VTS – Privacy Notice

Privacy Notice

How We Use Your Information

Introduction

Vision Business Support Services, trading as Vision Talent Solutions (VTS), is committed to complying with the General Data Protection Regulation and the Data Protection Act 2018. Looking after the personal information you share with us is very important, and we want you to be confident that your personal data is kept safely and securely and to understand how we use it to offer you a better and more personalised experience. VTS is a group company of Vision West Nottinghamshire College.

We have published this notice to help you understand:

• How and why VTS collect information from you;
• Who we share your information with, why and on what basis; and
• What your rights are.

If we make changes to this notice, we will notify you by updating it on our website. VTS will be what is known as the ‘Data Controller’ of the personal data you provide to us, and we will sometimes refer to ourselves in this notice as “we” or “us”. By Data Controller, this means VTS determines the purposes and way in which any personal data are, or will be, processed.

If you have any questions about this notice please contact the Data Protection Officer, Nish Khanna at ([email protected]).

What is personal information?

Personal information is information that identifies you as an individual and relates to you.

This includes your contact details, next of kin, identification documentation and financial information. We may also hold information such as your religion or ethnic group. Phone recordings and photos of you are also personal information.

How and why does VTS collect and use personal information?

We set out below examples of the different ways in which we use personal information and where this personal information comes from. The primary reason for using your personal information is to provide recruitment services to you.

• Individual work seekers who are seeking or who have been found work by us on either a temporary, interim, or permanent basis (referred to in this document as “associates”)
• Private individuals who are or were formerly working for our current or former clients, as further explained below under “Who we are and what we do” below
• Private individuals who work for or have worked for suppliers or prospective suppliers of services to us
• Students

Sharing personal information with third parties

• In accordance with our legal obligations, we may share information with local authorities and the Department for Education, for example, where we have any safeguarding concerns.
• On occasion, we may need to share information with the police.
• We may also need to share information with our legal advisers for the purpose of obtaining legal advice.
• We may share some information with our insurance company, for example, where there is a serious incident at the College.

Our legal grounds for using your information

This section contains information about the legal basis that we are relying on when handling your information.

Data Protection says that we are allowed to use and share your personal data only where we have a proper reason to do so. The law says we must have one or more of these reasons and these are:

• Contract – your personal information is processed in order to fulfil a contractual arrangement
• Consent – where you agree to us using your information in this way
• Legitimate Interests – this means the interests of the College in managing our business to allow us to provide you with the best service in the most secure and appropriate way
• Legal Obligation – where there is a statutory or other legal requirement to share the information
• We will only use your personal information when the law permits us to.

The majority of the processing of your data is performed by us for one of three reasons:

1. Necessary for contract

This means that we process your data in order to carry out our obligations arising from any contracts that we either intend to enter into or have entered into with you and to provide you with the information, products and services that you request from us or we think will be of interest to you because it is relevant to your career or to your organisation.

1. Legal obligations

Certain processing of your personal data is required to enable us to meet our legal obligations. For example, if you are an associate we are obliged by law to provide HMRC with information about any money that you earn through contracts that you enter with us and to remit income tax and National Insurance that is due.

1. Legitimate interests

In certain cases, we may process your personal data in order to further our legitimate business interests, or to help our clients to satisfy their legitimate interests. We will only do this when we have considered whether there is any other way to fulfil the relevant legitimate interest and balanced our legitimate interests against your right to privacy/the impact the processing has on your privacy.

An example of processing to fulfil a legitimate interest is our practice of recording all calls made to and by us. The recordings are held securely for a limited time and a very limited number of people have access to them. We use the recordings where there has been a complaint or dispute, to enable us to verify what was actually said.

This is a mutual benefit to both you and us, as it helps facilitate fair resolution of any issues and helps to protect all parties from being subject to false accusations.

Consent

While the majority of our processing of data is covered by the three legal bases explained above, in some cases we will seek your express consent to processing. Examples of when consent may be the lawful basis for processing include permission to introduce you to a client (if you are an associate).

The main instance in which we will seek your express consent are:

• Where we would like to send you marketing materials to introduce you to other services that we or our Group can provide. We do not share your data with any third parties for the purpose of their own marketing efforts
• Should we want or need to rely on consent to lawfully process your data the way we request your consent will depend on what the data to be processed is. For example, if you are an associate, we make a contractual commitment to you to get your consent before sharing information (excluding special category/sensitive information) with a client. This may be done orally if we are in telephone contact with you and we will make a note of your response.

In other cases, we may request consent by email or by an online process for the specific activity we require consent for and record your response on our system. Where consent is the lawful basis for our processing you have the right to withdraw your consent to this particular processing at any time.

Vital interests

This is information collected to protect your vital interests. The only data that we collect that falls in this category is next of kin/emergency contact details for associates. You do not have to provide us with this information if you do not want to.

Other Uses of your data:

• To notify you about changes to our service;
• To ensure that content from our site is presented in the most effective manner for you and for your computer.

We will use this information:

• To administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
• To improve our site to ensure that content is presented in the most effective manner for you and for your computer;
• To allow you to participate in interactive features of our service, when you choose to do so; as part of our efforts to keep our site safe and secure;
• To measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you;
• To make suggestions and recommendations to you and other users of our site about goods or services that may interest you or them.

Other information VTS collects

External web services

We use several external web services on our websites, mostly to display content within our web pages. For example, to display slideshows we sometimes use SlideShare; to show videos we use YouTube and Vimeo. This is not an exhaustive or complete list of the services we use, or might use in the future, when embedding content, but these are the most common. We cannot prevent these sites, or external domains, from collecting information on your usage of this embedded content. If you are not logged in to these external services then they will not know who you are but are likely to gather anonymous usage information e.g. number of views, plays, loads etc.

Email tracking

Some emails that we send you have no tracking in at all, for example personal correspondence or emails with invoices attached. Other emails we send we put in tracking so that we can tell how much traffic those emails send to our site and we can track, at an individual level, whether the user has opened and clicked on the email. We rarely use the latter information at a personal level, rather we use it to understand open and click rates on our emails to try and improve them. Sometimes we do use the personal information e.g. to re-email people who did not click the first time. If you want to be sure that none of your email activity is tracked, then you should unsubscribe from our email campaigns.

Links to other websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over the other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Automated decision making

We do not undertake automated decision making or profiling. We do use our computer systems to search and identify personal data in accordance with parameters set by a person and / or a client. A person will always be involved in the decision-making process.

Cookies

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For detailed information on the cookies we use and the purposes for which we use them see our system providers Cookie Policy.

Transfer of data outside of the EEA

VTS will not transfer your data outside of the EEA.

Data Security

All information you provide to VTS is stored on secure servers. Further we limit access to your personal information to those employees, agents, contractors or other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality. Any payment transactions will be encrypted using SSL technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

For how long do we keep your information?

We understand our legal duty to retain accurate data and only to retain personal data for as long as we need it to fulfil the purposes we collected it for. Accordingly, we have a data retention policy and run data routines to remove data in line with the policy.

We do the following to try to ensure our data is accurate:

• Our website enables you to manage your data and to review whether the details we hold about you are accurate
• Prior to making an introduction, we check that we have accurate information about you.
• We keep in touch with you so you can let us know of changes to your personal data.

We may archive part or all of your personal data or retain it on our financial systems only, deleting all or part of it from our main Customer Relationship Manager (CRM) system. We may pseudonymise parts of your data, particularly following a request for suppression or deletion of your data, to ensure that we do not re-enter your personal data into our database unless requested to do so.

For your information, Pseudonymised Data is created by taking identifying fields within a database and replacing them with artificial identifiers, or pseudonyms.

We may ask for your consent to use your information in certain ways. If we ask for your consent to use your personal information you can take back this consent at any time. Any use of your information before you withdraw your consent remains valid.

Please speak to our Data Protection Officer Nish Khanna at ([email protected]) if you would like to withdraw any consent given.

How long do we retain your data?

The data you provide to VTS is kept for the length of your registration, and, if worked they are archived for 6 years after your registration has ended.

To close your registration with VTS, please contact [email protected].

Direct marketing

You have the right to ask us not to process your personal data for marketing purposes. We will always aim to inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes and we will collect express consent from you if legally required prior to using your personal data for marketing purposes.

You can exercise your right to accept or prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us.

Our site may, from time to time, contain links to and from the websites of our partner networks, /partner service providers, advertisers, and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites. You are under no statutory or contractual obligation to provide data to the organisation during the recruitment process.

However, if you do not provide the information, the organisation may not be able to process your application properly or at all.

The Data Protection Act 2018 provides you with the right to:

• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request the erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object or withdraw your consent where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information.
• This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Make a complaint to a supervisory body which in the United Kingdom is the Information Commissioner’s Office.

Access to information

The Data Protection Act 2018 gives you the right to access information held about you. We also encourage you to contact us to ensure your data is accurate and complete.

Your right of access can be exercised in accordance with DPA 2018.

A subject access request should be submitted to the Data Protection Officer, Nish Khanna at ([email protected]).