Privacy notice

This Privacy Notice applies to services operated by UK ENIC.

UK ENIC understands that your privacy is important to you. We respect and value the privacy of everyone who visits our website and uses our services.

UK ENIC will only collect and use your personal data in ways that are described here, and in a manner that is consistent with our obligations and your rights under data protection and other laws.

The Notice is structured to help you find information that is relevant to the service or services you use.

Our contact details

Ecctis Ltd is the provider of the UK ENIC service.

Our registered office address is:

Suffolk House
68-70 Suffolk Road
Cheltenham
Gloucestershire
GL50 2ED
United Kingdom

Our Data Protection Officer can be contacted at [email protected] or via our postal address. Please mark postal communication with ‘Data Protection Officer’.

Our role in processing

UK ENIC may operate as the Controller of your personal data, or we may process your personal data on behalf of another Controller (as their Processor).

For more information on our role(s) specific to each service, please see How we process your personal data for services you request section.

Generally, the following applies:

UK ENIC acts as the Processor of your personal data when you contact us about, or apply for, our individual services, including:

Statement of Comparability
English Language Assessment
Career Path Report
Early Years Service
UK Qualification Reference Statement

For these services, we operate as a Processor on behalf of the Controller, who tells us what to do with your personal data, and how we should process it. UK ENIC will always have a contract in place with the Controller which sets out how UK ENIC must provide the service. Please see the specific service information below for more detailed information.

UK ENIC acts as a Controller for the delivery of training and events, undertaking marketing and sending you feedback surveys to understand satisfaction levels so we can improve our services.

Third party privacy information

Throughout this privacy notice, we will link to the privacy information of organisations with whom we share your information to enable you to see how each recipient organisation processes your information.

How we get your personal data

Most of the personal data we process is provided for one of the following reasons.

You are an Individual Applicant (Qualification Holder):

you have enquired about, and/or applied for, one of our services for individuals; or
an organisation has submitted an application for one of our services for individuals on your behalf

You are an individual acting in a business capacity, i.e. a ‘Corporate Subscriber’ (opens in a new tab), such as an employee of a:

client company/organisation or a higher education provider. You or your employer has subscribed to one or more of our services for organisations and either you or your employer has provided your personal data to us to allow you to access or make use of those services. This may include for training and events purposes;
higher education provider that works with UK ENIC to verify Qualification Holders’ qualifications;
UK government department;
company or organisation to whom UK ENIC provides services or has a business relationship;
supplier of goods or services (including consultancy) to UK ENIC. You or your employer provides goods and services to UK ENIC and either you or your employer has submitted your personal data to us to enter into an agreement, facilitate an order, pay an invoice or to facilitate collaborative working

Where we do not receive information from you directly, we will endeavour to contact you to let you know we are processing your personal data unless to do so would be:

disproportionate, or
prejudicial, for example, to law enforcement or national security

How we process your personal data for services you request as an Individual Applicant (Qualification Holder)

Your personal data is collected, stored, and used by our staff to communicate with you, identify you from other applicants, and deliver our services to you. This will include validating that qualification and identity information provided by you is accurate, and that you hold the qualifications submitted to us for comparison.

For most of the services provided, we operate as a Processor. This means we only process personal data under the instructions of another organisation, who is the Controller. The Controller is responsible for determining the purpose of processing and the lawful basis for processing.

Throughout this section we will clearly identify the Controller for each service. Where the service is being provided by UK ENIC on behalf of another third party, you should read this Privacy Notice in conjunction with the privacy information provided by Department for Education’s (DfE) personal information charter (opens in a new tab).

The following information relates to current services and applies where you apply directly to us via our website, or by post.

Statement of Comparability including Fast Track services and Translation Waiver

We process your personal data on behalf of the Department for Education (DfE) for the purpose of the Statement of Comparability service. This is to enable you to evidence the comparable level of your qualifications completed outside of the UK against those in the UK education frameworks.

Our role

We act as a Processor of your personal data. The Controller of your personal data is DfE.

What information we need and why

We collect and process personal data including your:

name
contact details
date of birth
identity and qualification documents
information to deliver the service to you, to identify you, to verify the qualifications and to communicate with you about your application

We collect and process information relating to the reasons for your application (including refugee status) to ensure we are delivering the correct service to you and to optimise our services for your needs.

Lawful basis for processing

These are determined by the DfE. Learn more about their personal information charter (opens in a new tab).

How long we keep it

For completed applications, we retain information for a period of up to 25 years. This is necessary for detecting and preventing crime, fraudulent applications, preserving the integrity of our services and providing the services in compliance with our contractual obligations.

We actively discourage applicants from sending original paper documentation to support their application, as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account, unless we are required to retain the documents.

UK Qualification Reference Statement

We process your personal data on behalf of DfE for the purpose of the UK Qualification Reference Statement service. This is to enable you to receive detailed information about your completed UK qualification(s).

Our role

We act as a Processor of your personal data. The Controller of your personal data is DfE.

What information we need and why

This is determined by the DfE, but includes information including your:

name
contact details
date of birth to deliver the service to you, to identify you, to verify the qualifications and to communicate with you about your application

We collect and process information relating to your qualifications (including copies of documentation) to provide the requested UK Qualification Reference Statement service to you.

Lawful basis for processing

These are determined by the DfE. Learn more about their personal information charter (opens in a new tab).

How long we keep it

Early Years Services (Early Years Statement and Early Years Advisory Service)

We process your personal data on behalf of the DfE for the purpose of the Early Years services. This includes the Early Years Statement service, the domestic Early Years Confirmation service, and the discontinued Early Years Service. This is to enable you to evidence your early years specialised qualifications for gaining the required recognition to work in an early years setting in England.

Our role

We act as a Processor of your personal data. The Controller of your personal data is DfE.

What information we need and why

We retain and process information including your:

name
contact details
date of birth
information relating to your qualifications (including copies of documentation)
identity to confirm the content of your Statement to a third party

Lawful basis for processing

These are determined by the DfE. Learn more about their personal information charter (opens in a new tab).

How long we keep it

Confirming the content of a Statement to a third party

On occasion we will be asked to confirm that a Statement issued by us is genuine, and/or accurate. This might be, for example, where you have provided your Statement to a third party for them to rely on the contents of it.

Where we are asked to do so, we will confirm whether the Statement was issued, and whether the information contained in the Statement is accurate.

Our role

We act as a Processor of your personal data. The Controller of your personal data is DfE.

What information we need and why

No further personal data will be collected.

Lawful basis for processing

We will confirm whether information provided to us matches our records. We will never volunteer any personal data to a third party.

The lawful basis will be determined by the Controller and can be found in the personal information charter (opens in a new tab).

How long we keep it

Historical and discontinued services

The following information relates to historical, discontinued services (which we no longer offer) and applies where you applied directly to us via our website, or by post.

English Language Assessment

We may continue to process your personal data on behalf of DfE for the purpose of the discontinued English Language Assessment service.

For completed applications, we are required to retain your personal data for a period for 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period.

Our role

We act as a Processor of your personal data. The Controller of your personal data is DfE.

What information we need and why

We retain and process information including your:

name
contact details
date of birth to confirm the content of your Statement to a third-party
information relating to your qualifications (including copies of documentation)
identity to confirm the contents of your Statement and confirm authenticity of Statements

Lawful basis for processing

These are determined by the DfE. Learn more about their personal information charter (opens in a new tab).

How long we keep it

Career Path Report

We may continue to process your personal data on behalf of the DfE for the purpose of the discontinued Career Path Report service. For complete applications, we are required to retain your personal data for a period for 25 years. This allows us to confirm the contents of statements, should you seek to rely on it within this time period.

Our role

We act as a Processor of your personal data. The Controller of your personal data is DfE.

What information we need and why

We retain and process information including your:

name
contact details
date of birth
information relating to your qualifications (including copies of documentation)
identity to confirm the contents of your statement

How long we keep it for

How we process your personal data for services your employer requests

Where we operate services for organisations, we may need to process personal data about their employees. If you are an employee of such an organisation, the following information sets out what we do with your personal data.

Corporate Subscriber contacts

Your information is collected, stored, and used by our staff to communicate with you if you or your employer has a working relationship with UK ENIC. See Corporate Subscriber above.

Our role

Where you or your employer has engaged with UK ENIC to use its services, verify Qualification Holders’ qualifications, supply services, instruct or develop a business relationship with UK ENIC, we process your personal data as a Controller.

What information we need and why

We collect and process personal data including your name, title, job title, the organisation you work for and their address and your email address. This is to deliver, develop, and/or receive services.

Lawful basis for processing

We collect and process your personal data for the purposes of delivering, developing and/or receiving our services.

We rely on Legitimate Interests as the lawful basis for processing your personal data, since it is the interests of you, us, and your employer for us to process your data for these purposes.

How long we keep it

We will keep your personal data for a period of up to 7 years from the conclusion of our engagement with your employer.

Training and events including conferences

Your information is collected, stored, and used by our staff to communicate with you, coordinate and tailor training and events to your needs, and deliver the training or event to you.

It is also used to invoice your or your employer and/or discharge any obligations we might have to you or them.

Our role

Where you apply to us for training or events, whether included in a membership package or paid for as a stand-alone service, we will be the Controller of your personal data.

What information we need and why

We collect and process personal data including your name, title, job title, the organisation you work for or represent and their address and your email address. This is to deliver the training or event to you, and to invoice your employer for payment.

If you tell us about dietary or special requirements (including disabilities) we may use this information to make adjustments for the relevant attendees. This may also include sharing with the venue provider to ensure appropriate access arrangements.

Photographs may be taken at Events by Our staff, which may subsequently be published by Us.

Lawful basis for processing

We collect and process your personal data for the purposes of delivering the training or event to you, including communicating with you.

A contract will exist relating to the delivery of training or event to you. This may be either directly with you, or with your employer, or both.

Where the contract is with you, we rely on Contract as the lawful basis for delivering the service to you as it is necessary for the performance of a contract that we have with you.

Where we contract with your employer rather than you, we rely on Legitimate Interests as the lawful basis for processing your personal data, since it is the interests of you, us, and your employer for us to process your data for this purpose.

We will request your Explicit Consent before processing your personal data relating to health and/or disability.

If your photograph is taken at an event and published by us we rely on legitimate interest for this processing.

How long we keep it

We will keep your personal data for a period of up to 7 years after the training or event has been completed or the contract with your employer has been fulfilled.

How we process your personal data for communicating with you as an Individual Applicant (Qualification Holder), including marketing and surveys

If you are an Individual Applicant (Qualification Holder), we will process your personal data when you contact us with enquiries or when we contact you for marketing purposes or to send you satisfaction surveys. The following information sets out what we do with your personal data.

Communications regarding a service or general enquiry

We may communicate with you in relation to general enquiries, or in relation to your existing applications via telephone or our website Live Chat functionality.

Generally, we receive two different types of enquiries:

a general enquiry for information about our services, or
an enquiry relating to an existing application you have with us (whether live or historical)

We will use the information to answer your enquiry and may record details of the enquiry for future reference.

Our role

It depends on the purpose of your enquiry:

if it is a general enquiry, then we will be the Controller of your personal data
if you are contacting us about an existing application for our services, then we will usually be acting as a Processor for the service you have applied for

What information we need and why

We will only collect sufficient personal data to allow us to deal with your enquiry, particularly when it is relevant to an existing application.

For general enquiries, we may not need to collect any information from you, though you should be aware that, in both cases, the software we use will collect the following additional personal data.

When you call our telephone helpline, we will:

collect Calling Line Identification (CLI) information, which is the phone number you are calling from. This is to help us to identify you, to understand demand for our services, improve how we operate, and call you back if we need to
record the audio of your telephone conversation - This is for training purposes and complaints, to improve the way in which our staff deal with enquiries and complaints

When you contact us via our live chat facility, we will collect information to identify your general location information (for statistical purposes) such as your IP address. A transcript of the conversation will also be recorded.

Lawful basis for process

The lawful basis that we will rely upon will depend on the reason for your enquiry.

For general enquiries we will rely on Legitimate Interests since it is in the interests of us and you to process personal data that is necessary to deal with your enquiry.

Where you are enquiring about an existing application, we rely upon the legal basis relevant to the processing of that application. You should check the section of this Privacy Notice relevant to the service for further information.

For telephone audio recordings, we rely on Legitimate Interests since it is in the interests of us, you, and the general public for our staff to provide training, improve the way our enquiries are managed, and investigate complaints.

How long we keep it for

We will keep call recordings for a maximum of 14 months. Live Chat transcripts are retained for a maximum of 14 months.

Where enquiries relate to an existing enquiry the transcript, or parts of it, may be transferred onto the permanent file associated with your application and kept for the retention periods outlined under ‘Individual Applications’, above.

Sending you marketing material

If you are an Individual Applicant (Qualification Holder) we will not send marketing communications to you unless we have consent to do so. You may be asked to opt-in to marketing emails.

Where we do send you marketing emails, you can withdraw your consent at any time. There will be a link in any marketing communications we send that will to allow you to do so easily.

The following relates to our direct email marketing activities.

Our role

We are the Controller of your personal data.

What information we need and why

We will use and share your email address and may personalise emails using your name.

Lawful basis for processing

The lawful basis that we will rely upon in this instance will be Consent as you will have consented to our sending you marketing emails either by opting in via our website or in some other way, such as at an event.

Sending you satisfaction surveys

We may send communications to you containing satisfaction surveys. We only do this to understand satisfaction levels so we can improve our services.

We do not rely on your consent to send satisfaction surveys to you, but we do not want to send these emails if you do not want us to. If you do not want to receive these emails you can opt out of them easily via the link provided in any survey communication we send to you.

The following relates to our satisfaction survey communications and activities.

Our role

We are the Controller of your personal data.

What information we need and why

We will already have collected your data, since you will have applied for one of our services. We will use your email address to send you satisfaction surveys.

Purpose and lawful basis for processing

We may send survey emails relating to services that you have used so that we can understand your level of satisfaction and improve our services.

The lawful basis that we will rely on is Legitimate Interests for us to receive your feedback so that we can improve our services.

How we process your personal data for communicating with you as a Corporate Subscriber, including marketing and surveys

If you are an individual acting in a business capacity, we will process your personal data when you contact us with enquiries or when we contact you for marketing purposes or to send you satisfaction surveys.

The following information sets out what we do with your personal data.

Sending you communications regarding a service or general enquiry

We may communicate with you in relation to general enquiries in the course of day-to-day business.

Our role

We are the Controller of your personal data.

What information we need and why

We will use and share your email address and may including your name and/or title.

Lawful basis for processing

We rely on Legitimate Interests as the lawful basis for communicating with you for this purpose as it is in our interests to communicate with customers, stakeholders and business contacts regarding services and for providing you the information necessary to satisfy your query.

Sending you marketing material

From time to time, we may email you about products, services and events which may be of interest to you or your organisation.

We will only ever contact you with these communications if we consider you to be an individual acting in a business capacity and the content is relevant to your role as an employee at the organisation you work for.

Please note that marketing emails should be distinguished from “Service” emails which might be sent to you if you are a representative of one of our members. Service emails are necessary to provide information about existing services that you or your organisation contract with us for.

Our role

We are the Controller of your personal data.

What information we need and why

We will use your email address and may personalise emails using your name and/or title.

Lawful basis for processing

We rely on Legitimate Interests as the lawful basis for delivering the service to you – since it is in ours, and we hope your, interests to provide information about other services we offer that might be of use to you or your organisation.

We do our utmost to ensure that you only receive communications that you want to receive, therefore you can change your mailing preferences (or unsubscribe completely) at any time by following the link that will be provided at the bottom of every marketing email.

Sharing your contact details with event sponsors

From time to time, we will share your contact details with training and events sponsors, but only when you have given us consent to do so. When you register for training or an event, you will be asked for permission to share your personal data with the event sponsor for marketing purposes.

Our role

We are the Controller of your personal data.

For the avoidance of doubt, the event sponsor will be an independent Controller for the purpose of any further processing (including marketing activity).

Please refer to each sponsor’s own Privacy Notice for further information.

What information we need and why

We will use and share your email address and name and/or title with the event sponsor.

Sending you satisfaction surveys

We may send communications to you containing satisfaction surveys. We only do this to understand satisfaction levels so we can improve our services.

The following relates to our satisfaction survey communications and activities.

Our role

We are the Controller of your personal data.

What information we need and why

We will already have collected your data, since you will have applied for one of our services.

We will use your email address to send you satisfaction surveys.

Purpose and lawful basis for processing

We may send survey emails relating to services that you have used so that we can understand your level of satisfaction and improve our services.

The lawful basis that we will rely on is Legitimate Interests for us to receive your feedback so that we can improve our services.

Inviting you to participate in market research

We may send communications inviting you to participate in market research. This will help us understand your challenges and what you and your organisation may need from our products and services in the future.

The following relates to our market research communications and activities.

Our role

We are the Controller of your personal data.

What information we need and why

We may have already collected your data if you have used or expressed an interest in using one or more of our consultancy services or commercial and educational products. Alternatively, we may obtain information about you from other sources, such as public databases, data providers, and from other third parties.

We will use your email address to send you satisfaction surveys or we will contact you via third party platforms, including LinkedIn. If you choose to participate in our market research initiatives, we will process your name and job title.

How long we keep your personal data

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any contractual, legal or reporting requirements.

To determine the appropriate retention period for personal data, we consider the volume, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances you can ask us to delete your personal data, however, where we are providing a service as a Processor we may be required to retain records for fraud monitoring purposes. Please see below for more information about your right to erasure.

Please refer to each individual service or purpose for specific information on how long we will retain your personal data.

Who we share your personal data with

We may need to share your personal data with third parties to deliver a service to you. This might be for the following general reasons:

Processors who provide part of our IT infrastructure. This may include, for example, off-site back-up providers, telephone recording, web, live chat and email servers
Processors who perform elements of our services for us, such as Primary Source Verification providers
Other third parties with whom we are required to share the information to deliver the services. Examples include organisations that issued your qualifications, or UK government departments
Organisations that you have disclosed a Statement to and they wish to confirm its authenticity
When we have your consent to do so, we will share your contact details with training and event sponsors who may contact you for their own marketing purposes
Where we are obliged to share your data by law, for example where we are involved in legal proceedings, or where we are complying with legal requirements, a court order, or the orders of a government authority
Where there is a requirement for us to do so to comply with an external audit

Where the party is a processor (points 1 & 2 above), we will have a contract in place with them to ensure that they cannot do anything with your personal data unless we have instructed them to do so. They must not share your data with anyone else unless we give them permission to do so. We will only give permission if we are satisfied that their sub-Processors will also comply with our instructions.

Your rights

Under data protection law, you have certain rights in relation to your personal data, such as the right to access and the right erasure. Please be aware that these rights do not apply in all circumstances, but we will always look to fulfil your request where possible.

To make a request related to any of these rights, please contact the Data Protection Officer at [email protected], or one of our customer services team. We will typically respond within one month.

If you have any cause for complaint about our use of your personal data, please contact us using the details in the following section, and we will do our best to help. Should you remain dissatisfied, you have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office.

You have the right to:

be informed:  about our collection and use of personal data: this Privacy Notice is our way of complying with this
have access: you have the right to ask us for copies of the information that we hold about you
rectification:  you have the right to have inaccurate or incomplete information we hold about you to be rectified
erasure:  in certain circumstances you can ask us to delete your information
restrict or prevent processing: in certain circumstances you can ask us to restrict the processing of your information
object: in certain circumstances you have the right to object to us using your information for particular purposes, for example, for direct marketing
data portability: in some circumstances and where appropriate, and technically feasible, you can ask us to provide your information in a commonly used, machine readable format
automated decision making and profiling: please note that UK ENIC Ltd does not perform any automated decision making or profiling

International Data Transfers

We may need to transfer your data out of the UK or European Economic Area (EEA). This might be because we need to do this to deliver your service, or because our Processors are located outside of the UK or EEA.

When we transfer, store or process your personal data outside of the UK or EEA, we take appropriate safeguards to ensure that your personal data remains protected in accordance with this Privacy Notice and appropriate legislation. We may rely on one of the following:

an adequacy agreement, if one exists, with the country we are transferring your personal data to, or
Standard Contractual Clauses approved by the European Commission and/or the UK Government / Information Commissioner’s Office, or
your explicit consent, or because it is necessary to perform the contract that we have with you or the transfer is necessary for a task carried out in the public interest; or
some other legal exception that is permitted by law.

Review and updates to this Notice

This notice is regularly reviewed and updated, for example when organisations change their name, or to clarify how your personal data is used.