Please read this notice carefully and make sure that you understand your rights and responsibilities. From time to time, as our organisation evolves and develops we may update and make changes to this privacy notice.

Last revised date: 20/02/2020

Automated individual decision-making is making a decision solely by automated means without any human involvement.

Data controller means a company or person who determines the purposes for which, and the manner in which personal data is processed.  In this context this relates to PM Training as an organisation.

Data subject means an individual who is the subject of personal data.

Data processor, in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller.

Data Protection Officer is the person responsible for overseeing Data Protection within the organisation.

Information Commissioners Office (ICO), The Information Commissioner’s Office in the United Kingdom, is a non-departmental public body which reports directly to Parliament. They are responsible for implementing data protection law and carrying out enforcement actions.

Lawful Grounds for processing data – Conditions that must apply for organisations to lawfully process personal data.

Personal data means  means any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

Processing means obtaining, recording or holding information or data or carrying out any operation or set of operations on that data.

Profiling is automated processing of personal data to evaluate certain things about an individual.

Office for Standards in Education, Children’s Services and Skills (OFSTED) inspect and regulate services that care for children and young people, and services providing education and skills for learners of all ages.

Education and Skills Funding Agency (ESFA) is the agency accountable for funding education and skills for children, young people and adults.

European Social Fund (ESF) – The ESF is the European Union’s main financial instrument for supporting employment in the member states of the European Union as well as promoting economic and social cohesion.

Sensitive personal data (also referred to as “special categories of personal data” under GDPR) means personal data relating to the data subject which includes information such as:  race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life, or sexual orientation.

PROJECT MANAGEMENT (STAFFORDSHIRE) LIMITED [trading as PM Training] is registered as a Data Controller with the Information Commissioner (registration number Z4679304).

PM Training is a leading training provider and social enterprise. We are experts in preparing young people for work, supporting adults into employment, creating practical apprenticeships, helping organisations to up-skill their workforces and enabling local areas to thrive.

PM Training is a company limited by guarantee and registered in England and Wales with registration number 1620339. Our Registered Office is Aspire Housing, Kingsley, The Brampton, Newcastle-under-Lyme, ST5 0QW Telephone: 01782 635200

ASPIRE HOUSING LIMITED is the parent company of PROJECT MANAGEMENT (STAFFORDSHIRE) LIMITED, and REALISE FOUNDATION [trading as Realise charity]. Each of these organisations have their own individual privacy notices that can be found on their web sites.

How we collect personal information

We collect information in a variety of ways including, cookies using this website (see more information below); on various forms, learner and apprentice applications, and contracts; through our on- going contact with you; in some cases we collect CCTV images; and calls to and from our telephone lines and online chats are recorded.

When you apply to become learner or apprentice, we request and hold on file any references necessary to assess your application including as appropriate (but not limited to) references from other organisations, schools, colleges, the Employment and Skills Funding Agency (ESFA) the Police, local authorities, the Probation Service, support workers, social workers and mental health workers.

It is important that you notify us of any changes to your personal information.

The information we collect

We collect personal information about:

Learners – This includes current, former and potential learners and apprentices, who access our support and other services. It may also include the parents and guardians of learners and apprentices (when you provide information about parents or guardians we assume that you do so with their full knowledge and consent).

Contacts within partner organisations – This includes contacts at the partner organisations where our apprentices are placed.

Client contacts – This includes contacts within organisations or individuals who may have a service contract with PM Training.

Colleagues – This includes current, former and potential colleagues, as well as Board and Committee members, apprentices and volunteers.

Anyone who makes a complaint or enquiry and visitors to our website and offices

Whenever we collect personal information from you we will always issue you with a privacy notice at the point of collection explaining why we are collecting that personal data.

We will collect, process, share and securely store personal information in order to operate as a training provider and deliver efficient and effective services.

All information will be retained in accordance with the requirements of our retention schedule.

Below we will describe the different lawful basis for processing personal (Section 4.1) and special categories of personal data (section 4.2). We will then describe the purposes and lawful basis under which PM Training processes data (section 4.3).

Under GDPR the lawful grounds for processing are set out in Article 6. At least one of these conditions must apply before PM Training can process your personal data. The lawful conditions are as follows:

(a) Consent: Where the data subject has given clear consent for PM Training to process their personal data for a specific purpose. Where the processing is based on consent a data subject can withdraw that consent at any time.

(b) Contract: the processing is necessary for a contract PM Training has with a data subject, or because the data subject has asked PM Training to take specific steps before entering into a contract. You will note that we need to process personal data as part of the learner agreement between you and PM Training.

(c) Legal obligation: the processing is necessary for us to comply with the law. Training providers are regulated by OFSTED. We also have to comply with UK law.

(d) Vital interests: the processing is necessary to protect someone’s life.

(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

Special categories or “sensitive personal data” specifically includes data with regard to race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life, or sexual orientation.

We must still have a lawful condition for processing sensitive personal data, in exactly the same way as for any other personal data. The difference is that we will also need to satisfy a specific condition under Article 9. There are a number of conditions at article 9 but for PM Training typically these are:

(a) Explicit Consent: the data subject has given explicit consent.

(b) Employment, social security and social protection law  – Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.

(c) Vital interests – Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.

(h) Preventative or occupational medicine – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards.

To find out more about the legal basis for processing personal data please visit the Information Commissioners Office (ICO) website: https://ico.org.uk/

The purposes and legal basis for processing data under the GDPR are detailed in the tables below. This has been grouped into personal data about:

  • Learners
  • Contacts within partner organisations
  • Client contacts
  • Colleagues
  • Other individuals who may make a complaint or enquiry

 

Learners
Purpose of collecting data Lawful condition to process data
Contact our learners without delay We have a legitimate interest to be able to contact our learners, parents and guardians without delay in an emergency or to assist learners in successfully completing their course.
Award placements for learners and apprentices on the courses we provide As part of your learner agreement with PM Training we will ask you to provide us with information to prove your eligibility and suitability for the courses we provide. We collect that information as a legal obligation and also as part of your learner agreement between you and PM Training.

 

 

We will ask you to provide us with information about criminal convictions. The purpose of collecting this information is to identify any risks, and safeguard our other learners and staff at PM Training and our partnership organisations. Where we ask for this information it will be in compliance with schedule 1 of the Data Protection Bill.

 

We will also ask you about your health in order to help with the allocation of suitable services that PM Training provide. Where we collect data concerning health (classed as special category data) we will only process that data based on your consent, and you have the right to remove that consent at any time.

 

We have a legitimate interest to contact third parties and check the validity of any information provided by applicants.

 

All application information is sent to the ESFA so that they can approve the funding of your course. We have a legitimate interest to send them this information and obtain funding.
Manage learners progression As part of your learner agreement with PM Training we will ask you to continue to provide us with information and changes in your circumstances to assist us in managing your learner progression.

 

 

We also have a legitimate interest in holding information such as date of birth for the purpose of verifying we are speaking to the correct person in relation to a learners record. If we did not take due diligence in verifying the identity of callers then we would not have appropriate measures to prevent unlawful access to personal data.

 

We have a legitimate interest to keep information up to date in order to tailor our services to meet your individual needs and assist you in successfully progressing as a learner.
Verify attendance and completion of the course We also have a legitimate interest to take photographs of learners to verify identity. We have a legitimate interest to use CCTV for learner registration and testing to verify that learners have completed the course and not used an alias.

 

 

We have a legitimate interest to verify attendance of our learners. PM Training use biometic fingerprint technology to uniquely identify learner attendance. Biometic fingerprints are taken with the consent of the learner and the learner can withdraw that consent at any time.
Monitor and report on learner progress All of our courses include tests and assessments to understand how a learner is progressing. We have a legitimate interest to be able to monitor learners progress and to ensure that they successfully complete their courses.

 

 

We also have a legitimate interest to address any concerns over performance and ensure learners continue to successfully complete their courses.

 

PM Training is regulated by OFSTED and accountable to the ESFA who fund apprenticeships and training. We also deliver training programs funded through the ESF. PM Training is obligated to report information about a learners progression with these organisations.

 

In order for learners to be awarded a qualification evidence of a learners work is required to be submitted to the assessors of an Awarding Body. Without this evidence an Awarding Body will not award a qualification. We have a legitimate interest to share this information and ensure that learners positively progress to successfully complete their courses.

 

It is compulsory for children to stay in education up to the age of 18 years old and we have a legitimate interest to share information on a learners performance and behaviour with parents and guardians in order to assist with a learners progression.

 

We also have a legitimate interest to share performance and behaviour information with partner organisations in order to assist with a learners progression.
Provide appropriate pastoral care The Education Act 2002 puts a duty on schools to exercise their functions with a view to safeguarding and promoting the welfare of children. The compulsory age of schooling is up to the age of 18 years old.

 

 

We have a legitimate interest to ask if you would like to be referred to other organisations who may support you in your development. In this situation we will only pass on your personal information with your consent. You may remove your consent to this at any time.

 

We have a legal obligation to safeguard young people and refer you on to the relevant services if we believe it to be an issue. It is also in the public interest to address concerns over safeguarding.
Engage with learner and make improvements to our products and services We have a legitimate interest to contact you and find out how we can improve our service through our market research surveys.

 

 

We also have a legitimate interest in making our products and services the best that they can be and promote the success of our organisation.
Marketing to encourage uptake of our services We have a legitimate interest to send you information about services that may assist you in completing your course and continuing to find employment.

 

 

You may ask us to remove you from our email alert lists at any time by unsubscribing within your customer account, or by clicking on any ‘unsubscribe’ link from one of our communications. You can also request to opt out by contacting your case worker.

 

In the event of us using case studies or photographs of some of our success stories, we will always get the consent of the individuals featured in those photographs or case studies before sharing with other organisations or making public.
Record contact with learners We have a legitimate interest to record telephone calls for training purposes.

 

 

We have a legitimate interest to record contact made through online contact forms, social media, email and other methods of contact. We may use this information to monitor the progress of enquiries and keep records of actions and decisions made throughout a learners course.
Ensure compliance with policies and procedures We have a legitimate interest in ensuring that the policies and procedures which we implement for the benefit of the organisation are followed and that breach of them is addressed appropriately

 

 

We have a legitimate interest to keep system logs of learners who use our IT systems to ensure they are used for the purposes that they are intended.

 

We also have a legitimate interest to keep records of IT issues to help find resolutions to problems and maintain effective systems.

 

 

Contacts within partner organisations
Purpose of collecting data Legal basis to process data
Contacting partner organisations to monitor the progress of learners We have a legitimate interest to have the personal details of managers of apprentices so that we can easily get in contact. We will need to monitor the progress of learners and arrange meetings to discuss progress or anything else to facilitate the progression of a learner.
Record contact with partner organisations We have a legitimate interest to record telephone calls for training purposes.

 

 

We have a legitimate interest to record contact made through online contact forms, social media, email and other methods of contact. We may use this information to monitor the progress of contact and keep records of actions and decisions made throughout your relationship with us.
Register contact details of partner organisations OFSTED and the ESFA require us to register the details of contacts at partner organisations.

 

 

We have a legal obligation to register information with HMRC as part of the apprenticeship levy.
Marketing to encourage uptake of further apprenticeships or services We have a legitimate interest to send partners information that may encourage the uptake of further apprenticeships, and that may assist a learner in successfully completing their course.

 

 

You may ask us to remove you from our email alert lists at any time by unsubscribing within your customer account, or by clicking on any ‘unsubscribe’ link from one of our communications. You can also request to opt out by contacting our partnerships services team.

 

In the event of us using case studies or photographs of some of our success stories, we will always get the consent of the individuals featured in those photographs or case studies before sharing with other organisations or making public.

 

 

 

Client contacts
Purpose of collecting data Legal basis to process data
Contacting client organisations We have a legitimate interest to hold the personal details of our clients so that we can contact you over the service we are providing.
Managing contracts and services with clients We have a legitimate interest to hold the personal details of our clients so that we can continue to provide our service.

 

 

We have a legitimate interest to keep information up to date to assist us in managing our contracts or services with you or your organisation.
Process payments from clients We have a legal obligation to keep records of payments from clients and a legitimate interest to process bank details to obtain payment for our services.
Record contact with clients We have a legitimate interest to record telephone calls for training purposes.

 

 

We have a legitimate interest to record contact made through online contact forms, social media, email and other methods of contact. We may use this information to monitor the progress of contact and keep records of actions and decisions made throughout your relationship with us.
Engage with clients and make improvements to our products and services We have a legitimate interest to contact you and find out how we can improve our service through our market research surveys.

 

 

We also have a legitimate interest in making our products and services the best that they can be and promote the success of our organisation.
Marketing to encourage uptake of further services We have a legitimate interest to send clients further information on our services.

 

 

You may ask us to remove you from our email alert lists at any time by unsubscribing within your customer account, or by clicking on any ‘unsubscribe’ link from one of our communications. You can also request to opt out by contacting our contract services team.

 

In the event of us using case studies or photographs of some of our success stories, we will always get the consent of the individuals featured in those photographs or case studies before sharing with other organisations or making public.

 

 

Colleagues
Purpose of collecting data Legal basis to process data
Keep and maintain up to date information about Directors to maintain statutory registers We have a legal obligation to maintain statutory registers.
Maintain personnel files for all staff We have a legal obligation to maintain certain records in relation to employees and a legitimate interest in keeping personnel files for all staff (namely as a record of the employment relationship).

 

 

This will include details of any training or other qualifications that may be required to be refreshed and updated after a certain amount of time.

 

For some job roles we may carry out regular Disclosure and Barring Service (DBS) checks where we have a legal obligation to safeguard our customers under the Safeguarding Vulnerable Groups Act 2006

as amended by the Protection of Freedoms Act 2012.

 

We have a legal obligation to ensure that all staff have the right to work in the UK under the Immigration, Asylum and Nationality Act 2006.
Giving or receiving of employee references Where we receive employee references, it is because we have a legitimate interest in verifying your employment history and in order to assess your suitability for employment with us.
Process salary and expense payments We have a legal obligation to keep records of expenses and salary payments. We need to process staff members bank details in order to pay salaries and expenses in accordance with the contract of employment.
Process pensions and other benefits We have a legal obligation to keep records of pensions and any other benefits that a staff member may be receiving.
Maintain records of sickness and absence We need to understand whether we should be paying sick pay.  We have a legal obligation to pay statutory sick pay where an individual is entitled to, and it is necessary for the purposes of the contract of employment to assess entitlement to occupational sick pay.

 

 

We have a legitimate interest to keep levels of absence to a minimum.
Ensure staff are healthy and fit for work PM Training have a legal obligation to ensure that staff and apprentices are fit to work and/or remain in work. Typically this would involve a referral to an occupational health specialist to understand what support we can put in place, including a phased return to work and/or any reasonable adjustments and this report then being shared with PM Training.  Processing of this information is necessary for the purposes of assessing the working capacity of an employee and/or to obtain a medical diagnosis.
Ensure staff are compliant with relevant laws PM Training have a legal obligation to ensure that staff are operating within the law and any qualifications or licences required to carry out their roles are kept up to date (e.g. driving licence).
Maintain a register of accidents PM Training have a legal obligation to keep a record of accidents that occur within the organisation. This information may be used to understand patterns of behaviour and avoid future accidents. It may also be used to assist with the processing of future insurance claims.
Promote equal opportunities and fair treatment for all colleagues We have a legal obligation to treat people fairly under the Equality Act 2010.

 

 

In order to do this PM Training hold information on age, disability, gender, marriage and civil partnership, pregnancy and maternity, race, religion and belief and sexual orientation to ensure people are treated fairly and equally.
Manage employment and colleague development PM Training have a legitimate interest to use information to develop staff and apprentices to realise their potential and maximise their contributions to the organisation.

 

 

Staff and apprentices are encouraged to talk about their development needs in one-to-one meetings with their line managers.
Ensure compliance with policies and procedures and employee rules We have a legitimate interest in ensuring that the policies and procedures which we implement for the benefit of the organisation are followed and that breach of them is addressed appropriately
Ensure effectiveness of systems and  compliance with user policies We have a legitimate interest to keep system logs of users to ensure compliance with the information Security and Systems usage policy.

 

 

We also have a legitimate interest to keep records of IT issues to help find resolutions to problems and maintain effective systems.
Record contact with PM Training We have a legitimate interest to record telephone calls for training purposes.

 

 

We have a legitimate interest to record contact made through online contact forms, social media, email and other methods of contact. We may use this information to monitor the progress of enquiries and keep records of actions and decisions made.

 

 

 

Other individuals who may make a complaint or enquiry
Purpose of collecting data Legal basis to process data
Processing of job applications Data received within job applications is processed on the basis of consent. An individual can withdraw that consent at any time.

 

 

For some job roles we may carry out regular Disclosure and Barring Service (DBS) checks where we have a legal obligation to safeguard our customers under the Safeguarding Vulnerable Groups Act 2006

as amended by the Protection of Freedoms Act 2012. It is also in our legitimate interests.

 

Where we receive employee references, it is because we have a legitimate interest in verifying your employment history and in order to assess your suitability for employment with us.

 

We have a legitimate interest to contact third parties and check the validity of any information provided during the recruitment process.

 

Failure to provide personal data

A failure to provide personal data may result in us being unable to assess the suitability of the candidate for the role.
Processing of complaints It is our legitimate interest to process complaints data and understand how we can improve our services.
Keep staff and premises secure PM Training have a legitimate interest to keep premises, staff and learners and visitors safe and secure with the use of CCTV.
Process applications for the courses we provide We will ask you to provide us with information to prove your eligibility and suitability for the courses we provide. We collect that information as a legal obligation and also as part of your learner agreement between you and PM Training.

 

 

We will ask you to provide us with information about criminal convictions. The purpose of collecting this information is to identify any risks, and safeguard our other learners and staff at PM Training and our partnership organisations. Where we ask for this information it will be in compliance with schedule 1 of the Data Protection Bill.

 

We will also ask you about your health in order to help with the allocation of suitable services that PM Training provide. Where we collect data concerning health (classed as special category data) we will only process that data based on your consent, and you have the right to remove that consent at any time.

 

We have a legitimate interest to contact third parties and check the validity of any information provided by applicants.

 

All application information is sent to the ESFA so that they can approve the funding of your course. We have a legitimate interest to send them this information and obtain funding.
Contact suppliers, contractors, and maintain relationships with any other external organisations It is our legitimate interest to hold contact details of individuals from the organisations we work in order for us to carry out our work as a training organisation.
Record contact with enquirers We have a legitimate interest to record telephone calls for training purposes.

 

 

We have a legitimate interest to record contact made through online contact forms, social media, email and other methods of contact. We may use this information to monitor the progress of enquiries and keep records of actions and decisions made off the back of an enquiry.

 

Automated decision making and profiling

The GDPR has provisions on:

  • Automated individual decision-making (making a decision solely by automated means without any human involvement).
  • Profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.

 

PM Training may use automated decision making and profiling for recruitment and selection purposes.

 

PM Training use automated decision making and profiling to assist in matching learners to apprenticeship vacancies.

PM Training is committed to respecting and protecting your personal data. In certain circumstances we may need to share your personal data with other organisations. When we share personal data to complete a task we will only share the minimum personal data required to complete that task. We will never sell, rent or trade your personal data.

 

We will also pass your information on to third parties whom you may ask us to, for example if you ask us to put you in contact with professional advisors.

 

Who we share data with

We may share your data with the following organisations.

  • Auditors
  • Business associates and professional advisers
  • Charities and voluntary organisations
  • Courts and tribunals
  • Credit reference agencies
  • Current, past or prospective employers
  • Customers and clients
  • Data processors
  • Debt collection and tracing agencies
  • Educators and examining bodies
  • Employees
  • Employee benefit providers
  • Employment and recruitment agencies
  • Enquirers and complainants
  • ESF
  • ESFA
  • Family, associates and representatives of the person whose personal data we are processing
  • Financial organisations
  • Health Authorities
  • Healthcare, social and welfare organisations
  • Local and central government
  • OFSTED
  • Other companies in the same group as the data controller (Aspire Housing, The Realise Foundation)
  • Other voluntary and charitable organisations
  • Pension fund providers
  • Police forces
  • Press and the media
  • Probation services
  • Professional advisers and consultants
  • Providers of goods and services
  • Security organisations
  • Suppliers and service providers
  • Survey and research organisations
  • Trade unions and associations
  • Trade, employer associations and professional bodies

Under the GDPR you have the following main rights:

  1. The right to be informed about how and why we gather your personal information, how we keep it and what we do with it.
  2. The right to access the personal data we hold about you. This is known as a ‘subject access request (SAR). SARs need to be made in writing and we have one calendar month to provide you with the information you have asked for. The period of compliance may be extended to two months where requests are complex or numerous.
  3. The right to have the information rectified if it is inaccurate or incomplete.
  4. The right to have your information erased from our records. You can do this where:
  • the information is no longer necessary in relation to the purpose for which we originally collected/processed it
  • where you withdraw consent
  • where you object to the processing and there is no overriding legitimate interest for us continuing the processing
  • where we unlawfully processed the information
  • the personal information has to be erased in order to comply with a legal obligation

We can refuse to erase your personal information where the personal information is processed for the following reasons:

  • to exercise the right of freedom of expression and information;
  • to enable functions designed to protect the public to be achieved e.g. government or regulatory functions
  • to comply with a legal obligation or for the performance of a public interest task or exercise of official authority;
  • for public health purposes in the public interest;
  • archiving purposes in the public interest, scientific research historical research or statistical purposes;
  • the exercise or defence of legal claims; or
  • where we have an overriding legitimate interest for continuing with the processing
  1. The right to object to processing where we say it is in our legitimate interests. We must stop using the information unless we can show there is a compelling legitimate reason for the processing, which override your interests and rights or the processing is necessary for us or someone else to bring or defend legal claims.
  2. You have the right to require us to stop processing your personal information. When processing is restricted, we are allowed to store the information, but not do anything with it. You can do this where:
  • You challenge the accuracy of the information (we must restrict processing until we have verified its accuracy)
  • You challenge whether we have a legitimate interest in using the information
  • If the processing is a breach of the GDPR or otherwise unlawful
  • If we no longer need the personal data but you need the information to establish, exercise or defend a legal claim.

If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.

  1. The right to request that your data be copied or transferred to another organisation in certain circumstances.
  2. The right to complain to us and/or to the Information Commissioner’s Office if your information is being used unlawfully (contact details are below).
  3. The right to challenge any automated decision making or profiling that may be carried out using your information.

If you would like to contact us about your data protection rights please contact: Data Protection Officer, Aspire Housing, Kingsley, The Brampton, Newcastle-under-Lyme, ST5 0QW. Telephone: 01782 635200. Email: DPO@aspirehousing.co.uk.

If you would like to complain to the Information Commissioners Office the contact details are as follows: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. https://ico.org.uk

Where we transfer data outside of the EU we will only transfer data in compliance with the GDPR transfer rules. We have GDPR data processing agreements in place where data is hosted outside of the EU.

Cookies are small text files placed on your computer by the websites you visit. They are used to help make websites work efficiently. You can control cookies through the settings of your web browser. To find out more, visit www.aboutcookies.org or www.allaboutcookies.org.

Click here to view cookies used on our website