01244 722697
Mon–Fri 8am–6pm
info@ctg.org.uk
Privacy Policy
Privacy Policy
How Construction Training Group Cyf (trading as Construction Training Group) collects, uses and protects personal data, under the UK GDPR and the Data Protection Act 2018.
1. Who is responsible for your data
Construction Training Group Cyf is the data controller. We are registered in England & Wales, company number 15451449.
- Registered office: recorded on the public register at Companies House. We are opening a new office and will publish the address here as soon as it is in use. For anything in writing, email us — that is a valid written notice for every purpose in these pages.
- Data protection enquiries: info@ctg.org.uk, or 01244 722697
- ICO registration number: ZB678142
We are not required to appoint a Data Protection Officer. Day-to-day responsibility sits with our centre management, and you can reach them on the details above.
2. What we collect
Identity and contact details — name, date of birth, postal address, email, phone number, employer, job role.
Qualification and assessment data — Unique Learner Number, National Insurance number (only where needed to obtain a ULN), prior qualifications, the qualification you are registered for, assessment plans, portfolio evidence, assessor feedback, photographs and video of you carrying out work tasks, witness testimony from your supervisor, results and certificate details.
Proof of identity — a copy of a passport, driving licence or similar, where the awarding body requires identity verification.
Health and support information — where you tell us about a disability, learning difficulty, medical condition or other need so that we can make reasonable adjustments. This is special category data and we treat it accordingly (see section 4).
Payment data — billing name and address, and order history. We do not hold your full card number; card details are entered directly with our payment providers.
Employer and funding data — where an employer books for you, their contact details, purchase orders, and CITB levy registration details for grant claims.
Website and marketing data — enquiry form submissions, email opens and clicks where you have subscribed, and cookie-based analytics data (see our Cookie Policy).
Recruitment data — CVs and application details if you apply for a role with us.
3. Where we get it
Mostly from you, or from your employer where they are booking on your behalf. We may also receive assessment or registration data back from awarding organisations, and identity or prior-learning data from the Learning Records Service.
4. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Respond to your enquiry and give you a quote | Steps at your request prior to entering a contract |
| Register you with the awarding body, plan and carry out assessment, quality-assure it and claim your certificate | Performance of our contract with you (or our legitimate interest in delivering the contract, where your employer is the contracting party) |
| Take payment and chase unpaid fees | Performance of a contract; legitimate interests (recovering money owed) |
| Verify your identity as the awarding body requires | Legal obligation and performance of a contract |
| Retain learner records for awarding-body audit and external quality assurance | Legal obligation; legitimate interests (defending our centre approval) |
| Make reasonable adjustments for a disability or support need | Legal obligation under the Equality Act 2010. For the health information itself we rely on Article 9(2)(b) — employment, social security and social protection law — and, where that does not apply, your explicit consent, which you can withdraw at any time |
| Submit and support CITB grant claims | Performance of a contract; legitimate interests of you and your employer in recovering grant |
| Keep accounting records | Legal obligation (Companies Act 2006, HMRC) |
| Handle complaints, appeals and malpractice investigations | Legal obligation; legitimate interests (running a compliant centre) |
| Send marketing emails about courses | Your consent, or the soft opt-in where you are an existing customer and we are marketing similar services. You can unsubscribe from any email |
| Measure and improve the website | Your consent, given through our cookie banner |
| Site safety and insurance where an assessor attends your premises | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced those interests against your rights and are satisfied they do not override them. You can ask us for that assessment.
5. Who we share it with
We never sell your data. We share it only with:
- Awarding organisations — GQA Qualifications and NPORS — to register you, verify assessment and issue certificates. They are separate controllers with their own privacy notices.
- The Learning Records Service (part of the Department for Education) to obtain or confirm your Unique Learner Number.
- CITB, where a grant claim is made for your qualification.
- CSCS, where you ask us to confirm an achievement in support of a card application.
- Your employer, where they are paying for or sponsoring your training — normally limited to enrolment status, progress and completion, not the detail of your portfolio or any health information.
- Our assessors and internal quality assurers, including self-employed associates, who are bound by written confidentiality and data protection terms.
- Our service providers, acting as processors on our written instructions: SiteGround (website hosting), Stripe and PayPal (payments), Brevo (transactional and marketing email), Google (Analytics), Trustindex (review display), and our e-portfolio and accounting systems.
- Professional advisers, insurers and auditors, where necessary.
- Law enforcement, regulators or courts, where we are legally required to.
6. Sending data outside the UK
Some of our providers process data outside the UK. Where they do, we rely on UK adequacy regulations or on the International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses, together with appropriate technical safeguards. You can ask us for details of the safeguard used for a particular provider.
7. How long we keep it
| Record | Retention period |
|---|---|
| Enquiries that do not lead to a booking | 12 months |
| Learner registration and assessment records, portfolio evidence, certificate claims | For as long as our awarding organisations require us to hold them, then securely destroyed. We will tell you the period that applies to your qualification on request |
| Identity documents | Deleted once identity has been verified and recorded |
| Health and reasonable-adjustment information | For the duration of the registration plus 12 months |
| Financial and accounting records | 6 years from the end of the financial year (HMRC / Companies Act) |
| Complaints, appeals and malpractice files | 6 years from closure |
| Marketing consents and unsubscribes | Until you withdraw, plus a permanent suppression record so we do not contact you again |
| Unsuccessful job applications | 6 months |
| Website analytics | For the retention period set in our Google Analytics account, which we review annually |
8. How we protect it
Access is limited to staff and assessors who need it. Systems are password-protected with multi-factor authentication where available, the website is served over HTTPS, and portfolio evidence is held in an access-controlled e-portfolio rather than sent by open email. We keep a record of processing activities and will report any qualifying personal data breach to the ICO within 72 hours, and to you where it is likely to result in a high risk to your rights.
9. Your rights
You have the right to:
- be informed — this notice;
- access a copy of the data we hold about you;
- rectification of anything inaccurate or incomplete;
- erasure, where we no longer have a lawful reason to hold it — note we cannot delete assessment records we are required to retain by an awarding body while that obligation lasts;
- restrict processing while a dispute is resolved;
- data portability, for data you gave us that we process by automated means under contract or consent;
- object to processing based on legitimate interests, and an absolute right to object to direct marketing;
- withdraw consent at any time, where consent is the basis we rely on.
To exercise any of these, email info@ctg.org.uk. We respond within one month and there is no charge. We may ask you to confirm your identity first.
Automated decision-making. We do not make decisions about you by automated means alone, and we do not profile you in any way that produces legal or similarly significant effects.
10. Cookies
See our Cookie Policy. You can change your choices at any time using the Manage consent control shown on every page.
11. Children
Our services are aimed at people aged 18 and over. Where a learner is under 18 we ask for a parent or guardian’s consent to any processing that relies on consent. We do not knowingly collect data about children outside that.
12. Complaining
Please raise concerns with us first — info@ctg.org.uk or our complaints procedure. You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 · ico.org.uk/make-a-complaint
13. Changes
We review this notice at least annually and whenever our processing changes. The date at the top shows the current version.