Policy
Data protection
We need to keep certain information about learners, employers and our team to deliver apprenticeships, meet our legal and funding duties, and keep people safe. This policy sets out how we collect, use, store and protect that information, in line with UK data protection law.
At a glance
- Used fairly and lawfully, only for the reason it was collected.
- Kept secure, with encryption, multi-factor authentication and regular training.
- Never released without permission or a lawful reason.
- Your right to see it, free of charge, within one month.
- Breaches taken seriously, logged, investigated and reported where required.
Our principles
Personal data must be:
- Processed lawfully, fairly and transparently
- Collected for specific, explicit and legitimate purposes, and not used for anything incompatible with them
- Adequate, relevant and limited to what's necessary
- Accurate and kept up to date
- Kept no longer than necessary
- Kept secure against unauthorised use, loss or damage
We're responsible for, and must be able to show, that we follow these principles. We're registered with the Information Commissioner's Office.
What you're entitled to know
Everyone whose data we hold is entitled to know what information we hold and why, how long we keep it, how to see it, who we share it with, how to keep it up to date, and what we're doing to comply with the law. Our privacy notice sets this out, and we include it in enrolment and recruitment documents.
How we keep data secure
- Paper records are kept in locked storage, archived securely and shredded by a certified confidential waste service.
- Electronic records are kept in approved systems, not on local devices unless necessary.
- Laptops use full disk encryption, and portable storage must be encrypted.
- Phones and tablets are protected by a PIN, and can be wiped remotely if lost or stolen.
- Multi-factor authentication protects all our systems.
- Regular training helps our team spot phishing and handle data safely, and our IT systems are audited regularly.
Any data breach, or loss of a device holding our data, is reported immediately, logged and investigated. Where required, we report breaches to the Information Commissioner's Office within 72 hours.
Responsibilities
Our team must handle personal data fairly and lawfully, keep it secure, never disclose it to anyone unauthorised, and complete data protection training. Unauthorised disclosure, or failing to secure data, is a disciplinary matter.
Learners should make sure the information they give us is accurate, and tell their Coach Mentor about any changes, such as a new address or emergency contact.
Seeing your data
You can ask to see the personal data we hold about you by making a subject access request to data@traintogetherltd.co.uk, or to any member of our team, who'll pass it on. There's no charge, unless a request is clearly unfounded or excessive. We aim to respond within one month, and will explain in writing if we need longer. A request made on someone else's behalf, including for a learner under 18, needs that person's consent.
You can also ask us to correct or delete your data, or object to how it's used, by emailing data@traintogetherltd.co.uk.
Sharing, consent and sensitive information
- Third parties. When anyone, including a parent, asks for someone's data, we verify who they are and check that sharing would be fair and lawful.
- Consent. Some processing needs your consent, and you can withdraw it in writing at any time.
- Sensitive information. We sometimes need information about health, criminal convictions or other special category data, for example to keep people safe or meet our legal duties. We handle it with extra care.
- New systems. We assess the data protection risks of any new form or system before we use it.
- Assessment results. Learners can ask for their marks, though some results are released by awarding organisations.
Keeping and disposing of data
We keep information only as long as we need to, in line with Department for Education requirements and our records retention schedule, then dispose of it securely.
Questions and complaints
Contact our data protection team at data@traintogetherltd.co.uk, call 0116 235 8000, or write to the Data Protection Officer, Train Together Ltd, 3 Gilmour Close, Leicester LE4 1EZ. If you're not satisfied with our response, you can contact the Information Commissioner's Office.
Related policies: Privacy notice · Cookie notice