Creative Skillset (or any successor in title) (‘we’, ‘us’, ‘our’) is committed to protecting and respecting your privacy. For the purposes of the General Data Protection Regulations (GDPR) and any subsequent UK legislation covering data protection the Data Controller is Creative Skillset (our Information Commissioner’s Office registration number is Z8941934)
This Policy covers Creative Skillset in relation to the collection and use of the information you give us. It sets out why we collect personal information and how we use that information. It explains the legal basis for this and the rights you have over the way your information is used.
We may change this Policy from time to time. If we make any significant changes we will advertise this on the website. Please check this Policy occasionally to make sure you are happy with any changes.
If you have any questions about this Policy or concerning your personal information please contact Creative Skillset, Data Protection Officer(s) at:
Telephone: 020 7713 9800
Or by post to Data Protection Officer, Creative Skillset, 94 Euston Street, London, NW1 2HA.
What type of personal information we collect
When we refer to "personal information", we mean information that identifies you as an individual, or is capable of doing so. We may hold and use information about you whether you’re a Creative Skillset stakeholder: i.e. customer, an individual acting on behalf of a business or receiving products or services as a result of the relationship with us, a job seeker or when you interact with us in other ways, for example when you visit our website or apply for a bursary, funding or scheme.
The type of personal information we collect and/or generate may vary depending on the products and services you use and your relationship with us. It may include (but it isn't limited to):
- your name, personal and/or business contact details (including postal address, phone number(s), email address), date of birth, credentials like passwords and any other information required to validate your identity;
- payment information such as bank account details;
- demographic information such as your gender, age etc. (this is usually requested on a voluntary basis);
- information about our products and services you use, have used or asked about
- Information about how you use our products and services, such as:
- programmes feedback surveys
- your customer services experience
- information about your computer and about your visits to and use of this website (including your IP address, geographical location, browser type, referral source, length of visit and number of page views);
- your communications with us;
- information that you provide to us for subscribing to our website services, email notifications and/or newsletters (including your name, address, job title, organisation or business name and the aspects of our services that may be of interest to you);
- information you give us when entering prize draws or competitions, or participate in surveys or consumer panels;
- information you give us when you sign up for or participate at events, conferences, seminars or Creative Skillset sponsored events;
- information about your computer and about your visits to and use of this website (including your IP address, geographical location, browser type, referral source, length of visit and number of page views).
How we collect information
We may collect information from you whenever you contact us or have any involvement with us, for example when you:
- enquire about our activities or services
- sign up to receive news about our activities
- create or update a profile on any digital products or services
- post content onto our website/social media sites
- sign up for Creative Skillset schemes and initiatives
- apply for funding from us
- take part in our events
- contact us in any way including online, email, phone, SMS, social media or post
- take up employment with us or go on worker contract
- send us invoices, statements or request us to transact with you in relation to financials
Where we collect information from
We collect information:
(1) From you when you give it to us directly. You may provide your details when you ask us for information, sign up for one of our schemes and/or initiatives, apply for funding, attend our events or contact us for any other reason.
(3) When you have given other organisations permission to share it. Your information may be provided to us by other organisations if you have given them your permission to do so. This might for example be a partner working with us or might be when you buy a product or service from a third party organisation. The information we receive from other organisations depends on your privacy settings or the option responses you have given them.
(5) When it is available on social media. Depending on your settings or the privacy policies applying for social media and messaging services you use, like Facebook, Instagram or Twitter, you might give us permission to access information from those accounts or services.
How we use your information
We will use your personal information in a number of ways which reflect the legal basis applying to processing of your data. These may include:
- providing you with the information or services you have asked for
- organising schemes and/or activity you have told us you want to be involved in
- processing grants or job applications
- sending you communications in the form of newsletters and/or e-mailshots that may be of interest including marketing information about our services and activities, campaigns other company or scheme activities and promotions
- when necessary for carrying out our obligations under any contract between us
- seeking your views on the services or activities we carry, so that we can make improvements
- maintaining our organisational records and ensuring we know how you prefer to be contacted
- analysing the operation of our website to improve the website and its usefulness
- for reporting purposes to comply with equality and diversity monitoring
Our legal basis for processing your information
The use of your information for the purposes set out above is lawful because one or more of the following applies:
- Where you have provided information to us for the purposes of requesting information or requesting that we carry out a service for you. You may withdraw consent at any time by emailing us at firstname.lastname@example.org. This will not affect the lawfulness of processing of your information prior to your withdrawal of consent being received and actioned.
- It is necessary for us to hold and use your information so that we can carry out our obligations under a contract entered into with you or to take steps you ask us to prior to entering into a contract.
- It is necessary to comply with our legal obligations (equality and diversity, immigration law etc).
- Where the purpose of our processing is the provision of information or services to you, we may also rely on the fact that it is necessary for your legitimate interests that we provide the information or service requested, and given that you have made the request, would presume that there is no prejudice to you in our fulfilling your request.
- The provision of information to a third party to enable them to fulfil part of a request for assistance or complete the service for you. We may also rely on the fact that it is necessary for your legitimate interests that we provide the information or service requested, and given that you have made the request, would presume that there is no prejudice to you in our fulfilling your request.
- Other basis which includes necessary processing to protect the vital interests of the individual concerned or other individuals and processing necessary for a task carried out in the public interest or in the exercise of official authority vested in the company.
If you want to contact us about your preferences please contact email@example.com or call on 02077139800
How we keep your information safe
Creative Skillset has put in place measures to protect the security of your personal information. It has internal policies, procedures and controls in place to try and prevent your personal information from being accidentally lost or destroyed, altered, disclosed or used or accessed in an unauthorised way. In addition, we limit access to your personal information to those employees, workers, agents, contractors and other third parties who have a business need to know in order to perform their job duties and responsibilities. You can obtain further information about these measures from our Data Protection Officer(s).
Where your personal information is shared with third-party service providers, we require all third parties to take appropriate technical and organisational security measures to protect your personal information and to treat it subject to a duty of confidentiality and in accordance with data protection law. We only allow them to process your personal information for specified purposes and in accordance with our written instructions and we do not allow them to use your personal information for their own purposes.
Creative Skillset also has in place procedures to deal with a suspected data security breach and we will notify the Information Commissioner’s Office (or any other applicable supervisory authority or regulator) and you of a suspected breach where we are legally required to do so.
No data transmission over the internet can however be guaranteed to be 100% secure. While we strive to safeguard your information, we cannot guarantee the security of any information you provide online.
Who has access to your information?
- Creative Skillset authorised staff
- Carefully selected partners with whom we run joint initiatives, schemes
- Funding agencies which whom Creative Skillset is partnered with for the purposes of the scheme
- Third parties who provide services for us, for example Paycheck contracted payroll providers. We select our third party service providers with care. We provide these third parties with only the information that is necessary to provide the service and have an agreement in place that requires them to operate with the same care over data protection as we do
- Third parties with whom if we run an event in conjunction with. We will let you know how your data is used when you register for any event
- Analytics and search engine providers that help us to improve our website and its use
- Third parties in connection with restructuring or reorganisation of our operations, In such event we will take steps to ensure your privacy rights are protected by the third party
Owing to matters such as financial or technical considerations the information you provide to us may be transferred to countries outside the European Economic Area (EEA), which are not subject to the same data protection regulations as apply in the UK. We may do this as some corporate systems are hosted on servers outside of EEA e.g. USA, Switzerland etc.
We meet our obligations under GDPR by ensuring that the information has equivalent protection as if it were being held within the EEA. We do this by ensuring that there are appropriate safeguards in place with any third parties processing your data outside the EEA. This will usually be because the country either benefits from an adequacy determination for GDPR purposes and/or, where appropriate, we have entered into a Data Processing Agreement with the third party which contains model EU clauses or the third party works under EU-US Privacy Shield Framework.
We may disclose your personal information if we are required to do so under any legal obligation and may use external data for the purposes of fraud prevention and credit risk reduction, or where doing so would not infringe your rights, but is necessary and in the public interest.
Other than this, we will not share your information with other organisations without your consent.
Keeping your information up to date
We really appreciate it if you let us know when your contact details change. You can do so by contacting us at firstname.lastname@example.org
Our use of 'cookies'
“Cookies” are small pieces of information sent by a web server to a web browser, which enable the server to collect information from the browser. They are stored on your hard drive to allow our website to recognise you when you visit. Please read our cookies policies for Creative Skillset here and for Hiive here.
We appreciate that our supporters are of all ages. Where appropriate we will ask for consent from a parent or guardian to collect information about children (under 16s).
How long we keep your information for
We will hold your personal information for as long as it is necessary for the relevant activity. By way of example, we hold records of financial transactions for at least six years plus current year, so we can fulfil our statutory obligations for tax purposes.
Where we rely on your consent to contact you for direct marketing purposes, we will treat your consent as lasting only for as long as it is reasonable to do so. This will usually be for ten years. We may periodically ask you to renew your consent.
To receive more information about our Data Retention policy please email email@example.com.
If you ask us to stop contacting you with marketing materials, we will keep a record of your contact details and limited information needed to ensure we comply with your request.
You have the right to request details of the processing activities that we carry out with your personal information through making a Data Subject Access Request. Such requests have to be made in writing. More details about how to make a request, and the procedure to be followed, can be found in our Data Subject Access Request page.
You also have the following rights:
- the right to request rectification of information that is inaccurate or out of date;
- the right to erasure of your information (known as the “right to be forgotten”);
- the right to restrict the way in which we are dealing with and using your information; and
- the right to request that your information be provided to you in a format that is secure and suitable for re-use (known as the “right to portability”);
- rights in relation to automated decision making and profiling including profiling for marketing purposes.
All of these rights are subject to certain safeguards and limits or exemptions, further details of which can be found in our Data Protection Policy. To exercise any of these rights, you should contact Data Protection Officer(s).
If you are not happy with the way in which we have processed or dealt with your information, you can complain to the Information Commissioner’s Office. Further details about how to complain can be found here.
This Policy may be changed from time to time. If we make any significant changes we will advertise this on our website or where necessary contact you directly with the information.
Do please check this Policy each time you consider giving your personal information to us.