Full policy

 1.0  Policy

1.1  The Advance Assessments board of directors is responsible for oversight of this policy.

1.2  The Advance Assessments’ Data Controller for the period ending 30^th September 2020 is Graham Meek (graham.meek@advanceassessments.co.uk) and he is responsible for implementation of this policy.  He is identified on the Advance Assessments’ online assessment site as the ‘Data Protection Officer’.

1.3  Advance Assessments is committed to protecting the rights to privacy of all its service users and stakeholders.  It is our policy to respect the privacy of private communication.

1.4  In this policy the people that Advance Assessments hold information on (apprentices, other service users and other stakeholders) are referred to as ‘data subjects’.

1.5  Information provided by data subjects will be held on servers based in the UK.  Data will not be transferred out of the UK.

1.6  Advance Assessments will always adhere to the UK Data Protection Legislation, including EU Regulation 2016/679 General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

1.7  Advance Assessments is registered with the UK Information Commissioner’s Office as a Data Controller.  Reference: ZA460596

1.8  Advance Assessments collects the data that service users (data subjects) provide on registration, which service users agree to supply to us as accurate.  Advance Assessments may process service users’ personal data in combination with their uploaded evidence documents to provide the services offered and improve the service offer.

1.9  Data will not be transferred to, or shared with, any third party with the exception of UK government bodies or their appointed agents, the apprentice’s employer and training provider(s) for the purpose of certification, award, audit and review.  These include:

1.9.1     The Education and Skills Funding Agency (ESFA)

1.9.2     The Institute for Apprentices (IfA)

1.9.3     External Quality Assurance organisations appointed by the IfA

1.9.4     The employer of an apprentice

1.9.5     The training provider(s) for an apprentice

1.9.6     The assessor(s) of an apprentice

1.9.7     The internal verifiers of apprentice assessments

1.10       Data supplied by data subjects is used to:

1.10.1   Provide and manage the user’s account

1.10.2   Supply the user with information, feedback, assessment and support materials, assessment results and other documents that are material to the End Point Assessment process.

1.10.3   Manage the assessment process, including review of gateway evidence and assessment evidence from an apprentice

1.10.4   Manage payment to employees, subcontractors and suppliers

1.10.5   Manage the quality and performance of the assessment process

1.11       Email users.  Please note that the emails Advance Assessments sends are an integral part of the assessment service offered and this service cannot be provided where the use of email communication is opted out of.  By registering with Advance Assessments users are consenting to the storage and use of the data required to send emails and provide assessment services.  Advance Assessments limits the use of personal data to that which is reasonably required to provide its services.

1.12       Retention of personal data. A service user (data subject) may request that personal data provided when registering with Advance Assessments is deleted.  Please note that it is a requirement of the ESFA that information about end point assessments undertaken, including the assessment evidence, which versions of the standard and plan referred, the assessor’s details, the internal verifier’s details and payments received by Advance Assessments is held for six years after the activity took place.  In order to comply with this ESFA stipulation all data relating to an assessment will be held for six years after all assessment activity is completed.  Please also note that it will not be possible to complete an assessment for a data subject (apprentice) should the data subject request data removal prior to the completion of the assessment process.  In this case the cost of the assessment activities completed will be payable in full at the time of data deletion.  

1.13       Storage and protection of personal data. Advance Assessments takes reasonable steps to protect service users’ data from loss or destruction. Advance Assessments will notify service users and any applicable regulator of a suspected data security breach where legally required to do so. Unfortunately, the transmission of information via the internet is not completely secure. Advance Assessments takes all practicable steps to protect personal data, but cannot guarantee the security of personal data during transmission; any transmission is at the risk of the sender. Once Advance Assessments has received personal data, strict procedures and security features that aim to prevent unauthorised access are implemented.

1.14       Rights of data subjects. Data subjects have the following rights under the GDPR:

1.14.1    The right to be informed about collection and use of personal data by Advance Assessments (as described in this Privacy and Data Protection Policy).

1.14.2   The right to access personal data by means of a subject access request.  Personal data provided by a data subject during registration can be accessed by emailing the contact below.

1.14.3   The right to have personal data rectified if any of the data subject’s personal data held by Advance Assessments is inaccurate or incomplete. Please contact Advance Assessments to do this.

1.14.4   The right to erasure (also known as the right to be forgotten). Data subjects can exercise this right either by emailing Advance Assessments or using the facility embedded in the online assessment system.

1.14.5   The right to restrict or object to Advance Assessments processing personal data for particular purposes. Please contact Advance Assessments about this.

1.14.6   The right to data portability. This means that data subjects can ask Advance Assessments for a copy of personal data to re-use with another service or business. Please note, however, that this right applies only if a data subject has provided personal data to Advance Assessments directly.

1.14.7   Rights relating to automated decision-making and profiling; Advance Assessments does not use personal data in this way.

1.14.8   The right to object to how personal data is processed in certain circumstances.

1.15       Requests from site users (data subjects).  Should a data subject wish to make a request, in accordance with their rights listed above, they should contact support@advanceassessments.co.uk stating their name and email address (as supplied to Advance Assessments).  Requesters will be required to verify their identity.  Where the request is made on behalf of a data subject, the requester will be required to provide consent from the data subject they represent.

1.16       Destruction of physical data records.  Advance Assessments holds all personal data about apprentices, employers and training providers in an electronic format only.  When it is necessary to temporarily store data in a paper format, all Advance Assessment employees are trained to destroy data securely.

1.17       Site Security and Password Policy. When registering with Advance Assessments, all service users are asked to accept this privacy and data protection policy.  All service users are required to choose a strong password during first log-on.  Where service users have a username or password (or other identification information) to enable access to certain services or parts of the Advance Assessments online assessment site, the service user is responsible for keeping this password confidential. Please do not share a password with anyone.  The system is designed so that apprentices registering with the site have access to their personal data and evidence documents only.

1.18       Use of Cookies.  Cookies must be enabled in your browser to allow functionality of the site.  Two cookies are used on the site:

1.18.1   The essential one is the session cookie, usually called MoodleSession. Users must allow this cookie in their browsers to provide continuity and to remain logged in when browsing the site. When a user logs out or closes the browser, this cookie is destroyed (in the browser and on the server).

1.18.2   The other cookie is purely for convenience, usually called MOODLEID or similar. It remembers a service user’s username in the browser. This means that when a service user returns to this site, the username field on the login page is already filled in. It is safe to refuse this cookie – service users will then have to retype their username each time they log in.

1.18.3    Accepting this policy indicates that you, as a service user, accept the use of cookies in this way.

1.18.4   To learn more about cookies and how to manage them, visit the Information Commissioner’s Office page at: ico.org.uk/for-the-public/online/cookies/  Advance Assessments Limited is not responsible for the content or maintenance of the ico.org.uk site.

1.19       Data breach incidents. Advance Assessments will follow its regulatory requirements in the event of data breach incidents.  This means that there are procedures in place for the issue of notifications, documentation and management of incidents, including notification of the Information Commissioner’s Office.  All data breaches will be notified to the Information Commissioner’s Office within 72 hours of detection and all affected individuals will be notified without undue delay. 

1.20       For more information about Advance Assessments’ use of personal data or exercising your rights as outlined above, please contact: support@advanceassessments.co.uk

1.21       Further information about the rights of data subjects can be obtained from the Information Commissioner’s Office (ICO). Service users also have the right to lodge a complaint with the Information Commissioner’s Office if they believe that their rights have been breached. Contact the ICO on casework@ico.org.uk  Advance Assessments is registered with the ICO, Reference ZA460596.