Privacy Policy

Introduction

References to “we”, “us” and “our” mean Support Connect Ltd, company number 12514780, whose registered office is at Shell Store, Canary Drive, Skylon Park, Hereford HR2 6SR. We are the controller of the personal data described in this Policy, except where we process personal data on behalf of a Training Provider, university, employer or other organisation (see “When we act on behalf of other organisations” below). We are registered with the Information Commissioner’s Office (ICO) under registration number ZA861983.

This updated Policy explains how we collect and use personal data when you interact with our website, our online portal, our services and our systems. It also explains the legal bases we rely on, how long we keep your personal data, how we protect it, your rights and how to contact us or complain if you are not happy.

The scope of this Policy applies to the Support Connect Ltd website, online portal and information management system, and wherever else this Privacy Notice may be mentioned or referenced, regardless of how you access them. It should be read alongside our Cookie and Similar Technologies Policy. We may amend this Policy from time to time. Any updated versions will be posted on this site showing the effective date.

Personal information

What do we class as personal information?

This is any information relating to an identified or identifiable living individual. A person can be identified directly or indirectly, for example by a name, email address, identification number, location data or online identifier, or by one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

Information that has been anonymised so that it can no longer be used to identify a specific person is not personal information and is not covered by this Policy.

Special category personal data

Some of the services we provide, such as learning support, neurodiversity screening and assessment, wellbeing support and mentoring, involve information about health, disability or neurodivergent conditions. This is known as special category personal data and receives extra protection under data protection law. We only process special category data where we have a lawful basis and an additional condition under Article 9 of the UK GDPR, for example where you have given explicit consent, where processing is necessary for the provision of health or social care, where it is necessary for reasons of substantial public interest (such as safeguarding, or equality of opportunity or treatment) under Schedule 1 of the Data Protection Act 2018, or where it is necessary to protect someone’s vital interests.

Some of the apprentices and learners we support may be under 18. We take additional care when handling their personal data.

How we collect your personal data

We collect your personal data when you call or email any of the @supportconnect.org.uk email addresses, visit or log in to our website or portal, or use our services. For instance, but not limited to, if you request a call or information, if your Training Provider, university or employer refers you to us for an assessment or support, or if you receive support services from us. Some personal data is provided by you and some is provided by the organisation that refers you to us. The legal basis we rely on depends on why we are processing the data, as explained in the next section.

Our legal basis for processing your personal data

There are a number of reasons why a business may collect, store and process personal data, ranging from what might reasonably be expected as part of running a business, to the needs of a regulated sector, to a requirement to comply with the law. The following are the key legal bases on which Support Connect holds and processes personal information.

When we act on behalf of other organisations

Where we provide services under an agreement with a Training Provider, university, employer or other organisation, that organisation may be the controller of your personal data and we act as its processor. In that case we process your data only on that organisation’s documented instructions, and its own privacy notice will also apply. You may wish to contact that organisation to exercise your rights, and we will help them respond.

What personal data do we collect?

When you use our website we will collect your name, telephone number and email address along with other details shown on the contact form and relating to the services you are interested in. At times there may be an option to provide a postal address. If you have an account on our portal, we will also hold your account details. A telephone number will be collected if you call our offices or any Support Connect personnel. Your email address will be collected with any correspondence, queries or contact sent to any of the @supportconnect.org.uk email addresses.

There may be a requirement to take notes of conversations with Support Connect personnel. These could include queries, complaints, preferences and services you have shown an interest in.

If you receive assessment or support services from us, we will also hold the information needed to deliver those services, such as details of your course or apprenticeship and Training Provider, assessment results, support plans, session notes and, where relevant, health or disability information (see Special Category Personal Data above).

Our website uses only strictly necessary cookies and similar technologies, such as browser local storage and session storage. These are used to keep you securely logged in, deliver pages correctly and remember interface preferences you have chosen. We do not use analytics, advertising or other tracking technologies, and we do not allow third parties to collect information about you through our website. Full details, including the name, purpose and duration of each cookie, are set out in our Cookie and Similar Technologies Policy.

How we use your personal information

We use your personal data to provide the services you have requested or that have been commissioned for you, to manage your account, to improve our services and, where you have agreed or the law otherwise allows, to send you updates and marketing about other services that may interest you. We will contact you about changes to your account, updates to our services, and to provide customer service.

Where the law requires or permits, your data may also be used to prevent or detect fraudulent or criminal activity and, if we are lawfully requested, may be provided to law enforcement bodies or the courts.

You choose how we contact you with marketing

You always have a choice about receiving marketing from us. You can tell us whether you want to receive marketing, how you would like to receive it and whether you are happy to receive phone calls. You can opt out at any time by using the unsubscribe link in any marketing email or by contacting us.

Your rights

Under data protection law you have the following rights, subject to certain conditions and exemptions:

• the right to be informed about how we use your data;
• the right of access to a copy of your personal data;
• the right to have inaccurate or incomplete data corrected;
• the right to have your data erased;
• the right to restrict how we use your data;
• the right to data portability;
• the right to object to processing based on our legitimate interests, and to object at any time to direct marketing; and
• rights relating to automated decision-making.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

If any data we hold about you is incorrect, outdated or incomplete, you have the right to ask us to correct and update it. You can also ask us to delete it or restrict how we use it. These rights are not absolute. For example, we may need to keep some information to meet a legal obligation, and deleting or restricting data may affect our ability to provide some of our services.

How to complain

If you are unhappy with how we have handled your personal data, please contact us first so that we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection, or telephone 0303 123 1113.

Sharing your personal information

We do not sell your personal information to anyone. We only share personal information where it is necessary and lawful to do so, for example:

• with the Training Provider, university or employer that referred you or commissioned your support, so that the support can be delivered and reported on;
• with safeguarding leads and relevant authorities where there is a risk of harm;
• with organisations that fund your support, their auditors and Ofsted where support is publicly funded;
• with trusted service providers who process data on our behalf, such as IT, hosting, email and software providers, under contracts that require them to keep it secure and use it only on our instructions; and
• where we are required to by law, or to detect, prevent or investigate illegal or fraudulent activity related to our services.

We will ask for your consent before sharing your information for any other purpose. At all times we will minimise the personal information we disclose and share only what is relevant and necessary for the purpose.

If we sell, merge or restructure the Support Connect business, relevant personal data may be transferred to the new owners or controlling entities, who will be required to use it in line with this Privacy Notice. We will tell you about any such transfer where it affects how your personal data is used.

Third-party sites

This Policy does not cover third parties and their services, nor do we take any responsibility for the way they use your information should you have signed up for their services via a link from our website. This could be for outsourced events, software or services not operated by Support Connect, recruitment sites and services or relevant business activities. We cannot guarantee the security or privacy of your data if you disclose your information to any third party. Please consult these parties directly and review their website for their Privacy Policy.

Security, retention and processing location

How we keep your personal data secure

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. Learner data is stored in a system that is Cyber Essentials Plus certified and penetration tested, and access is limited to staff who need it to do their job.

How long we will keep your personal information

We keep each record containing personal information for five years, to provide the services you have requested, to meet legal, contractual, funding and audit requirements, and to deal with any complaints or legal claims. At the end of that period we securely delete or anonymise it. We may periodically contact you to check that your information is accurate and that you still wish to hear from us.

Where your personal data will be processed

Your data will only be processed within the UK. If any data is collected outside the UK it will be transferred to our UK base.