Collecting specific, relevant personal information is a necessary part of us being able to provide you with services. Go Train wants to make sure all the personal information we have collected about you is safe and secure. This policy sets out our commitments to you, in compliance with the General Data Protection Regulations (known as GDPR) and explains how we collect, store and use your personal information.
- Go Train is committed to protecting your privacy when you use our services. This privacy statement explains how we use information about you and how we protect your privacy. From 25 May 2018, your personal information is processed, held and/or controlled in accordance with the General Data Protection Regulations (2016/679) or more commonly known as ‘GDPR’.
- Go Train has obligations to the organisations which fund the services we deliver and these organisations include the government (Education Skills Funding Agency), Further Education Colleges, independent training providers, National Careers Service, housing associations, local authorities and other similar organisations. The obligations Go Train has include sharing some information about you, your learning, careers guidance you receive and achievements.
- In many cases, the Education Skills Funding Agency (EFSA) is the ultimate funder. The ESFA is an executive agency of the Department for Education (DfE). For the purposes of relevant data protection legislation, the DfE is the data controller for personal information processed. The EFSA privacy notice can be viewed via this link https://www.gov.uk/government/publications/esfa-privacy-notice/education-and-skills-funding-agency-privacy-notice-may-2018
- The Education and Skills Funding Agency issues a Unique Learner Number (ULN) and creates a learner’s Personal Learning Record, as part of the functions of the DfE. For more information about how your information is processed by the government’s Learner Record Service and to access your Personal Learning Record, please refer to https://www.gov.uk/government/publication/lrs-privacy-notices
- Learners should also read and understand privacy notices of organisations which fund and have arranged for Go Train to deliver services on their behalf:
- The regulations set out some definitions which are helpful to understand.
- Personal Information can be anything that identifies and relates to a living person and can include information that when put with other information can then identify the person. For example, this could be your name, contact details, email address and/or telephone number. It could include a photograph, audio or video.
- Sensitive Personal Data is ‘special’ information because it needs more protection due to its sensitivity. An easy way of thinking about this is that it is information that is very personal to you and that you would not want widely known. This is likely to include anything that can reveal your:
- sexuality and sexual health
- religious or philosophical beliefs
- physical or mental health
- trade union membership
- political opinion
- genetic/biometric data
- criminal history
- Data Subject is a living individual
- Data Controller is when an organisation determines the purpose and the way information is processed
- Data Processor is an organisation which carries out actions on behalf of a Data Controller
- Sub Processor is an organisation which may assist with processing.
- Processing is carrying out activities with personal information (for example, storing it).
Why we need your personal information
- Go Train may collect both personal information and sensitive personal information about you. We need to collect and use this information about you to:
- Deliver services and support to you
- Manage those services we provide to you
- Train and manage the employment of our staff who deliver those services
- Help investigate any concerns you have about your services and to answer your enquiries
- Allow you to take part in training
- Check and improve the quality of our services
- Help keep you safe under our safeguarding and health and safety policies
- Help with research and planning of new services
- Send you information which we think might be of interest to you if you have agreed to this
- Comply with requirements of contracts with funders, the Government and referral partners. This might for example include contacting you some time after you no longer use Go Train services so we can find out whether you are working or are in further learning.
- Make sure that any third party organisation which works for us can carry out that work
- Monitor compliance with our equal opportunities policy
- Carry out our obligations arising from any agreements made between you and Go Train
- Market our related products and services to you, where you have given your consent for us to do so
How the law allows us to use your personal information
- There are a number of legal reasons why we need to collect and use your personal and special categories of information:
- You or your legal representative, give your consent.
- We need to collect it to ensure we fulfil contractual obligations for services with which you are involved (eg; delivering adult education and National Careers Services)
- We are required by law to collect it. For example Go Train is legally obliged to collect personal information for an Individual Learner Record.
- To safeguard your or another person’s welfare.
- Go Train may need to use information about learners to carry out legitimate activity.
- You have made your information publicly available
- It is necessary for legal cases
- It is to the benefit of society as a whole
- It is necessary for archiving, research, or statistical purposes
- If we have consent to use your personal information, rather than legal or contractual reasons, you have the right to remove it at any time. If you want to remove your consent, please contact firstname.lastname@example.org and tell us which service you are using so we can deal with your request.
How we collect your information
- We typically collect information from you in the following ways:
- You provide information by filling in forms on paper or using computer. This includes information provided when you begin to access a service for the first time from Go Train or access a new service once you are already known to us.
- You provide information to our staff so they can help and support you.
- We may collect information about your computer, including (where available) your IP address, operating system and browser type. You may refuse to accept cookies by changing the settings on your browser. We use videos from YouTube and feeds from other websites. These websites may also place cookies on your device when watching or viewing these pages. Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over other websites. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.
- We may also collect information from other third party organisations in the following ways:
- You give your consent to us checking Government data systems (eg; your Individual Learner Record)
- The organisation or person has referred you to us because they think you would benefit from your services. If you have been mandated by your JobCentre Plus to us they do not need your consent but if you have not been mandated you should have been asked for your consent to send information to us.
- Go Train sometimes engages third party organisations to make contact with learners (for example to find out whether you have a job or are in learning, or to ask whether you would be interested in further learning with Go Train).
We only use what we need
- We only collect and use personal information if we need it to deliver a service or meet a requirement. If we do not need personal information we will either keep you anonymous if we already have it for something else or we will not ask you for it. For example, in a survey we may only need your name not your contact details.
- If we use your personal information for research and analysis, we’ll always keep you anonymous or use a different name unless you’ve agreed that your personal information can be used for that research.
- We do not sell your personal information to anyone else. We reserve the right to transfer your data if Go Train is sold, goes into a merger, liquidation or receivership or transfers all, or substantially all, of its assets to a new owner.
Sharing your information
- We may share your information with other organisations where those organisations:
- help Go Train deliver services to you (eg; email/text messaging platforms, mailing houses)
- are essential to you receiving services from us (eg; a qualification awarding organisation, National Careers Service)
- have referred you to Go Train (eg National Careers Service, JobCentre Plus, housing association etc) and are entitled to know about your progress, achievements and outcomes
- store personal information (eg; data management platforms and storage facilities)
- have funded Go Train (eg; government agency, FE College, local authority, housing association, National Careers Services provider etc)
- have legal right to the information (eg; Government, Ofsted, the Courts and other regulators)
- are Police, law enforcement, security services or safeguarding services. We may share your personal information when we feel there is a good reason that is more important than protecting your privacy. This does not happen often but we may share your information to find and stop crime and fraud, if there are serious risks to the public, our staff or to other professionals and to protect a child vulnerable adult. For all of these reasons the risk must be serious before we can override your right to privacy.
- If we are worried about your physical safety or feel we need to take action to protect you from being harmed in other ways, we will discuss this with you and, if possible, get your permission to tell others about your situation before doing so. We may still share your information if we believe the risk to others is serious enough to do so. There may also be rare occasions when the risk to others is so great that we need to share information straight away. If this is the case, we will make sure that we record what information we share and our reasons for doing so. We’ll let you know what we’ve done and why if we think it is safe to do so.
- Where we have these arrangements, there is always an agreement in in place to make sure that the organisation complies with data protection law. We will usually complete a data protection impact assessment (DPIA) before we share personal information to make sure we protect your privacy and comply with the law.
Storing your information
- Examples of our security include:
- Encryption, meaning that information is hidden so that it cannot be read without special knowledge (such as a password). This is done with a secret code or what’s called a ‘cypher’. The hidden information is said to then be ‘encrypted’
- Controlling access to systems and networks to stop people who are not allowed to view your personal information from getting access to it
- Training for our staff to make them aware of how to handle information and how and when to report when something goes wrong
- Testing of our technology and ways of working including keeping up to date on the latest security updates (commonly called patches)
You can find more details of our Information Security in our separate policy.
How long we store your information
- We will retain your personal information only for as long as we need it in order to fulfil the purposes for which we have initially collected it. Generally this is for a maximum of seven years from the end of July in the year (August to July) in which you last interacted with Go Train. We might retain your information for longer periods where Go Train is required to do so by law, contractual requirement, insurance requirement or relevance to any on-going or prospective legal proceedings.
- The law gives you a number of rights to control what personal information is used by us and how it is used by us.
- You can ask for access to the information we hold on you. This is called a Data Subject Access Request (DSAR). You have the right to ask for all the information we have about you and the services you receive from us. When we receive a request from you, we must give you access to everything we have recorded about you. However, we cannot let you see any parts of your record which contain:
- Confidential information about other people
- Information a professional advisor thinks will cause serious harm to your or someone else’s physical or mental wellbeing
- Information which we think may stop a crime being prevented or detected if we give it to you
This applies to personal information that is in both paper and electronic records. If you ask us for access to your information then we will ask you to provide evidence so that we can verify your identity. If you have any queries about access to your information please contact email@example.com
- You can ask to change information you think is inaccurate. You should let us know if you disagree with some information we hold about you. We may not always be able to change or remove that information but we will correct factual inaccuracies and may include your comments in the record to show that you disagree with it. If you ask us to change the information we hold about you then we will ask you to provide evidence so that we can verify your identity. The quickest way to inform us of any inaccuracies is to complete a form which we can provide to you or you can talk to a member of staff, contact firstname.lastname@example.org or write to us at Go Train, Sussex House, 21-25 Lower Stone Street, Maidstone, Kent ME15 6YT.
- You can ask to delete information (the right to be forgotten). In some circumstances you can ask for your personal information to be deleted, for example:
- where your personal information is no longer needed for the reason why it was collected in the first place
- where you have removed your consent for us to use your information and where there is no other legal reason for us to use it
- where there is no legal reason for the use of your information
- where deleting the information is a legal requirement
Where your personal information has been shared with others, we will do what we can to make sure those using your personal information also comply with your request for erasure. Please note that we cannot delete your information where:
- we are required to have it by law
- it is used for freedom of expression
- it is for, scientific or historical research, or statistical purposes where it would make information unusable
- it is necessary for legal claims
- You can ask to limit what we use your personal data for. You have the right to ask us to restrict what we use your personal information for where:
- you have identified inaccurate information, and have told us of it
- where we have no legal reason to use that information but you want us to restrict what we use it for rather than erase the information altogether
When information is restricted it cannot be used other than to store securely the data and with your consent; or, to handle legal claims and protect others, or where it’s for important public interests of the UK. Where restriction of use has been granted, we will inform you before we carry on using your personal information.
- You can withdraw your consent where consent was the reason we use your information. You have the right to ask us to stop using your personal information for any service we provide. You also have the right to unsubscribe from any materials we may send you. However, if you make a request this may cause delay or prevent us delivering services to you. Where possible we will seek to comply with your request, but we may need to hold or use information because we are required to by law or by contract.
- You can ask to have your information moved to another provider. You have the right to ask for your personal information to be given back to you or another service provider of your choice in a commonly used format. This is called data portability. However, this only applies if we are using your personal information with consent (not if we’re required to by law or contract).
- You can ask to have any ‘computer-made’ decisions explained to you or choose not to be the subject of a decision which is based on automated processing. You have the right to question decisions made about you by a computer, unless it is required for any contract you have entered into, required by law, or you have consented to it.
- You have the right to object if you are being ‘profiled’. Profiling is where decisions are made about you based on certain things in your personal information. Go Train uses personal information to create group profiles for teaching and learning; this is usual practice in education and helps our teaching staff ensure that all learning activities are appropriately tailored for each individual.
- If you have any worries or questions about how your personal information is handled by Go Train please contact email@example.com or write to Chief Operating Officer, Go Train, Sussex House, 21-25 Lower Stone Street, Maidstone, Kent ME15 6YT.
- We are here to help and would encourage you to contact us first to resolve your concerns. You may if you choose contact the Information Commissioner’s Office (ICO) at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or you can visit ico.org.uk.
Changes to our Privacy Statement
- Any changes we may make to this statement will be posted on our website go-train.co.uk so you are always aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. When we change this statement in a material way we will update the version number at the top of this page so you know you are looking at the most up to date statement.
- If at any time we decide to use personal data in a manner significantly different from that stated in this privacy statement, or otherwise disclosed to you at the time it was collected, we will notify you by email, and you will have a choice as to whether or not we use your information in the new manner.