How we use and protect your personal information.

Who we are

Eagles Consultancy Ltd provides education, training, workforce-development and consultancy services.

For the purposes of UK data protection law, Eagles Consultancy Ltd is normally the data controller for the personal information described in this notice.

On some publicly funded programmes, a government department, combined authority, local authority, college, prime contractor or other funding body may also be a controller of some learner information. Where this applies, you may receive an additional privacy notice from that organisation.

Who this notice covers

This notice may apply to:

• prospective, current and former learners;
• parents, carers and emergency contacts;
• people who make an enquiry or complete an online form;
• representatives of schools, colleges, employers, charities, community organisations and referral partners;
• placement providers, suppliers, contractors and professional advisers;
• visitors to our premises, website, online learning platforms and social-media pages; and
• people attending our events, workshops and training programmes.

Employees, workers, tutors, assessors, contractors and job applicants may also receive a separate workforce or recruitment privacy notice where appropriate.

Personal information we collect

The information we collect depends on your relationship with us and the service or programme you use. It may include:

Where we obtain information

We may obtain personal information:

• directly from you;
• from a parent, carer, advocate or authorised representative;
• from a school, college, employer, community organisation, referral agency or placement provider;
• from funding bodies, government departments, combined authorities, local authorities or prime contractors;
• from awarding organisations and previous education providers;
• from publicly available professional or organisational sources; and
• automatically when you use our website, online forms, learning systems or digital services.

Where information is obtained from another source, we will provide relevant privacy information within the period required by law unless an applicable exemption applies.

How and why we use personal information

We must have a lawful basis whenever we use personal information. The basis depends on the purpose and circumstances.

Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against your rights and reasonable expectations.

Special-category and criminal-offence information

Some information requires additional protection under data protection law. Depending on the programme and your individual circumstances, this may include information about:

• racial or ethnic origin;
• religious or philosophical beliefs;
• health, disability or learning needs;
• sexual orientation;
• trade-union membership;
• biometric information used for identification;
• safeguarding or welfare matters; and
• criminal convictions, allegations or offences.

We only use this information where we have both an Article 6 lawful basis and an additional condition permitted by UK data protection law.

Depending on the purpose, these conditions may include explicit consent, employment and social-protection law, protecting vital interests, substantial public interest, health or social-care purposes, equality monitoring, preventing or detecting unlawful acts, safeguarding, or establishing and defending legal claims.

Where required, our Data Protection Policy and appropriate policy documents explain how this information is handled and retained.

Who we may share information with

We do not sell personal information. We only share it where there is a legitimate purpose and an appropriate legal basis.

Depending on the service, recipients may include:

• the Department for Education, Education and Skills Funding Agency and other government bodies;
• combined authorities, local authorities, colleges, prime contractors and funding partners;
• awarding organisations, examination bodies, external quality assurers and certification providers;
• employers, placement settings, schools, nurseries, care providers and other delivery partners;
• referral organisations, careers services, employment support providers and community partners;
• safeguarding partners, social care, healthcare professionals, police or other public bodies where necessary;
• accountants, auditors, insurers, legal advisers and professional consultants;
• IT, email, hosting, communications, customer-management, learning-platform and document-storage providers;
• payment processors and financial institutions; and
• regulators, courts, law-enforcement bodies or other parties where disclosure is required or permitted by law.

Organisations processing information on our behalf are required to use it only for agreed purposes, maintain appropriate security and comply with applicable data protection requirements.

Some organisations, including funding bodies and awarding organisations, use personal information as independent controllers under their own privacy notices.

Publicly funded learning

Where you apply for or take part in publicly funded learning, we may be required to collect additional identity, residency, employment, income, prior-learning, eligibility, participation and achievement information.

This information may be shared with the relevant funding body, commissioning authority, college, prime contractor, government department or auditor. It may be used to:

• confirm your eligibility;
• administer and fund your programme;
• monitor participation and achievement;
• prevent and detect fraud or error;
• evaluate publicly funded services;
• carry out research and statistical analysis; and
• meet statutory or public-accountability requirements.

Relevant funding bodies may provide their own learner privacy notice. Where they do, you should read that notice alongside this one.

Marketing and keeping in touch

We may contact you with information about courses, events, resources or services where:

• you have asked us to do so;
• you have provided consent;
• the communication relates to an existing enquiry, application, programme or organisational relationship; or
• another lawful basis and the electronic-marketing rules permit the communication.

You can unsubscribe from promotional emails at any time by using the unsubscribe option in the message or contacting us. We may still send essential administrative or service communications where necessary.

We will not provide your details to unrelated organisations so that they can market their own products or services to you without an appropriate legal basis.

Our website, online services and cookies

When you use our website or digital services, we may collect technical information about your device, browser, IP address, activity and interaction with our pages.

Some cookies and similar technologies are necessary for the website to operate. Other technologies, such as analytics, advertising or embedded-media cookies, should only be used in accordance with the choices available through our cookie controls.

Third-party content, including videos, maps, forms, payment tools or social-media features, may also set cookies or collect usage information under the provider's own privacy terms.

You can adjust your choices through the website's cookie controls and your browser settings. Disabling necessary technologies may affect how parts of the website operate.

International data transfers

Some of our technology and service providers may store or access personal information from countries outside the United Kingdom.

Where personal information is transferred internationally, we take steps intended to ensure that an appropriate level of protection applies. Depending on the destination and provider, these measures may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement or UK Addendum to approved contractual clauses;
• contractual and security assessments;
• recognised data-protection frameworks where legally available; or
• another safeguard permitted by UK data protection law.

You may contact us for further information about the safeguards relevant to a particular transfer.

How long we keep personal information

We keep personal information only for as long as it is reasonably required for the purpose for which it was collected and to meet relevant legal, contractual, funding, awarding-body, insurance and regulatory requirements.

When setting retention periods, we consider:

• the type and sensitivity of the information;
• the purpose for which it is used;
• funding-body, awarding-body and audit requirements;
• limitation periods for complaints or legal claims;
• safeguarding and public-interest considerations;
• tax, accounting and financial-record requirements; and
• whether the information can be deleted, anonymised or securely archived.

Further detail is maintained within our internal records and retention arrangements. You may contact us about the period relevant to a particular category of information.

How we protect personal information

We use proportionate organisational and technical measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction.

These measures may include:

• role-based access and account controls;
• password and authentication requirements;
• secure cloud and document-storage systems;
• encrypted communications or storage where appropriate;
• staff training and confidentiality requirements;
• supplier due diligence and data-processing agreements;
• secure disposal and retention procedures;
• backup, recovery and incident-management arrangements; and
• regular review of risks, systems and working practices.

No method of transmitting or storing information can be guaranteed to be completely secure. We nevertheless take reasonable steps to manage risks and respond appropriately to suspected personal-data breaches.

Automated decisions

We do not generally make decisions about learners or service users solely through automated processing where the decision would have a legal or similarly significant effect.

Digital systems may assist with activities such as eligibility checks, risk identification, communications, reporting or service administration. Where a significant decision involves automated processing, we will provide the additional information and safeguards required by law.

Your data-protection rights

Depending on the purpose and lawful basis, you may have the right to:

These rights are not absolute. For example, we may need to keep information to meet legal, safeguarding, regulatory, awarding or public-funding obligations.

We may ask for information to confirm your identity and clarify your request. We will normally respond without undue delay and within one month. The law permits an extension in certain complex cases, and we will tell you where this applies.

You will not normally be charged for exercising your rights. A reasonable fee may apply, or a request may be refused, where the law allows this because it is manifestly unfounded or excessive.

Children and young people

Some of our services may involve information about children and young people, including where we work with schools, nurseries, families, employers or education partners.

We take account of age, understanding and vulnerability when providing privacy information and deciding how information should be collected, used and shared.

Where appropriate, information may be provided to or obtained from a parent, carer, school or other responsible organisation. However, a child or young person may have their own data-protection rights depending on their age, understanding and circumstances.

Changes to this notice

We may update this notice to reflect changes to our services, working practices, legal obligations, funding arrangements or technology.

The latest version will be published on this page. Where a change is particularly significant, we may also notify affected individuals through an appropriate communication channel.

Questions, rights requests and complaints

Please contact our Data Protection Lead where you:

• have a question about this notice;
• want to exercise a data-protection right;
• want to withdraw consent;
• believe information we hold is inaccurate; or
• have a concern about how your personal information has been used.

We would welcome the opportunity to resolve your concern directly. You also have the right to complain to the Information Commissioner's Office.