Privacy Policy — page 2

Continued from Firebrand Training Privacy Policy — page 1.

YOUR LEGAL RIGHTS

Under certain circumstances, you have rights under data protection laws in relation to your personal data. Please click on the links below to find out more about these rights:

• Request access to your personal data.
• Request correction of your personal data.
• Request erasure of your personal data.
• Object to processing of your personal data.
• Request restriction of processing your personal data.
• Request transfer of your personal data.
• Right to withdraw consent.
• If you wish to exercise any of the rights set out above, please contact us.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

GLOSSARY

Lawful basis

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

Third parties

Internal Third Parties

Other companies in the Firebrand Group acting as joint controllers or processors and who are based in and outside the UK and provide administration services and undertake leadership reporting.

External Third Parties

• Your employer, acting as an independent controller, where your employer/prospective employer is sponsoring your place on a course or programme (or where your employer/prospective employer has arranged for a course or programme to be delivered to a group of its employees/prospective employees). We will share information relating to your attendance, performance (including exam/assessment results and mock exam/assessment results and if applicable, recordings of coaching and performance calls) and general behaviour/performance on the course/programme.
• Any other education provider/employer where Firebrand is the subcontractor for any element of the teaching of your course or programme. We will share information relating to your performance (including mock and actual assessment results), progress and attendance on the course/programme.
• Any other tuition provider/reseller where Firebrand is providing training services to you through your contract with that third party training provider or reseller. We will share information relating to your performance (including mock and actual assessment results), progress and attendance on the course/programme.
• Any third party which Firebrand collaborates with for the purpose of creating, and/or marketing, and/or delivering tailored programmes or courses.
• Service providers acting as processors based outside the UK who provide IT and system administration services.
• Service providers which act as processors in respect of our telephone call recording operations (CallCabinet).
• Service providers which act as processors in respect of providing security services, including monitoring of closed circuit television systems and audio visual recording systems in place at our premises.
• Third party platforms which act as processors in respect of providing education and learning materials (including Pluralsight).
• Other venues or assessment centres you may attend as part of your studies with Firebrand, including assessment (such as exam centres
• Professional advisers acting as processors including lawyers, bankers, auditors and insurers based in the UK who provide consultancy, banking, legal, insurance and accounting services.
• Debt recovery agents with whom we may share your data when you owe a debt to Firebrand.
• HM Revenue & Customs, the UK Home Office, regulators and other authorities acting as independent controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.
• Specific regulators in the field of education, including the Education and Skills Funding Agency (for apprenticeships and traineeships), The Federation for Industry Sector Skills and Standards (for apprenticeships), Ofsted, The Office for Students, The Quality Assurance Agency (or any successor organisations to the preceding) acting as independent controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.
• For Apprentices, the personal information you provide us will be passed to the Department of Education ("DfE") and the ESFA, both of which are based in the United Kingdom. The information is used by the DfE to exercise its functions and to meet its statutory responsibilities, including under the Apprenticeships, Skills, Children and Learning Act 2009 and to create and maintain a unique learner number (ULN) and a personal learning record (also known as PLR). Your information will be securely destroyed after it is no longer required for these purposes.
• For Apprentices, your information may be shared by the DfE with third parties for education, training, employment and well-being related purposes, including for research. This will only take place where the law allows it and the sharing is in compliance with data protection legislation. We may share your information with such third parties but only if have a legal obligation to do so (e.g. where instructed by the DfE).
• For Apprentices, The European Social Fund English Managing Authority (the Department for Work and Pensions (also known as DWP)), or agents acting on its behalf, may contact you in order for them to carry out research and evaluation to inform the effectiveness of training that you receive through your apprenticeship.
• For further information about how the DfE and other government organisations use and access your personal data, please visit: https://www.gov.uk/government/publications/privacy-notice-for-key-stage-5-and-adult-education.
• We may also disclose your personal information in the following circumstances and on the basis that we have a legal obligation or a legitimate interest to do so:
• If we are under a duty to disclose or share it in order to comply with any legal obligation (for example with funding authorities, our auditors, our insurers and HMRC).
• We may release your personal information to any member of our group.
• If we sell or buy any business or assets, we may disclose your personal information to the prospective seller or buyer of such business or assets.
• If we or substantially all of our assets are acquired by a third party, personal information we hold about you will be one of the transferred assets.
• The police or governmental body, where the police/ governmental body make a request for personal information (including recordings from audio visual systems and/or closed circuit television) to Firebrand or as and when we consider necessary for the purpose of crime / fraud prevention.
• The ambulance service if there is any immediate concern regarding your physical health or mental wellbeing.

Your legal rights

You have the right to:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. Please be aware that this right does not apply to exam scripts or exam marks.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. Please be aware that this right does not apply to exam scripts, recorded assessments or exam marks.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. Please be aware that this right does not apply to exam scripts, recorded assessments or exam marks.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. Please be aware that this right does not apply to exam scripts, recorded assessments or exam marks.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

Consent to the use of cookies.

For our website to function properly we use cookies. To obtain your valid consent for the use and storage of cookies in the browser you use to access our website and to properly document this we use a consent management platform: CookieFirst. This technology is provided by Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH, Amsterdam, The Netherlands. Website: https://cookiefirst.com referred to as CookieFirst.

When you access our website, a connection is established with CookieFirst’s server to give us the possibility to obtain valid consent from you to the use of certain cookies. CookieFirst then stores a cookie in your browser in order to be able to activate only those cookies to which you have consented and to properly document this. The data processed is stored until the predefined storage period expires or you request to delete the data. Certain mandatory legal storage periods may apply notwithstanding the aforementioned.

CookieFirst is used to obtain the legally required consent for the use of cookies. The legal basis for this is article 6(1)(c) of the General Data Protection Regulation (GDPR).

Data processing agreement

We have concluded a data processing agreement with CookieFirst. This is a contract required by data protection law, which ensures that data of our website visitors is only processed in accordance with our instructions and in compliance with the GDPR.

Server log files

Our website and CookieFirst automatically collect and store information in so-called server log files, which your browser automatically transmits to us. The following data is collected:

• Your consent status or the withdrawal of consent
• Your anonymised IP address
• Information about your Browser
• Information about your Device
• The date and time you have visited our website
• The webpage url where you saved or updated your consent preferences
• The approximate location of the user that saved their consent preference
• A universally unique identifier (UUID) of the website visitor that clicked the cookie banner

End of Firebrand Training Privacy Policy. Updated March 20, 2023.