Privacy Policy

General Data Protection Regulation Policy 2018

1.0 - Context and Overview
2.0 - Personal Data Held and Reasons for Processing
3.0 - Data Collection and Storage
4.0 - Sharing of Data
5.0 - Accuracy of Data
6.0 - Data Security and Data Breaches
7.0 - Disclosing Data for other reasons
8.0 - Providing Information
9.0 - Right to be Forgotten
10.0 - Deleting Data
APPENDIX A

A PDF Document of this policy can be downloaded here.

1.0 - Context and Overview

Key Details

Policy prepared by: Graham Amery
Approved by Board 01/10/2018
Policy became operational on 01/10/2018
Next review date 30/09/2019

Introduction

For Construction Training Assessments Limited to provide training, assessments and qualifications to its customers and clients, promote its services, maintain its own accounts and records and support and manage its employees and subcontractors, it gathers and uses certain information about individuals and companies directly and legitimately associated to Construction Training Assessments business.

CONSTRUCTION TRAINING ASSESSMENTS is registered as a Data Controller (no.ZA327005) with the Information Commissioners Office (ICO) refer to Appendix A for contact details.

2.0 - Personal Data Held and Reasons for Processing

In order to conduct its business, Construction Training Assessments is required to hold electronic data to:

Accurately contact individuals responsible for arranging training for their workforce on their
Allow for delivery of training to those individuals who have been nominated by their employer to complete a course or those individuals who have arranged their own
Produce a certificate for an individual who has attended a course or pass the information on to the recognised accrediting body who produce the individuals certificate, for example CPCS or
Produce ‘training reports’ when requested by a company who require visibility of their workforce training completions- this will include details of their employees who have been on courses arranged by CONSTRUCTION TRAINING ASSESSMENTS.
Share the individual’s details with the appropriate accrediting body for the type of training undertaken.
Share the individual’s details with CONSTRUCTION TRAINING ASSESSMENTS instructors and approved sub-contractor providers who are responsible for ensuring the right individuals receive scheduled
Process sales invoices to companies or individuals for services or training materials provided by CONSTRUCTION TRAINING ASSESSMENTS.
Process purchase invoices for services or materials provided to CONSTRUCTION TRAINING ASSESSMENTS.

CONSTRUCTION TRAINING ASSESSMENTS holds electronic data on individuals in the CRM (Customer Relationship Management) system, accounting package (Xero), Office 365 and within the file structure on the server.

CONSTRUCTION TRAINING ASSESSMENTS records and stores data on paper forms required to:

Carry out its business service - to test individuals who attend training
To produce a certificate for an individual who has attended a
To maintain a record of the individuals’
To share proof of training with the relevant accrediting bodies to allow them to produce a certificate of training in line with their

CRM:

The information held on CONSTRUCTION TRAINING ASSESSMENTS' CRM includes the collection and storage of:

The company and company contacts with whom the CONSTRUCTION TRAINING ASSESSMENTS Sales Teams and other departments
The individual contacts, employed by these companies, who attend a training
Individuals who have booked to attend a training course with CONSTRUCTION TRAINING ASSESSMENTS
Associate instructors and approved subcontractor providers who carry out work on behalf of CONSTRUCTION TRAINING ASSESSMENTS

3.0 - Data Collection and Storage

Data held on the CRM system includes;

Company contacts
The company whom CONSTRUCTION TRAINING ASSESSMENTS have been requested to deliver training on the behalf of
Training contact’s forename and surname
Job title and role within the company
Contact’s phone numbers
Contact’s company email address
Company address
Opt in / opt out of which type of marketing communications
Individual’s data
Company whom the individual is employed by
Name
Employee Number
National Insurance Number*
CSCS/CPCS Number*
Date of birth
Course dates
Course details
Site Address
Individual’s address - only in the instance that this has been a direct booking or a qualification that is sent to the individual’s house

*National Insurance numbers/CSCS/CPCS Numbers are mandated as unique identifiers by some of the accrediting bodies with whom CONSTRUCTION TRAINING ASSESSMENTS is approved.

Individuals’ data is collected through the completion of forms known as test sheets, registration forms and course evaluation forms. These forms are completed by the individual on the course and by a sub-contracted instructor who is authorised as a sub-processor by CONSTRUCTION TRAINING ASSESSMENTS.

The forms include a statement explaining why the data is being collected and with whom CONSTRUCTION TRAINING ASSESSMENTS share it.

Data collected is used to create a certificate for the individual (delegate) which is then either sent via standard postage or recorded delivery to the contact at the individual’s workplace or a central contact, dependent upon the terms agreed in the contract between the company and CONSTRUCTION TRAINING ASSESSMENTS. In some instances, certification is produced in an electronic format and saved on to a shared filing system that is accessed by the training department of the customer that arranged the training with CONSTRUCTION TRAINING ASSESSMENTS.

Tracking online activity

CONSTRUCTION TRAINING ASSESSMENTS track activity on their website and engagement with their online marketing via cookies and marketing analysis tools, for example, Google Analytics. Data retention controls are in place to periodically remove user data over time.

4.0 - Sharing of Data

CONSTRUCTION TRAINING ASSESSMENTS only share data with those who legitimately require the information to complete the purchase contact with the individual themselves or their employer. Training companies are required to share data of individuals who have been trained with the appropriate accrediting body. Individuals' data is shared to the following people / organisations:

With the company that ordered the training in the form of a certificate and / or This information will only include:
- Name
- Employee number
- Company name
- Equipment and course title
- Dates of training
- Name and registration number of the Instructor / Examiner that carried out the training / testing

The individual’s data is shared with the appropriate accrediting body as required by Health and Safety Law. This will include:

Name
Date of birth
National Insurance Number*
CPCS/CSCS No*
Home address*
Course start date
Course end date
Length of course
Duration of course
Test date
Instructor / Examiner name and registration number
Course type
Photographic Evidence

*National Insurance numbers and home address may be mandated as unique identifiers by some of the accrediting bodies with whom CONSTRUCTION TRAINING ASSESSMENTS is approved.

Some individual’s and company data is shared with the approved trainer/assessor as required to deliver the This will include:
- Company name and address
- Site contact name
- Delegate name
- Delegate employee number
- Course start date
- Course end date
- Length of course
- Duration of course
- Course type

All of the data that CONSTRUCTION TRAINING ASSESSMENTS holds on individuals who have done courses is classed as low risk and does not include financial records for these individuals.

5.0 - Accuracy of Data

Collection of new contacts and accuracy of data

CONSTRUCTION TRAINING ASSESSMENTS endeavour to accurately collect the data it needs and provide clear and transparent justification for doing so, referenced at the point of collection, including a privacy policy that is accessible via the website or the App (once developed).

New contacts and sales leads must be constantly brought in to the company to ensure survival and growth. Although this is not an exhaustive list, CONSTRUCTION TRAINING ASSESSMENTS aim to bring in new contacts through the following ways:

Website
Visits
Leads across company groups
Leads through trade union groups
Marketing – online and trade magazines
Trade shows

CONSTRUCTION TRAINING ASSESSMENTS will only market to/contact companies where we believe content will be of legitimate interest to the company/individual but will always provide them with the opportunity to opt out via links contained in every email. CONSTRUCTION TRAINING ASSESSMENTS does not use purchased leads to build up its contact database.

6.0 - Data Security and Data Breaches

CONSTRUCTION TRAINING ASSESSMENTS protects itself to the best of its ability against data breaches through staff training and by keeping its IT systems up to date with the latest anti-virus, ransomware and firewall protection and by complying with the latest best practice for data storage and protection. CONSTRUCTION TRAINING ASSESSMENTS' website is tested against hackers ensuring that there is no ‘backdoor’ entry to gain access to the IT system and individuals’ data.

If CONSTRUCTION TRAINING ASSESSMENTS do suffer a personal data breach, the Data Protection Leader will notify the ICO and the affected parties within 72 hours of the breach. CONSTRUCTION TRAINING ASSESSMENTS consider a breach to be an occurrence involving a loss of data which presents a risk to the rights and freedom of any individuals involved and could result in:

Discrimination
Damage to reputation
Financial loss
Loss of confidentiality
Any other significant economic or social

7.0 - Disclosing Data for other reasons

In certain circumstances, GDPR allows personal data to be disclosed to law enforcement agencies without the consent of the data subject. Under these circumstances, CONSTRUCTION TRAINING ASSESSMENTS will disclose the requested data. However, the data controller will ensure the request is legitimate, seeking assistance from the board and from the company’s legal advisers where necessary.

8.0 - Providing Information

CONSTRUCTION TRAINING ASSESSMENTS aims to ensure that individuals are aware that their data is being processed and that they understand:

How the data is being
How to exercise their

To these ends, the company has a privacy statement setting out how data relating to individuals is used by the company- this is available on request. A version of this statement is also available on the company’s website.

9.0 - Right to be Forgotten

Due to the nature of the industry in which CONSTRUCTION TRAINING ASSESSMENTS operates, we believe in the Right to be Forgotten;

Attendees of a course: if an individual employed by a company requests the right to be forgotten, CONSTRUCTION TRAINING ASSESSMENTS will first check with the company to ensure that they approve of this data removal from their training records. Once approved, the data can be removed from the
CRM Contact: if a contact no longer wishes to be contacted then we can remove that individual’s data from the If we have provided training for their company then we cannot delete their company record from our CRM as individual training records will be associated to it.
Tracked online activity: anyone who would like records of their online activity removed can request to do so by emailing the Data

10.0 - Deleting Data

If a contract ends between CONSTRUCTION TRAINING ASSESSMENTS and the customer, CONSTRUCTION TRAINING ASSESSMENTS can provide all the personal data that they hold about the customer and the individuals within the organisation, if requested.

CONSTRUCTION TRAINING ASSESSMENTS will not delete the associated training records as this data may be requested as evidence of training if for example, an individual has an accident.

Personal data for people who have attended one of our courses must be stored and recorded to meet standards set by the Health and Safety The industry standard for keeping this data is a minimum of 7 years. After 7 years all paper copies of the personal data collected will be shredded on-site by an approved secure shredding company. Electronic data is stored back to 2007. Our customers use this data to prove compliance to the standards set by the accrediting bodies, legislation and HSE guidance.

APPENDIX A