Privacy Policy

The Compliance Manager will be responsible for ensuring that the policy is reviewed at least annually and in line with changes in legislation. The Contracts and Data Manager will be responsible for ensuring that the Senior Management team and Board are briefed on the policy and its content. Department Managers will be responsible for ensuring that all staff under their direct control are adhering to the
policy.

The policy will be communicated via the company’s website and IrisHR. The policy will be stored on the company’s internal network in the policies and procedures folder for information security.

Changes to the policy will be made by the Compliance Manager, with requests for changes to be made via email to roberthaines@acttraining.org.uk. Our privacy policy explains what information we collect, why we collect it, and how we use this information. In addition to this, the policy will explain the steps we take to secure your information. The policy also explains your rights in respect of your personal data.

If you have any questions about your personal data or about this privacy policy, please email us at
dataprotection@acttraining.org.uk or write to us at the following address:

Data Protection Officer
ACT
Ocean Park House
East Tyndall Street
Cardiff
CF24 5ET

We collect information from you to enable us to provide our services to you as a customer or stakeholder of the company. All personal information you provide us with will be recorded, used and protected by us in line with the General Data Protection Regulations and the Data Protection Act 2018.

In general, we will use your information for the following purposes:

• To administer and provide services you request or have expressed an interest in
• For internal record keeping and progress tracking against the services we provide
• We will share this information with Welsh Government and other public bodies, to carry out the funding, planning, monitoring and inspection of learning, and to produce statistical publications.
• With awarding bodies in order to administer the delivery of learning programmes
• To communicate with you about the services you request or express an interest in
• To personalise and/or tailor any communications that we may send you.
• To assist with statistical research

The Welsh Government will also use your information in the following ways:

• By selected third parties, including social research organisations, to carry out research, analysis or equal opportunities monitoring relating to education and training.
• By the Welsh Government and third parties acting on its behalf, to assist in linking your records to other data sources for the purpose of statistical research.
• The Welsh Government may share your name, date of birth, address and postcode with electoral registration officers taking part in data matching pilot schemes to improve the accuracy of electoral registers.
• Your contact details may be passed on to contractors acting on behalf of the Welsh Government (including the Wales European Funding Office), to undertake interviews or surveys of current and former learners, as part of formal evaluations of Welsh Government-funded programmes. Con-tractors will contact a sample of individuals.
• You may be contacted and asked to take part in an evaluation of your personal experience of a learning
  activity.

If you are contacted, the purpose of the interview or survey will be explained to you and you will be given the option to say yes or no to taking part. Contractors will use your details only for the purpose of carrying out the evaluation and in accordance with the Data Protection Act. Your details will then be deleted once the evaluation contract is complete.

We may also share your information for legal reasons if we believe in good faith that access, use, preservation, or disclosure of the information is necessary to:

• Meet requests from government bodies, and law enforcement agencies in relation to any investigation to aide with the detection, and prevention of any unlawful activity
• Detect or prevent fraud, security or technical issues
• Assist other third parties in legal proceedings

In providing you with our services we may collect and store any personal information that you provide to us.

We will keep a record of the following information in relation to your personal data:

• Your name
• Address
• Date of birth
• Email address
• Telephone number
• Payment details (where applicable)
• Disability, additional learning needs or health requirements
  (these are optional and you have the choice to provide/or not provide this information)
• IP address
• MAC address
• Date and time stamp

When you interact with the company’s digital platforms, create an online account, register to receive marketing communication from us, fill in one of our forms online or offline or directly provide us with your personal information, we may collect and store any personal information that you provide. We may use this information to provide services you request from us, to carry out statistical research.

When we interact with suppliers we will collect personal, identifiable information such as:

• Employee name
• Telephone number
• Work email address

We collect this information in order to be able to contact you about the goods or services that you supply us with, to allow us to place additional orders with you and pay for goods and services that you supply to us. This data will be held for 6 years from the point of the goods or services that you supply.

We will retain your data for as long as is necessary to provide you with our services, or unless a longer period is required by a contractual, legal or regulator requirement. Further information in relation to retention periods can be found in our privacy notices.

As with many other websites, we utilise standard technology cookies on our website. A cookie is a small file which asks permission to be placed on your computer. These files help us analyse web traffic on each visit to our site. These cookies help us analyse data about our website and improve our website in order to ensure that we continue to meet the needs of our customers. We only use this information for statistical analysis purposes and then the data is removed from the system.

You can choose to accept or decline these cookies through your web browser settings, however, declining cookies may affect your use of the website.

We take the safety of your information extremely seriously and work hard to ensure that it is protected from unauthorised access. We have appropriate firewalls and encryption in place on the databases holding your personal data and this information is only accessed in line with the company’s access control policy.

In addition to this, we have physical access controls in place within our buildings and access to your data is only given to those employees that need it to carry out their job role. Employees may be disciplined or their contract terminated if they fail to comply with these obligations.

We will not sell, distribute or lease your personal data with any third parties unless we have your explicit
permission or we are required by law to do so.

We will only use the personal information you provided us where the law permits. Generally we will process your personal data in the following ways:

•  In the performance of a contract we enter into with you
• Where necessary in compliance with a legal obligation that we are subject to
• In line with public interests
• For legitimate business interests

• The right to request a copy of the personal data which we hold about you
• The right to request that we correct any personal data if it is found to be inaccurate or out of date
• The right to request your personal data is erased (in certain circumstances)
• The right to withdraw your consent to the processing at any time, where consent was the lawful basis for processing the data
• The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
• The right to object to the processing of personal data, (where applicable i.e. where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics
• Lodge a complaint with the Information Commissioner’s Office (ICO) which is the independent regulator for data protection

You may request details of the personal data which we hold about you under the General Data Protection
Regulations and Data Protection Act 2018. If you believe that any of the information we are holding on you is incorrect or incomplete, please write or email us as soon as possible using the contact details listed in the how to contact us section of this policy.