CEC Privacy Notice & Cookies
This document is the ¸£Àû¼§ and Enterprise Company’s general Privacy Notice. It provides information about our processing of your personal data, summarises your data rights and explains how to contact us or complain about our data processing.
1. Introduction to CECÌý
The ¸£Àû¼§ and Enterprise Company Ltd (CEC) is the national body for careers education in England, supporting schools and colleges to deliver modern, 21st century careers education.Ìý
Our mission is to help every young person find their best next step. Our work is evidence-led so data is essential in achieving this mission.ÌýÌý
We achieve our mission by working with primary, secondary and special schools, pupil referral units, colleges, Independent Training Providers (ITPs) and employers to improve careers education and secure better outcomes for young people.Ìý
2. Using our Privacy Notice and Contacting Us about Your DataÌýÌý
We have structured this Privacy Notice to make it easier to understand how we process your personal data based upon your relationship with CEC. It was built upwards from the records of processing activities (ROPA) maintained by each team to give a transparent picture of the personal data we process in our work and our purposes for doing so.Ìý
If you engage with us in a new way, we may provide additional information about how we will process your personal data for that purpose. The additional information acts as a supplement to this general Privacy Notice.ÌýÌýÌý
If you have questions about CEC’s data processing not answered by this Privacy Notice, please contact our Data Protection Officer. Email dpo@careersandenterprise.co.uk or write to:ÌýÌý
Claire Stevenson, Data Protection Officer, The ¸£Àû¼§ and Enterprise Company Limited, 1st Floor, Work.Life, 120 Aldersgate St, Barbican, London EC1A 4JQÌý
Cookie Policy
3. The Data we process, our Purposes, and our Lawful Basis for processing data
A. Young People
We process data about Young People for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:
Ìý
- To support schools, special schools, colleges and independent training providers in their careers education provision, recording and improvementÌý
- To plan, deliver and measure the effectiveness of CEC programmes and eventsÌý
- To safeguard young people involved in CEC programmes and eventsÌý
- To conduct research related to our missionÌý
- To promote and publicise work to achieve our mission (photography, video. audio recordings which you have granted us a license to use)Ìý
- To give Young People a voice in the governance of CECÌýÌý
- To manage work experience at CECÌý
- To enable systems management and securityÌý
- For CEC’s legal and compliance purposes
We process the following types of personal data about Young People:
Ìý
- Personal identifiers including name and date of birthÌý
- Educational establishment(s) attendedÌý
- Email addressÌý
- Career education engagement and experiencesÌý
- Career interests, intentions and readinessÌý
- Post-compulsory education destinations and Employment, Education or
- Training (NEET) statusÌý
- Special category and other sensitive information including SEND status and indicators of disadvantage such as free school meal status, Pupil Premium status, low school attendance, exclusions, EHE (elective home education) status, English as an Additional LanguageÌý
- Attainment data (if Young Person takes part in a CEC programme)Ìý
- Opinions (responses to surveys and other research)Ìý
- Photographs, video and audio recordings (If you have been involved in a CEC project and granted us a license to use these)Ìý
The lawful bases for processing Young People’s personal data are:Ìý
Ìý
- Necessity for the performance of our task in the public interest related to our mission to help every young person to find their best next stepÌý
- Necessity for compliance with a legal obligationÌý
- Necessity for CEC’s legitimate interests in relation to security, safeguarding and legal risk.Ìý
Our work is at national scale and delivered through our network of ¸£Àû¼§ Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership with local democratic authorities to connect with local skills needs.Ìý
Ìý
Organisations who enable us to deliver our work have access to Young People’s personal data only where necessary. Data protection law calls these organisations Data Processors. They include IT partners who host or develop our databases or support systems security. We take steps to verify that Data Processors can protect your data, ensure that appropriate contractual agreements are in place, and we monitor their performance.ÌýÌý
Ìý
If you are invited to take part in CEC research or a project, we will provide more information to you and your school about how your data will be used for that work. Where we work with partner or supplier organisations on these projects, it may be necessary to provide your personal data to enable them to deliver and evaluate the project, or to keep you safe when you take part.Ìý
Ìý
We do not share young people's individual personal data with other organisations for their own purposes unless we are legally required to.
B. ¸£Àû¼§ Leaders and Education Provider Staff
This category includes ¸£Àû¼§ Leaders and Educational Institution Staff.Ìý
We process data about ¸£Àû¼§ Leaders for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:Ìý
Ìý
- To support schools, colleges and independent training providers in their careers education provision, recording and improvementÌý
- To support institutions in their uptake and use of CEC’s digital tools and resourcesÌý
- To promote and publicise work to achieve our missionÌý
- To plan, deliver and measure the effectiveness of CEC programmes and eventsÌý
- To conduct research related to our missionÌý
- To enable systems management and securityÌý
- For CEC’s legal and compliance purposes
We process the following types of personal data about ¸£Àû¼§ Leaders and Education Provider Staff:Ìý
Ìý
- Personal identifiers including your name, job title and the name of the school or college which is your employerÌý
- Contact details including your email address, telephone number and employer’s addressÌý
- The CEC digital products you are registered to use and your user type (for example, whether you are your institution’s primary user with admin rights)Ìý
- Records of your engagement with our digital products, Customer Management services, training, programmes and other services and eventsÌý
- Your responses to surveys and other researchÌý
- Your image and comments for a case study or articleÌý
The lawful bases for processing ¸£Àû¼§ Leaders and Education Provider Staff personal data are:Ìý
Ìý
- Performance of our task in the public interest which is related to our mission to help every young person to find their best next stepÌý
- Performance of a contractÌý
- Consent to receive marketing communicationsÌý
- Necessity for compliance with a legal obligationÌý
- Necessity for CEC’s legitimate interests in relation to security and legal risk.Ìý
Our work is at national scale and delivered through our network of ¸£Àû¼§ Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs.Ìý
Ìý
We provide access to ¸£Àû¼§ Leader personal information where necessary to enable partnership working towards our mission and to enable our suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý
C. Employer Contacts and Volunteers
This category includes Employer Contacts and Volunteers
Please note that the organisation which hosts the ¸£Àû¼§ Hub which is a Volunteer’s main point of contact conducts recruitment and verification activities for volunteers from industry. Similar personal data processing activities to those described in section 3E for Job Applicants also verify volunteers' suitability.Ìý
We process data about Employer Contacts and Volunteers for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:Ìý
Ìý
- To support links between employers and schools, colleges and independent training providersÌýÌý
- To promote and publicise work to achieve our missionÌý
- To plan, deliver and measure the effectiveness of CEC programmes and eventsÌý
- To conduct research related to our missionÌý
- To enable systems management and securityÌý
- For CEC’s legal and compliance purposesÌý
- Applicants for volunteer positions should also refer to section 3.E.i relating to job applicants for details of additional processing purposes.Ìý
We process the following types of personal data about Employer Contacts and Volunteers:Ìý
Ìý
- Personal identifiers including your name, job title and the name of the Employer you representÌý
- Contact details including your email address, telephone number and employer’s addressÌý
- Your volunteer statusÌý
- Your engagement with our products, training, programmes and other services and eventsÌý
- Your responses to our surveys and other researchÌý
- Applicants for volunteer positions should also refer to section 3.E.ii relating to job applicants for details of additional categories of personal data processed.Ìý
The lawful bases for processing Employer Contacts and Volunteers data are:Ìý
Ìý
- Performance of our task in the public interest related to our mission to help every young person to find their best next stepÌý
- Performance of a contractÌý
- Consent to receive marketing communicationsÌý
- Necessity for compliance with a legal obligationÌý
- Necessity for CEC’s legitimate interests in relation to security and legal riskÌý
- Applicants for volunteer positions should also refer to section 3.E.iii relating to job applicants for details of additional lawful bases.Ìý
Our work is at national scale and delivered through our network of ¸£Àû¼§ Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs.Ìý
Ìý
We provide access to Employer Contacts and Volunteers personal information where necessary to enable partnership working towards our mission and to enable our suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý
Ìý
Applicants for volunteer positions should also refer to section 3.E.iv relating to job applicants for details of the additional data sharing involved.Ìý
D. Partners and Supplier Staff
This category includes the staff of suppliers and other organisations we work with, including organisations hosting Career Hubs and our funders.
We process data about Partners and Supplier Staff for the following purposes:Ìý
Ìý
- To manage our contract and partnership working with your employerÌý
- To communicate with you in order to facilitate operationsÌý
- To enable systems management and securityÌý
- For CEC’s legal and compliance purposes.Ìý
We process the following types of personal data about Partners and Supplier Staff:Ìý
Ìý
- Personal identifiers including your name, job title and the name of the Employer you representÌý
- Contact details including your email address, telephone number and employer’s addressÌý
- Your role in relation to our contractÌý
- Records of our communicationsÌý
The lawful bases for processing Partners and Supplier Staff data are:
Ìý
- Performance of a contractÌý
- Necessity for compliance with a legal obligationÌý
- Necessity for CEC’s legitimate interests in relation to security and legal riskÌý
Our work is at national scale and delivered through our network of ¸£Àû¼§ Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs.Ìý
Ìý
We provide access to Partners and Supplier Staff personal information where necessary to enable partnership working towards our mission and to enable other suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý
E. Job Applicants
We process data about Job Applicants for the following purposes:Ìý
Ìý
- To assess the fit of the Job Applicant to the position applied forÌý
- To communicate with the Job Applicant (or recruiter where applicable) regarding their applicationÌýÌý
- To arrange and manage our selection processesÌý
- To verify the suitability of candidates offered a position subject to verificationÌý
- To monitor CEC’s equity, diversity and inclusionÌý
- To enable systems management and securityÌý
- For CEC’s legal and compliance purposesÌý
We process the following types of personal data about Job Applicants:Ìý
Ìý
- Personal identifiers including your name and date of birthÌý
- Contact details including your email, telephone number and home addressÌý
- QualificationsÌýÌý
- Employment historyÌý
- Other information volunteered by you within application and selection processÌý
- Application scoringÌý
- Special category data including ethnic/ racial origin, nationality, disability status, sexual orientation, marital status (for CEC’s EDI monitoring)Ìý
Ìý
Additionally, we process the following types of personal data about successful Job Applicants who have been offered a position subject to verification of suitability:Ìý
Ìý
- Criminal record data (if a criminal record check via the Disclosure and Barring Service is required due to the nature of the role this will be noted within the vacancy advert and/ or job description)Ìý
- Health data, sickness absence record and reasonable adjustment requestsÌý
- Employment and/ or educational/character references provided by your nominated refereesÌý
The lawful bases for processing Job Applicants’ personal data are:Ìý
Ìý
- CEC’s legitimate interest in recruiting job applicants who provide the best fit to role requirementsÌý
- Performance of a contract (successful Job Applicants who accept a role offered subject to verification of suitability)Ìý
- Necessity for compliance with a legal obligationÌý
- Necessity for CEC’s legitimate interests in relation to security and legal risk.Ìý
We provide access to Job Applicant personal information where necessary to enable our suppliers to support our recruitment and suitability verification processes. In such cases we take steps to verify that suppliers provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý
Ìý
Verification for successful candidates also requires us to provide your nominated referees with your personal identifiers and details of the position you have been offered subject to verification.Ìý
Ìý
We do not share Job Applicant personal data with other organisations for their own purposes unless we are legally required to.
F. Employees
In addition to the personal data processing described in this section, CEC process employees’ personal data described at section 3.E for Job Applicants.
We process data about Employees and other workers for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:Ìý
Ìý
- To communicate with Employees and support employee relationsÌý
- To provide salary, pension and other benefitsÌý
- To reward and manage performanceÌý
- To assess training and development requirementsÌý
- To facilitate HR managementÌý
- To monitor CEC’s equity, diversity and inclusionÌý
- To enable systems management and securityÌý
- For CEC’s legal and compliance purposesÌý
We process the following types of personal data about Employees:Ìý
Ìý
- Personal identifiers including name and date of birthÌý
- Contact information including personal email address, telephone number and home addressÌý
- Bank details, tax code and national insurance numberÌý
- Benefit selectionsÌý
- Absence records including sickness absence, annual, parental and other types of leave/ absenceÌý
- Performance dataÌý
- Grievance and Disciplinary recordsÌý
- Records of requests for reasonable adjustments and flexible working arrangementsÌý
- Health and disability informationÌý
- Data about use of CEC IT assets and compliance with our Acceptable Use PolicyÌý
- Special category data including ethnic/ racial origin, nationality, disability status, sexual orientation, marital status (for CEC’s EDI monitoring)Ìý
- The name and contact details of your next of kin/ emergency contactÌý
The lawful bases for processing Employees’ personal data are:Ìý
Ìý
- Necessity for CEC’s legitimate interest in managing employees to facilitate our mission of helping every young person to make their best next stepÌý
- Performance of a contractÌý
- Necessity for compliance with a legal obligationÌý
- Necessity for CEC’s legitimate interests in relation to security and legal risk.Ìý
We provide access to employee personal information where necessary to enable our partners and suppliers to support the delivery of our work. In such cases we take steps to verify that organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý
G. Website visitors
For information about data processing in relation to the use of our digital products for education, please see section 3B.
We process data about website visitors for the following purposes:Ìý
Ìý
- To provide essential website functionalityÌý
- To understand how the website is usedÌý
- To improve performance of the website and user experienceÌý
- To respond appropriately to information you enter into our web formsÌý
- To enable systems management and securityÌý
- For CEC’s legal and compliance purposes.Ìý
We process the following types of data about Website Visitors:Ìý
Ìý
- Information you enter in our web forms. This may include:Ìý
- Personal identifiers including your name and date of birthÌý
- Contact details including your email, telephone number and home addressÌý
- Your employerÌý
- Your query or a registration for CEC training, a service or other eventÌý
- Other information you have chosen to enter into a web formÌý
- Cookies and similar technologies which provide information about your system, pages visited, and content accessedÌý
Ìý
When you browse our website you will be presented with a pop up which provides information about Cookie options. Only cookies which are strictly necessary for the basic functioning of our website are essential and cannot be refused. More information about CEC’s use of Cookies is available in our Cookie Policy
The lawful bases for processing Website Visitors’ personal data are:Ìý
Ìý
- Your consent when you register to receive marketing communicationsÌý
- Your consent to set cookiesÌý
- Performance of our task in the public interest related to our mission to help every young person to find their best next stepÌý
- Our legitimate interest in processing the data you enter into our web forms and responding appropriately.ÌýÌý
- Please also see the appropriate section relating to the forms’ purpose. For example, Section 3B if you are a ¸£Àû¼§ Leader who used a form on our website to register for an eventÌý
- Necessity for compliance with a legal obligationÌý
- Necessity for CEC’s legitimate interests in relation to security and legal risk.Ìý
Our work is at national scale and delivered through our network of ¸£Àû¼§ Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs.Ìý
Ìý
We provide access to Website Visitor personal information where necessary to enable partnership working towards our mission and to enable our suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý
4. How long we keep your personal dataÌý
We will only keep your personal data for as long as we need it. CEC has a retention schedule for personal data based on the needs of the organisation, fairness to you, and applicable law.ÌýÌý
We take necessary steps to keep your information safe throughout the time we keep your data: CEC holds the international standard ISO 27001 certification for information security as well as the UK government’s Cyber Essentials Plus verification.ÌýÌý
5. Processing personal data outside the UKÌý
When CEC processes personal data outside the UK, we make sure we comply with data protection law and take necessary steps to keep your personal data safe.Ìý
6. Your data protection rightsÌý
Under data protection law, you have rights including:Ìý
- Right of accessÌý
You have the right to ask us to see the personal information we are processing about you.Ìý
- Right to rectification Ìý
You have the right to ask us to rectify personal information you think is inaccurate or incomplete.Ìý
- Right to erasure Ìý
You have the right to ask us to erase your personal information in certain circumstances.Ìý
- Right to restriction of processingÌýÌý
You have the right to ask us to restrict the processing of your personal information in certain circumstances.Ìý
- Right to object to processing Ìý
You have the right to object to the processing of your personal information in certain circumstances.Ìý
The Information Commissioner’s Office (ICO) provides more information about each of these data protection rights on its web site: ÌýÌý
7. How to complainÌý
If you have concerns about our use of your personal information, you can make a complaint to the Data Protection Officer. Email dpo@careersandenterprise.co.ukÌýÌý
The ICO is the independent authority responsible for supervising compliance with data protection law in the UK. You may also complain to the ICO by writing to:ÌýÌý
ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.Ìý
Helpline number: 0303 123 1113ÌýÌý
ICO website: https:/ÌýÌý
8. Changes to this privacy noticeÌý
This privacy notice will be updated from time to time, and we encourage you to check our website for updates.Ìý
Date of last update: 17 September 2024Ìý