The information we collect will change based on the reason we are processing your data. We will never collect more from you than we need.
Data Protection Officer
When you contact us in our capacity as DPO, we will collect whatever information is necessary to fulfil our legal obligation to you and our contract with our client.
This will typically include your name and some details about why our client was processing your data and information about whether you feel they are meeting their data privacy obligations towards you. We may ask for verification to prove who you are and what your relationship is with our client.
You have the right to contact us in regard to all issues related to processing of your personal data. This includes contacting us to exercise your rights under the GDPR. We are bound by confidentiality in the performance of this task, in accordance with the Data Protection Act 2018.
You can contact our Chief DPO, Nigel Gooding, to find out more about how we process your personal data in confidentiality, by emailing email@example.com.
Enquiring about our products and services or asking for our materials online
When you contact us enquiring about products, services, and events, we will collect whatever information is necessary prior to taking steps to enter into a contract with you. This information will typically include the name and place of work of key contacts in your organisation and their contact details.
We will also process any information you submit via our online forms. We may also process any other information that we have legitimately collected about you in relation to our other services (such as whether your business has paid for our training courses in the past) where this other purpose was known to you at the point of data collection. This information would only be processed in relation to engaging in a contract at your request.
Contacting you after a referral
When we contact you at the request of someone else, we will always tell you who we are and where we got your information from. We will do this as soon as is reasonably possible and no later than 28 days after first receiving your contact details. Wherever possible, we will ask the person referring you to us to make the introduction or to check with you whether it is ok for us to call you first.
The information that we will have processed prior to that point will be likely minimal and will include your name, job title/ place of work and a contact point such as an email or telephone number.
The lawful basis we rely on when contacting you about our products or services at the request of someone else will be different depending on the context. For the most part, it will be in our legitimate interest to do so, and you can request that we stop processing your data. Where you have agreed for us to get in touch, we will be doing so based on your consent and you can withdraw this at any time.
You apply for a job with us
If we advertise a job posting or you are interested in working as a contractor for us, we may process some of your personal data so as to take steps to enter into a contract with you.
Typically, we will process your name, contact information and your CV and cover letter. Depending on the route you came into us, we may also look at your publicly available profiles in advance of an interview, such as a LinkedIn page or a professional Twitter account. We will also contact those you offered as a reference for you.
If you let us know about a disability or health condition (or provide us with any other special category data), we will process this data under our legal obligations in relation to employment and equality laws.
If you are successful in your application and we want to offer you a job, we will process more information than this. To see our employee privacy notice, please contact firstname.lastname@example.org.
You enter a competition or you attend a free DPAS Privacy Pulse Webinar or Event
If you register to attend a free webinar or training event, we will process this data so we can send
you information about the webinar or event that you have registered to attend. To ensure the safety of individuals who attend our in-person events, we may also collect special category personal data, such as food allergies and accessibility requirements.
We will also let you know about future DPAS Privacy Pulse webinars and training courses under the lawful basis of legitimate interest.
If you enter a competition with DPAS, we will process this data so we can send you information
about the competition should you be successful. We will also let you know about future competitions, so you have a chance of winning again.
You use our website
information sent by an organisation to your computer and stored on your hard drive to allow that website to recognise you when you visit. They collect statistical data about your browsing actions and patterns and most do not identify you as an individual.
However, some cookies and tagging/ tracking technologies that we use, such as Google Analytics, do let us know some information which may constitute personal data. An example of this is our Google Analytics Cookies that tell us about which of our pages a certain IP address accessed,
when and where it was accessed from. Consent is required for all cookies except essential cookies, and you can adjust your preferences using the preference centre tab displayed on the home page.
DPAS will process the names, attendance dates, job title, and place of work data of attendees, per its obligations to fulfil the terms of the contract. If our contract is directly with the attendee, we will rely on the legal basis of contract to process this data. If our contract is with the employer, we will rely on the legal basis of legitimate interests to process this data. DPAS will maintain this data for 6 years after the course completion date, per industry best practice and the Limitation Act 1980. This data will be processed on our CRM for this purpose only. DPAS have a contract in place with this CRM provider. This data will also be shared with the trainer on the day of the course, who will have a contract with DPAS. To find out the identity of this trainer in advance of this information being shared, please contact email@example.com.
DPAS may process the payment details of the client, through our website and using our accounting provider, Xero Ltd. DPAS will maintain a record of this payment for six years, per its legal obligations under the Limitations Act 1980. Card payment details will not be retained beyond immediate use in the payment gateway. Payment status will be held on our CRM and accessed by limited DPAS employees for this purpose only. DPAS have a contract in place with Xero, whereby they and their sub-processors meet EEA standard adequacy arrangements.
DPAS will process information relating to attendee transport, as per our legitimate interest to organise the logistics of the course. With your explicit consent, we may also need to process information relating to disabilities (in some circumstances) and dietary requirements for the same reason. DPAS will retain this information for up to a maximum of 30 working days post course completion. This data will be processed on our CRM for this purpose only.
DPAS and our trainers will access the names, of attendees, and any answer sheets and pass or fail status per our contractual obligation to award the CPD credits and BCS certificates. DPAS will also collate statistical evidence using this personal data to evaluate the effectiveness of training, to improve upon the courses and to assist DPAS in providing further advice to the Client. DPAS will keep this in an identifiable form for 1 year only, after which, any statistical conclusions will be kept in an anonymised format. This data will be stored on Arlo CRM for this purpose only. DPAS have a contract with this software provider. DPAS will also share the pass / fail status of attendees with the Continuing Professional Development body, where required to by contract.
DPAS offers accredited training courses, and to enable delegates to sit their chosen exams, DPAS must pass some personal information to the professional accrediting bodies. This will enable candidates to sit their exam and gain access to their BCS associate membership.
DPAS delivers accredited training courses for the Chartered Institute for IT – BCS. DPAS have signed a Provider Contract with the BCS which allows us to deliver the following BCS Certified training courses:
- BCS Foundation Certificate in Data Protection
- BCS Practitioner Certificate in Data Protection
- BCS Practitioner Certificate in Freedom of Information
DPAS is not a Data Processor for, nor does it process personal data on behalf of the BCS.
Our BCS Accredited Training Provider status does not infringe upon our personal data collection practices. We will only share your personal information with BCS when we have to in order to fulfil our contract with you.
We share the delegate’s name and email address at their request when they inform us that they wish to sit a BCS exam. We only pass across these details once the delegate has confirmed the specific exam date (usually included within the classroom training course) and where applicable, have completed their exam prep and mock exam successfully. The BCS then contacts the delegate directly to create a log-in portal on their site. DPAS does not have access to the delegate portal.
We are required to provide the BCS feedback from delegates regarding courses they have attended. Delegates receive a feedback form at the end of their course, which enables us to fulfil our obligation to the BCS, and also allows us to improve the quality of our training services. We are grateful to all delegates that complete these forms, including giving your name to enable your comments to be used.
The BCS share your exam results (marks only) with DPAS as we are the Accredited Training Provider (ATP). This benefits us in a number of ways:
- It enables us to monitor the success of our training
- It helps us to improve the service we offer you
- It allows us to maintain a record of exam results for our delegates
We will not share this information with any third party.
We become business associates/connections
If you are a business connection, for example, we meet you at a networking event, we will only collect the information you choose to provide to us which typically includes your name, company address, company telephone number and company email address. Our legal basis for processing your information is legitimate interests and we will retain it for 12 months following our last meaningful contact.
We contact you for marketing purposes
Where we have publicly found your contact details (e.g., firstname.lastname@example.org), we may send you business marketing information by email where we think you may be interested in our products or services.
Where we have a corporate email address for you which contains identifiable information (e.g., Joe.email@example.com) we may send you business marketing information by email, if we think your products or services may be of interest to you. We may also telephone you to discuss our products and services providing your telephone number is not listed on the Corporate Telephone Preference Service list (CTPS).
We may contact you after you have entered a competition we are running. We will generally provide you with information about further competitions should you have been unsuccessful, or discounts on DPAS products that you may be interested in. This will be processed under the lawful basis of legitimate interest, Article 6(1)(f) of the UK GDPR. If you’d like to stop receiving our emails simply click the unsubscribe button or get in touch with us.
We may contact you after you have registered to attend a free webinar or training event. We will generally provide you with information about further webinars or training events which you may be interested in. This will be processed under the lawful basis of legitimate interest, Article 6(1)(f) of the UK GDPR. If you’d like to stop receiving our emails simply click the unsubscribe button or get in touch with us.
You have the right to object, and if you do, we will respect your wishes and remove you from our mailing list, if this is the case, please email firstname.lastname@example.org.
We may share your information with:
- Fresh Desk – Client ticketing system.
- Hubspot – Client management system.
- Arlo – Training management system.
- WordPress – Website.
- Xero – Invoicing software.
- Survey Monkey – Feedback software company.
- People HR – HR management software (employment purposes only).
- Eventbrite – Event management.
- Glasscubes – To share files securely.
- Nalytics – To review raw data, from a range of file types to remove meta data to create a clean PDF image on the original file.
We may share your information with credit reference agencies and other companies for use in credit decisions and for fraud prevention.
We may share your information with third party contractors or organisations working with DPAS to fulfil supplier contracts.
We will only share information that is relevant to fulfilling your request. For example, if you are booked onto a DPAS training course, we will share your information with the course trainer. If you attend one of our in-person events, we will share your information with the venue provider, catering companies, and any other third-party that may be involved in hosting the event.
We operate internationally. As part of the services offered to you by DPAS, the information, which you provide to us may be transferred to countries outside the European Union (“EU”) and the European Economic Area (EEA). By way of example, this may happen if any of our servers are from time to time located in a country outside of the EEA. These countries may not have similar data protection laws to the UK. If we transfer your information outside of the EEA in this way, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this Privacy Notice.
We take appropriate technical and organisational measures to safeguard your personal information when transferring it outside the EEA as:
- We only allow personal data to be processed in countries which the European Commission have confirmed have adequate protection for personal data (see European Commission: Adequacy of the protection of personal data in non-EU countries) and/or;
- We enter into appropriate contracts which the European Commission have confirmed provide adequate protection for personal data (see European Commission: Model contracts for the transfer of personal data to third countries)
- If you use our services while you are outside the EEA, your information may be transferred outside the EEA in order to provide you with those services.