This policy is designed to inform learners, parents and carers, employees, employers/companies and relevant external agencies how we gather and process personal information in accordance with this Privacy Policy and in compliance with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and any equivalent legislation amending, supplementing or replacing this Regulation. Herefordshire & Worcestershire Group Training Association (HWGTA) is registered with the Information Commissioner’s Office (ICO) – Registration Number Z6274321

We are committed to ensuring that your privacy is protected and are transparent about how we collect and use your personal data. This Policy provides you with the necessary information regarding your rights and our obligations and explains how we collect, process and store your personal data and who we share this data with.


Information that we collect

HWGTA collects, holds and processes your personal data to meet our legal, statutory and contractual obligations in providing you with our services. We only collect personal data for specified, explicit and legitimate purposes.

Learners (including Apprentices & Commercial):

Personal data for the Application, Recruitment, Registration and Learning Programme processes. A separate, signed Consent Form is required at the start of the Application process and during the Registration process at the start of the learning programme. If a Learner is under the age of 16, we will require their parent/guardian’s permission before they provide any personal information to HWGTA.

Employers, Suppliers and Relevant External Agencies:

Company and organisational data to meet contractual requirements, which are defined within the Terms and Conditions of the Contract.

How we process personal data

General Principles

HWGTA will process information in accordance with the Data Protection Act and its own Data Protection Policy. To comply with the law, information about individuals and companies must be collected and used fairly, stored safely and securely, be adequate, relevant and not excessive, be kept accurate and up to date, held only as long as is necessary and not disclosed to any third party unlawfully.

The information provided is shared with the Education and Skills Funding Agency (ESFA), on behalf of the Secretary of State for the Department of Education (DfE). Learners’ personal information will be used by the DfE, the ESFA (an executive agency of the DfE) and any successor bodies to these organisations and is used by the DfE to exercise its functions and to meet its statutory responsibilities, including under the Apprenticeships, Skills, Children and Learning Act 2009 and to create and maintain a unique learner number (ULN) and a personal learning record (PLR). The information will be securely destroyed after it is no longer required for these purposes. The information may be shared with third parties for education, training, employment and well-being related purposes, including for research.

This will only take place where the law allows it and the sharing is in compliance with data protection legislation. Further information about the use of and access to data are available at HWGTA’s Data Protection Policy is also available on request.

We will only collect your personal data in the performance of a contract or to provide you with a service. As part of our contractual terms and conditions, we may also share personal information with other external agencies pertinent to the training programme(s) undertaken, which will include external Awarding Bodies, end-point assessment organisations and Ofsted. This also includes other external third-party service providers, such as accountants, auditors, industry experts, legal and other outside professional advisors, for example, IT systems support and hosting service providers, printing, advertising and marketing providers, that assist us in carrying out business activities. HWGTA is a member of the Group Training Associations England (GTAE) and other relevant Membership organisations. We will never disclose or share your data without your consent; unless required to do so by law. We only retain your data for as long as is necessary and for the purpose(s) specified in this Policy, Contract or Agreement.


We only retain your data for as long as is necessary and for the purpose(s) specified in this Policy. Our policy is to keep personal data for a specified period in which time it will be securely destroyed, or for as long as is required in order to carry out a particular purpose, meet a particular obligation and/or meet regulatory and statutory requirements. Data will usually be retained for a period of 6 years, unless legal or statutory requirements require us to extend this period. All data processors, including staff, or acting on our behalf only process your data in accordance with instructions from us and comply fully with this Privacy Policy, the data protection laws and any other appropriate confidentiality and security measures.

For marketing purposes

We may contact you for marketing purposes and send you relevant information about our training programmes, or if you have made an enquiry regarding HWGTA’s services if you have provided consent to receive this information. We would use your information to:

  • provide you with information about the services we offer
  • assist you in answering any questions or queries you request
  • send newsletters, brochures or updates, where you have consented to do so

We will keep such data until you notify us otherwise and/or withdraw your consent.

We may also occasionally use a marketing automation platform, for example, Survey monkey to conduct surveys. Any distribution lists are stored securely on the platform’s server and are not sold under any circumstances.

Keeping your information safe and secure

HWGTA is committed to keeping all personal information secure to protect it from being inappropriately or accidentally accessed, used, shared or destroyed. All information is stored safely and securely.

Internal databases

A significant amount of our learner data is held on our internal database system, which has a significant number of inbuilt features to control access. In addition to being able to specify what actions internal users can perform, we also restrict them to subdivisions of the database using Sites, Funding Organisations and Main Users and fields which contain personal information are encrypted and restricted to only the necessary users. The system is also able to pseudo-anonymise learner records to restrict unnecessary access to personal data.

The website

HWGTA’s Website and its hosts take a proactive approach to user privacy and ensure the necessary steps are taken to protect the privacy of its users. Our website complies to all UK national laws and requirements for user privacy.

Cookie Policy

Our website uses cookies to improve your experience when visiting our website. Cookies are small files which asks permission to be placed on your computer/device. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual and tracks, saves and stores information about your interactions with and usage of the website. This allows the website, through its server to provide you with a tailored experience within the website. Our website uses a cookie control system allowing the user on their first visit to the website to allow or disallow the use of cookies on their computer/device. This complies with legislation requirements for websites to obtain explicit consent from users before leaving behind or reading files such as cookies on a user’s computer/device.

Links to other websites

Our website may contain links to other websites of interest. However, you should note that we do not have any control over these other websites. Once you have used any of these links to leave our site, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting these sites and such sites are not governed by this privacy statement.

Social Media Platforms

We participate with social media platforms subject to their privacy policies. Our website may use social sharing buttons which help share web content directly from web pages to social media platforms. The social media platform may track and save your request to share a web page through your social media platform account.

Subject Access Requests

Individuals have the right to make a subject access request in relation to their personal data and can ask for confirmation that their data is being processed and access the data. HWGTA may ask for proof of identification before the request can be processed. HWGTA reserves the right to make a reasonable charge for the information where a request is manifestly unfounded or excessive, particularly if it is repetitive. HWGTA will endeavour to respond within the one month specified by law.

Your Rights

Individuals have a number of other rights in relation to their personal data and how it is collected, processed and shared. The GDPR includes the following rights for individuals:

  • the right to be informed
  • the right of access
  • the right to rectification
  • the right to erasure
  • the right to restrict processing
  • the right to data portability
  • the right to object

Data Security

HWGTA takes the security of personal data seriously. We have internal policies and controls in place to protect personal data against loss, alteration, destruction, misuse or disclosure and ensures relevant access control. Where we engage third parties to process personal data on our behalf, such parties do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data. Some of these measures have been mentioned above, but this also includes:

  • email and website encryption
  • Firewall protection
  • Network protection
  • Full antivirus protection

If there were to be a breach of personal data that poses a risk to the rights and freedoms of individuals, HWGTA will report it to the Information Commissioner’s Office (ICO) within 72 hours of discovery. We will record all data breaches regardless of their effect.

International Data Transfers

As we operate from a single establishment in the UK, we seldom need to transfer personal data or processing. However, on the rare occasions where this may involve emailing for legitimate business purposes, we utilise the aforementioned data security measures to ensure that personal data is safe and secure.

To make a complaint

HWGTA processes your personal data in compliance with this Privacy Policy and in accordance with the relevant data protection regulations. If you have any complaints about the way in which your personal data is handled or regarding the processing of your personal data, please contact us using the contact details below. Alternatively, you have the right to contact the supervisory authority to register a complaint, the details are which are below.

In the first instance please contact:

Herefordshire and Worcestershire Group Training Association
Holmer Road

Report a concern to the Supervisory Authority:

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Telephone: 0303 123 1113

Update 7th June 2024