Privacy Notice

From time to time you may be asked to submit personal information about yourself. The term ‘personal data’ means information about you that may identify you from that data. The term therefore covers a wide range of data which may for example, include your name, address, telephone number, or the type of career that you may wish to pursue. We ensure that our staff work to data protection principles which require information to be:

· Used lawfully, fairly and in a transparent way.

· Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.

· Relevant to the purposes we have told you about and limited only to those purposes.

· Accurate and kept up to date.

· Kept only as long as necessary for the purposes we have told you about.

· Kept securely

We have a privacy notice for each area of our business where we need to store, use and/or disclose your personal data. Each notice identifies the specific purposes we will use your personal data for, the individuals and organisations we may require to disclose your personal data to and how long we will keep your personal data for.

They also provide details of your rights in relation to accessing your personal data. Please see the list at the beginning of this notice to find the area that is relevant to you.

We need to collect, hold and process information for a number of reasons.

Below are examples of some of the purposes for which we may require to use your personal data. Our services are designed to give you the information that you want to receive:-

· to confirm your identity and to keep in touch with you by post, fax, e-mail, text message, telephone, or other method

· to understand your needs and to inform you of relevant services we offer

· to help you find and prepare for employment and training opportunities

· to exchange information with selected partners who work with us to deliver services

· to work with employers and other partners to support skills development and job creation

· to support you if you are facing redundancy

· to provide information to you about working life, fair work practices and the services and benefits you can access from us and other public sector and/or government bodies in Scotland and/or the UK

· to meet our statutory obligations including those related to equality and diversity

· to meet our statutory obligations related to sharing your information with other organisations, for the promotion of employment and skills in Scotland and to understand the impact of our programmes

· to process financial transactions related to the services you may receive such as grants or payments

· to monitor our compliance with the conditions of funding appropriate to our various programmes and schemes

· to build a picture of how well we deliver our services and how we can improve in the future

· to monitor the performance of our service providers who may be providing services to you

· to prevent and detect fraud and / or corruption in the use of public funds

· to undertake statistical research regarding the value and impact of our various programmes and schemes and to assist with policy development

The above list is illustrative only. Please refer to the relevant privacy notice for detailed information regarding each area of our business, the purposes for which we process personal data and the legal basis for doing so.

There are broadly two types of information that we might need:

Personal Information – such as your name, date of birth, contact details, unique customer reference number, notes about the services you have received, details of your current situation with regard to education, training or employment, qualifications and your future career aspirations. There are many other types of personal data that would be included in this category.

Special Category Personal Information – such as your racial or ethnic origin, gender, sexual life, sexual orientation, physical or mental health, genetic data, biometric data, religious or philosophical beliefs, political opinions, trade union membership or information on other agencies that currently supply help and support to you of a sensitive nature. We may also process information regarding criminal records and court proceedings.

Skills Development Scotland aim to avoid asking unnecessary questions beyond what is reasonably required for our purposes. Information may be provided by you, by a guardian or parent if you are a young person, or may be passed to us by another organisation working with you. Information may be collected in a variety of ways such as paper form, online forms, e-mails, face to face communication, telephone, text messaging or image/audio recording devices.

In some cases, we may provide your information to another organisation engaged by us to process the data as a “data processor” on our behalf. In this circumstance, we identify the restricted purposes for which your information will be processed, and the manner in which that information must be processed. The data processor will require to satisfy us that they have adequate controls in place relating to confidentiality and security.

We will only use the information in ways that adhere to data protection law in force in the UK.

Access to your information by SDS and its selected partners will be controlled to reflect the purposes and disclosure, held securely, and with limited access by our own staff or staff at partners who work with us to provide the service. We shall endeavour to maintain your information in an accurate, up to date and secure manner at all times.

From time to time we may use your information in an anonymised form, combined with information of other customers in order to produce reports and statistical analysis. When your personal data is anonymised, it cannot at all be traced back to you as a person - your name or any other personal identifier will have been permanently removed. These reports and analysis are for us to improve our services in the future, and to better understand how well our services represent the people of Scotland.

We will only keep your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Please see the list of individual programmes at the top of this policy to find out more information on the retention period for each programme. For any other information, please get in touch with us through the contact listed below.

Skills Development Scotland maintain a high standard of both physical and network security designed to protect paper or electronic forms of storage to hold and process your personal information.

Information that we hold about you is subject to rigorous safeguards to ensure that it isn’t accessed or disclosed inappropriately. We also take steps so that your information is not damaged or made unavailable to those who have a right to see it.

To meet confidentiality, data retention and security requirements for our customers, stakeholders and staff, Skills Development Scotland has Confidentiality, Data Protection, Information Technology and Systems policies in place and we ensure that staff are fully aware of these and the associated guidance in relation to your personal information. These also apply when we dispose of paper records and delete electronic information in ways that ensure that your information cannot be recreated.

We may share your personal information with other organisations when required by law. We may also transfer your personal information with a successor organisation which takes over our functions or any one or more of them.

Our partners are obliged to keep your information secure and to use the information only to fulfil specific and agreed purposes. We will check where possible that appropriate steps have been taken by the recipient to protect your information. If we need to share your personal information and we do not have a statutory obligation to do so we will ensure we have an appropriate legal basis for doing so.

In certain limited circumstances we may need to share personal information about you, including special categories of personal information, without your consent or knowledge. This will only be done where the disclosure is necessary, proportionate and in compliance with the law

If we transfer your personal information outside the European Economic Area (“EEA”), we will let you know in the applicable privacy notice. We will ensure a similar degree of protection is afforded to it, generally by ensuring that at least one of the following safeguards is implemented:

· We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.

· Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.

· Where we use providers based in the US, we may transfer data to them if they are certified to the UK Extension to the EU-US Data Privacy Framework which requires them to provide similar protection to personal data shared between the Europe and the US.

· Skills Development Scotland delivers a range of national training programmes, working with private learning providers and colleges across the country to ensure that everyone in Scotland has the opportunity to develop their career. We also work with a range of other national and local initiatives with recognised partners such as Jobcentre Plus and Local Council Employer Services to support you.

· Your agreement that Skills Development Scotland may share any personal, information is usually obtained when you sign and agree to support or learning from our partners. Further information can be found by contacting your local SDS Centre or contacting the SDS Data Protection Officer at the address shown at the end of this notice.

· During the course of any visit to Skills Development Scotland's website, the pages you see, along with something called a ‘cookie’, may be downloaded to your computer. Most, if not all, websites do this, because cookies allow the website publisher to do useful things like find out whether the computer (and probably its user) has visited the site before. This is done on a repeat visit by checking to see, and finding, the cookie left there on the last visit.

· Any information that is supplied by cookies can help us to provide you with a better service and assists us to analyse the profile of our visitors. For example, if on a previous visit you went to the 'Our Services' pages, then we might find this out from your cookie and highlight educational information on a second visit.

· Both the cookies and the embedded code provide non-personal statistical information about visits to pages on the site, the duration of individual page view, paths taken by visitors through the site, data on visitors' screen settings and other general information.

· Skills Development Scotland uses this type of information, as with that obtained from other cookies used on the site, to help it improve the services to its users.

We have installed CCTV systems at some of our Centres used by members of the public. This is solely for the purposes of public safety and crime prevention/detection. Signs are displayed in all locations notifying you that CCTV is in operation and explaining who to contact for further information. Our systems do not record audio. The policy on the use of CCTV is reviewed annually.

We will only disclose CCTV images to others to meet the purposes stated above.

Images captured by CCTV are normally retained for 31 days however we may hold images longer than this where a crime is being investigated or there is a statutory obligation on us to do so.

You have the right to see CCTV images of yourself and be provided with a copy of the image we currently retain, where this is practicable.

Skills Development Scotland sometimes make use of creative digital technologies such as digital photography and video/audio recordings to support our delivery. You will be advised in advance about your rights. You have the right to refuse. If you agree to participate, we will require you to sign a release form covering images and audio in which you appear.

Skills Development Scotland sometimes use case studies to highlight the success of clients to encourage other customers. This may be in an anonymised form, or if you agree, use your personal information. Skills Development Scotland respects your rights to privacy where you do not agree and there will be no adverse consequences for you if you do not agree.

If you request your own personal data under UK General Data Protection Regulation (GDPR)or Data Protection Act 2018, this request is known as a ‘Subject Access Request’ or a

‘SAR’. If you would like to make a SAR relating to personal data held in respect of any services provided by Skills Development Scotland you can Write to

Data Protection Team

Skills Development Scotland

Monteith House

11 George Square Glasgow, G2 1DY

Or email the SDS Data Protection Team at DPO@sds.co.uk

Fees

You will not have to pay a fee to access your personal information (or to exercise any of your other rights set out below). However, we may charge a reasonable fee based on administrative costs if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one calendar month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Under data protection laws, you have a number of rights available to you in terms of accessing the personal information we hold on you, understanding what we do with it and requesting that something be changed.

Below, we spell out what all of the rights under data protection laws are and what they mean to you.

Firstly, you have the right to be told about what we do with your personal information. What you’re reading just now is aimed at addressing this right – by providing you clear information on who we are, how to contact us, what we do with your personal information and why we do it.

You also have the right to access the personal information we hold on you. We have already set out the details of our procedure for dealing with these “Subject Access Requests” above.

You can make a request for your personal information to be corrected or updated. Perhaps the email address you use has changed or you typed it in incorrectly, or you have moved house and you need your address updated (if it is necessary for us to have that information in the first place). We will try to act on these requests without any undue delay.

You can also make a request for your personal information to be completely erased. We can do this for you when any of the following reasons apply:

• We no longer need your personal information to provide you a service

• If you consented to us keeping the information in the first place, you can change your mind and withdraw that consent

• There is no other good reason to use or hold your personal data

• If your personal data has been used unlawfully

• When a legal obligation requires us to delete the information

• Where you are under the age of 16 and have signed up to an information society service

If we have made the personal information public or passed it on to other places and you request that information to be deleted, we will do all we reasonably can to get in touch with those sources and inform them that the information must be deleted on their side also.

Where it is possible, we can suspend the use of your personal information (upon your request). Why would we do this, and why would this be useful to you?

• Perhaps you think that some of the personal information we hold about you is inaccurate. If this takes us a period of time to verify or complete your request, we can temporarily block the use of that information whilst we are in that process.

• The way we were using your personal information was unlawful, and you would rather that the use of your information was suspended/restricted rather than outright deleted (as perhaps, you may want the use of the information to continue in the future). This gives you more flexibility should you change your mind, as deletion is permanent.

• We no longer need your information to provide a service to you, but you may need it kept if the information is important to a legal claim you are currently involved in.

• You believe that there is no good reason for us to be using your personal information.

You may be able to request that we give you your personal information in a commonly used and structured format that can be used electronically (for example, an Excel spreadsheet, or a PDF file). Why would this be useful to you, and in what circumstance could we do this?

• Firstly, we are able to do this when you consented to giving us the personal information in the first place, or where the use of your personal information was part of a contract between us.

• Secondly, the use of the personal information in question must be processed by automated means. This essentially means that a computer process was managing your personal information. If you are unsure of whether any of this applies to your case, you can always make a request to find out.

• This could be beneficial to you if, for example, you are moving to another country and need your careers information in a transportable format to give to another careers adviser in your new area.

On the occasion that you have consented to us sending you marketing communications, you can tell us to stop this happening and we will always comply.

Sometimes we will process personal information because it is important in the public interest, and is part of our role as a public body that seeks to help people in Scotland into employment. If your personal information is being used for this reason, and you have an objection, you may make a request for your personal information to stop being used.

On rare occasions, we make use of automated decision-making processes and profiling in order to offer you a more efficient service. What do the last two terms really mean, and what do they mean for you?

• An automated decision-making process is essentially the use of a computer system to put together relevant information and come to a decision on something. For example – you may give us personal information when signing up to a course because of eligibility requirements. A computer may work out whether what you have entered meets the course eligibility,and decide on that basis. These processes are reviewed by SDS staff in order to ensure that they work properly and fairly. You will always be made aware if any of these processes are ever used with your personal information – why it happens, and what effects they may have on you.

• Profiling is the use of automated processes to create a picture of who you are – to take together information and create a ‘profile’. Similar to before, you will always know if anything like this happens concerning your personal information, why it happens and what this means for you. You can always make a request to understand more about the above two aspects, and can make a request that these processes stop happening.

Where we are solely relying on consent to process your personal information (and not, for example, where we are processing your personal information in order to fulfil a contract with you), you may withdraw your consent at any time by emailing DPO@sds.co.uk

However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. 

Complaints

If you have a complaint about the way we are handling your personal information, or the way we have dealt with a request from you in relation to any of your rights set out above, you have the right to require us to review our decision.

Your request for review should be made within 40 working days of receipt of the information. We will aim to reply within 20 working days of receipt of that request. Following any review, if you still remain dissatisfied then you have the right to make a formal complaint to the Information Commissioner.

If you require a review of a decision to be carried out, please write to:

Data Protection Officer
Skills Development Scotland Monteith House 11 George Square Glasgow, G2 1DY

Email the SDS Data Protection Team at  – DPO@sds.co.uk

If following any review you remain dissatisfied with our response, you are entitled to appeal to the Information Commissioner. Such an application should be sent to the following address:

Information Commissioners Office
Wycliffe House

Water Lane

Wilmslow

SK9 5AF 

Phone:  0303 123 1113

Web Site: https://ico.org.uk/ 

Please note it is open to you to submit a complaint to the Information Commissioner at any time, but we request that you give us the opportunity to deal with your compliant first.

We may update this privacy policy by posting a new version on the website. You should check this page occasionally to ensure you are happy with any changes and any substantial changes will be highlighted on the site.

We may also notify you of changes to our privacy policy by email.

Under the UK General Data Protection Regulation (GDPR) organisations that process personal information (personal data) must notify the Information Commissioner’s Office unless they are exempt from doing so. Data controllers are required to inform the Information Commissioner’s Office of certain details about their processing of personal information. The Commissioner uses these details to make an entry describing the processes in the Data Protection Register and this is available to the public for inspection on the Information Commissioner’s website.

Registration is a basic principle of Data Protection that the public should know (or should be able to find out) who is carrying out the processing of personal information as well as other details about the processing (such as for what reason it is being carried out).
The Data Controller responsible in respect of the information collected by Skills Development Scotland is identified within the Information Commissioner’s Register under registration number Z1445093 as Skills Development Scotland.

If you have any questions about this or any of our other privacy notices, data retention or our treatment of your personal information, please write to the Data Protection Officer, Skills Development Scotland, Monteith House, 11 George Square, Glasgow, G2 1DY., or send an email to DPO@sds.co.uk

The Skills Development Scotland Co. Limited, a company registered in Scotland with company number SC202659 and having its registered office at Monteith House, 11 George Square, Glasgow, G2 1DY.

Our ICO registration number is:  Z1445093.