Privacy Policy

The ECITB is committed to protecting your privacy and ensuring that any information that it collects about any person (“Personal Data”) is never misused.  Protecting the confidentiality and integrity of Personal Data is a critical responsibility that the ECITB takes seriously at all times.  ECITB recognises that the correct and lawful treatment of Personal Data will maintain confidence in the organisation.

This Privacy Policy explains what information ECITB collects, how and why it is used, how it is kept safe, and what your rights are as a Data Subject.

By using the ECITB’s courses, qualifications, websites, and other services, you agree to the way the ECITB collects and uses your Personal Data according to the terms of this Privacy Policy.

The ECITB’s Privacy Policy is divided into the following sections:

1. About the ECITB and this policy;
2. Why and How ECITB collects and uses your Personal Data;
3. Your rights; and
4. Data Privacy and the ECITB’s training courses and services.

A         About the ECITB and this policy

The ECITB

The Engineering Construction Industry Training Board (ECITB) is a public body (an industrial training board) and also a charity registered in England and Wales.

The ECITB has a Data Protection Officer.  If you have any comments or concerns about any aspect of this policy or any privacy or data protection issue, please contact The Data Protection Officer:

• By email at dpo@ECITB.org.uk
• By post at:

Data Protection Officer
ECITB
Office Suite KD3 First Floor
KD Tower
Cotterells
Hemel Hempstead
HP1 1FW

Data Processing principles

ECITB adheres to the following principles relating to processing of personal data, which are set out in the General Data Protection Regulation (GDPR).  The principles require Personal Data to be:

• Processed lawfully, fairly and in a transparent manner (Lawfulness, Fairness and Transparency).
• Collected only for specified, explicit and legitimate purposes (Purpose Limitation).
• Adequate, relevant and limited to what is necessary in relation to the purposes for which it is Processed (Data Minimisation).
• Accurate and where necessary kept up to date (Accuracy).
• Not kept in a form which permits identification of Data Subjects for longer than is necessary for the purposes for which the data is Processed (Storage Limitation).
• Processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful Processing and against accidental loss, destruction or damage (Security, Integrity and Confidentiality).
• Not transferred to another country without appropriate safeguards being in place (Transfer Limitation).
• Made available to Data Subjects and Data Subjects allowed to exercise certain rights in relation to their Personal Data (Data Subject’s Rights and Requests).

Changes to the policy

When the ECITB’s Privacy Policy is reviewed, the date it was last updated will be noted and published on the ECITB’s website.

This Privacy Policy was last reviewed and updated in May 2018.

B       ECITB’s collection and use of Personal Data

Why ECITB collects Personal Data

Under GDPR the ECITB may only collect, process and share Personal Data fairly and for specified lawful purposes.  These restrictions are not intended to prevent processing, but ensure that the ECITB processes your Personal Data fairly and without adversely affecting your rights as a Data Subject.

The GDPR allows processing of Personal Data for specific purposes, and the purposes for which the ECITB processes such data are set out below:

• When the Processing is necessary for the performance of a contract with a Data Subject;
• To meet the ECITB’s legal compliance obligations and purposes carried out in the public interest or in the exercise of official authority vested in the ECITB as a public body; and/or
• To pursue the ECITB’s legitimate interests for purposes where they are not overridden because the data processing prejudices the interests or fundamental rights and freedoms of Data Subjects.

The GDPR also allows processing of Personal Data when the Data Subject has given his or her consent.  Whenever the ECITB needs to process Personal Data for purposes which fall outside the purposes described above or to protect the Data Subject’s vital interests, the ECITB will seek and obtain the Data Subject’s consent.

How ECITB collects Personal Data

You give the ECITB Personal Data and other information when you:

• Use the ECITB’s website and services;
• Complete and/or submit one of the ECITB’s forms (for example, when attending a training course with an ECITB Approved Training Provider);
• Correspond with the ECITB by telephone, email or otherwise;
• Register with the ECITB;
• Subscribe to ECITB’s services;
• Search for a service (such as a course, a qualification or an apprenticeship); or
• Respond to an ECITB survey.

The ECITB also collects information about you when you visit its websites through the use of cookies (see “Cookies” below).

The ECITB may also get information from other sources, including third parties, such as training providers and “in-scope” employers.

What the ECITB collects

The information the ECITB collects from you could include your:

• Name, address, email and phone number;
• Date of birth;
• National Insurance number;
• Financial and credit card information;
• Personal description or CV
• Photograph
• IP address
• Geographical location

The ECITB may also have Sensitive Personal Information concerning its employees, but with the consent of such individuals.  The ECITB does not collect Sensitive Personal Information relating to other individuals.

How ECITB uses Personal Data

Information relating to Data Subjects in connection with ECITB training courses, apprenticeships, awards and qualifications.

The ECITB collects information about individuals who have either attended the ECITB’s and other approved training courses, or have attained the ECITB’s qualifications (including vocational qualifications).  The information is received from the individuals themselves, employers and ECITB’s network of approved providers and verifiers.

The ECITB holds and uses this information as a data controller (whether on its own account, or in-common with its approved providers and recipients of this information).

The collected information may include personal details (often including photographs) together with details relating to:

• Completed training courses;
• ECITB apprenticeships; and
• The registration for, and achievement of, awards and qualifications.

The ECITB retains this information in its management information systems, and some information may be held in an online secure database.

Examples of the uses requiring your Personal Data are as follows:

• The ECITB uses your contact details to ask you to confirm the ECITB’s records about you, and to process your applications, enquiries; awards and qualifications;
• The ECITB uses identification information to prevent fraud;
• The ECITB uses your achievement information to certify that you have the necessary knowledge and skills to work in the engineering construction industry; and
• The administration of certification, qualification and card schemes.

Sharing Data Subjects’ Training and Qualifications Information

The ECITB may share information relating to a Data Subject’s training and qualifications with parties that wish to verify that such individuals:

• have undertaken the ECITB’s and other approved training programmes (including apprenticeships), or are in the process of such training;
• hold valid cards issued under the ECITB’s card schemes;
• hold awards and qualifications, or are in the process of working towards them.

When ECITB shares such information, it is likely to be with:

• Training providers;
• Your employer or prospective employers;
• The operators of sites at which you might work or visit;
• Users of ECITB’s card schemes;
• Regulatory bodies in the education sector (in accordance with the ECITB’s arrangements with such bodies); or
• Funding bodies.

Such third parties who can provide the ECITB with certain search information about you (such as your name, ECITB individual ID or card registration number, National Insurance number or other personal details) can check your identity and your ECITB training, awards, tests and qualifications achievements by:

• Submitting enquiries by email or telephone; or
• By using an online portal interface that the ECITB made available to authorised employers, approved training providers and other parties.

The information shared with such parties may include:

• Your surname and first name;
• Your photograph;
• Your ECITB Registration Number;
• Health and safety test passes;
• Training and assessment certificates;
• Technical Test passes;
• VQ achievements; and
• ECITB training course attendance.

The ECITB may also share your ECITB-accredited achievements with newspapers, websites and other media.

Contact the ECITB’s Data Protection Officer (at dpo@ECITB.org.uk) if you would prefer us not to share your information.

The ECITB will not share other information with third parties unless required to do so for legal reasons.

Information relating to other Data Subjects

The ECITB uses Personal Data relating to other Data Subjects for the following purposes and reasons:

• Administering its records and accounts relating to employers, including levy raising;
• Managing its employees, contractors and service providers;
• Providing educational, training, careers advisory services;
• Undertaking charitable trading;
• Advertising, promoting and marketing ECITB’s services;
• Developing and improving ECITB’s services; and
• Undertaking research;
• Fulfilling its statutory roles, duties and functions as a public body and an industrial training board;
• Fulfilling ECITB’s contractual obligations;
• Performing ECITB’s duties as a registered data controller and public authority;
• Confirming identities in connection with the ECITB’s legal obligations (for example, in connection with litigation, freedom of information requests or crime prevention); and
• Analysing website users’ behaviour.

The ECITB may share information relating to Data Subjects with its service providers or agents or law enforcement agencies, if this contractually or legally required.

How ECITB keeps Personal Data safe

The ECITB takes the security of your Personal Data very seriously.

ECITB uses technical measures in its IT systems, such as encryption, and carries out regular security reviews to keep its protections up to date. The ECITB also strictly controls access and ensures staff who are authorised for access are adequately trained in keeping your information safe. The ECITB’s procedures mean that you may be asked to prove your identity before ECITB shares your personal data with you.

Third-party websites you access through links on the ECITB’s website will have their own privacy policies. The ECITB does not accept any responsibility or liability for them.

How long Personal Data is kept

The ECITB will only retain Personal Data:

• to enable it to meet its contractual responsibilities;
• to enable it to meet its legal compliance obligations and purposes carried out in the public interest or in the exercise of official authority vested in the ECITB as a public body, or
• for legitimate business use.

Such information will not be retained for longer than necessary for the purpose for which it was created or collected.

The ECITB has implemented a Data retention and Disposal Policy.  This sets out the ‘default’ retention periods for different categories of personal and other data.  In some cases certain data and will fall within an exemption to the default retention period where records should be kept for a longer or shorter period of time.

It is not always practical to permanently delete data when it is no longer required.  When personal data cannot be deleted for practical reasons, certain techniques and safeguards will be applied put that personal data “beyond use”. This means that the ECITB:

• will not, or will not attempt, to use the personal data to inform any decision in respect of any individual or in a manner that affects the individual in any way;
• will not give any third party access to the personal data;
• will surround the personal data with appropriate technical and organisational security; and
• will permanently delete the information if, or when, this becomes possible.

Data transfer outside the EEA

Sometimes the ECITB may transfer your details to third parties outside of the European Economic Area (EEA). If this happens the transfer and storage of your information will still comply with UK or EEA laws and this Privacy Policy.

Cookies

When you visit the ECITB’s website cookies are placed on your device.  Cookies are small text files that help the ECITB’s website to work and the ECITB to understand what information is most useful to the website’s users. They also speed things when you come back to a site. The ECITB does not use them to identify you personally.

You can delete cookies stored on your device at any time.

Cookies allow the following types of information to be gathered about your visits to the ECITB’s website, including your:

• IP address;
• Geographical location;
• Browser type;
• Device type;
• Operating system;
• Browsing data, such as access times;
• Navigation history; and
• Preferences.

Cookies enable the ECITB to use the tools and services of Google Analytics, which helps to measure and analyse how users are using the ECITB’s website.  ECITB’s staff and Google can access information related to Google Analytics cookies.

When the ECITB uses internet tools from other companies to enhance its website, these companies may also put cookies on your device. They include:

• Facebook;
• Google Maps;
• Twitter;
• LinkedIn;
• YouTube;
• WordFence; and
• WordPress.

Phone

The ECITB does not record telephone calls which it makes or receives.

Email and social media

There are many ways you may communicate with the ECITB online, including by:

• Email;
• Social media (such as Facebook, LinkedIn, YouTube, Google+ or Twitter);
• Video conferencing (such as GoToMeeting, Webex, and Skype for Business); and
• File sharing platforms.

When you use email, social media and other online platforms, it is likely you know what information you are sharing with the ECITB.  How the ECITB uses and processes your information, who accesses it, and how long it is kept, depends on the context in which the information has been collected.  For example, if you participate in video conferencing such proceedings may be recorded. However, in such circumstances the terms of the ECITB’s Privacy Policy and UK law will be followed.

Your payment details

The ECITB uses bank details to process orders (for example, for replacement cards), collect levy payments and distribute funds, such as training grants.

The ECITB does not use such information for any purpose authorised which has not been authorised, and does not disclose it to third parties without permission.

The ECITB processes credit and debit card transactions following the Payment Card Industry Data Security Standard.  Only ECITB authorised staff and contracted data processors have access to your payment details to carry out your transactions.

For bank and building society account transactions, the ECITB may make a record of your:

• Account name;
• Branch address;
• Sort code; and
• Account number.

The ECITB keeps your bank or building society details only for as long as they are needed.  When this is no longer the case, the information is deleted.

Insofar as payment card information and transactions are concerned, the ECITB accepts payments made by credit and debit cards.  The ECITB processes data such as the:

• Cardholder’s name;
• Card number;
• Card security code (CSC);
• Validity and expiry dates; and
• Issue number

The ECITB usually collects card data by telephone directly from the card holder.  This information is immediately entered into the card payment system.  The ECITB does not record payment card information.  The relevant transaction report subsequently received from the card payment system provider only contains details of the amount, the card bearer’s name and the final 4 digits of the card number.

Children

The ECITB’s website may include content designed to impart information to people of school age who may be interested in careers in engineering, and more particularly in the engineering construction industry.  In all other respects, the ECITB’s website, services and products are not aimed at children, and the ECITB does not knowingly collect any information from them.

The ECITB asks children not to register with the ECITB or give us any of their information.

Where the ECITB has inadvertently collected information from a child, it will be deleted as soon as this is discovered.

If you know that a child has given their information to the ECITB, please contact the ECITB’s Data Protection Officer (at dpo@ECITB.org.uk).

C       Your rights

Summary of your rights

You have the right to:

• Ask for a copy of any information the ECITB holds about you;
• Withdraw any consents you have given;
• Lodge a complaint with the ECITB or the Information Commissioner’s Office or with any other relevant supervisory authority about how the ECITB handles your personal data;
• Ask the ECITB to correct any inaccurate or incomplete information it has about you;
• Ask the ECITB to delete your information from its records; and
• Ask the ECITB to send a copy of your information to a third party in a data portable format.

Making a request to see your information

To see the information the ECITB holds about you, you should make a Subject Access Request in writing, including your:

• Full name, including previous or other names, if appropriate;
• Address;
• Telephone;
• Unique ECITB registration or ID numbers, if appropriate; and
• Date of birth, if you don’t have a unique registration number

You should send the Subject Access Request to:

Data Protection Officer
ECITB
Office Suite KD3 First Floor
KD Tower
Cotterells
Hemel Hempstead
HP1 1FW

Email:  dpo@ECITB.org.uk

D       ECITB’s training courses and services

Card schemes

The ECITB manages card schemes, which help to ensure the safety and proficiency of the engineering construction workforce in Great Britain and abroad. Individuals undertake the ECITB’s safety training courses (for example, “CCNSG” safety training courses in GB, and  “IHSP” safety training courses abroad) and take assessment tests, which lead to the award of cards certifying safety training and test achievements.  Through these schemes it is possible to check someone’s identity and training achievements or qualifications.

The ECITB records your scheme achievements in a database.  Your card scheme data may be shared with other parties (see “How ECITB uses Personal Data” above).

The ECITB will keep card scheme information for no longer than 50 years from the expiry date of your last achievement.

ECITB Apprenticeships

The ECITB offers support relating to apprenticeships in the engineering construction industry across Great Britain.

The ECITB receives Personal Data about you in connection with your participation in apprenticeship programmes relating to the ECITB apprenticeship frameworks and standards.  The information may be provided to the ECITB by you, your employer or by a training provider involved in your training.

When you provide the information (for example, through an application process) the ECITB uses the information to understand your career goals and development needs, so that you can be placed with the right employer and/or training provider.  Your data will not be shared with parties other than those involved in your apprenticeship, including relevant regulatory authorities in the education sector, current and prospective employers and training providers.

Your apprenticeship data may be shared with other parties (see “How ECITB uses Personal Data” above).

The ECITB keeps a record of your apprenticeship for up to 50 years.

Other ECITB Training Courses and Awards

Additionally, the ECITB offers a range of training courses, awards, qualifications and other related services in Great Britain and abroad.  The ECITB may receive Personal Data about you in connection with such services in the same way that it does in connection with Apprenticeships (see above).  The ECITB collects and uses Personal Data in connection with its training courses and awards for the reasons and in the circumstances explained in section B of this Privacy Policy above.

Your training and awards data may be shared with other parties (see “How ECITB uses Personal Data” above).

ECITB keeps a record of your training and other achievements for up to 50 years.

Grants and funding

The ECITB provides grants and other funding in support of training and career development largely to learners, employers and training providers in the engineering construction industry in GB.  In order to administer the agreement and payment of grants and other funding, the ECITB may collect Personal Data about you.

For example:

• Employers and training providers can express an interest in or apply for grant funding to the ECITB.  This may occur via the ECITB’s internet portal systems.
• Evidence of training activity containing your Personal Data may be received and is required by the ECITB to demonstrate that agreed training activity has occurred as a condition of grant payment.

This information is stored in a secure database.  Only the ECITB’s staff, contracted data processors and auditors have access to the information.  The ECITB may keep your information for at least 7 years, in view of accounting requirements/legislation, and possibly longer if a funding authority is also involved.

Research

The ECITB conducts and commissions research and analysis relating to the engineering construction industry sector to help the industry improve and succeed (as permitted by the Industrial Training Act 1982) and to meet governmental requirements.

Whenever possible the ECITB and its commissioned contractors use anonymous information that cannot be linked to you, or pseudonymous information which replaces your name or other identifying data with something else to make it virtually impossible to identify you.  However, if it is necessary to use your Personal data in connection with its research activities, the ECITB may use any of the information it has collected about you in the research.

ECITB staff and contracted data processors performing research have access. If necessary, the ECITB may also share information with agents, service providers, and survey and research organisations.

Levy

The ECITB has statutory powers to collect the industrial training levy from engineering construction employers to fund training in the sector.  The ECITB keeps a register of engineering construction establishments and employers, which is used in connection with the assessment and collection of levy from those who are required by law to pay it.

In the administration of the industrial training levy the ECITB may use your:

• Contact details to ask you to confirm the ECITB’s records about you or your employer; and
• Employer’s details to determine if it is liable to pay the levy, to process levy assessments, to issue levy collection notices and to process levy payments.

Only ECITB staff, contracted data processors and the ECITB’s professional advisors have access to such information.  The ECITB keeps levy data for 10 years after you or your company is no longer required to complete a levy return.