°µÒ¹³ÉÈËÊÓÆµ

Skip to main content

CEC Privacy Notice & Cookies

This document is the °µÒ¹³ÉÈËÊÓÆµ and Enterprise Company’s general Privacy Notice. It provides information about our processing of your personal data, summarises your data rights and explains how to contact us or complain about our data processing.

1. Introduction to CECÌý

The °µÒ¹³ÉÈËÊÓÆµ and Enterprise Company Ltd (CEC) is the national body for careers education in England, supporting schools and colleges to deliver modern, 21st century careers education.Ìý

Our mission is to help every young person find their best next step. Our work is evidence-led so data is essential in achieving this mission.ÌýÌý

We achieve our mission by working with primary, secondary and special schools, pupil referral units, colleges, Independent Training Providers (ITPs) and employers to improve careers education and secure better outcomes for young people.Ìý

2. Using our Privacy Notice and Contacting Us about Your DataÌýÌý

We have structured this Privacy Notice to make it easier to understand how we process your personal data based upon your relationship with CEC. It was built upwards from the records of processing activities (ROPA) maintained by each team to give a transparent picture of the personal data we process in our work and our purposes for doing so.Ìý

If you engage with us in a new way, we may provide additional information about how we will process your personal data for that purpose. The additional information acts as a supplement to this general Privacy Notice.ÌýÌýÌý

If you have questions about CEC’s data processing not answered by this Privacy Notice, please contact our Data Protection Officer. Email dpo@careersandenterprise.co.uk or write to:ÌýÌý

Claire Stevenson, Data Protection Officer, The °µÒ¹³ÉÈËÊÓÆµ and Enterprise Company Limited, 1st Floor, Work.Life, 120 Aldersgate St, Barbican, London EC1A 4JQÌý

Cookie Policy

View our Cookie Policy

3. The Data we process, our Purposes, and our Lawful Basis for processing data

Sections: A. Young People B. °µÒ¹³ÉÈËÊÓÆµ Leaders and Education Provider StaffC. Employer Contacts and VolunteersD. Partners and Supplier StaffE. Job ApplicantsF. EmployeesG. Website visitors

A. Young People

i. CEC’s use of Young People’s data

We process data about Young People for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:

Ìý

  • To support schools, special schools, colleges and independent training providers in their careers education provision, recording and improvementÌý
  • To plan, deliver and measure the effectiveness of CEC programmes and eventsÌý
  • To safeguard young people involved in CEC programmes and eventsÌý
  • To conduct research related to our missionÌý
  • To promote and publicise work to achieve our mission (photography, video. audio recordings which you have granted us a license to use)Ìý
  • To give Young People a voice in the governance of CECÌýÌý
  • To manage work experience at CECÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposes
  • To assist education providers in identifying Young People who may benefit from additional support to make their best next step
ii. Categories of personal data CEC processes about Young People

We process the following types of personal data about Young People:

Ìý

  • Personal identifiers including name and date of birthÌý
  • Educational establishment(s) attendedÌý
  • Email addressÌý
  • Career education engagement and experiencesÌý
  • Career interests, intentions and readinessÌý
  • Post-compulsory education destinations and Employment, Education or
  • Training (NEET) statusÌý
  • Special category and other sensitive information including SEND status and indicators of disadvantage such as free school meal status, Pupil Premium status, low school attendance, exclusions, EHE (elective home education) status, English as an Additional LanguageÌý
  • Attainment data (if Young Person takes part in a CEC programme)Ìý
  • Opinions (responses to surveys and other research)Ìý
  • Photographs, video and audio recordings (If you have been involved in a CEC project and granted us a license to use these)Ìý
iii. Lawful basis for processing data about Young People

The lawful bases for processing Young People’s personal data are:Ìý

Ìý

  • Necessity for the performance of our task in the public interest related to our mission to help every young person to find their best next stepÌý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security, safeguarding and legal risk.Ìý
iv. Sharing Young People’s personal data

Our work is at national scale and delivered through our network of °µÒ¹³ÉÈËÊÓÆµ Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership with local democratic authorities to connect with local skills needs.Ìý

Ìý

Organisations who enable us to deliver our work have access to Young People’s personal data only where necessary. Data protection law calls these organisations Data Processors. They include IT partners who host or develop our databases or support systems security. We take steps to verify that Data Processors can protect your data, ensure that appropriate contractual agreements are in place, and we monitor their performance.ÌýÌý

Ìý

If you are invited to take part in CEC research or a project, we will provide more information to you and your school about how your data will be used for that work. Where we work with partner or supplier organisations on these projects, it may be necessary to provide your personal data to enable them to deliver and evaluate the project, or to keep you safe when you take part.Ìý

Ìý

We do not share young people's individual personal data with other organisations for their own purposes unless we are legally required to.

B. °µÒ¹³ÉÈËÊÓÆµ Leaders and Education Provider Staff

This category includes °µÒ¹³ÉÈËÊÓÆµ Leaders and Educational Institution Staff.Ìý


i. CEC’s use of °µÒ¹³ÉÈËÊÓÆµ Leaders and Education Provider Staff data

We process data about °µÒ¹³ÉÈËÊÓÆµ Leaders for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:Ìý

Ìý

  • To support schools, colleges and independent training providers in their careers education provision, recording and improvementÌý
  • To promote and publicise work to achieve our missionÌý
  • To plan, deliver and measure the effectiveness of CEC programmes and eventsÌý
  • To conduct research related to our missionÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposes
ii. Categories of personal data CEC processes about °µÒ¹³ÉÈËÊÓÆµ Leaders and Education Provider Staff

We process the following types of personal data about °µÒ¹³ÉÈËÊÓÆµ Leaders and Education Provider Staff:Ìý

Ìý

  • Personal identifiers including your name, job title and the name of the school or college which is your employerÌý
  • Contact details including your email address, telephone number and employer’s addressÌý
  • The CEC digital products you are registered to use and your user type (for example, whether you are your institution’s primary user with admin rights)Ìý
  • Records of your engagement with our digital products, Customer Management services, training, programmes and other services and eventsÌý
  • Your responses to surveys and other researchÌý
  • Your image and comments for a case study or articleÌý
iii. Lawful basis for processing data about °µÒ¹³ÉÈËÊÓÆµ Leaders and Education Provider Staff

The lawful bases for processing °µÒ¹³ÉÈËÊÓÆµ Leaders and Education Provider Staff personal data are:Ìý

Ìý

  • Performance of our task in the public interest which is related to our mission to help every young person to find their best next stepÌý
  • Performance of a contractÌý
  • Consent to receive marketing communicationsÌý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security and legal risk.Ìý
iv. Sharing °µÒ¹³ÉÈËÊÓÆµ Leaders and Education Provider Staff personal data

Our work is at national scale and delivered through our network of °µÒ¹³ÉÈËÊÓÆµ Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs.Ìý

Ìý

We provide access to °µÒ¹³ÉÈËÊÓÆµ Leader personal information where necessary to enable partnership working towards our mission and to enable our suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý

C. Employer Contacts and Volunteers

This category includes Employer Contacts and Volunteers

Please note that the organisation which hosts the °µÒ¹³ÉÈËÊÓÆµ Hub which is a Volunteer’s main point of contact conducts recruitment and verification activities for volunteers from industry. Similar personal data processing activities to those described in section 3E for Job Applicants also verify volunteers' suitability.Ìý


i. CEC’s use of Employer Contacts and Volunteers’ data

We process data about Employer Contacts and Volunteers for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:Ìý

Ìý

  • To support links between employers and schools, colleges and independent training providersÌýÌý
  • To promote and publicise work to achieve our missionÌý
  • To plan, deliver and measure the effectiveness of CEC programmes and eventsÌý
  • To conduct research related to our missionÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposesÌý
  • Applicants for volunteer positions should also refer to section 3.E.i relating to job applicants for details of additional processing purposes.Ìý
ii. Categories of personal data CEC processes about Employer Contacts and Volunteers

We process the following types of personal data about Employer Contacts and Volunteers:Ìý

Ìý

  • Personal identifiers including your name, job title and the name of the Employer you representÌý
  • Contact details including your email address, telephone number and employer’s addressÌý
  • Your volunteer statusÌý
  • Your engagement with our products, training, programmes and other services and eventsÌý
  • Your responses to our surveys and other researchÌý
  • Applicants for volunteer positions should also refer to section 3.E.ii relating to job applicants for details of additional categories of personal data processed.Ìý
iii. Lawful basis for processing data about Employer Contacts and Volunteers

The lawful bases for processing Employer Contacts and Volunteers data are:Ìý

Ìý

  • Performance of our task in the public interest related to our mission to help every young person to find their best next stepÌý
  • Performance of a contractÌý
  • Consent to receive marketing communicationsÌý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security and legal riskÌý
  • Applicants for volunteer positions should also refer to section 3.E.iii relating to job applicants for details of additional lawful bases.Ìý
iv. Sharing data about Employer Contacts and Volunteers

Our work is at national scale and delivered through our network of °µÒ¹³ÉÈËÊÓÆµ Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs.Ìý

Ìý

We provide access to Employer Contacts and Volunteers personal information where necessary to enable partnership working towards our mission and to enable our suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý

Ìý

Applicants for volunteer positions should also refer to section 3.E.iv relating to job applicants for details of the additional data sharing involved.Ìý

D. Partners and Supplier Staff

This category includes the staff of suppliers and other organisations we work with, including organisations hosting Career Hubs and our funders.


i. CEC’s use of Partners and Supplier Staff data

We process data about Partners and Supplier Staff for the following purposes:Ìý

Ìý

  • To manage our contract and partnership working with your employerÌý
  • To communicate with you in order to facilitate operationsÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposes.Ìý
ii. Categories of personal data CEC processed about Partners and Supplier Staff

We process the following types of personal data about Partners and Supplier Staff:Ìý

Ìý

  • Personal identifiers including your name, job title and the name of the Employer you representÌý
  • Contact details including your email address, telephone number and employer’s addressÌý
  • Your role in relation to our contractÌý
  • Records of our communicationsÌý
iii. Lawful basis for processing data about Partners and Supplier Staff

The lawful bases for processing Partners and Supplier Staff data are:

Ìý

  • Performance of a contractÌý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security and legal riskÌý
iv. Sharing data about Partners and Supplier Staff

Our work is at national scale and delivered through our network of °µÒ¹³ÉÈËÊÓÆµ Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs.Ìý

Ìý

We provide access to Partners and Supplier Staff personal information where necessary to enable partnership working towards our mission and to enable other suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý

E. Job Applicants

i. CEC’s use of Job Applicant data

We process data about Job Applicants for the following purposes:Ìý

Ìý

  • To assess the fit of the Job Applicant to the position applied forÌý
  • To communicate with the Job Applicant (or recruiter where applicable) regarding their applicationÌýÌý
  • To arrange and manage our selection processesÌý
  • To verify the suitability of candidates offered a position subject to verificationÌý
  • To monitor CEC’s equity, diversity and inclusionÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposesÌý
ii. Categories of personal data CEC processes about Job Applicants

We process the following types of personal data about Job Applicants:Ìý

Ìý

  • Personal identifiers including your name and date of birthÌý
  • Contact details including your email, telephone number and home addressÌý
  • QualificationsÌýÌý
  • Employment historyÌý
  • Other information volunteered by you within application and selection processÌý
  • Application scoringÌý
  • Special category data including ethnic/ racial origin, nationality, disability status, sexual orientation, marital status (for CEC’s EDI monitoring)Ìý

Ìý

Additionally, we process the following types of personal data about successful Job Applicants who have been offered a position subject to verification of suitability:Ìý

Ìý

  • Criminal record data (if a criminal record check via the Disclosure and Barring Service is required due to the nature of the role this will be noted within the vacancy advert and/ or job description)Ìý
  • Health data, sickness absence record and reasonable adjustment requestsÌý
  • Employment and/ or educational/character references provided by your nominated refereesÌý
iii. Lawful basis for processing data about Job Applicants

The lawful bases for processing Job Applicants’ personal data are:Ìý

Ìý

  • CEC’s legitimate interest in recruiting job applicants who provide the best fit to role requirementsÌý
  • Performance of a contract (successful Job Applicants who accept a role offered subject to verification of suitability)Ìý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security and legal risk.Ìý
iv. Sharing Job Applicant personal data

We provide access to Job Applicant personal information where necessary to enable our suppliers to support our recruitment and suitability verification processes. In such cases we take steps to verify that suppliers provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý

Ìý

Verification for successful candidates also requires us to provide your nominated referees with your personal identifiers and details of the position you have been offered subject to verification.Ìý

Ìý

We do not share Job Applicant personal data with other organisations for their own purposes unless we are legally required to.

F. Employees

In addition to the personal data processing described in this section, CEC process employees’ personal data described at section 3.E for Job Applicants.


i. CEC’s use of Employee data

We process data about Employees and other workers for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:Ìý

Ìý

  • To communicate with Employees and support employee relationsÌý
  • To provide salary, pension and other benefitsÌý
  • To reward and manage performanceÌý
  • To assess training and development requirementsÌý
  • To facilitate HR managementÌý
  • To monitor CEC’s equity, diversity and inclusionÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposesÌý
ii. Categories of personal data CEC processes about Employees

We process the following types of personal data about Employees:Ìý

Ìý

  • Personal identifiers including name and date of birthÌý
  • Contact information including personal email address, telephone number and home addressÌý
  • Bank details, tax code and national insurance numberÌý
  • Benefit selectionsÌý
  • Absence records including sickness absence, annual, parental and other types of leave/ absenceÌý
  • Performance dataÌý
  • Grievance and Disciplinary recordsÌý
  • Records of requests for reasonable adjustments and flexible working arrangementsÌý
  • Health and disability informationÌý
  • Data about use of CEC IT assets and compliance with our Acceptable Use PolicyÌý
  • Special category data including ethnic/ racial origin, nationality, disability status, sexual orientation, marital status (for CEC’s EDI monitoring)Ìý
  • The name and contact details of your next of kin/ emergency contactÌý
iii. Lawful basis for processing data about Employees

The lawful bases for processing Employees’ personal data are:Ìý

Ìý

  • Necessity for CEC’s legitimate interest in managing employees to facilitate our mission of helping every young person to make their best next stepÌý
  • Performance of a contractÌý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security and legal risk.Ìý
iv. Sharing Employee personal data

We provide access to employee personal information where necessary to enable our partners and suppliers to support the delivery of our work. In such cases we take steps to verify that organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý

G. Website visitors

For information about data processing in relation to the use of our digital products for education, please see section 3B.


i. CEC’s use of Website Visitor data

We process data about website visitors for the following purposes:Ìý

Ìý

  • To provide essential website functionalityÌý
  • To understand how the website is usedÌý
  • To improve performance of the website and user experienceÌý
  • To respond appropriately to information you enter into our web formsÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposes.Ìý
ii. Categories of personal data CEC processes about Website Visitors

We process the following types of data about Website Visitors:Ìý

Ìý

  • Information you enter in our web forms. This may include:Ìý
  • Personal identifiers including your name and date of birthÌý
  • Contact details including your email, telephone number and home addressÌý
  • Your employerÌý