PARTICIPANT PRIVACY NOTICE

Data Protection Officer: Rachel Whale, Founder and CEO rachel@koreo.co | 0203 6205252

Delegated day to day operational implementation of data protection compliance: Jordan Rolfe, Consultancy & Communications Manager jordan@koreo.co | 0203 6205252

Koreo (Charityworks) collects and processes personal data relating to programme participants. We are committed to being transparent about how we collect and use that data and to meeting our data protection obligations.

Data protection principles

In relation to your personal data, Koreo (Charityworks) will always strive to:

process it fairly, lawfully and in a clear, transparent way;

collect personal data from you that is necessary to facilitate your participation on our programme. We will explain to you what data we collect from you and why only use it in the way that we have told you about;

ensure it is correct and up to date;

keep your data for only as long as we need it ; and

ensure that your data is kept safe and secure and access to it is limited to those who need to process it for the purposes we explain to you.

What information does Koreo (Charityworks) collect?

Koreo (Charityworks) collects a range of information about you. This can include:

your name, address and contact details, including email address and telephone number;

information about your emergency contacts;

a recent photograph of you;

your date of birth;

details of your qualifications, education history, skills, experience and employment history;

information about your socio-economic background including your eligibility for free school meals and whether your parents attended university;

information about your current level of remuneration, including benefit entitlements;

whether or not you have a disability;

equal opportunities monitoring information, including information about your ethnic origin, gender, sexual orientation, health and religion or belief;

employment information including employer name and job title;

programme performance reviews;

programme assignments; and

assessor markings.

Koreo (Charityworks) may collect this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes; obtained from your passport or other identity documents, collected through interviews or other forms of assessment including online tests or through provision of your own programme assignments.

Data will be stored in a range of different places, including on your placement application record, in programme management systems and on other IT systems (including email).

Koreo (Charityworks) will not transfer your data to countries outside the European Economic Area.

Why does Koreo (Charityworks) process personal data?

Koreo (Charityworks) needs to process data to take steps at your request to provide you with the training and development offered by the programme.

Koreo (Charityworks) has a legitimate interest in processing personal data during the programme and for keeping records of the process.

Processing data from programme applicants and participants allows us to:

develop and provide effective learning interventions;

assess and confirm a candidate’s suitability for the programme;

assess the development achieved by programme participants;

evaluate the effectiveness of the training (and those delivering the training);

maintain accurate and up-to-date participant records and contact details (including who to contact in an emergency);

operate and keep a record of programme attendance;

provide programme updates to line managers within employer/placement organisations; and

maintain and promote equality of opportunity.

Koreo (Charityworks) may also need to process data from participants to respond to and defend against legal claims.

Where Koreo (Charityworks) processes other special categories of data, such as information about ethnic origin, sexual orientation, or religion or belief, this is for equal opportunities monitoring purposes.

Who has access to data?

Your data will be shared with colleagues within Koreo (Charityworks) where it is necessary for them to undertake their duties. This includes, for example, those involved in the selection of participants for programmes, delivery of training and development, arranging events and IT staff.

Koreo (Charityworks) shares your data with third parties for the provision of training and development including trainers, mentors, coaches and any certification body e.g. Institute of Leadership and Management (ILM).

Koreo (Charityworks) may share your data with your employer/placement organisation in order to appraise them of your attendance and performance on the programme.

Koreo (Charityworks) will not share your data with third parties for any other purpose without your express consent.

Koreo (Charityworks) endeavours to ensure specific contractual agreements are in place with any third parties who undertake this processing in order to protect your data. This is explained in more detail below.

Automated decision-making

Programme participation processes are not based solely on automated decision-making.

We will tell you beforehand if we use any automated forms of assessment in our decision making processes. You have the right to request that your participation is not assessed by automated processes.

How does Koreo (Charityworks) protect data?

Koreo (Charityworks) takes the security of your data seriously. We maintain internal policies and controls that are designed to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees or associates engaged by Koreo (Charityworks) in the proper performance of their duties. Details are provided within our Data Protection Policy and relevant IT policies.

Where Koreo (Charityworks) engages third parties to process personal data on our behalf, they do so only on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of your data.

For how long does Koreo (Charityworks) keep data?

In line with data protection principles, we will only keep your data for as long as we need it.

In some cases, we will keep your data for a period after your participation has ended. Retention periods can vary depending on why we need your data. This may be determined by law. Koreo (Charityworks) will hold your data on file for 12 months after the end of the relevant programme.

What if you do not provide personal data?

One of the reasons for processing your data is to allow Koreo (Charityworks) to facilitate your development. Whilst you are under no statutory or contractual obligation to provide data to Koreo (Charityworks) during your participation on the programme, if you do not provide the information, we may not be able to provide you with the development opportunity.

Your rights

As a data subject, you have a number of rights under current and new data protection legislation. In summary, these are:

the right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice;

the right to access your data and to be told what data is held, who by, the purpose for which it is held and how long it will be held for. You have the right to ask for a copy of your data and an explanation of where it has been sourced. You may do this by contacting Koreo’s Data Protection Officer using the details at the top of the notice. The formal process for making such a request is known as a ‘Subject Access Request’. You can find out more information about doing so at https://ico.org.uk/for-the-public/personal-information/;

the right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it;

the right to have personal information about you deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it;

the right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, you can ask us to stop processing the data (whilst still holding it) until it has been corrected;

the right to portability. You may transfer the data that we hold on you for your own purposes to another organization;

the right to object to the way we use or process your data; and

the right to regulate any automated decision-making and profiling on the basis of your personal data. You have a right not to be subject to automated decision making in way that adversely affects your legal rights.

Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. There will be no consequences for withdrawing your consent. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use, however we may continue to process your data if we have a statutory reason or lawful basis for doing so.

If you would like to exercise any of these rights, you may do so by contacting Koreo’s Data Protection Officer using the details at the top of the notice.

If you believe that Koreo (Charityworks) has not complied with your data protection rights, you can complain to the Information Commissioner. You can find more information about doing so at https://ico.org.uk/concerns/