Introduction

We use information to help us deliver our programmes, help us understand how they work, and to help demonstrate how our work makes a difference.

Information we collect about you will always be handled in accordance with the principles of the General Data Protection Regulation (GDPR) and guidance from the Information Commissioner’s Office (ICO). We want to be clear and honest about what information we collect and why, how we use it, and to make sure you know what your rights are.

This is our general Privacy Notice. If you take part in one of our programmes you may be given a Privacy Notice specific to the programme you are on, but it will always be based on this notice. There are details of some common examples at the end of this Privacy Notice.

Who we are and how to contact us

We are Causeway Education Limited. We’re a registered company in England, number 09239703. We’re also a registered charity in England and Wales, number 1175109, and in Scotland, number SCO48038. You might also know us as HE Access Network or HEAN, which is a working name of ours.

When you provide information to us, or someone provides it to us on your behalf, Causeway Education will be the controller of that information.

You can contact us in writing at Causeway Education, EdSpace, Falkirk Street, London N1 6HQ, by phone on 020 3808 5140, or by e-mail on [email protected].

If you have specific questions about how we handle personal information, please contact our Data Protection Officer on [email protected]

Your rights

Under the GDPR you have specific rights over the information we hold about you, as follows:

You have the right of access to see what information we hold about you and, if any of it is incorrect, you have a right to have us rectify it. You can request this by e-mailing [email protected].

Where you have provided information to us you have the right to portability, which means you can reuse the information you have provided to us elsewhere for your own purposes.

You have the right to ask for information we hold about you to be erased at any time by e-mailing [email protected].

Where your information is held under the legal basis of legitimate interests the right to erasure does not apply. You do have a right to object to, or to ask us to restrict, our processing of the information. You can do this by e-mailing [email protected] explaining the grounds relating to your particular situation that you feel mean we should stop or restrict processing your information.

If you want to make a complaint

You have the right to raise a concern about how we handle your information. You should do so in the first instance by e-mailing [email protected]. If you are not satisfied with the response you get, you can report your concern to the ICO https://ico.org.uk/for-the-public/raising-concerns/

Ways we collect personal information

In general, we collect personal information when you choose to interact with us, for example:

  • when you send us an e-mail, fill out a contact form on or website, or phone or write to us
  • when you register for or attend an event we’re running
  • when you complete a questionnaire of ours
  • when you visit our website
  • when you, or somebody at your school, creates an online account on our website.

We may also collect information about you from third parties, such as your mentor or your school. If you choose to share information on social media (like Facebook or LinkedIn) and messaging services (like WhatsApp or Twitter), we may access information from those accounts or services that’s available publicly.

There are details of some common examples at the end of this Privacy Notice.

Why we collect information about you and how we use it

We collect information about you so we can carry out our business, deliver our programmes, and so we can measure and understand the impact of our work.

As a registered charity we’re governed by our ‘charitable objects’. These state our purpose, which is “for the public benefit to promote the education of people under the age of 25 in the UK in particular but not exclusively by increasing the chances of students accessing higher education, further training, apprenticeships and careers”.

When we collect and process information we do so bearing this purpose in mind, and always with a legal basis for doing so. This will vary depending on our relationship with you, and we have a data register that identifies our legal basis for processing different categories of information we collect and how they will be used.

We’ll never use information we hold about you to make automated decisions about you or to automatically profile you as an individual.

Where we rely on legitimate interests as a legal basis for processing, we have carried out a Legitimate Interest Assessment and a Data Privacy Impact Assessment in line with guidance from the ICO.

We’ll keep your information for no longer than is necessary and will destroy it when it’s no longer needed. We have clearly defined retention policies for different categories of personal information that state how long it should be retained for and how it should be disposed of.

Some of our delivery partners or service providers may need access to your information in order to carry out services on our behalf. We will always make sure that there is a legal basis for sharing your information, that the third party meets or exceeds our data protection standards, and that we have an agreement in place stating they will not use your information for anything other than the clearly defined purpose relating to the service they are providing.

We will disclose your information where we are required to do so, for example by the ‘know your donor’ principles under charity law or a court order, or by the police or a regulatory or government authority investigating illegal activities.

We will, from time to time, screen our data against recognised data hygiene files (such as the National Change of Address file) to correct inaccurate information and remove anything that’s out-of-date.

How we protect your information

We have appropriate policies and technologies in place to protect information from unauthorised access and improper use.

All our core systems are located in the UK. They are certified to ISO27001 and secured to make sure that only authorised users have access to them. We have policies in place governing passwords and data transfer that everybody who has access to our systems must abide by.

We may transfer personal information outside the European Economic Area (EEA) if, for example, we use a third-party service based in another country. If we do, we will ensure that your information is protected to at least the same standards as if it were processed in the EEA.

While we take every appropriate precaution, transmitting data over the internet is not 100% secure and you disclose information to us at your own risk.

We are not responsible for the privacy notices and practices of other websites, even if you follow a link from our website. We recommend that you check the privacy policy of each website you visit and contact its owner or Data Protection Officer if you have any concerns or questions.

Updates or changes to this Privacy Notice

This notice was updated in May 2018. It may be updated to take into account changes at Causeway Education or to reflect changes to regulation or legislation.

Updates will be posted here, and you should check back from time to time. We may also write to inform you of any changes where we hold an e-mail address for you.

Further information on data protection regulations and laws can be found here:

Data Protection: https://ico.org.uk/for-the-public

Fundraising regulator: www.fundraisingregulator.org.uk/code-of-fundraising-practice/code-of-fundraising-practice

Common examples

Below is more detail about the information we collect, and how we process it, for the most common situations where we handle personal information. You should read this in conjunction with the rest of our Privacy Notice above. If your situation isn’t listed here please e-mail [email protected] and we’ll be happy to provide more detail.

If you take part in one of our programmes

We need to be able to keep records of who takes part in our programmes so we can run them effectively. We do this under the legal basis of consent.

We also want to understand how well our programmes work, and must be able to report to the organisations that fund them, so we need to carry out research looking at how effective our programmes are. To do this we need to be able to look at where you apply to and go to university and how your career progresses, so may match your information to other official data sources such as the National Pupil Database, UCAS, and the National Labour Force Survey. We do this under the legal basis of legitimate interests.

The personal information we collect when you take part in one of our programmes includes:

  • your name
  • your e-mail address, address, phone number
  • other information you provide when you contact us or interact with us, including notes of mentoring sessions, the text of your personal statement, or responses to a survey or feedback form.
  • the elements of the programme you’ve attended
  • the school you attend/work at
  • your student/staff ID number

and if you are a student, we’ll also collect:

  • your date of birth
  • your year and registration group
  • your gender and ethnicity as recorded by your school
  • whether you are eligible for free school meals
  • whether you have English as an Additional Language (EAL)

We may get some of this information from third parties, such as your school or your mentor. We will always have an agreement in place before sharing information, and will do so only when the third party has confirmed it has a legal basis to do so. We recommend you check the Privacy Policy of any third party when you provide information to fully understand how your information will be processed and protected.

We will never identify you personally in any of our research or reporting without checking first.

If you withdraw your consent or exercise your right to erasure by asking us to remove information we hold about you from our systems, you should be aware that we may not be able to do so unless you choose to leave the programme. You should also be aware that we will retain information for research under our legitimate interests assessment.

Where the information we collect is used only for the delivery of the programme we’ll retain it for a period of twelve months after you finish the programme. Where the information is needed for research and held under our legitimate interests assessment we’ll retain it in perpetuity.

To keep in touch with you

If you sign up to receive any of our newsletters we’ll keep you on the mailing list until you choose to unsubscribe. We do this under the legal basis of consent.

The personal information we collect when you sign up to a mailing list includes:

  • your name
  • your e-mail address
  • details of whether you interact with (for example, open or click a link in) any of the messages we send to the list

We’ll only ever add you to a mailing list where we have your specific permission to do so, and there will be an option to unsubscribe at the bottom of every e-mail we send to that mailing list. We won’t ever sell or rent the mailing list to a third party.

If you unsubscribe from a mailing list, we will keep the minimum amount of information (name and address or e-mail address) to ensure we are able to comply with your request.

Fundraising

We collect and process information about individuals to help in our fundraising activities and so we can continue to operate as a charity. We do this under the legal basis of legitimate interests.

The personal information we collect about donors or potential donors includes:

  • your name
  • your contact details
  • areas of interest related to our work
  • details of conversations we’ve had with or proposals we’ve made to you

We make use of company, director and shareholder information from publicly available, officially registered information providers, such as Onesource, Lexis Nexis, Wealthmonitor or Trustfunding. We may collect information found in public places such as Companies House and information that has been published in articles/newspapers.

You have the right to request we stop contacting you, and we will respect your wishes. If you ask us to stop contacting you, we will keep the minimum amount of information (name and address or e-mail address) to ensure we are able to comply with your request.

We’ll review the information we hold annually to ensure it’s correct and up to date, and remove anything that’s no longer accurate or relevant.

If you visit our website

We want to be able to understand how people interact with our websites in order to improve them and to include details of how the site is used in our research. We do this under the legal basis of legitimate interests.

The personal information we collect when you visit one of our websites includes:

  • your IP address
  • details about which pages of the site you visit and how you interact with those pages
  • if you fill out a contact form, we’ll store the information you enter in to the form
  • if you log in to the site we will store your login details, which link to your online account and the information it contains

We may store cookies on your device to help us do this, which is explained in our Cookies Policy.

Where the information we collect is needed for research and held under our legitimate interests assessment we’ll retain it in perpetuity.