Privacy Policy

PLEASE READ THIS DOCUMENT CAREFULLY, IF YOU DO NOT ACCEPT THESE TERMS, YOU ARE ADVISED NOT TO USE THE WEBSITE

This policy was last updated: 13^th June 2018

Use of this website, www.c-m-t.co.uk, constitutes your legal agreement to the terms within this policy and your acceptance of this policy is deemed to occur upon your first use of the website. 

About this Policy

Construction and Management Training understands that your privacy is important to you and that you care about how your personal data is used and shared online. This Privacy Policy sets out how Construction and Management Training collects and processes your personal data. We will take all reasonable steps to ensure that personal data is safeguarded and kept in accordance with applicable data protection law.

By providing us with your data, you warrant that you are over 13 years of age.

Who we are

Construction and Management Training limited is registered with registration number 07037234 and our registered address is Studio 1, Corby Enterprise Centre, London Road, Corby, Northamptonshire NN17 5EU. We are registered with the Information Commissioner’s Office (ICO) for data protection reference number ZA236923.

For the purposes of the General Data Protection Regulation (GDPR) and relevant legislation we are a Data Controller and recognise and act on our obligations under applicable data protection law. For any issues relating to data protection we have an appointed Data Protection Officer, Katie Marrison (see below for contact details).

We are regulated by all the Awarding Bodies we accredit our training to.

What personal data do we collect?

We may collect some or all of the following personal data (this may vary according to your relationship with us):
• Name;
• Date of birth;
• National insurance number;
• Gender;
• Address;
• Email address;
• Telephone number;
• Business name;
• Job title;
• Payment information;
• Information about your preferences and interests;
• Previous qualifications
• Information on disabilities, learning difficulties, ethnicity is required as part of the Individual Learner Record as required by the National Vocational Qualification Awarding Bodies.

Under the GDPR, we must always have a lawful basis for processing personal data. Information that you provide to us is retained and processed in accordance with UK data protection legislation. Our legal basis for collecting and using your personal data will depend on the personal information collected and the specific context in which we collect it. We will normally collect personal data from you only where:

(a) we have your consent

(b) where we need your personal data to perform a contract with you

(c) where the processing is in our legitimate interest

If you do not provide the requested data, we may not be able to provide our services to you.

In certain circumstances, we may have a legal obligation to collect personal data from you, or may otherwise need the personal information to protect your vital interests or those of another person.

Where we rely on your consent to process your personal data, you have the right to withdraw or decline consent at any time. Where we rely on our legitimate interest to process your personal data, we are obliged to ensure that this does not override your data protection interests and rights See ‘Your Rights’ below.

We collect your data from the following interactions with us:

Contact enquiry form

We use a form to collect your first and last name, email and phone number as well as your message, so that we can contact you and provide details of our services to you and deal with general company enquiries. Data is held on the grounds of being legitimate to our business interests.

Emails

We retain copies of emails sent to us in order to provide our services and deal with other company business. Your personal information will be held by us in accordance with this Privacy Policy and will be on the basis of being legitimate to our business interests.

Interest in our training courses

If you complete our form to express an interest in our training sessions, we will collect your first and last name, email and phone number, so that we can contact you and provide details of our training services to you. Personal data will be processed on the basis of being legitimate to our business interests.

If you wish to sign up for details of our training courses and dates, we will ask for your first name, last name and email address so that we can send relevant details to you. Personal data will be processed on the basis of being legitimate to our business interests.

Phone calls

Records of phone calls (and notes) may be retained by us so that we can communicate with you. The data will be held on the basis of being for our legitimate business needs or in order to fulfil our contractual obligations if you are a client of ours.

Social media

We use social media to engage with users on Facebook, Google+, LinkedIn, and Twitter. We do not keep any specific data that identifies you as an individual user, but hold details of our followers on these platforms. You should refer to the Privacy Policies of these channels to understand how they treat your data in relation to linking to our site.

Facebook:           https://www.facebook.com/privacy/explanation

Google+:             https://privacy.google.com/

LinkedIn:             https://www.linkedin.com/legal/privacy-policy

Twitter:                https://www.twitter.com/en/privacy

YouTube:             https://policies.google.com/privacy

If you send us a message on social media, the details may be retained by us only as relevant to any ongoing contract or to further our legitimate business interests or as required for legal purposes. The third party provider may also retain details in accordance with their Privacy Policy.

Subscription to our email updates

If you subscribe online to our email updates you will be asked to give us your full name and email address so that we can send these to you. Data is processed on the basis of your consent which can be withdrawn at any time. See ‘Your Rights’ below. Your attention is drawn to this Privacy Policy before submitting your details.

Testimonials

We may ask you for a testimonial in relation to our services that may be used on our website or social media. Your full name and company may be used. Data is only published on the basis of valid consent obtained from you.

Children

We do not market this website at those under 18 years old. Consistent with the GDPR we will never knowingly request personally identifiable information from anyone under the age of 16 years old.

We will take appropriate steps to delete any personal data of individuals less than 16 years of age that has been collected on our website upon learning of the existence of such data.

Special categories of data / sensitive data

Some of the information you provide to us may be considered sensitive personal data which includes information about a data subjects ethnic or racial origin, political opinions, religious beliefs, trade union membership, physical or mental health, sexual life or criminal record. We will take extra measures where appropriate to protect such data.

Other sources of Information

Information collected automatically

We automatically collect information from your browser when you visit our website. Data is stored in log files when you interact with our website or service. This information includes internet protocol (IP) addresses as well as browser type, operating system, identification numbers associated with your devices, time of access, and error logs.

Information we get from other sources

From time to time, we may need to obtain information from third parties. This may apply to obtaining marketing contact details from third parties. This will apply where it is necessary to provide our services to you, on the basis of our legitimate interests, or as permitted by law. 

How do we use your data?

We may use the information we collect from you in the following ways:

• To administer and improve the website
• To personalise the content and your experience of the website
• To allow us to respond to communications sent to us
• To administer site features
• To send you email notifications which you have specifically requested
• To send to you marketing communications, where expressly agreed
• To provide third parties with statistical information about our users
• To deal with enquiries and complaints made by or about you relating to the website
• To register your qualification or exam with an Awarding Body
• To certify your qualification or exam with an Awarding Body.

Users contacting this website and/or its owners do so at their own discretion and provide any such personal details requested at their own risk. Your personal information is kept private and stored securely until a time it is no longer required or has no use.

Sharing Information

Disclosure

We don’t share, sell, or distribute your data to third parties, except as contractually agreed with you or as provided in this Privacy Policy.

We may disclose your personal data to any of our employees, officers, agents, suppliers or subcontractors insofar as reasonably necessary for the purposes set out in this Privacy Policy.

In addition, we may disclose personal data in the following circumstances:

• where we are required to do so by law;
• in connection with any legal proceedings or prospective legal proceedings;
• in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk);
• to the purchaser (or prospective purchaser) of any business or asset which we are (or are contemplating) selling.

Awarding Bodies

We share personal data with the Awarding Bodies of our accredited courses and other organisations that support the training and certification of our learners. We take appropriate measures to ensure that all personal data provided to these organisations (as Data Processors) is processed in accordance with applicable data protection laws and regulations.

Data Processors

Construction and Management Training may use Data Processors who act on our instruction in relation to the management of your data and they must adhere to all data protection laws and regulations. We will ensure that any Data Processors used only operate on our written instructions and comply with their obligations under the GDPR. You will be informed of any other Data Controllers who have access to your data and who may determine processing activities separately to us, or as a Joint Data Controller. 

Email marketing

We may contact you if we have expressly asked for, and obtained, your consent to do so or if we have a legitimate interest to do so i.e. a customer relationship with you. If you give consent, this can be withdrawn at any time. See ‘Your Rights’ below.

External links

Construction and Management Training provides links to third party websites. Users are advised to take care when clicking on any external web link as this will take the user away from our website. Once you leave our website, you are no longer governed by this Privacy Policy or our website’s terms and conditions. We cannot guarantee or verify the contents of any externally linked website and users click on external links at their own risk. Construction and Management Training and its owners cannot be held liable for any damages, or the consequences of visiting any external links.

Construction and Management Training use a third party, ActiveCampaign, for designing and sending e-shots (i.e. marketing communications) to our marketing contacts. All data subjects have rights in relation to the processing of such information (see below, Your ‘Rights’) and users are advised to read the Privacy Policy at: https://www.activecampaign.com/privacy-policy/

Social media platforms

Communication, engagement and actions taken through external social media platforms that this website and its owners participate on are subject to our terms and conditions as well as the privacy policies held with each social media platform respectively.

Users are advised to use social media platforms wisely and communicate and/or engage with them with due care in regard to their own privacy and personal details. This website nor its owners will not ask for personal or sensitive information through social media platforms and encourage users wishing to discuss sensitive details to contact them through primary communication channels such as by telephone or email.

Payment processing

Construction and Management Training does not accept payment for services online and does not store or process payment data on our servers. We do not share financial details with 3^rd parties.

Payments made directly to us do not require us to process your personal data and only transactional data will be held, both in our manual and electronic filing systems.

Data Retention

We keep your personal data in accordance with our Data Retention Policy which reflects our needs to provide services to you as contracted and also as required to meet legal, statutory and regulatory obligations.

We retain personal data for the qualifications achieved by our learners, which is stored for lifetime via the registered awarding bodies and learner records services. You will have the right to access your learning records at any time.

The need to hold information is regularly reviewed and data will be disposed of when no longer required.

Data Security

Your personal data is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential.

We will take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information. However, we cannot guarantee the security of data transmitted to us.  Any transmission is at your own risk.

Data Storage

We keep and manage learning records for our customers in our own secure storage systems, in accordance with the requirements of the GDPR. This ensures secure access to personal learning records, when required.

We only store data with organisations that support the training and certification of learners, none of these are based outside of the EU.

Data Transfers

Our website is hosted in the EU. We take appropriate steps to ensure a safe processing of personal data, however, we cannot guarantee the security of data transmitted through our website or by email.  Any transmission is at your own risk.

Any information that you supply to us may be stored and processed by us in accordance with this Privacy Policy. Your data will only be transferred to countries within the EEA or to a country that has ‘adequate’ safeguards in place (as determined by the European Commission), or as permitted by relevant data protection laws.

When we share data, it may be transferred to, and processed in, countries outside of the EEA that have been identified as providing adequate protection for EEA data, or to a third party where we have approved transfer mechanisms in place to protect your personal data i.e. by entering into the European Commission’s Standard Contractual Clauses, or by ensuring the entity complies with the EU-US Privacy Shield.

Your Rights

Construction and Management Training recognises a data subjects rights and will uphold these in accordance with data protection laws. If you wish to invoke any of these rights, you should contact the person responsible for data protection by emailing CMTUK@c-m-t.co.uk

Further information about your rights can also be obtained from the Information Commissioner’s Office (see complaints below) or your local Citizens Advice Bureau.

You are entitled to see the information held about you in relation to the following:

Subject access requests

Data subjects (i.e. individuals) have the right to access personal data that is held by submitting a subject access request (SAR) to Construction and Management Training. All subject access requests should be made in writing. See ‘Contact Us’ below for our address. We may send you a Subject Access Request Form to facilitate and simplify the process.

There is not normally any charge for a subject access request, except if your request is ‘manifestly unfounded or excessive’.

We aim to respond to a subject access request within 14 days and, in any case, within one month of receiving the request and necessary information. We aim to provide a complete response, including a copy of your personal data within that time, however, if your request is more complex, the response time may be extended up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

Right to rectification

Data subjects have the right to request that we amend or change personal information that is inaccurate or incorrect.

Right to erasure

Data subjects have the right to ask us to delete personal information from our systems without giving any reason and at any time. We will act on any such request without delay.

Right to restrict processing

Data subjects have the right to rectification or erasure of personal data in the following circumstances:

• Personal data is not accurate;
• The processing of data is unlawful – data subjects may request that processing is restricted;
• Data is required to exercise legal rights or defend legal claims;
• Data is unlawful (there may be lawful grounds for processing, which override this right).

Right to data portability

Data subjects have the right to obtain and request the transfer of their data to different service providers.

Right to object

Data subjects have the right to object to the processing of data at any time based on their particular situation. This includes objecting to profiling unless it is in the ‘public interest’ or exercised lawfully by an official authority. We will only process data under lawful grounds.

Right not to be subject to decisions based on automated processing

We collect data through tracking codes and email marketing software, which tell us when you open our emails and which links you choose to click.

Data Breaches

We will report any unlawful breach of data as required by the GDPR within 72 hours of the breach occurring, if it is considered that there is an actual, or possibility, that data within our control including the control of our data processors, has been compromised. If the breach is classified as ‘high risk’ we will notify all data subjects concerned using an appropriate means of communication. We will report any relevant breaches to the ICO, see below.

Contact Us

If you have any concerns regarding the processing of data, you can contact the Data Control Officer, Miss Katie Marrison, by the following.

Email:              CMTUK@c-m-t.co.uk 
Telephone:     08433 301 236 
Post:                 Studio 1, Corby Enterprise Centre, London Road, Corby, NN17 5EU

Complaints

If you want to raise a concern about the use of your data, you can contact us by email to CMTUK@c-m-t.co.uk. Alternatively, you can formally raise a concern or complaint to the Information Commissioner’s Office (ICO) directly on 0303 123 1113, or see the options for reporting issues on https://ico.org.uk/concerns/

Changes to this Policy

From time to time we may change this policy and any changes will be posted on the website. You will be deemed to have accepted the terms of the Privacy Policy on your first use of the website following the alterations. We recommend that you check this page regularly to keep up-to-date.

Legal Information

No Waiver

No failure or delay by us in exercising any of our rights in accordance with this Privacy Policy or our terms and conditions shall be deemed to be a waiver of that right, and no waiver of a breach of any provision of the Agreement shall be deemed to be a waiver of any subsequent breach of the same or any other provision.

Severance

If one or more of the provisions of this Privacy Policy or our terms and conditions is found to be unlawful, invalid or otherwise unenforceable, those provision(s) shall be deemed severed from the remainder of these terms and conditions and shall remain enforceable.

Third Party Rights

The terms of this Privacy Policy shall not confer rights on any third parties and accordingly the Contracts (Rights of Third Parties) Act shall not apply.

Jurisdiction and Governing Law

The terms of this Privacy Policy and all disputes, whether contractual or otherwise, arising out of or in connection with the policy are governed by and shall be construed in accordance with the laws of England and Wales and each party submits to the exclusive jurisdiction of the English courts.