Privacy Policy

This Policy sets out the basis on which any personal information we collect from you, or that you provide to us, will be processed by us where you are a user of our services, a supplier of services or a visitor to our website.

It also tells you about your privacy rights under data protection laws such as the UK Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR) and the EU GDPR. Please read it so you know how and why we use your personal information, and contact us with any questions.

Controller for personal data

A controller is a person or organisation who, alone or jointly, decides why and how personal data is processed. Unless we tell you otherwise, we are the controller of your personal data for this website and where we interact with you directly.

Scope

• End users: where we provide our services or products to you through your employer.
• Suppliers: where suppliers or service providers provide products and services to us.
• Website visitors: where you visit our website.

What we collect depends on which of our products and services you use. It may come from your employer as part of their use of our products or services, from your use of our products, from documents or forms you complete, or from communications between us.

• Identity data: for example name or a unique identifier or reference number.
• Contact data: including email address, mobile phone number and correspondence address where required.
• Technical data: details of your visits to our website, such as traffic data, location data (including the country and telephone area code where your device is located) and the pages you view.
• Marketing data: your marketing preferences.
• Service data: information needed for the products and services your employer uses:
  • eSQEP: to manage assurance of competence, such as employment dates, team, department and location, skills, behavioural competencies, certification documents, assessment dates and times, and comments added by verifiers. We can also store extended HR information such as job title, organisation, location, manager, your photo and work contact details. You and your system administrators, with the right permissions, can access this data securely within the application.
  • Payroll: to process your pay we hold your date of birth, personal email address, name, home address, National Insurance number, tax code, gender, marital status, phone numbers, passport number (if you've given it to your employer), job title, employment start and end dates, salary details, hourly rate, hours worked, whether you have a student or postgraduate loan, attachment orders, bank account number, sort code, bank name and branch, pension provider and details of benefits in kind (as part of your P11D).
  • vILT users: email addresses (sourced from Cornerstone, so usually a work email, although external instructors may use a personal email) and user identifiers (Cornerstone user ID, username and GUID; Teams/AD username and GUID; Teams membership ID).

If you give us personal information about another person, you must make sure they agree and know how we use personal information as set out in this Policy.

Most of the personal information we process is given to us directly by you or by your employer. We use it on the following lawful bases:

• Performance of a contract: where we need to perform a contract we have, or are about to enter into, with you. For example, with an employer for the end user's benefit.
• Legal obligation: where we need to comply with the law, for example for accounting or legal purposes.
• Legitimate interests: where it's necessary for our legitimate interests, or those of a third party, and your interests and fundamental rights don't override them.
• Consent: we don't generally rely on consent. Where we do, you can withdraw it at any time. For eSQEP, vILT and Payroll, you can withdraw consent through the right person at your employer, such as HR, the DPO or Payroll.
• Vital interests: where it's necessary to protect your vital interests in an emergency.
• Public obligation: where we need to comply with a public obligation, for example in matters of public health or public interest.

End users

Suppliers

Website visitors

Where we need personal data by law or under a contract and you don't provide it, we may not be able to perform the contract, for example to provide our services. If that happens, we'll tell you at the time.

We may send you marketing communications. You have the right to object to direct marketing. You can unsubscribe at any time using the link in our emails or by contacting us. Opting out doesn't apply to personal data we hold because you use our services.

We will never sell or rent your personal information. We may share it with:

• Our team: employees and contractors working on your services, on a need-to-know basis.
• Service providers: who support our business, including IT, communications and outsourced business support.
• Marketing and PR providers: who help us with marketing and PR.
• Professional advisers: including lawyers, bankers, auditors and insurers. For Payroll, we share information with HMRC for PAYE and with your pension provider for pension contributions.
• Law enforcement, regulators and other authorities: to meet our legal obligations or follow good practice.
• Other third parties: where we have a legal duty, such as a court order, or to enforce our agreements or protect our rights, property or safety and those of our customers, employees or others.
• Analytics and advertising providers: to understand how our website is used and to support ads on our website and social media.
• A buyer of our business: if all or part of our business is sold or reorganised, the new owners may use your data in the same way as set out here.

Our service providers must keep your data secure and may only use it for specified purposes, on our instructions.

We have security measures in place to stop your personal information being accidentally lost, used or accessed without permission, changed or disclosed. Only people with a business need can access it, on our instructions and under a duty of confidentiality. We have procedures for any suspected data breach and will tell you and any regulator where we're legally required to.

SQEPtech holds Cyber Essentials Plus certification.

We keep personal data only for as long as we reasonably need it for the purposes we collected it for, including legal, regulatory, tax, accounting or reporting requirements. We may keep it longer if there's a complaint or we reasonably believe there may be legal action.

To decide how long to keep it, we consider how much there is, how sensitive it is, the risk of harm from misuse, why we process it, whether we can achieve that another way, and our legal obligations.

We may transfer and process your personal data outside the UK or EU. When we do, we only transfer it to organisations that give the same level of protection as UK and EU data protection law:

1. to countries recognised as giving an adequate level of protection; or
2. using approved contracts, such as Article 46 UK and EU GDPR safeguards endorsed by the UK Government or European Commission.

For other countries, we follow local law to make sure personal data is transferred securely. Contact us to find out which safeguard we use.

Depending on where you are, you have rights under data protection law. Not all rights are absolute.

• Access: ask for copies of your personal information.
• Rectification: ask us to correct or complete information you think is wrong or incomplete.
• Erasure: ask us to delete your information in certain circumstances.
• Restriction: ask us to restrict how we process your information in certain circumstances.
• Objection: object to us processing your information in certain circumstances.
• Portability: ask us to transfer information you gave us to another organisation, or to you.
• Automated decisions: we don't make automated decisions that have legal or similarly significant effects on you.

There's no fee, unless a request is clearly unfounded, repetitive or excessive. We may ask you to confirm your identity first. We aim to respond within one month, and will tell you if a complex request takes longer. Please let us know if your details change so we can keep them accurate.

Our website uses cookies. Non-essential cookies only load if you agree, and you can change your choice at any time. See our Cookie Policy for the full list.

We'd like the chance to sort out any concern first, so please contact us. If it isn't resolved, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113, or to the data protection authority where you live or work.

SQEPtech Ltd, Heybury House, 2 Heybridge Lane, Prestbury, Cheshire SK10 4HD
Phone: +44 1625 813 664
Email: DPO@sqeptech.com

We may change this Policy in response to legal, technical or business developments, and will let you know when we do. We'll ask for your consent to any material changes where data protection law requires it.