Introduction

Smart Awards Ltd (“Smart Awards”, “we”, “us” or “our”) is committed to protecting the privacy and personal information of learners, apprentices, centres, training providers, employers, assessors, contractors, customers, website users and other individuals who interact with us.

This Privacy Statement explains how we collect, use, store, share and protect personal information and describes the rights individuals have in relation to their personal data.

Smart Awards processes personal data in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This statement should be read alongside our Cookie Statement Policy and any other privacy information provided when we collect personal data.

Who we are

Smart Awards Ltd is an awarding organisation and apprenticeship assessment organisation providing qualifications, assessments and associated services.

Our activities include:

• regulated qualifications;
• customised and endorsed programmes;
• apprenticeship assessment and End-Point Assessment (EPA);
• centre approval and monitoring;
• external quality assurance;
• learner registration and certification;
• assessment and verification activities;
• the Network Operative Passport Scheme (NOPS); and
• associated business, customer and regulatory activities.

For relevant processing activities, Smart Awards will normally act as a Data Controller, meaning that we determine why and how personal data is processed.

In some circumstances, Smart Awards may act as a Data Processor on behalf of another organisation. Where this occurs, the processing will be governed by the appropriate contractual arrangements.

Personal information we may collect

The information we collect will depend on your relationship with Smart Awards and the services being provided.

Personal data may include:

• name;
• date of birth;
• address and contact details;
• email address and telephone number;
• employer or training provider details;
• learner, candidate or apprentice identification numbers;
• qualification, training and assessment information;
• assessment results and achievement records;
• registration and certification information;
• employment and occupational information;
• assessor, IQA or EQA information and competence records;
• identification and identity-verification information;
• photographs or other information used for identification or scheme administration;
• records of communications with Smart Awards;
• information relating to complaints, appeals, investigations, malpractice or maladministration;
• payment, invoicing and transaction information;
• website and system usage information;
• IP addresses and technical information;
• information supplied through our websites, applications and online systems; and
• other information reasonably required to provide, regulate or quality assure our services.

Special category and sensitive information

In limited circumstances, Smart Awards may need to process special category personal data or other sensitive information.

This may include information relating to health or disability where, for example, reasonable adjustments or special considerations are requested.

We will only process special category data where there is a valid legal basis under UK data protection legislation and appropriate safeguards are in place.

Where criminal offence information is relevant to an investigation, safeguarding matter, regulatory obligation or other legitimate function, it will only be processed where legally permitted.

How we collect personal information

We may collect personal information directly from you or from organisations involved in delivering or administering our services.

These may include:

• approved centres;
• training providers;
• employers;
• apprenticeship training providers;
• assessors and quality assurance personnel;
• government departments or agencies;
• regulators;
• other awarding or assessment organisations;
• industry bodies;
• contractors and service providers; and
• systems used to administer qualifications, assessments and associated services.

We may also collect information when you use our website, applications, portals or other digital services.

Why we use personal information

Smart Awards may process personal information to:

• register learners and apprentices;
• administer qualifications and assessments;
• conduct apprenticeship and End-Point Assessment activities;
• issue, replace, verify or withdraw certificates;
• maintain accurate records of achievement;
• administer NOPS registrations and records;
• approve and monitor centres;
• conduct external quality assurance and sampling;
• verify assessment and quality assurance activities;
• investigate complaints, appeals, malpractice and maladministration;
• prevent and detect fraud;
• protect the integrity and security of qualifications and assessments;
• provide reasonable adjustments and special considerations;
• communicate with centres, learners, apprentices, employers and other stakeholders;
• respond to enquiries;
• administer contracts and customer relationships;
• process payments and maintain financial records;
• meet regulatory and legal obligations;
• provide information to regulators, government bodies or other competent authorities where required;
• undertake internal governance, audit and risk management;
• maintain and improve our systems and services;
• maintain website and information security; and
• establish, exercise or defend legal claims.

Our lawful bases for processing

Under UK GDPR, Smart Awards must have a lawful basis for processing personal data.

Depending on the circumstances, we may rely upon:

Legal obligation – where processing is necessary to meet a legal or regulatory requirement.

Contract – where processing is necessary to enter into or perform a contract.

Legitimate interests – where processing is necessary for the legitimate interests of Smart Awards or another party and those interests are not overridden by the individual’s rights and freedoms.

Consent – where you have freely provided consent for a specific processing activity. Where we rely upon consent, you can withdraw it at any time.

Vital interests – in exceptional circumstances where processing is necessary to protect someone’s life.

Where special category personal data is processed, we will also identify an appropriate condition under Article 9 of UK GDPR and, where applicable, the Data Protection Act 2018.

Regulatory and awarding organisation responsibilities

As a regulated awarding and assessment organisation, Smart Awards is required to maintain appropriate records and evidence relating to qualifications, assessment, quality assurance and certification.

This means that in some circumstances we may be required to retain or process information even where an individual asks us to delete it.

We may also be required to provide information to relevant regulators, government departments or other authorised bodies in connection with our regulatory obligations, investigations, monitoring activities or the protection of learners.

Where information is shared for these purposes, we will only disclose information that is necessary and appropriate.

Sharing personal information

We do not sell personal information.

We may share personal information where necessary with organisations including:

• approved centres and training providers;
• employers;
• assessors, IQAs, EQAs and other authorised personnel;
• regulators and government bodies;
• apprenticeship and education authorities;
• other awarding or assessment organisations where appropriate;
• contractors and professional advisers;
• IT, software, hosting and data-storage providers;
• payment and financial service providers;
• auditors;
• legal advisers;
• law enforcement agencies or courts where legally required; and
• other organisations where disclosure is necessary to comply with a legal or regulatory obligation.

Where third parties process personal information on our behalf, appropriate contractual and data protection arrangements will be put in place.

Fraud, malpractice and regulatory investigations

Smart Awards has a responsibility to protect the integrity of its qualifications, assessments and certification.

Where we receive information suggesting fraud, malpractice, maladministration, assessment irregularity or another compliance concern, we may collect, review and share relevant personal information for investigation and regulatory purposes.

Information may be shared with regulators, government bodies, other awarding organisations, centres, employers or other competent organisations where there is an appropriate lawful basis for doing so.

Automated decision-making

Smart Awards does not intend to make decisions producing legal or similarly significant effects on individuals solely through automated processing unless this is legally permitted and appropriate safeguards are provided.

Where automated tools or artificial intelligence are used to support administrative, analytical or quality assurance activities, Smart Awards remains responsible for ensuring appropriate governance, security and human oversight.

How long we keep personal information

We retain personal information only for as long as it is reasonably necessary for the purpose for which it was collected and to meet applicable legal, contractual and regulatory requirements.

Retention periods may vary depending on the type of information concerned.

Certain qualification, assessment and certification records may need to be retained for extended periods to enable Smart Awards to verify achievements, issue replacement certificates, maintain regulatory evidence and protect the integrity of qualifications.

Information that is no longer required will be securely deleted, destroyed or anonymised in accordance with our retention arrangements.

Keeping personal information secure

Smart Awards takes appropriate technical and organisational measures to protect personal information against:

• unauthorised access;
• accidental loss;
• inappropriate disclosure;
• alteration;
• destruction; and
• other unlawful processing.

Measures may include access controls, passwords, authentication, secure systems, staff training, contractual controls, backups and monitoring.

Access to personal information is restricted to individuals who have an appropriate business need to access it.

International transfers

Some suppliers or technology providers may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, Smart Awards will ensure that appropriate safeguards are in place as required by UK data protection legislation.

These may include an adequacy decision, approved contractual safeguards or another legally recognised transfer mechanism.

Your data protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your personal information is used;
• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information;
• request restriction of processing;
• object to certain processing;
• request transfer of your information in a portable format where applicable;
• withdraw consent where processing is based on consent; and
• raise concerns about automated decision-making where applicable.

These rights are not absolute and may be subject to legal or regulatory exemptions.

For example, Smart Awards may need to retain qualification, assessment or certification information to meet regulatory obligations even where an individual requests its deletion.

We may need to verify your identity before responding to a request concerning your personal information.

Complaints about the use of personal information

If you have concerns about how Smart Awards has handled your personal information, we encourage you to contact us so that we can investigate the matter.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Making a complaint to Smart Awards does not affect your right to contact the ICO.

Cookies and website information

Our website may use cookies and similar technologies to operate effectively and understand how visitors use our services.

Further information about the cookies we use, the purposes for which they are used and how you can manage your preferences is contained in our Cookie Statement Policy.

Links to other websites

The Smart Awards website may contain links to websites operated by other organisations.

Smart Awards is not responsible for the privacy practices of third-party websites. You should review the relevant privacy information when visiting an external website.

Changes to this Privacy Statement

Smart Awards may update this Privacy Statement to reflect changes to our services, systems, regulatory requirements or applicable legislation.

The latest version will be published on our website and will show the relevant effective or last updated date.

Contact us

If you have a question about this Privacy Statement, wish to exercise your data protection rights or have a concern about the way your personal information has been handled, please contact:

Smart Awards Ltd

Data Protection / Privacy Enquiries

Please use the contact details published on the Smart Awards website.

For further information about our use of website cookies and similar technologies, please refer to our Cookie Statement Policy.