GDPR & Privacy Policy

Dynamic Training UK Ltd
GDPR & Privacy Policy

1. Introduction
Dynamic Training UK Ltd (“we”, “us”, “our”) is committed to protecting the privacy and personal data of all learners, employers, staff, subcontractors, and stakeholders.

This Privacy Policy explains how we collect, use, store, share, and protect personal data in accordance with:
•    UK GDPR 
•    Data Protection Act 2018 
•    Apprenticeships, Skills, Children and Learning Act 2009 
•    Department for Education (DFE)
By using our services, systems, or website(s), you acknowledge the practices described in this policy.

2. Scope
This policy applies to:
•    All employees and workers 
•    Apprentices and learners 
•    Employers and partner organisations 
•    Contractors and subcontractors 
•    Third-party processors and system providers 
It covers all personal data processed in any format (digital, paper, verbal).

3. Data Protection Principles
We comply with UK GDPR principles:
•    Lawfulness, fairness and transparency 
•    Purpose limitation 
•    Data minimisation 
•    Accuracy 
•    Storage limitation 
•    Integrity and confidentiality (security) 
•    Accountability 
We maintain records of processing activities to demonstrate compliance.

4. Types of Personal Data We Collect
We may collect and process:
Learner and apprentice data:
•    Name, contact details, date of birth 
•    National Insurance number and Unique Learner Number (ULN) 
•    Ethnicity, disability, and equality monitoring data 
•    Qualification and progress data 
•    Attendance and engagement records 

Employer and partner data:
•    Business contact details 
•    Billing and contract information 
•    Workplace and placement information 

Safeguarding and welfare data (where applicable):
•    Next of kin or emergency contacts 
•    Safeguarding concerns and case notes 

System and usage data:
•    Login and access records 
•    IP addresses and device identifiers 
•    Platform usage (e-portfolio, LMS, MIS systems) 

5. Lawful Basis for Processing
We process personal data under the following lawful bases:
•    Contract: delivery of apprenticeship and training services 
•    Legal obligation: DFE funding rules, safeguarding, and statutory reporting 
•    Public task: apprenticeship delivery funded by government schemes 
•    Legitimate interests: operational management and service improvement 
•    Consent: where required for marketing or optional processing 
•    Special category data: explicit consent or legal requirement (e.g. equality data, safeguarding) 

6. How We Use Personal Data
We use personal data to:
•    Deliver apprenticeship and training programmes 
•    Enrol learners and verify eligibility 
•    Manage employer relationships and placements 
•    Meet DFE and awarding organisation requirements 
•    Monitor progress and performance 
•    Safeguard learners and meet welfare obligations 
•    Maintain system security and prevent fraud 
•    Communicate with learners and employers 
•    Conduct audits, quality assurance, and reporting 
We only process data that is necessary for these purposes.

7. Sharing of Personal Data
We may share personal data with:
•    Department for Education (DfE) 
•    Education and Skills Funding Agency (ESFA) 
•    Awarding organisations (e.g. Pearson, NCFE, City & Guilds) 
•    Employers (for apprenticeship delivery and compliance) 
•    External auditors and quality assurance bodies 
•    Approved IT system providers (e.g. LMS/MIS/e-portfolio systems) 
•    Safeguarding partners where required by law 
All third parties are required to comply with data protection obligations.

8. International Data Transfers
Where data is processed outside the UK:
•    We ensure adequate safeguards are in place 
•    Transfers comply with UK GDPR requirements 
•    We use approved contractual clauses or adequacy decisions 

9. Data Retention
We retain personal data only as long as necessary for:
•    DFE funding rules and audit requirements 
•    Legal and regulatory obligations 
•    Safeguarding requirements 
•    Contractual requirements 
Retention periods are defined in our internal Data Retention Schedule.
After expiry, data is securely deleted or anonymised.

10. Data Security
We implement appropriate technical and organisational measures including:
•    Role-based access controls 
•    Encryption of data in transit and at rest (where applicable)
•    Secure cloud storage systems 
•    Multi-Factor Authentication (MFA) for system access 
•    Regular system security reviews 
•    Staff training on data protection and cyber security 
Access is restricted strictly on a need-to-know basis.

11. Data Breach Management
In the event of a personal data breach, we will:
•    Assess risk immediately 
•    Contain and mitigate the breach 
•    Record the incident internally 
•    Notify the ICO within 72 hours where legally required 
•    Notify affected individuals where high risk is identified 
All breaches are logged in a central incident register.

12. Data Subject Rights
Individuals have the right to:
•    Access their personal data 
•    Request correction of inaccurate data 
•    Request deletion (where applicable) 
•    Object to processing 
•    Request restriction of processing 
•    Request data portability (where applicable) 
Requests should be submitted to: datarequest@dynamictraining.co.uk
We respond within statutory timeframes (normally 1 month).

13. Consent and Marketing
Where consent is used:
•    It must be freely given and clearly recorded 
•    Individuals can withdraw consent at any time 
•    Withdrawal will not affect core service delivery 
Marketing communications will always include opt-out options.

14. Safeguarding and Welfare
Where there is a safeguarding concern:
•    Information may be shared without consent where legally required 
•    This is done in line with safeguarding duties and public interest 
•    Decisions are documented and proportionate 

15. Automated Processing
We do not make solely automated decisions that significantly affect individuals without human oversight.

16. Complaints
If you are unhappy with how your data is handled, you may:
•    Contact us directly at GDPR@dynamictraining.org.uk  
•    Lodge a complaint with the Information Commissioner’s Office (ICO) 

17. Data Protection Officer (DPO)
Our Data Protection Officer oversees compliance and can be contacted at: GDPR@dynamictraining.org.uk