Privacy Notice
This Privacy Notice applies to services operated by ECCTIS Limited (Ecctis). Ecctis operates services to individuals and organisations; this notice covers the services offered under the ecctis.com web domain.
Ecctis understands that your privacy is important to you. We respect and value the privacy of everyone who visits our website and uses our services. Ecctis will only collect and use your personal data in ways that are described here, and in a manner that is consistent with our obligations and your rights under data protection and other laws.
How to read this notice: The notice is structured to help you find information that is relevant to the service or services you use.
Our contact details
Ecctis Ltd is a limited company registered in England with company number 2405026.
Our registered office address is:
Ecctis Ltd
Suffolk House
68-70 Suffolk Road
Cheltenham
Gloucestershire
GL50 2ED
United Kingdom
Our Data Protection Officer can be contacted at [email protected] or via our postal address. Please mark postal communication with ‘Data Protection Officer’.
The Ecctis Ltd ICO Registration Reference is Z7566127.
European Union representative:
Pursuant to Article 27 of the General Data Protection Regulation (GDPR), Ecctis Limited has appointed European Data Protection Office (EDPO) as its GDPR Representative in the EU. You can contact EDPO regarding matters pertaining to the GDPR:
- By using EDPO’s online request form: https://edpo.com/gdpr-data-request/
- By writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium
Switzerland representative:
Pursuant to Article 14 of the FADP, Ecctis Limited has appointed EDPO Switzerland as its Representative in Switzerland. You can contact EDPO Switzerland regarding matters pertaining to the FADP:
- By using EDPO Switzerland’s online request form: https://edpo.com/swiss-data-request/
- By writing to EDPO Switzerland at Rue de Lausanne 37, 1201 Geneva, Switzerland
Our role in processing
Ecctis operates as the Controller of your personal data. For information on our role(s) specific to each service, please see ‘How we process your personal data for services you request below.
Ecctis acts as a Controller when processing personal data for the services we provide for individuals, and for the purposes of undertaking marketing, sending you feedback surveys to understand satisfaction levels so we can improve our services, to check in visitors to our offices and when you apply to us for a job.
Third party privacy information
Throughout this privacy notice we will link to the privacy information of organisations with whom we share your information to enable you to see how each recipient organisation processes your information.
How we get your personal data
Most of the personal data we process is provided for one of the following reasons:
You are an Individual Applicant (Qualification Holder)
- You have enquired about, and/or applied for, one of our services for individuals; or
- An organisation has submitted an application for one of our services for individuals on your behalf
You are an individual acting in a business capacity, i.e. a ‘Corporate Subscriber’, such as an employee of a:
- Client company/organisation or a higher education provider. You or your employer has subscribed to one or more of our services for organisations and either you or your employer has provided your personal data to us to allow you to access or make use of those services. This may include for training and events purposes;
- Higher education provider that works with Ecctis to verify Qualification Holders’ qualifications;
- UK government department;
- Company or organisation to whom Ecctis provides services or has a business relationship;
- Supplier of goods or services (including consultancy) to Ecctis. You or your employer provides goods and services to Ecctis and either you or your employer has submitted your personal data to us to enter into an agreement, facilitate an order, pay an invoice or to facilitate collaborative working.
You are a Job Applicant who has applied for a role with Ecctis:
- Direct via email
- Through a recruitment agency
Where we do not receive information from you directly, we will endeavour to contact you to let you know we are processing your personal data unless to do so would be:
- Disproportionate, or
- Prejudicial e.g. to law enforcement or national security
How we process your personal data for services you request as an Individual Applicant (Qualification Holder)?
Your personal data is collected, stored, and used by our staff to communicate with you, identify you from other applicants, and deliver our services to you. This will include validating that qualification and identity information provided by you is accurate, and that you hold the qualifications submitted to us.
Throughout this section we will clearly identify the Controller for each service. The following information relates to current services and applies where you apply directly to us via our website:
Industry skills statement
We process your personal data as Controller for the purpose of the Industry Skills Statement service. This is to enable you to evidence your overseas qualifications for those in the construction, plumbing, electrical, or land land-based sectors.
| Our role | We are the Controller of your personal data. |
| What information we need and why | We collect and process personal data including your name, contact details, date of birth, identity and qualification documents and information to deliver the service to you, to identify you, to verify the qualifications, and to communicate with you about your application. We collect and process information relating to the reasons for your application (including refugee status) to ensure we are delivering the correct service to you and to optimise our services for your needs. |
| Lawful Basis for Processing | We rely on Legitimate Interests as the lawful basis for delivering the service to you, since it is the interests of you, us, and the general public to be able to issue statements and/or confirm the contents of our statements if necessary. |
| How long we keep it | For completed applications, we retain information for a period of up to 5 years. This is necessary for detecting and preventing crime, fraudulent applications and preserving the integrity of our services. Scanned documents submitted in support of applications are deleted within 12 months of the service being completed, or the last action on an account. We actively discourage applicants from sending original paper documentation to support their application, as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or last action on an account, unless we are required to retain the documents. |
Confirming the content of a statement to a third party
On occasion we will be asked to confirm that a Statement issued by us is genuine, and/or accurate. This might be, for example, where you have provided your Statement to a third party for them to rely on the contents of it.
Where we are asked to do so, we will confirm whether the Statement was issued, and whether the information contained in the Statement is accurate.
| Our role | We are the Controller of your personal data. |
| What information we need and why | No further personal data will be collected. |
| Lawful Basis for Processing | We will confirm whether information provided to us matches our records. We will never volunteer any personal data to a third party. The lawful basis that we rely upon to process this information will be Legitimate Interests since it is in the interests of us, you, and the general public for statements to be able to be relied on and checked for accuracy. |
| Who we share it with | Organisations to whom a Statement has been disclosed by you if they wish to confirm its authenticity. We will confirm with the enquirer whether information matches our records. |
| How long we keep it | For completed applications, we retain information for a period up to 5 years. This is necessary for detecting and preventing crime, fraudulent applications and preserving the integrity of our services. We actively discourage applicants from sending original paper documentation to support their application, as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or last action on an account, unless we are required to retain the documents. |
How we process your personal data for communicating with you as an Individual Applicant (Qualification Holder), including marketing and surveys?
If you are an Individual Applicant (Qualification Holder), we will process your personal data when you contact us with enquiries or when we contact you for marketing purposes or to send you satisfaction surveys. The following information sets out what we do with your personal data:
Communications regarding a service or general enquiry
We may communicate with you in relation to general enquiries, or in relation to your existing applications via the Ecctis application portal, or via email. Generally we receive two different types of enquiry:
- A general enquiry for information about our services, or
- An enquiry relating to an existing application you have with us (whether live or historical).
We will use the information to answer your enquiry and may record details of the enquiry for future reference.
| Our role | Whether you are contacting us with a general enquiry or regarding an existing application, we will be acting as the Controller of your personal data. |
| What information we need and why | We will only collect sufficient personal data t allow us to deal with your enquiry, particularly when it is relevant to an existing application. For general enquiries, we may not need to collect any information from you, though you should be aware that, in both cases, the software we use will collect the following additional personal data. |
| Lawful basis for processing | The lawful basis that we will rely upon will depend on the reason for your enquiry: For general enquiries we will rely on Legitimate Interests since it is in the interests of us and you to process personal data that is necessary to deal with your enquiry. Where you are enquiring about an existing application, we rely upon the legal basis relevant to the processing of that application. You should check the section of this Privacy Notice relevant to the service for further information. |
| How long we keep it | We keep data regarding general enquiries for a maximum of 12 months after the date of enquiry. |
Sending you marketing material
If you are an Individual Applicant (Qualification Holder) we will not send any marketing communications to you unless we have consent to do so. You may be asked to opt-in t marketing emails.
Where we do send you marketing emails, you can withdraw your consent at any time. There will be a link in any marketing communications we send that will allow you to do so easily.
The following related to our direct email marketing activities:
| Our role | We are the Controller of your personal data. |
| What information we need and why | We will use and share your email address and may personalise emails using your name. |
| Lawful basis for processing | The lawful basis that we rely upon in this instance will be Consent as you will have consented to our sending you marketing emails either by opting in via our website or in some other way, such as at an event. |
Sending you satisfaction surveys
We may send communications to you containing satisfaction surveys. We only do this to understand satisfaction levels so we can improve our services.
We do not rely on your consent to send satisfaction surveys to you, but we do not want to send these emails if you do not want us to. If you do not want to receive these emails you can opt out of them easily via the link provided in any survey communication we send to you.
The following relates to satisfaction survey communications and activities:
| Our role | We are the Controller of your personal data. |
| What information we need and why | We will already have collected, since you will have applied for one of our services. We will use your email address to send you satisfaction surveys. |
| Purpose and Lawful Basis for processing | We may send survey emails relating to services that you have used so that we can understand your level of satisfaction and improve our services. The lawful basis that we will rely on is Legitimate Interests for us to receive your feedback so that we can improve our services. |
How we process your personal data for services relating to our Global Ed Community?
Where we operate services for organisations, we may need to process personal data about their employees. If you are an employee of such an organisation, the following information sets out what we do with your personal data:
- Corporate Subscriber Contacts
Your information is collected, stored, and used by our staff to register you and communicate with you regarding the services offered through our Global Ed Community.
| Our role | Where you or your employer has engaged with Ecctis to use its services relating to the Global Ed Community, we process your personal data as a Controller. |
| What information we need and why | We collect and process personal data including your name, job title, the organisation you work for and your work email address. This is to deliver, develop, and/or receive services. |
| Lawful Basis for Processing | We collect and process your personal data for the purposes of delivering, developing and/or receiving our services. We rely on Legitimate Interests as the lawful basis for processing your personal data, since it is the interests of you, us, and your employer for us to process your data for these purposes. |
| How long we keep it | We will keep your personal data for a period of up to 1 year from your last engagement after your subscription has ended. |
How we process your personal data for communicating with you as a Corporate Subscriber, including marketing and surveys?
If you are an individual acting in a business capacity, we will process your personal data when you contact us with enquiries or when we contact you for marketing purposes or to send you satisfaction surveys. The following information sets out what we do with your personal data:
Sending you communications regarding a service or general enquiry
We may communicate with you in relation to general enquiries in the course of day-to-day business.
| Our role | We are the Controller of your personal data. |
| What information we need and why | We will use and share your email address and may including your name and/or title. |
| Lawful basis for processing | We rely on Legitimate Interests as the lawful basis for communicating with you for this purpose as it is in our interests to communicate with customers, stakeholders and business contacts regarding services and for providing you the information necessary to satisfy your query. |
Sending you marketing material
From time to time, we may email you about products, services and events which may be of interest to you or your organisation. We will only ever contact you with these communications if we consider you to be an individual acting in a business capacity and the content is relevant to your role as an employee at the organisation you work for.
Please note that marketing emails should be distinguished from “Service” emails which might be sent to you if you are a representative of one of our members. Service emails are necessary to provide information about existing services that you or your organisation contract with us for.
| Our role | We are the Controller of your personal data. |
| What information we need and why | We will use your email address and may personalise emails using your name and/or title. |
| Lawful basis for processing | We rely on Legitimate Interests as the lawful basis for delivering the service to you – since it is in ours, and we hope your, interests to provide information about other services we offer that might be of use to you or your organisation. We do our utmost to ensure that you only receive communications that you want to receive, therefore you can change your mailing preferences (or unsubscribe completely) at any time by following the link that will be provided at the bottom of every marketing email. |
Sending you satisfaction surveys
We may send communications to you containing satisfaction surveys. We only do this to understand satisfaction levels so we can improve our services.
We do not rely on your consent to send satisfaction surveys to you, but we do not want to send these emails if you do not want us to. If you do not want to receive these emails you can opt out of them easily via the link provided in any survey communication we send to you.
The following relates to our satisfaction survey communications and activities:
| Our role | We are the Controller of your personal data. |
| What information we need and why | We will already have collected your data, since you will have applied for one of our services. We will use your email address to send you satisfaction surveys. |
| Purpose and Lawful Basis for Processing | We may send survey emails relating to services that you have used so that we can understand your level of satisfaction and improve our services. The lawful basis that we will rely on is Legitimate Interests for us to receive your feedback so that we can improve our services. |
Inviting you to participate in market research
We may send communications inviting you to participate in market research. This will help us understand your challenges and what you and your organisation may need from our products and services in the future.
The following relates to our market research communications and activities:
| Our role | We are the Controller of your personal data. |
| What information we need and why | We may have already collected your data if you have used or expressed an interest in using one or more of our consultancy services or commercial and educational products. Alternatively, we may obtain information about you from other sources, such as public databases, data providers, and from other third parties. We will use your email address to send you satisfaction surveys or we will contact you via third party platforms, including LinkedIn. If you choose to participate in our market research initiatives, we will process your name and job title. |
| Purpose and Lawful Basis for Processing | The lawful basis that we will rely on is Legitimate Interests for us to receive your feedback so that we can improve our products and services. |
How we process your personal data for taking payments?
When you make a payment for one of our services, whether on our website or over the telephone, this is done using Stripe, an independent third-party payment processing company. We do not have access to your banking or payment card information and this privacy notice does not cover how Stripe processes personal information. We encourage you to read their privacy notice, which can be found here: https://stripe.com/gb/privacy.
We do not encourage you to send payment card details to us in any format. Any payment card details received by us will be destroyed immediately.
How we process your personal data when you apply for a job with us?
We will also process your personal data when you apply for a job with us, whether directly or through a recruitment agency. The following information sets out what we do with your personal data:
| Our role | We are the Controller of your personal data. |
| What information we need and why | When you apply for a role with Ecctis we will process your CV (including previous work history and qualifications) to review your application and your contact details to arrange and conduct an interview. |
| Lawful Basis for Processing | This processing is carried out for our legitimate interests to ensure you have appropriate qualifications for the role which you are applying for. |
| How long we keep it | If your application is successful, your application form, CV and covering letter will be held as part of your employment record for 6 years beyond the termination of your employment with Ecctis. If your application is not successful, your application form, CV, and covering letter will be held for one year from the date at which someone is appointed to the advertised position. Data is held for the purpose of monitoring the level of repeated applications and maintaining a talent pool of candidates who may be interested in other vacancies. |
How we process your personal data when you visit our office?
We process your personal data when you visit our offices for security and health & safety purposes.
| Our role | We are the controller of your personal data. |
| What information we need and why | We collect and process personal data including your name and email address to ensure we are aware of who is in the building at all times and to send you confirmation of your check in. |
| Lawful basis for processing | We rely on legitimate interest for this processing since it is of the interest of both you and us that we are aware who is in the building for health and safety and security purposes. |
| How long we keep it | Your personal data will be kept for a period of 7 days after your visit. |
How long we keep your personal data?
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any contractual, legal or reporting requirements.
To determine the appropriate retention period for personal data, we consider the volume, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances you can ask us to delete your personal data, however, where we are providing a service as a Processor we may be required to retain records for fraud monitoring purposes. Please see below for more information about your right to erasure.
Please refer to each individual service or purpose for specific information on how long we will retain your personal data.
Who we share your personal data with?
We may need to share your personal data with third parties to deliver a service to you. This might be for the following general reasons:
- Processors who provide part of our IT infrastructure. This may include, for example, off-site back-up providers, web and email servers.
- Processors who perform elements of our services for us, such as Primary Source Verification providers.
- Other third parties with whom we are required to share the information to deliver the services. Examples include organisations that issued your qualifications, or UK government departments.
- Organisations that you have disclosed a Statement to and they wish to confirm its authenticity.
- Where there is a requirement for us to do so to comply with an external audit
Where the party is a processor (points 1 & 2 above), we will have a contract in place with them to ensure that they cannot do anything with your personal data unless we have instructed them to do so. They must not share your data with anyone else unless we give them permission to do so. We will only give permission if we are satisfied that their sub-Processors will also comply with our instructions.
Your rights
Under data protection law, you have certain rights in relation to your personal data, such as the right to access and the right erasure. Please be aware that these rights do not apply in all circumstances, but we will always look to fulfil your request where possible.
To make a request related to any of these rights, please contact the Data Protection Officer at [email protected], or one of our customer services team. We will typically respond within one month.
- The right to be informed about our collection and use of personal data: this Privacy Notice is our way of complying with this.
- The right of access: you have the right to ask us for copies of the information that we hold about you.
- The right to rectification: you have the right to have inaccurate or incomplete information we hold about you to be rectified.
- The right to erasure: in certain circumstances you can ask us to delete your information.
- The right to erasure: in certain circumstances you can ask us to delete your information.
- The right to object: in certain circumstances you have the right to object to us using your information for particular purposes e.g. for direct marketing.
- The right to data portability: in some circumstances and where appropriate, and technically feasible, you can ask us to provide your information in a commonly used, machine readable format.
- Rights related to automated decision making and profiling: please note that Ecctis Ltd does not perform any automated decision making or profiling.
If you have any cause for complaint about our use of your personal data, please contact us using the details above and we will do our best to help.
Should you remain dissatisfied, you have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office.
International data transfers
We may need to transfer your data out of the UK or European Economic Area (EEA). This might be because we need to do this to deliver your service, or because our Processors are located outside of the UK or EEA.
When we transfer, store or process your personal data outside of the UK or EEA, we take appropriate safeguards to ensure that your personal data remains protected in accordance with this Privacy Notice and appropriate legislation. We may rely on one of the following:
- An adequacy agreement, if one exists, with the country we are transferring your personal data to; or
- Standard Contractual Clauses approved by the European Commission and/or the UK Government / Information Commissioner’s Office; or
- Your explicit consent, or because it is necessary to perform the contract that we have with you or the transfer is necessary for a task carried out in the public interest; or
- Some other legal exception that is permitted by law.
Please contact [email protected] to obtain further information about these safeguards or if you have any questions about how your personal data is disclosed outside the UK or EEA.
Review and updates to this notice
This notice is regularly reviewed and updated, for example when organisations change their name, or to clarify how your personal data is used. Updates can be made at any time, and you will always find the most up-to-date version at https://www.ecctis.com/privacynotice.aspx.