Welcome to UFA’s Privacy Policy. This policy is in relation to UFA activity, including contracting areas such as the National Citizen’s Service (NCS) and trading subsidiary Top Tutors (TT).
The UFA respects your privacy and is committed to protecting your personal data and being transparent about how we collect and use your data. We will comply with any data protection legislation in force. This Privacy Policy, together with our General Data Protection Policy explains how we use any personal information that you provide and the measures we take to keep your information secure.
What does this policy cover?
- Important information about who we are,
- The data we collect from you and how we collect it,
- How we use the data you provide,
- Sharing data with third parties,
- Data security,
- Data retention and
- Your legal rights.
- Important information about who we are
UFA Registered charity no. 1061308
UFA Registered company no. 3319307
Top Tutors Registered company no. 8375862
Registered office address:
UFA,
The Toll House,
The Bond,
180-182 Fazeley Street
Birmingham,
B5 5SE
UFA is a charity with over 20 years’ experience in the education sector. In addition to our work in schools, we are contracted to deliver National Citizen Service (NCS) programmes, and own a subsidiary tuition agency, Top Tutors (TT).
Controller and processor
On all aspects of our school work and TT, as well as financial and HR records, UFA is a controller of any personal data you provide to us and will process information in ways outlined in this document, our GDPR policy and privacy notices. On all NCS contracts, we are a processor of information relating to the young people taking part in our programmes, and will only process your information in accordance with guidance provided by the NCS Trust.
UFA’s Data Protection Officer (DPO) is Alex Stoenciu. Alex is responsible for answering questions about this privacy notice and may be contacted at our registered address, by email at [email protected] or by phone on 01217668077.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with any concerns you may have before you approach the ICO, so please feel free to contact us first.
Changes to the Privacy Policy and your duty to inform us of changes
This Privacy Policy was last updated on 19 July 2018
It’s important that the personal data that we hold about you is accurate and up-to-date. Please keep us informed if your personal data changes during the duration of your relationship with us.
We may update this Privacy Policy from time to time. If we make significant changes we will contact you to confirm that changes have been made.
- The data we collect from you and how we collect it
The personal data that we collect about you may include the following information:
- Personal data you provide to us in person, via our website or by telephone
- Personal data you provide when you enquire about our services, or when you purchase a service, through us
- General information about you, such as your name, address, contact details and date of birth
- Personal data you provide if you subscribe to any of our mailing or newsletter services
- Financial details, such as your bank account and card details
- Criminal convictions
- Information about your use of our website such as your IP address, which is a unique number identifying your computer, including personal data gathered using cookies
- Information collected through programmes in the form of surveys and case studies
- Feedback in the form of surveys, calls and emails
- How we use the data you provide
We will only use your personal data when and in ways the law allows us to. Most commonly, we will use your personal data in the following circumstances
- In order to perform our contractual obligations to you.
- Legal basis: Contractual (The processing is necessary in connection with any contract that you may enter into with us)
- To administer your account, including financial transactions
- Legal basis: Contractual (The processing is necessary in connection with any contract that you may enter into with us)
- To comply with our legal obligations and procedures, for example when running DBS checks
- Legal basis: Legal obligation (Processing is necessary due to the legal obligation of ensuring the safeguarding of the young people and adults we work with)
- To improve the quality of our service
- Surveys: UFA and its subsidiary Top Tutors will conduct surveys with people to produce evaluation research on the effects of the programme on participants, and the organisations they come from, as well as general feedback on the performance of Associates and Tutors. Participation in surveys is voluntary. Although most of the information collected in our surveys cannot be traced back to an individual, personal identifiable information may be collected in situations where it is necessary for us to give individual tailored feedback.
- Case Studies: UFA and Top Tutors may also publish case studies of people with a particularly interesting story. Participation in case studies is voluntary and consent is sought before publication. You have the ability to withdraw from this activity at any time.
- UFA is a company with a legitimate interest to learn from its practise in order to improve outcomes for education. Any information you provide will be used anonymously (unless otherwise consented to) for this purpose and to assist UFA in gaining further support and funding for the continuation of the programmes.
- Legal basis: Legitimate interest (The processing is necessary for UFA and Top Tutor’s legitimate interest, where these don’t conflict with your own interests, rights and freedoms)
- Keeping a record of Associate, Tutor and Client information
- UFA and its subsidiary TT have a legitimate interest keep a record of Associates, Tutors and Clients we’ve worked with and have undergone our programmes. Personal information will not be shared with third parties, will be anonymised where possible and you have the right to erasure at any time, within the limits of our retention policy
- Legal basis: Legitimate interest (The processing is necessary for UFA’s legitimate interest, where these don’t conflict with your own interests, rights and freedoms)
- To let you know about similar products and services that may be of interest to you
- Legal basis: Consent (The processing has been allowed you)
We will also inform you on how we’ll be using your personal data at the time we’re collecting it from you.
- Sharing data with third parties
We will never pass your personal information to other organisations for them to use for their own marketing purposes.
However, we may disclose your personal information under the following circumstances:
- To third parties who provide a service to us and are data processors (for example IT support, marketing service providers or outdoor activity providers). We require these third parties to comply strictly with our instructions and Data Protection Laws and we will make sure that appropriate controls are in place. We enter contracts with all our data processors and make sure that their activities comply with UFA’s policies and procedures.
- Where we are under duty to disclose your personal information in order to comply with the law or the disclosure is ‘necessary’ for purposes of national security, taxation and criminal investigation or we have your written consent.
- Where sharing basic information is stipulated in the service level agreement you and the UFA engage in. For example
- Putting Tutors in touch with Parents/ Guardians/ Schools
- Providing schools with personalised feedback on individual their pupils we’ve worked with
Except for the specific cases listed above, we won’t share your personal data without your specific consent, unless required to do so by law
- Data Security
We take the security of your personal information very seriously. We have internal policies, controls and appropriate data collection, storage and processing practices and security measures in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed. Our IT infrastructure is regularly scanned by trusted third party providers and the UFA has obtained a Cyber Essentials certificate.
Some of the information we collect may be transferred and stored outside the EEA (European Economic Area). We will always take steps to ensure these locations have appropriate levels of protection in place (in accordance with UK Data Protection Law) and that your information is safeguarded.
Where we are legally required to do so, we will always inform you and any applicable regulator of any data breach.
Our website may contain links to third party websites. This policy only applies to this site so if you follow a link to a third party site, please make sure you read the privacy policy on that site. We do not accept any responsibility for third party websites.
Photography from our website may not be downloaded and used without obtaining prior permission from the UFA. If you do so, you will be taking full responsibility for the ways in which you use images.
- Data retention
The UFA will keep copies of records for a period of 7 years, unless:
- We have deemed it appropriate to hold records for a different period of time
- We have a legal obligation to retain records for a specific period of time
- You have requested your personal information to be deleted, in cases where this does not conflict with our legal obligations
For a full list of retention periods, please see our Retention Policy.
- Your legal rights
Under the General Data Protection Regulation (GDPR), you have the following rights:
- The right to access your personal information,
- The right to edit and update your personal information,
- The right to request to have your personal information deleted,
- The right to restrict processing of your personal information,
- The right to object and
- The right to lodge a complaint with a supervisory authority.
For a full breakdown of your rights, please visit the ICO website (www.ico.org.uk)
If you wish to exercise your rights, please contact us providing as much information as possible about the nature of your contact with us to help us locate your records. Any changes you have requested may take 30 days before they take effect.