Section 1 Introduction
1.1 Scope of the policy
This policy applies to all individuals who may have personal data stored with DNA Skills. Please read this Policy carefully, as it contains important information about what information we collect, how and why we do so, how we process and protect this data after collection, your rights in relation to your personal data and how to contact us and / or the appropriate external authorities in the event that you wish to report a concern about the way in which we process your data. The term 'apprentice' used in this policy refers to registered apprentices with DNA Skills who attend end-point assessment events.
This policy should be read alongside our organisational policies and procedures including:
1.2 Purpose of the policy
1.3 A shared responsibility
Where appropriate it is important that all approved staff within a centre who are involved in the processing of personal data are made aware of this policy and its range of possible outcomes, should they fail to comply with DNA Skills requirements as described above.
1.4 Reviewing the policy
We will review this policy regularly and where otherwise necessary and may revise it as required in response to the findings of any review.
Section 2 What information do we collect?
Under the terms of the GDPR, DNA Skills is considered the ‘controller’ of data that individuals or companies provide us.
Information that we may collect is listed below:
Data that you provide us with when working with us is collected. This information includes information that you will provide our partner training providers with when you undertake an apprenticeship. For example:
Information from your relationship with DNA Skills or other organisations
When you become involved with DNA Skills this will result in some personal data being created, such as details of apprenticeships/training that have been undertaken.
Personal data is also sometimes received about individuals from other organisations, such as, partner training providers/employers (for example, if you have completed a functional skills qualification with a different provider, and we need that additional information as evidence of completion).
From time to time, we may also use other organisations to help us conduct research and analysis on personal data, in turn, resulting in new personal data being created.
Sensitive Personal Data
Information classified as ‘Sensitive Personal Data’ may be collected by DNA Skills, such as ethnicity or additional learning needs. We will only carry this out where we have been asked to do so by official Government agencies, or where the information is needed for the assessment of additional educational support needs, or reasonable assessment adjustment. If we do so, we will take extra care to ensure your personal data is protected.
Accidents or incidents
If an accident or incident occurs in one of our assessment locations or office, and/or involving one of our employees, then we are required to keep a formal record of this, (which may include sensitive personal data.
Section 3 How do we collect personal information?
It is very important for individuals that are undertaking an EPA with DNA Skills to know that certain elements of their personal data will typically need to be shared with us via their training provider or employer, in order for us to deliver the relevant service.
Wherever personal information is shared with us by anyone other than the person whose information we are collecting (the ‘data subject’), it is the responsibility of the third party to ensure that the data subject is fully aware that their information will be shared with us and has obtained their consent for this to happen prior to their information being shared. In this context, DNA Skills is the ‘data processor’, rather than the controller. For example, a training provider/employer ensuring that an apprentice has consented to their personal information being shared with us during their sign-up registration.
Section 4 What do we use your personal information for?
At DNA Skills we only ever use personal data with your consent, or where it is necessary to:
By doing so it means that we are keeping you safe from harm or for (or a third party’s) lawful interests, provided your rights do not override these. We will only use your information for the purpose or purposes it was collected for.
Your personal information will be used to:
We use personal data for administrative purposes, and this includes:
Analysis and research
DNA Skills may carry out research and analysis on the data that we hold in our Creatiogreen system, to determine success rates of end-point assessments, understand behaviours and identify patterns and trends.
To help us to ensure that communications are relevant and timely to our customers we profile them in terms of their interaction with our website and resources that are downloaded. This allows us to keep information on preferences and send material that you are most likely to be interest in.
We will also obtain information about you from other sources, such as partner training providers and employers as previously described.
We use personal data to communicate with people and to promote DNA Skills. This includes keeping you up to date with our news and offerings.
Section 5 Who will we share your personal information with?
We will take all reasonable steps to ensure that our staff protect your personal data and are aware of the information security obligations. We limit access to your personal data to those who have a genuine business need to know it.
We will never sell your personal information. We may disclose and share your personal information with:
Sometimes we use third parties to process information on our behalf. If we do so, we require these third parties to comply strictly with our privacy guidelines.
When we transfer your data, we will:
Where personal data needs to be transferred to countries outside of the European Economic Area (‘EEA’), we will take appropriate steps to ensure your personal information is afforded the same level of protection as described in this Policy.
Section 6 How do we protect and store your personal data?
We use a variety of physical and technical measures to keep your data safe and to prevent unauthorised access or sharing of your personal information.
Electronic data and databases are stored on secure computer systems and we control who has access to information using both physical and electronic means. Our employees receive data protection training and we have a set of detailed data protection procedures which personnel are required to follow when handling personal data.
DNA Skill’s operations are based in the UK and we store our data within the EEA. We will never process or store personal information outside of the EEA.
Section 7 What are your rights?
The GDPR outlines various rights that a data subject has with regard to their personal data. Please see a summary below:
If you wish to exercise any of these rights, or raise a data protection issue with us, please find the appropriate contact details below.
Section 8 How long do we keep your data for?
DNA Skills retain data for as long as is required to fulfil our ongoing regulatory, quality assurance and/or legal obligations. For example, apprentice achievement data will be retained beyond the end of a contract between us and the apprentice’s employer and/or provider, in case it should be required during regulatory audits, complaint handling, appeals and / or legal proceedings. For these reasons we will hold personal data that is essential, as described here, for a period of seven (7) years.
Where you have opted into marketing communications, please note that you can update your preferences or unsubscribe at any time but emailing firstname.lastname@example.org
How long we keep information for depends on the information and what it is used for. For example, if you ask us not to send you marketing emails, we will stop storing your emails for marketing purposes (though we will keep a record of your preference not to be emailed). We continually review what information we hold and delete what is no longer required. We never store payment card information.
Section 9 Young People
As an End Point Assessment Organisation, we regularly process the personal data relating to young people who undertake one of our End-Point Assessment opportunities.
Information for Parents
If your child is under 18 then we will seek permission to record any audio-visual communications. We take great care to ensure that individual’s rights are protected and respected in relation to their personal data, especially in the case of young people.
Section 10 Complaints
If you believe that your data protection rights may have been breached you can raise your concerns directly to email@example.com, with accompanying relevant evidence. However, if we have been unable to resolve the situation to your satisfaction, you may lodge a complaint with the Information Commissioner’s Office.
Please visit https://ico.org.uk/concerns/ for more information on how to report a concern to the ICO.
Section 11 Contacts
Your contact for this policy
If you have any queries about the contents of the policy, please contact our DNA Skills EPA Team:
Telephone: 01344 944675
DNA Skills EPA Team
7 Lakeside Business Park
© 2021 All Rights Reserved