不良研究所 Ltd
External Privacy Notice
Last Updated: 22/11/2024
1. Who we are and what we do
Who we are
We are 不良研究所 Ltd (“不良研究所”, “us”, “we”, “our”). We are a limited company registered in England and Wales under registration number 03866683 and charity number 1079836 and we have our registered office at West Gate, 6 Grace Street, Leeds LS1 2RP. We are registered with the UK supervisory authority, Information Commissioner’s Office (“ICO”) in relation to our processing of Personal Data under registration number Z6220820.
What we do
We are in the business of social care workforce development. We and our related entities are committed to protecting the privacy and security of the Personal Data we process about you.
Controller
Unless we notify you otherwise, we are the controller of the Personal Data we process about you. This means that we decide what Personal Data to collect and how to process it.
2. Purpose of this privacy notice
The purpose of this privacy notice is to explain what Personal Data we collect about you and how we process it. This privacy notice also explains your rights, so please read it carefully. If you have any questions, you can contact us using the information provided below under the ‘How to contact us’ section.
3. Who this privacy notice applies to
This privacy notice applies to you if:
1. You visit our website.
2. You participate in our partnerships and programmes.
3. You purchase goods or services from us, for example, on our bookshop or Learning Management System (LMS).
4. When you apply for and access your Quality Assurance account. In this case 不良研究所 Ltd will act as the processor of your personal data.
5. When you apply for and view the status of ASYE (assessed and supported year in employment) funding.
6. You enquire about our products and/or services.
7. You sign up to receive newsletters and/or other promotional communications from us.
4. What Personal Data is
‘Personal Data’ means any information from which someone can be identified either directly or indirectly. For example, you can be identified by your name or an online identifier.
‘Special Category Personal Data’ is more sensitive Personal Data and includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purposes of uniquely identifying someone, data concerning physical or mental health or data concerning someone’s sex life or sexual orientation.
5. Personal Data we collect
The type of Personal Data we collect about you will depend on our relationship with you. For the type of Personal Data we collect see the table below in the section entitled ‘Purposes, lawful bases and retention periods’.
6. How we collect your Personal Data
We collect Personal Data:
- directly from you in person, by telephone, or email and/or via our website, including by using analytics technology
- from your employers/social care service providers
- from our registered managers’ network
- others to whom you have provided consent
- publicly available sources.
7. Purposes and lawful bases
This notice applies to all Personal Data that is collected in relation to our services and we will only use your Personal Data when the law allows. Most commonly, we will use your Personal Data in the following circumstances:
Common uses for personal data
| Category of individuals | Categories of personal data | Purpose of processing | Lawful basis |
|---|
| Website users |
Login and password, name, address, email address, work phone number, postcode, job title, job role, organisation information, marketing preferences, interests. |
To allow you to register in our network and create an account. |
Contract. |
| Website users |
Name, phone number, email address, company, role, communication preferences, history of purchases and financial transactions. |
To allow you to buy our products on our bookshop or buy a registered manager membership. |
Contract. |
| Website users |
Name, email address, work phone number, any details you choose to share with us. |
To answer to your enquiries through the website and phone. |
Contract. |
| Website users |
Name, email address, login and password, marketing preferences and interests, information related to accessibility needs and disabilities. |
To send you marketing communications, including newsletters, informative content, surveys and invitations for events.
Accessibility and disability information is collected for the purposes of user research.
|
Consent if you are a customer, when carrying out B2C marketing.
Legitimate interests when carrying out B2B marketing.
Consent is the appropriate lawful basis for collecting special category data (accessibility and disabilities).
|
| Social care workers and assessors |
Name, gender, age group, nationality, ethnicity, registered disability, SWE registration number, work email address, work phone number, qualifications and education information, information about care services provided, records of training, number of sick days taken, employee ID, records of training, national insurance number.
|
To allow you to participate in our grant and funding management programmes and use our workforce management and funding platform. |
Processing is necessary for the performance of a task carried out in the public interest.
Consent is applicable when collecting special categories of data.
|
| Social care workers and assessors |
ASYE Programmes: Social care worker/assessors ID, role, data of birth, national insurance number, disability, ethnicity, citizenship, address, nationality, record of training and sickness.
SWRES (Social Care Workforce Race Equality Standard) programmes: job title, compensation salary band, ethnicity or racial origin, the existence of disciplinary processes, harassments and bullying in the workplace. This information is collected on an aggregate level from employers (separate Controllers), based on employee consent, and fully anonymised. However, a small number of individuals could be unintentionally identified for smaller organisations where individuals are the only small group of people belonging to a specific ethnicity, if their information (workplace, role, and ethnicity) are combined with other publicly available information.
|
ASYE and SCWRES Programmes: To understand the size and shape of adult social care and the issues affecting care providers and the workforce and obtain intelligence which is used at national and local level to inform policy, funding levels and commissioning decisions, including to mitigate workplace inequality based on ethnicity. To allow social care providers to better understand their workforce and how they compare with similar care providers in the sector by accessing benchmark reports. |
Special categories of data are collected under consent, which is sought by the employer as a Separate Controller before sharing personal data with 不良研究所.
Where 不良研究所 act as a Processor (ASYE Children and Family programme), the Data Controller establishes the applicable lawful basis.
|
| Social care workers and assessors |
Name, work email address, work phone number, role, organisation. |
To onboard your business and allow you to use our workforce management platform. |
Contract. |
| Website and platform users |
IP address, browser information and history, online behaviour, and information about how you interact with our website, such as: how long you spend on our website pages, what you click on while in our website, the order in which you see content and what device you use to access our website. |
To obtain analytical information regarding how users interact with our website, obtain insights and improve our website and products. For further information, please refer to our Cookie Policy. |
Consent. |
| Social care workers and assessors (ASYE and leadership programmes) |
Name, email address, phone number, job title, company, opinions about colleagues or self-assessment, log-in and password. |
To provide the 360 degrees tool as part of the ASYE or leadership programmes and allow you and colleagues appointed by you to assess your leaderships skills through a questionnaire. |
Contract – participation is optional. |
| QA Service Process |
Name, address, contact details, such as email address and telephone number. |
To consider and manage your QA Service application and the management and maintenance of such application, including audit. |
Consent. |
Where Personal Data is processed because it is necessary for the performance of a contract to which you are a party, we will be unable to provide our services without the required information.
8. Sharing your Personal Data
It is unlikely that we’ll ever share your personal data outside the UK, European Union or European Economic Area. If, however, it becomes necessary for the purposes of providing our services to you, we will only share it with organisations in countries benefiting from a European Commission adequacy decision or UK adequacy regulation, on the basis of Standard Contractual Clauses approved by the European Commission or International Data Transfer Agreement approved by the Secretary of State in the UK, which contractually oblige the recipient to process and protect your personal data to the standard expected within the UK/EU/EEA.
We may share your data with companies belonging to our Group, including our subsidiaries and holding, and with third-party companies that provide us with services and assistance, such as HR, finance, marketing automations, survey and assessment providers, and data management third-party cloud-based systems. We only transfer personal data to third parties that we trust and that are capable of providing adequate levels of data protection compliance.
We may choose to sell, transfer, or merge parts of our business, or we may seek to acquire other businesses or merge with them. During any such process, we may share your data with other parties. We’ll only do this if they agree to keep your data safe and private.
9. How long we keep your data
We will retain your personal data for as long as is necessary to provide you with our services and for a reasonable period thereafter to enable us to meet our contractual and legal obligations and to deal with complaints and claims.
At the end of the retention period, your personal data will be securely deleted or anonymised.
You can find more about our data retention periods by requesting a copy of our Data Retention and Deletion Policy.
10. International Transfers
Your Personal Data may be processed outside of the UK. This is because the organisations we use to provide our service to you are based outside the UK.
We have taken appropriate steps to ensure that the Personal Data processed outside the UK has an essentially equivalent level of protection to that guaranteed in the UK. We do this by ensuring that:
- Your Personal Data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (an adequacy regulation), or
- We enter into an International Data Transfer Agreement (“IDTA”) with the receiving organisation and adopt supplementary measures, where necessary. (A copy of the IDTA can be found here ).
11. Your rights and how to complain
You have certain rights in relation to the processing of your Personal Data, including to:
You have the right to know what personal data we collect about you, how we use it, for what purpose and in accordance with which lawful basis, who we share it with and how long we keep it. We use our privacy notice to explain this.
- Right of access (commonly known as a “Subject Access Request”)
You havethe right to receive a copy of the Personal Data we hold about you.
You have the right to have any incomplete or inaccurate information we hold about you corrected.
- Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete your Personal Data.
- Right to object to processing
You have the right to object to us processingyour Personal Data. If you object to us using your Personal Data for marketing purposes, we will stop sending you marketing material.
If you wish to receive additional communications from us, please let us know by: registering on our website and contacting our marketing team on marketing@skillsforcare.org.uk or 0113 241 0977.
You can unsubscribe to our marketing communications by following the unsubscribe link at the bottom of our emails, logging into our website and selecting ‘my account’ then ‘marketing preferences’ or contacting our marketing team on marketing@skillsforcare.org.uk or 0113 241 0977.
If you unsubscribe from our communications, we will keep a record of your preferences on a suppression list to ensure we don’t send you any further communications.
- Right to restrict processing
You have the right torestrict our use of your Personal Data.
You have the right to ask us to transferyour Personal Data to another party.
- Automated decision-making. You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We do not use automated decision-making.
- Right to withdraw consent
If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.
- Right to lodge a complaint
You have the right to lodge a complaint with the relevant supervisory authority, if you are concerned about the way in which we are handling your Personal Data. The supervisory authority in the UK is the Information Commissioner’s Office who can be contacted online at:
Or by telephone on 0303 123 1113
How to exercise your rights
You will not usually need to pay a fee to exercise any of the above rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
If you wish to exercise your rights, you may contact us using the details set out below within the section called ‘How to contact us and our Data Protection Officer’. We may need to request specific information from you to confirm your identity before we can process your request. Once in receipt of this, we will process your request without undue delay and within one month. In some cases, such as with complex requests, it may take us longer than this and, if so, we will keep you updated.
12. How to contact us and our Data Protection Officer
If you wish to contact us in relation to this privacy notice or if you wish to exercise any of your rights outlined above, please contact our appointed Data Protection Officer (“DPO”) as follows:
West Gate, 6 Grace Street, Leeds LS1 2RP
compliance@skillsforcare.org.uk
Please mark your communications FAO the ‘Data Protection Officer’.
13. Changes to this privacy notice
We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify of the changes where required by applicable law to do so.
Last modified 22/11/2024
Read the previous version of our privacy policy.