Privacy Policy

1. The purpose of this privacy policy

1.1. CIFA EDUCATION MANAGEMENT LTD, a limited company registered in England and Wales with company number 12852521 and registered office address at 94-96 Seymour Place, London, England, W1H 1NB (we, us, our) is committed to protecting the privacy and security of all prospective directors, employees, volunteers, apprentices, contractors and candidates. We operate numerous websites and platforms for the benefit of our valued customers - students like you. For this, this policy is applicable for all relevant websites and platforms operated by us.

1.2. Our services include (but are not limited to) the ability for you to be shown to prospective recruitment companies and employers via our platform and websites. You may have studied courses with us, undertaken certifications with us and created a digital profile/virtual resume via our platform and websites. We use this information to help you find a job by showing you to prospective recruiters and employers.

1.3. We are a data ‘controller’ for this information. This means that we are responsible for deciding how we hold and use personal data about you.

1.4. The purpose of this policy is to explain to you the personal data we hold about you, and how we collect, use and share it during the course of our Services and afterwards (whether or not those Services resulted in you becoming an employee). The provisions of the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 require that we notify you of this information. This policy explains:

1.4.1. who we are;

1.4.2. what personal information we collect about you;

1.4.3. how, when and why we collect, store, use and share your personal data;

1.4.4. how we keep your personal data secure;

1.4.5. how long we keep your personal data;

1.4.6. your rights in relation to your personal data; and

1.4.7. how to contact us, or the relevant supervisory authorities, should you have a complaint.

1.5. Please make sure that you read this policy together with any other related information or policies/notices that we may provide to you from time to time so that you know how and why we are using such information. A separate privacy policy will apply for the normal use of our platform and websites, usually related to your studying of our courses. You can access it here https://cifa.ac/privacy-policy.

1.6. Our contact details are as follows:

1.6.1. address 94-96 Seymour Place, London, England, W1H 1NB;

1.6.2. email [info]@cifa.ac.

1.7. We have appointed [name] to be our Data Protection Manager to oversee compliance with this privacy policy. If you have any questions about this privacy policy, or how we handle your personal information, please contact that person at the address given above.

2. The data protection principles

2.1. We will at all times comply with the data protection principles set out in the UK GDPR and Data Protection Act 2018 (which includes not only electronic data, but also personal data held in paper format in filing systems). We are registered with the Information Commissioner under ZA812255. We will ensure that your personal data is:

2.1.1. fairly and lawfully processed;

2.1.2. processed for limited purposes;

2.1.3. adequate, relevant and limited to what is necessary in relation to the purposes for which your data is processed;

2.1.4. accurate;

2.1.5. not kept longer than necessary;

2.1.6. processed in accordance with the data subject’s rights;

2.1.7. secure; and

2.1.8. not transferred outside the UK without adequate protection.

2.2. For these purposes, personal data means any information about an individual from which that individual is capable of being identified. It does not include data where the identity has been removed (anonymised data).

2.3. There are ‘special categories’ of sensitive personal data which require a higher level of protection. More on that further below.

3. The data we process

3.1. We may collect, store and process the following types of personal data relating to you:

3.1.1. information provided by you such as your name, address and contact details, including email address and telephone number;

3.1.2. details of your qualifications, skills, experience and employment history, including start and end dates with previous employers and with the organisation;

3.1.3. your video recordings and video resumes that you have submitted to one of our platforms o;

3.1.4. information about your courses and studies with us; and

3.1.5. details of your referees.

3.2. We may also, in certain circumstances, require:

3.2.1. information about any medical or health conditions, including whether or not you have a disability in connection with which we need to make reasonable adjustments;

3.2.2. details of your pension arrangements, and any related information necessary to enable us to implement and administer them;

3.2.3. information about your nationality and entitlement to work in the UK;

3.2.4. details of your driving licence and vehicles you are entitled to drive;

3.2.5. criminal records information, including the outcome of any Disclosure and Barring Service (‘DBS’) checks;

3.2.6. equal opportunities monitoring information, including information about your ethnic origin, sex, pronouns, sexual orientation, health and religion or belief; and

3.2.7. other relevant information as applicable and as required by us in order to ensure that we fulfil our obligations as a prospective employer.

3.3. If you have specific requirements when it comes to the pronouns you would like others to use, please contact us.

3.4. Note that some of this information is of the sort referred to as ‘special category’ data. Special category data is ‘personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation’. The processing of special category data is subject to restrictions and enhanced duties of care.

3.5. Where the data processed by us is special category data (for example your health data), we will rely on the following additional bases for processing that data; namely that it is:

3.5.1. for the purpose of carrying out our obligations and exercising our rights in relation to your employment and studies, and for the safeguarding of your fundamental rights;

3.5.2. to protect your vital interests or those of another person, where you are incapable of giving your consent;

3.5.3. for the purposes of preventative or occupational medicine, and assessing your working capacity as an employee;

3.5.4. in order to process personal data which is manifestly made public by you;

3.5.5. for establishing, exercising or defending a legal claim; or

3.5.6. for archiving purposes in the public interest.

3.6. In the event that we process data relating to criminal convictions and offences we will rely on the basis that this is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract.

4. How we collect your data

4.1. We may collect personal data about you in various ways. These include from:

4.1.1. our platforms and websites, accessible via https://cifa.ac/, to which you will

have submitted your personal data including video resume;

4.1.2. application forms that you have submitted to us, and from CVs;

4.1.3. letters, emails and other forms of communication sent by you or on your behalf;

4.1.4. your passport or other identity documents, such as your driving licence;

4.1.5. conversations (in person and by telephone) with you;

4.1.6. interviews, meetings or other assessments;

4.1.7. government departments;

4.1.8. your doctors and medical and occupational health professionals used by us;

4.1.9. the Disclosure and Barring Service (‘DBS’);

4.1.10. previous employers and referees; and

4.1.11. consultants and others used by us to carry out personnel reviews, or to be involved in recruitment processes and delivery of our Services.

4.2. Please note that in some cases personal data about you may be obtained from third parties, (for example references supplied by former employers and information from employment background check providers).

5. How we store your data

5.1. We will keep your personal data secure at all times. Although, please note that all personal data that you submit to our platforms and website as part of your digital profile will be viewable by the public. If you do not want this information to be viewed by the public or shared with third parties such as prospective recruiters and employers, please either (a) do not submit such information, or (b) if you have already submitted it, immediately remove it and contact us. As always, if you encounter any issues, please contact us immediately.

5.2. Personal data may be held at our offices, at third party agencies and service providers, and by our representatives and those agents used by us. Some of your data may be held on third-party software that has security measures in place. Where this takes place outside the UK then the provisions set out in Paragraph 8 below will apply.

5.3. We operate various security measures in order to prevent loss of, or unauthorised access to, your personal data. In order to ensure this, we restrict access to your personal data to those with a genuine business need to access it, including prospective recruiters and employers, and we have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

5.4. Personal data that is processed by us will not be retained for any longer than is necessary, for longer than you want or for purposes relating to or arising from that processing. How long we retain your personal data will depend on whether you decide to keep your data on our platform and websites or not. As you will have created a virtual resume or digital profile (used interchangeably), you can decide when to remove this information from our platform and websites. If you encounter any issues removing your personal data, please contact via our website and we would be happy to help.

5.5. Recruitment information, including any notes made during your interview (if applicable), will be kept for no longer than is reasonable, taking into account the limitation periods for potential claims, such as race or sex discrimination, after which they will be destroyed subject to you having removed and deleted the information from your digital profile on our websites and platforms. If you do not remove your personal data from our websites and platforms, we will remain of the position that you want to continue to be seen by potential recruiters and employers. Should there be a proper business reason for retaining recruitment records beyond the period of your recruitment, we may do so, but will always try and ensure that such data is retained in an anonymised form.

5.6. Where your personal data is retained after the Services have ended (and hence you have removed your personal data from our websites and platforms), this will generally be for one of the following reasons:

5.6.1. so that we can respond to any questions, complaints or claims made by you or on your behalf;

5.6.2. so that we are able to demonstrate that your employment and departure from this organisation or other orgaisations was fair, and that you were treated fairly at all times;

5.6.3. to establish, exercise or defend a legal claim;

5.6.4. to assist our clients with matters relating to their employment or engagement of you;

5.6.5. in order to comply with legal and regulatory requirements.

5.7. Please note, however, that different periods for keeping your personal data will apply depending upon the type of data being retained and the purpose of its retention.

5.8. In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

6. How we use your personal information

6.1. We need to process your personal data in connection with the recruitment-like process and to provide our Services, to meet our obligations to you in that regard, and to ensure that we have the necessary information in order to enable us to make a decision as to whom to show to prospective recruiters and employers. This includes, for example, issues relating to qualifications, experience, ability to do the work in question, willingness to accept the terms being offered, and freedom to take up the offer, should it be made, within a reasonable timescale.

6.2. Some of our websites and platforms may use filter options to enable prospective recruiters and employers to filter through a number of different candidates (such as yourself). These filters are triggered (and work) according to the information that you provide to us via our websites and platforms. We cannot guarantee that the filters will accurately reflect your digital profile, real-world experience and details.

6.3. In some cases, we will also need to process your personal data to make sure that we are complying with our legal obligations. This includes, for example, checking to make sure that you are entitled to work in the UK, to comply with health and safety laws, and to deal with issues such as reasonable adjustment and ensuring that you are able to attend an interview.

6.4. We also need to process your personal data in order to ensure that we are able to protect your interests (or those of someone else) and where it is needed in the public interest.

6.5. In other cases, we have a legitimate interest in processing your personal data, not only during the recruitment period but before and after. This might include:

6.5.1. carrying out promotion of the job and ensuring that you receive details (where for example we hold your information in the event that a job becomes available);

6.5.2. maintaining accurate and up-to-date records and contact details;

6.5.3. taking up references from current or former employers;

6.5.4. establishing, exercising and defending legal claims; and

6.5.5. maintaining and promoting equality in the workplace.

6.6. There may be instances where we need to obtain and process data in order to satisfy legal requirements placed upon us.

6.7. We may need to process special category data, such as information about ethnic origin, sexual orientation, health or religion or belief, for the purposes of equal opportunities monitoring. If we do process special category data, such data will be anonymised. However, you are free to decide whether you wish to provide such data, and there will be no consequences for you should you choose not to do so.

6.8. Please be aware that, in the event that you do not provide us with certain information when requested, we may not be able to ensure that we are able to give full consideration to your potential employment by us, or we may be prevented from complying with our legal obligations. In some cases, you will be under a duty to supply us with certain personal data in order to satisfy your and our legal obligations.

6.9. We confirm that your personal data will only be used for the purposes for which it was collected, except in those circumstances where we reasonably consider that it needs to be used for another reason, and that reason is compatible with the original purpose. Should we need to use your personal data for an unrelated purpose, we will notify you, and we will explain the legal basis which allows us to do so.

6.10. Note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

7. Sharing your data with others

7.1. It is necessary for us to share your personal data with others so that we can carry out the services of a recruitment-enabling platform, or to comply with legal or regulatory obligations to you or that we are subject to. These may include:

7.1.1. professional advisers such as HR consultants, recruitment consultants, solicitors in relation to legal issues, accountants in relation to financial issues, advisors, experts, management consultants and our clients who are looking for candidates to fill their vacancies;

7.1.2. others within our business;

7.1.3. your/our regulator(s); and

7.1.4. suppliers of services required in relation to your potential employment.

7.2. When we share your personal data, we may try and share it anonymously, and where we cannot do so as it would be impractical due to the nature of our services and the platforms, we will ensure at all times that those with whom it is shared process it in an appropriate manner, and take all necessary measures in order to protect it.

7.3. Internally, your personal data may be shared with other staff members, including the HR team, managers in the business area in which you may work, and accounts staff in relation to issues of affordability and the payment of any agreed expenses to you.

7.4. We may also share your personal data with third parties in order to obtain pre-employment references from other employers, and to obtain employment background checks from third-party providers.

7.5. From time to time, we will be required to disclose personal data and exchange information about you, or relating to you, with government, law enforcement and regulatory bodies and agencies in order to comply with our own legal and regulatory obligations.

7.6. From time to time it may be necessary for us to share data for statistical purposes. We will always take steps to try to ensure that information shared is anonymised; where this is not possible, we will require that the recipient of the information keeps it confidential at all times.

7.7. Your data will be shared on our websites and platforms with third party companies who are looking for candidates to fill their vacancies or their clients’ vacancies. By providing us with your personal data, you agree for this data to be shared as this is an essential part of our Services and the intended purpose for which you shared your data with us.

8. Transferring your data out of the UK

8.1. Some of your data may be held on third-party softwares, which have robust security measures in place. Special rules will apply to the protection of your data if it is held outside the UK.

8.2. In order to ensure that data is kept secure, and to prevent there being any breach of confidentiality, we have put in place security measures which are intended to prevent your personal data from being accidentally lost or used or accessed unlawfully. Access to your personal data is restricted to those with a need to access it, and regard will be had to the need for confidentiality when that personal data is processed.

8.3. In the event that there is a suspected data security breach you will be notified. Where relevant we will also inform the appropriate regulator (including the Information Commissioner’s Office) of a suspected data security breach where we are legally required to do so.

8.4. Further information may be obtained from our Data Protection Manager.

9. Your rights in relation to your data

9.1. Data protection legislation gives you, the data subject, various rights in relation to your personal data that we hold and process. These rights are subject to specific time limits in terms of how quickly we must respond to you. The rights which data subjects have are, in the main, set out in Articles 12–23 of the UK GDPR. They are as follows:

9.1.1. Right of access—the right to obtain from us confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to that personal data and various other information, including the purpose for the processing, with whom the data is shared, how long the data will be retained, and the existence of various other rights (see below).

9.1.2. Right to rectification—the right to obtain from us, without undue delay, the putting right of inaccurate personal data concerning you.

9.1.3. Right to erasure—sometimes referred to as the right to be forgotten, this is the right for you to request that, in certain circumstances, we delete data relating to you.

9.1.4. Right to restrict processing—the right to request that, in certain circumstances, we restrict the processing of your data.

9.1.5. Right to data portability—the right, in certain circumstances, to receive that personal data which you have provided to us, in a structured, commonly used and machine-readable format, and a right to have that personal data transmitted to another controller.

9.1.6. Right to object—the right, in certain circumstances, to object to personal data being processed by us where it is in relation to direct marketing, or in relation to processing supported by the argument of legitimate interest.

9.1.7. Right not to be subject to automated decision making—the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you, or similarly significantly affects you.

9.2. Full details of these rights can be found in the UK GDPR or by reference to guidance produced by the Information Commissioner’s Office.

9.3. In the event that you wish to exercise any of these rights you may do so:

9.3.1. by contacting us using any medium you wish, including in writing, by telephone, by text, electronically, or using such social media as we employ for communication purposes;

9.3.2. by completing a form which we can supply to you for this purpose; or

9.3.3. through a third party whom you have authorised for this purpose.

10. Making a complaint

10.1. If you have any queries as to the acquisition, use, storage or disposal of any personal data relating to you please contact the Data Protection Manager using our contact details provided in this document.

10.2. Notwithstanding our best efforts, inevitably sometimes things do go wrong. If you are unhappy with any aspect of the use and/or protection of your personal data, you have the

right to make a complaint to the Information Commissioner’s Office, who may be contacted in writing at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; by telephone on 0303 123 1113; by fax on 01625 524510; or online at www.ico.org.uk.

11. This policy

The terms and provisions of this privacy policy may be changed, updated and amended from time to time. If we do so during the period in which we are attempting to find you suitable vacancies or your recruitment, we will inform you of those changes.