DNA SKILLS PRIVACY NOTICE

Section 1   Introduction

1.1  Scope of the notice

This notice applies to all individuals who may have personal data stored with DNA Skills. Please read this notice carefully, as it contains important information about what information DNA Skills collect, how and why it does so, how it processes and protects this data after collection, your rights in relation to your personal data and how to contact DNA Skills and/or the appropriate external authorities in the event that you wish to report a concern about the way in which the data has been processed.

Please note that the term 'apprentice' used in this policy refers to registered apprentices with DNA Skills who attend end-point assessment events.

This notice should be read alongside our organisational policies and procedures including:

• Cookie Policy
• Data Protection and GDPR Policy

1.2  Purpose of the notice

DNA Skills, trading name of SCL Education and Training, is committed to the security and fair processing of personal and/or sensitive data. At all times DNA Skills aim to respect personal information that is shared, or that is received from others, and to keep it safe. This privacy notice explains what data is collected and how it is processed, thereafter, in accordance with applicable data protection law, in particular the General Data Protection Regulation (EU) 2016/679 (GDPR).

1.3  A shared responsibility

All staff and those who are involved in the processing of personal data will be made aware of this notice, its contents, and requirements.

1.4  Reviewing the notice

This notice will be reviewed annually or:

• Interim when there has been changes to notice or legislation
• Where DNA Skills are approved for additional apprenticeship standards

Section 2    What information do DNA Skills collect?

Under the terms of the GDPR DNA Skills is considered the ‘controller’ of data that individuals or companies provide us.

Information that DNA Skills may collect is listed below:

2.1 Personal Data

This includes information that apprentices will provide their training provider when they undertake an apprenticeship, for example:

• Personal and contact details (name, date of birth, email, address, telephone etc.)
• Data classified as Sensitive Personal Data (ethnicity, additional learning needs)
• Financial information (payment information such as credit/debit card or direct debit details or bank account details)
• Marketing and Communications Data, such as preferences about receiving communications from us or third parties
• Technical information such as IP addresses, login data, browser information, time zone, browser plug-ins, operating systems, platforms and other technology on the device used to access the website

2.2 Information from your relationship with DNA Skills or other organisations

When you become involved with DNA Skills this will result in some personal data being created, such as details of apprenticeships/training that have been undertaken. Personal data is also sometimes received about individuals from other organisations, such as, partner training providers/employers (for example, if you have completed a functional skills qualification with a different partner, and DNA Skills need that additional information as evidence of completion).

From time to time, DNA Skills may also use other organisations to help conduct research and analysis on personal data, in turn, resulting in new personal data being created.

2.3 Sensitive Personal Data

Information classified as ‘Sensitive Personal Data’ may be collected by DNA Skills, such as ethnicity or additional learning needs. This will only be carried out where DNA Skills have been asked to do so by official Government agencies, or where the information is needed for the assessment of additional educational support needs, or reasonable assessment adjustment.

2.4 Accidents or incidents

If an accident or incident occurs in one of the assessment locations or office, and/or involving one of DNA Skills employees, then formal records are required to kept (which may include sensitive personal data. 

Section 3    How do DNA Skills collect personal information?

Data is either sent directly to DNA Skills via means such as email and online services (e.g., learner registration uploads in Creatiogreen, or collected automatically via the website (e.g., items such as IP address and browser type). To find out more about the website data that is collected automatically, please see the DNA Skills’ Cookie Policy.

It is very important for individuals that are undertaking an EPA with DNA Skills to know that certain elements of their personal data will typically need to be shared with DNA Skills via their training provider or employer, to deliver the relevant service.

Wherever personal information is shared with DNA Skills by anyone other than the person whose information DNA Skills are collecting (the ‘data subject’), it is the responsibility of the third party to ensure that the data subject is fully aware that their information will be shared with DNA Skills and has obtained their consent for this to happen prior to their information being shared. In this context, DNA Skills is the ‘data processor’, rather than the controller. For example, a training provider/employer ensuring that an apprentice has consented to their personal information being shared with DNA Skills during their sign-up registration. 

Section 4    What do DNA Skills use your personal information for?

DNA Skills only ever use personal data with your consent, or where it is necessary to:

• Enter into, or perform, a contract with you.
• Comply with a legal duty.
• Protect your vital interests.

By doing so it means that DNA Skills are keeping you safe from harm or for (or a third party’s) lawful interests, provided your rights do not override these. DNA Skills will only use your information for the purpose or purposes it was collected for.

4.1 End-Point Assessment Data

Personal information will be used to:

• Register apprentices onto the Creatiogreen platform for assessment administration purposes and to enable DNA Skills to carry out assessments and issue results
• Ensure that DNA Skills comply with Ofqual’s or any other regulatory body’s General Conditions of Recognition or equivalent documentation

4.2 Administration Data

DNA Skills uses personal data for administrative purposes, and this includes:

• Receiving payment (e.g., direct debits, payment card details or bank details)
• Maintaining databases of apprentices through the EPA process
• Performing obligations under partner contracts
• Helping respect your choices and preferences (e.g., if you ask not to receive marketing material, DNA Skills will keep a record of this)
• Answer your questions/requests and communicate with you in general

4.3 Analysis and Research Data

DNA Skills may carry out research and analysis on the data that is held in the Creatiogreen platform, to determine success rates of end-point assessments, understand behaviours and identify patterns and trends.

To help ensure that communications are relevant and timely to customers DNA Skills profile them in terms of their interaction with the website and resources that are downloaded. This allows DNA Skills to keep information on preferences and send material that you are most likely to be interest in.

4.4 Marketing Data

DNA Skills uses personal data to communicate with people and to promote the organisation. This includes keeping you up to date with DNA Skills news and offerings.

Section 5    Who will DNA Skills share your personal data with?

DNA Skills will take all reasonable steps to ensure your personal data is protected and that you are made aware of the information and security obligations. DNA Skills limit access to your personal data to those who have a genuine business need to know it.

DNA Skills will never sell your personal information however, in some instances, data may be disclosed with:

• Regulatory bodies ensuring compliance with Conditions of Recognition or other equivalent documentation. DNA Skills also share aggregated achievement data with regulatory bodies such as Ofqual
• Relevant third parties (such as training providers/employers, service suppliers or law enforcement agencies) if DNA Skills reasonably believe that you may be in breach of the law, or if required to do so in accordance with applicable law
• Consultants and/or professional experts whose remit specifically requires access to personal data

Sometimes DNA Skills use third parties to process information on their behalf. If this is carried out, DNA Skills will require these third parties to comply strictly with all privacy guidelines.

When/if DNA Skills transfer your data, the following will apply:

• Shared data in a secure way
• Never allow other companies to use it to contact you with their own marketing

Where personal data needs to be transferred to countries outside of the European Economic Area (‘EEA’), DNA Skills will take appropriate steps to ensure your personal information is afforded the same level of protection as described in this notice.

Section 6    How do DNA Skills protect and store your personal data?

DNA Skills uses a variety of physical and technical measures to keep your data safe and to prevent unauthorised access or sharing of your personal information.  

Electronic data and databases are stored on secure computer systems, and DNA Skills control who has access to information using both physical and electronic means. Employees receive data protection training, and a set of detailed data protection procedures are required to be followed when handling personal data (see DNA Skills Data Protection & GDPR Policy).

DNA Skills ‘operations are based in the UK and data is stored within the European Economic Area (EEA). Personal data information will never be processed or stored outside of the EEA.

Section 7    What are your rights?

The GDPR outlines various rights that a data subject has with regard to their personal data. Please see a summary below:

• The “Right to be Informed”; individuals must be made aware of how and why their personal data is collected. In providing the notice, DNA Skills meets this requirement
• The “Right of access”; individuals can request access to copies of their personal data in order to verify that it is being processed in a lawful and correct way 
• The “Right to rectification”; individuals can request that inaccurate personal data is corrected (or completed if it is incomplete) 
• The “Right to erasure”; under certain circumstances, an individual can request that their personal data is deleted (e.g., if they wish to unsubscribe from receiving marketing communications and/or have their contact details completely deleted from systems. This would be possible, provided there was no legitimate ongoing reason for DNA Skills to retain their details)  
• The “Right to restrict process”; under certain circumstances an individual can request the suppression of their personal data (e.g., allowing DNA Skills to continue holding their data, but pausing all processing of that data whilst they seek to verify that it is accurate and / or being processed lawfully) 
• The “Right to portability”; under certain circumstances, an individual can request that their personal data is electronically transferred from DNA Skills to another data controller 
• The “Right to object”; under certain circumstances, an individual can object to the way in which their data is being processed (for example, if they believe that DNA Skills do not have legitimate grounds for collecting and processing certain information about them). If the objection is upheld, DNA Skills are required to stop processing that information

If you wish to exercise any of these rights, or raise a data protection issue with DNA Skills, please find the appropriate contact details below.

Section 8    How long do DA Skills keep your data for?

DNA Skills retain data for as long as is required to fulfil ongoing regulatory, quality assurance and/or legal obligations. For example, apprentice achievement data will be retained beyond the end of a contract between DNA Skills and the apprentice’s employer and/or partner, in case it should be required during regulatory audits, complaint handling, appeals and/or legal proceedings. For these reasons DNA Skills will hold personal data that is essential, as described here, for a period of seven years.

Where you have opted into marketing communications, please note that you can update your preferences or unsubscribe at any time by emailing enquiries@dnaskills.co.uk.

How long DNA Skills keep information for depends on the information and what it is used for. For example, if you request not to be sent marketing emails, DNA Skills will stop storing your emails for marketing purposes (though a record of your preference will be stored, not to be emailed). DNA Skills continually review what information is held and will delete what is no longer required. DNA Skills never store payment card information.

Section 9   Data gathering permissions for apprentice under 18

As an End Point Assessment Organisation, DNA Skills regularly process the personal data relating to young people (under the age of 18) who undertake end-point assessments as per apprenticeship.

9.1 Information for Parents/guardians

If an apprentice is under 18 then DNA Skills will seek permission to record any audio-visual communications. DNA Skills take great care to ensure that individual’s rights are protected and respected in relation to their personal data, especially in the case of young people.

Section 10   Complaints

If you believe that your data protection rights may have been breached you can raise your concerns directly to enquiries@dnaskills.co.uk, with accompanying relevant evidence. If you are a user of the Creatiogreen platform, complaints can be raised directly through here using a Complaints Form’. However, if DNA Skills have been unable to resolve the situation to your satisfaction, you may lodge a complaint with the Information Commissioner’s Office. 

Please visit https://ico.org.uk/concerns/ for more information on how to report a concern to the ICO.

Section 11   Contacts

Your contact for this policy

If you have any queries about the contents of the notice, please contact our DNA Skills EPA Team:

Email: enquiries@dnaskills.co.uk

Telephone: 01344 944675

Post:
DNA Skills EPA Team
7 Lakeside Business Park
Sandhurst
GU47 9DN

Title & Key Responsibilities

General Manager - Accountable for the strategic objectives of DNA Skills and its regulatory compliance. Ensures all policies are effectively implemented

Head of Quality & Compliance - Responsible Office and point of contact for regulatory bodies. Oversees the version control of policies

Head of Product & Assessment Development - Acting Deputy for Responsible Officer. Manages the development and life cycle of our products

Quality & Performance Manager - Responsible for the delivery of assessments and quality assurance processes