Privacy Notice for Customers of Keystone Training Ltd.

Introduction

This document demonstrates our commitment to protecting the privacy and security of your personal information. It contains information regarding how we collect and use personal data or personal information about you in accordance with the General Data Protection Regulation (GDPR) and all other data protection legislation currently in force.

In line with that legislation, when processing data we will;

process it fairly, lawfully and in a clear, transparent way
collect your data only for reasons that we find proper for carrying out our business relationship with you
only use it in the way that we have told you about
ensure it is correct and up to date
keep your data for only as long as we need it
process it in a way that ensures it will not be lost or destroyed or used for anything that you are not aware of or have not consented to (as appropriate)

Keystone Training Ltd. is a “data controller”. This means that we are responsible for determining the purpose and means of processing personal data relating to you.

“Personal data”, or “personal information”, means any information that can be used to identify you, such as your name, phone number, passport number, home address or email address.

There are “special categories” of sensitive personal data, meaning data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health conditions, sex life or sexual orientation, genetic data, and biometric data which require a higher level of protection.

This privacy notice applies to current and former clients.

Details of information we will hold about you

The list below identifies the kind of data that we will hold about you:

business and/or personal contact details such as name, title, addresses, telephone numbers, email addresses
location of employment or workplace

Method of collection of personal information

Your business/personal information may be obtained through client referrals, website enquiry forms, business cards, social media platforms, networking events, exhibition attendance information and other third parties. Further information will be collected directly from you when you agree to enter into a business relationship with us for the purpose of researching, designing and delivering our training and development interventions with your organisation.

Personal data is kept in our CRM Salesforce database which is secure.

Processing information about you

We will only administer personal information in accordance with the lawful basis for processing. At least one of the following will apply when we process personal data:

consent: You have given clear consent for us to process your personal data for a specific purpose.
contract: The processing is necessary for a contract we have with you, or because we have asked you to take specific steps before entering into a contract.
legal obligation: The processing is necessary for us to comply with the law (not including contractual obligations).
vital interests: the processing is necessary to protect someone’s life.
public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.
legitimate interests: the processing is necessary for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect your personal data which overrides those legitimate interests.

Lawful basis for processing your personal information

We consider that the basis for which we will process your personal data is necessary for the performance of the contract we have with you and/or the legitimate interest of offering and delivering training and development solutions to your organisation.

The circumstances in which we will process your personal information are listed below.

To introduce Keystone Training Limited to you and the services we offer that may be of interest to you and your organisation.
To make contact by phone or email in order to follow up with you regarding the services we offer.
To respond to an enquiry you have made regarding our services.
To enter your details into our Client Relationship Database (Salesforce) to record all contact and next steps required.
To record and update in Salesforce, any changes to your details.
To add your details to our marketing list where you consent to receive future updates regarding the services we offer.
To follow up with you regarding any training and development contract we agree for the duration of that contract.
To review and evaluate the intervention and agree any follow up required.
To use any quotes and feedback for marketing purposes with your consent.

Automated decision-making

We do not anticipate that any of our decisions will occur without human involvement.

Sharing data

Your data will be shared with colleagues within Keystone where it is necessary for them to undertake their duties. This includes, for example, Business Development and Account Managers in the exploratory stage and Programme Managers, Operations and Finance functions for the purpose of managing the programme you have contracted us to deliver.

It may be necessary for us to share your personal data with a third party or third-party service provider (including, but not limited to, contractors, agents or other associated/group companies) within, or outside of, the European Union (EU). Data sharing may arise due to a legal obligation, as part of the performance of a contract or in situations where there is another legitimate interest (including a legitimate interest of a third party) to do so.

The list below identifies which activities are carried out by third parties on our behalf:

Associate consultants and facilitators
Awarding bodies and regulatory bodies such as ILM, the CMI), ESFA and Ofsted
Psychometric profiling organisations
Partners and providers of supplementary elements of our programmes such as online learning platforms

Data may be shared with third parties in the following circumstances:

in the process of regular reporting activities regarding our performance,
with regard to a business or group reorganisation, sale or restructure,
in relation to the maintenance, support and/or hosting of data
to adhere with a legal obligation
in the process of obtaining advice and help in order to adhere with legal obligations

If your data is shared, we expect third parties to adhere and comply with the GDPR and protect any data of yours that they process. We do not permit any third parties to process personal data for their own reasons. Where they process your data, it is for a specific purpose according to our instructions.

We will not be transferring your data to other countries.

Data security

As part of our commitment to protecting the security of any data we process, we have put the following measures in place:

A Data Protection Policy has been developed and communicated
Employees and third party stakeholders understand their responsibilities for the protection and security of personal data
Our systems and processes have all been checked for compliance and security

If you would like further details, please contact rendee.yule@keystonetrainingltd.co.uk.

In addition, we have put further security measures in place to avoid data from being accessed, damaged, interfered with, lost, stolen or compromised. In cases of a breach, or suspected breach, of data security you will be informed, as will any appropriate regulator, in accordance with our legal obligations.

Any data that is shared with third parties is restricted to those who have a business need, in accordance with our guidance and in accordance with the duty of confidentiality.

Data retention

We anticipate that we will retain your data as part of the process of developing the relationship and delivering an agreed contract for no longer than is necessary for the purpose for which it was collected.

We have given consideration to the following in order to decide the appropriate retention period:

quantity
nature
sensitivity
risk of harm
purpose for processing
legal obligations

At the end of the retention period, upon conclusion of any contract we may have with you, or until we are no longer legally required to retain it, it will be reviewed and that data.

Your rights in relation to your data

We commit to ensure that any data we process is correct and up to date. It is your obligation to make us aware of any changes to your personal information.
In some situations, you may have the;

Right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice.
Right to request access. You have the right to access the data that we hold on you. To do so, you should make a subject access request
Right to request correction. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it.
Right to request erasure. If you would like us to stop processing your data, you have the right to ask us to our systems where you believe there is no reason for us to continue processing it.
Right to object to the inclusion of any information. In situations where we are relying on a legitimate interest (or those of a third party) you have the right to object to the way we use your data where we are using it.
Right to request the restriction of processing. You have the right to ask us to stop the processing of data of your personal information. We will stop processing the data (whilst still holding it) until we have ensured that the data is correct.
Right to portability. You may transfer the data that we hold on you for your own purposes.
Right to request the transfer. You have the right to request the transfer of your personal information to another party.

Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. If you wish to exercise any of the rights explained above, please contact rendee.yule@keystonetrainingltd.co.uk.

Change of purpose for processing data

We commit to only process your personal information for the purposes for which it was collected, except where we reasonably consider that there is another reason for processing that is consistent with the original basis for processing. Should we need to process personal information for another reason, we will inform you of this and advise you of the lawful basis upon which we will process.

Questions or complaints

It is the responsibility of our Data Representative, Rendee Yule, to oversee compliance with this statement. Should you have any questions regarding this statement, or how we process your personal information, please contact rendee.yule@keystonetrainingltd.co.uk

The supervisory authority in the UK for data protection matters is the Information Commissioner (ICO). If you think your data protection rights have been breached in any way by us, you are able to make a complaint to the ICO.

Privacy Notice for Keystone Training Ltd. Learners

Introduction

In line with that legislation, when processing data we will;

process it fairly, lawfully and in a clear, transparent way
collect your data only for reasons that we find proper for carrying out our business relationship with you
only use it in the way that we have told you about
ensure it is correct and up to date
keep your data for only as long as we need it
process it in a way that ensures it will not be lost or destroyed or used for anything that you are not aware of or have not consented to (as appropriate)

Keystone Training Ltd. is a “data controller”. This means that we are responsible for determining the purpose and means of processing personal data relating to you.

“Personal data”, or “personal information”, means any information that can be used to identify you, such as your name, phone number, passport number, home address or email address.

This privacy notice applies to current and former learners.

Details of information we will hold about you

The list below identifies the kind of data that we will hold about you:

business and/or personal contact details such as name, title, addresses, telephone numbers, email addresses
location of employment or workplace
for accredited programmes, details of your prior learning, gender, date of birth, and personal data if required to carry out our quality assurance processes, investigations, complaints and appeals
in exceptional circumstances, we may collect sensitive personal data, such as information about your health, to enable us to determine whether reasonable adjustments are needed to ensure our content is accessible to you

Method of collection of personal information

Your business/personal information may be obtained from an authorised representative within your organisation who requested the training/development on your behalf, from an application you have completed to join one of our programmes or from a qualification registration form that you’ve completed. Further information may be collected directly from you by phone, email or otherwise in the course of delivering the training/development you are undertaking.

Processing information about you

We will only administer personal information in accordance with the lawful basis for processing. At least one of the following will apply when we process personal data:

consent: You have given clear consent for us to process your personal data for a specific purpose.
contract: The processing is necessary for a contract we have with you, or because we have asked you to take specific steps before entering into a contract.
legal obligation: The processing is necessary for us to comply with the law (not including contractual obligations).
vital interests: the processing is necessary to protect someone’s life.
public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.
legitimate interests: the processing is necessary for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect your personal data which overrides those legitimate interests.

Lawful basis for processing your personal information

We consider that the basis for which we will process your personal data is that it is necessary for the delivery of training/development that has been requested by your employer on your behalf.

The circumstances in which we will process your personal information are listed below.

To let the delivery team for the training/development event know who is attending
To send you Joining Instructions before you attend one of our training/development events
To send you a pre and post course questionnaires related to the event
To ask you for feedback on the training/development event
To use your feedback for analysis, evaluation and making improvements
To send a client report to the contact within your organisation who requested the training/development event.
To administer profiling and/or psychometric tools relating to the development event to help your personal understanding and learning. If these tools are being used for assessment or for making decisions then you will be asked for your consent before they are disclosed.
To register you for a qualification with relevant awarding bodies (e.g. ILM, CMI, the Apprenticeship Service, etc.) and upload your details into their systems as required for the completion of the qualification.
To enable our facilitators/coaches/support tutors/assessors to make contact with you in relation to your development.
To maintain our own accounts and records.
To review and evaluate the intervention and agree any follow up required.
To use any quotes and feedback for marketing purposes with your consent.

Automated decision-making

Any profiling tools or psychometric questionnaires used will be for the personal use of the data subject in relation to the training/development taking place. If the information is being used for decision making purposes, then consent will be sought before any information is shared.

Sharing data

Your data will be shared with colleagues within Keystone where it is necessary for them to undertake their duties. This includes, for example, programme managers, delivery associates and support tutors, as well as assessors, verifiers and awarding body representatives for accredited programmes, for the purpose of providing the development your employer has contracted us to deliver.

The list below identifies which activities are carried out by third parties on our behalf:

Associate consultants and facilitators
Awarding bodies and regulatory bodies such as ILM, the CMI), ESFA and Ofsted
Psychometric profiling organisations
Partners and providers of supplementary elements of our programmes such as online learning platform

Data may be shared with third parties in the following circumstances:

in the process of delivering the training/development event outcomes
in the process of regular reporting activities regarding our performance,
with regard to a business or group reorganisation, sale or restructure,
in relation to the maintenance, support and/or hosting of data
to adhere with a legal obligation
in the process of obtaining advice and help in order to adhere with legal obligations

Data security

As part of our commitment to protecting the security of any data we process, we have put the following measures in place:

A Data Protection Policy has been developed and communicated
Employees and third-party stakeholders understand their responsibilities for the protection and security of personal data
Our systems and processes have all been checked for compliance and security

If you would like further details, please contact rendee.yule@keystonetrainingltd.co.uk.

Any data that is shared with third parties is restricted to those who have a business need, in accordance with our guidance and in accordance with the duty of confidentiality.

Data retention

We anticipate that we will retain your data as part of the process of providing the training/development that has been contracted for no longer than is necessary for the purpose for which it was collected.

We have given consideration to the following in order to decide the appropriate retention period:

quantity
nature
sensitivity
risk of harm
purpose for processing
legal obligations

For non-accredited events and programmes, we will retain your data for a maximum of 6 years following the end of the event/programme. For accredited programmes we will retain your data as long as required by the respective awarding body as well as to enable us to provide information about your learning or obtain a replacement certificate on your behalf.

At the end of the retention period, your data will be reviewed and out further notice to you.

Your rights in relation to your data

We commit to ensure that any data we process is correct and up to date. It is your obligation to make us aware of any changes to your personal information.

In some situations, you may have the;

Right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice.
Right to request access. You have the right to access the data that we hold on you. To do so, you should make a subject access request
Right to request correction. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it.
Right to request erasure. If you would like us to stop processing your data, you have the right to ask us to our systems where you believe there is no reason for us to continue processing it.
Right to object to the inclusion of any information. In situations where we are relying on a legitimate interest (or those of a third party) you have the right to object to the way we use your data where we are using it.
Right to request the restriction of processing. You have the right to ask us to stop the processing of data of your personal information. We will stop processing the data (whilst still holding it) until we have ensured that the data is correct.
Right to portability. You may transfer the data that we hold on you for your own purposes.
Right to request the transfer. You have the right to request the transfer of your personal information to another party.

Change of purpose for processing data

Questions or complaints

The supervisory authority in the UK for data protection matters is the Information Commissioner’s Office (ICO). If you think your data protection rights have been breached in any way by us, you are able to make a complaint to the ICO.