will keep your details for no longer than we feel necessary. This will not exceed 1 year.

Who we share it with

We share your information with third parties mentioned in the section “Sharing your Information” above.

We may also use a third-party online marketing platform to manage our marketing emails, specifically MailChimp. Their privacy notice can be found here: https://mailchimp.com/legal/privacy/

Since Mailchimp are based in the United States of America (USA), your data may be transferred out of the UK and European Union to the USA, however Appropriate safeguards are in place to ensure this is done in compliance with privacy laws, specifically through the use of the European Commission’s standard EU Contractual Clauses.

We may send communications to individuals containing satisfaction surveys. We only do this in order to ascertain satisfaction levels with a view to improving our services.

Where we send out surveys, we do not rely on your consent, but we do not want to send these emails if you do not wish us to. We There will be a link in any survey communications we send that will to allow you to opt out of them easily.

The following relates to our satisfaction survey communications and activities:

Our role

We will be the controller of the data

Purpose and Lawful Basis for Processing

We may send survey emails relating to services that you have utilised, in order that we can ascertain levels of satisfaction and improve our services.

The lawful basis that we will rely upon in this instance will be Article 6(1)(f) of the GDPR in that we have a legitimate interest in getting your feedback so that we can improve our services.

What information we need and why we need it

We will already have collected your data, since you will have applied for one of our services.

What we do with it

We will use your email address to send you satisfaction surveys relating to our services.

How long we keep it

Where you have applied for a service previously, we will keep your information for the retention period relevant to that service.

Who we share it with

We share your information with third parties mentioned in the section “Sharing your Information” above.

We may also use a third-party online marketing platform to manage our marketing emails, specifically MailChimp. Their privacy notice can be found here: https://mailchimp.com/legal/privacy/

Since Mailchimp are based in the United States of America (USA), your data may be transferred out of the UK and European Union to the USA, however appropriate safeguards are in place to ensure this is done in compliance with privacy laws, specifically through the use of the European Commission’s Standard EU Contractual Clauses.

We may also use a third-party survey software provider called SurveyMonkey to manage surveys. Their privacy notice can be found here: https://www.surveymonkey.co.uk/mp/legal/privacy/

Since SurveyMonkey are based in the United States of America (USA), your data may be transferred out of the UK and European Union to the USA, however Appropriate safeguards are in place to ensure this is done in compliance with privacy laws, specifically through the use of the European Commission’s Standard EU Contractual Clauses.

We may impose a restriction on your access to our services if it is necessary to protect our staff from unacceptable behaviour. The restriction will be recorded on your file.

The lawful basis we will rely upon when doing this is Article 6(1)(f) of the GDPR since we have a legitimate interest in protecting our staff from abusive behaviour.

Before we take such action, we will contact you to explain why we have done so, and why it is necessary.

When you make a payment for one of our services, whether on the website or over the telephone, this is done using an independent third-party card processing company, Stripe. We do not have access to your banking or payment card information.

This privacy notice does not cover how Stripe processes personal information. We encourage you to read their privacy notice which can be found here: https://stripe.com/gb/privacy.

If you made payment to one of our services before 26/11/2022 it would have been through an independent third-party card processing company, WorldPay. We do not have access to your banking or card information and this privacy notice does not cover how WorldPay processes personal information. We encourage you to read their privacy notice which can be found here: https://www.fisglobal.com/en-gb/privacy.

We do not encourage you to send payment card details to us in any format. Any payment card details received by us will be destroyed immediately.

Where you provide payment card information to us over the telephone, staff are trained to switch off any telephone recording software or equipment. We do not record the information in any other way.

Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes your personal information. We encourage you to read the privacy notices on the other websites you visit.