Privacy notice for Users of HERE for Schools and HERE for Business

What do we use the information for?

HERE for Schools and HERE for Business are designed to give the education sector, businesses and other organisations access to a single place to learn about, and purchase traded and discretionary services.

The HERE websites use SLA Online, a system provided by Frontline Data Limited and managed by the council. 

The system allows registered users to purchase services on behalf of their school, company or organisation; view and book training courses and events for their staff and governors and access help, resources and news.

Each school, company or organisation is responsible for managing other authorised users of the system together with any delegated authority to make purchases on behalf of the school, company or organisation.

HERE for Schools (external website) 

We collect, process and hold your personal information in order to provide our services effectively.  

• To provide services under a service level agreement, service agreement or other contractual agreement which includes Continuing Professional Development (CPD) courses
• To provide administration and quality assurance of services, training and events delivered
• To provide information to course administrators so they are aware of who is expected to attend
• To provide information related to local policies and practices pertinent to your role. 

We also use information to improve our services so that they are more appropriate to people’s requirements. We recognise that you personal  information is important to you, and we take our responsibilities for ensuring that we collect and manage it proportionately, correctly and safely very seriously. 

What information do we hold and use?

We collect and process the following:  

• Personal Information (including full name) 
• Contact details (such as  email address and school / company / organisation telephone number)
• Job title
• School / company / organisation name.

Where course and event bookings are made by users, there is provision to share specific disability, accessibility and dietary needs of participants to enable suitable arrangements to be made before and during the course or event.

Each individual service agreement may require additional personal information to be processed to enable the service to be delivered following purchase. Service agreements contain specific information about the subject matter, duration of processing, type of personal data processed and retention, destruction and return of data.

On what grounds do we use the information?

We process personal data for the following reasons: 

• GDPR Article 6(1)(a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes
• GDPR Article 6(1)(b) - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• GDPR Article 6(1)(f) - processing is necessary for the purposes of the legitimate interests pursued by the controller or by third party.

We process special category data for the following reasons:

• GDPR Article 9(2)(a) - the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject.

How do we collect this information?

We may collect information in the following ways:

• Requested by the customer
• Input by the customer. 

Who do we share your information with?

HERE for Schools and Business may need to share your information with our subcontracted service providers  in the course of delivering a contractual service. This is outlined within the data protection section of each contracted service held within the system. 

The reason why we may share your data are for the necessary delivery of the contracted service purchased through they system. 

We will not pass your personal information to external organisations for marketing or sales purposes or for any commercial use without your prior expressed consent. 

How long do we store it and is it secure?

We keep your information as long as you retain a live login. You may update and correct this at any time. Records of purchases are retained for 6 years following completion of service delivery. This is so that we can keep required auditable records.

Where a user account is set up but no purchase is made over a 12 month period. We will erase the data unless we make contact with you and you require us to maintain the account for a further period.

Your information is stored on a secure server hosted by KCOM Group PLC, a company registered in England and Wales under number 2150618. Their security arrangements are here:  

KCOM Group PLC (external website) 

The council has retention schedules in place to ensure that information is only held for as long as it is needed. We will not keep your information for longer than is required to by law.  Your information will be disposed of in a controlled and secure manner in accordance with the council’s Records Management and Data Quality Policy. The council’s IT security and confidentiality policies ensure that your information is protected, and accessed only by staff directly involved in your care.  

For information on how long your information will be held, visit the retention page.

What rights do you have?

The rights that you have depend upon the grounds upon which we collected your information.  All of the rights you could have are outlined on the data protection rights page. 

In most cases, people who have been involved with HERE for Schools and HERE for Business will have the following rights:

• The right of access -  you are entitled to see the information  the service holds about you. 
• The right to rectification -  we will amend information accordingly. If any information  the service holds about you  is incorrect.
• The right to erasure / right to be forgotten - in certain circumstances, you may be able to ask for some of the information we hold to be deleted. The service has determined that all requests to permanently delete a service user record will be dealt with on an individual basis.  

To exercise any of your above rights, please visit the data protection rights page for more information. 

Where can I find out more?

If you want to know more about how the council uses information, your rights or have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance; contact details are available on the general privacy information page. Alternatively, you can contact the Information Commissioner's Office (ICO). The ICO is the UK’s independent authority set up to uphold information rights in the public interest and they handle public concerns regarding organisations information rights practices. 

Information Commissioner’s Office (external website)

When was this privacy notice last updated?

We will continually review and update this privacy notice to reflect changes in our services, feedback from customers, and to comply with any changes in the law.  This privacy notice was last updated on 10 February 2021.