ECITB Privacy Policy

The ECITB is committed to protecting your privacy and ensuring that any information that it collects about any person (“Personal Data”) is never misused. Protecting the confidentiality and integrity of Personal Data is a critical responsibility that the ECITB takes seriously at all times. ECITB recognises that the correct and lawful treatment of Personal Data will maintain confidence in the organisation.

This Privacy Policy explains what information ECITB collects, how and why it is used, how it is kept safe, and what your rights are as a Data Subject.

This Privacy Policy details the way the ECITB collects and uses your Personal Data when you use ECITB’s website and other services, enroll on its courses, and obtain qualifications. It is, therefore, important that you read this Policy in full to understand how your Personal Data is used.

The ECITB’s Privacy Policy is divided into the following sections:

A. About the ECITB and this policy;

B. Why and how the ECITB collects and uses your personal data;

C. Your rights; and

D. Data Privacy and the ECITB’s training courses and services.

A About the ECITB and this policy

The ECITB

The Engineering Construction Industry Training Board (ECITB) is a public body (an industrial training board) and also a charity registered in England and Wales.

The ECITB has a Data Protection Officer. If you have any comments or concerns about any aspect of this policy or any privacy or data protection issue, please contact The Data Protection Officer by email at dpo@ecitb.org.uk

Data processing principles

ECITB adheres to the following principles relating to processing of personal data, which are set out in the General Data Protection Regulation (GDPR). The principles require Personal Data to be:

Processed lawfully, fairly and in a transparent manner (Lawfulness, Fairness and Transparency).
Collected only for specified, explicit and legitimate purposes (Purpose Limitation).
Adequate, relevant and limited to what is necessary in relation to the purposes for which it is Processed (Data Minimisation).
Accurate and where necessary kept up to date (Accuracy).
Not kept in a form which permits identification of Data Subjects for longer than is necessary for the purposes for which the data is Processed (Storage Limitation).
Processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful Processing and against accidental loss, destruction or damage (Security, Integrity and Confidentiality).
Not transferred to another country without appropriate safeguards being in place (Transfer Limitation).
Made available to Data Subjects and Data Subjects allowed to exercise certain rights in relation to their Personal Data (Data Subject’s Rights and Requests).

Changes to the policy

When the ECITB’s Privacy Policy is reviewed, the date it was last updated will be noted and published on the ECITB’s website.

This Privacy Policy was last reviewed and updated in March 2023.

B ECITB’s collection and use of personal data

Why ECITB collects personal data

Under GDPR the ECITB may only collect, process and share Personal Data fairly and for specified lawful purposes. These restrictions are not intended to prevent processing, but ensure that the ECITB processes your Personal Data fairly and without adversely affecting your rights as a Data Subject.

The GDPR allows processing of Personal Data for specific purposes, and the purposes for which the ECITB processes such data are set out below:

When the Processing is necessary for the performance of a contract with a Data Subject;
To meet the ECITB’s legal compliance obligations and purposes carried out in the public interest or in the exercise of official authority vested in the ECITB as a public body; and/or
To pursue the ECITB’s legitimate interests for purposes where they are not overridden because the data processing prejudices the interests or fundamental rights and freedoms of Data Subjects.

The GDPR also allows processing of Personal Data when the Data Subject has given his or her consent. Whenever the ECITB needs to process Personal Data for purposes which fall outside the purposes described above or to protect the Data Subject’s vital interests, the ECITB will seek and obtain the Data Subject’s consent.

How ECITB collects personal data

You give the ECITB Personal Data and other information when you:

Use the ECITB’s website and services;
Complete and/or submit one of the ECITB’s forms (for example, when attending a training course with an ECITB Approved Training Provider);
Register and undertake an examination;
Obtain and maintain your ECITB qualifications;
Correspond with the ECITB by telephone, email or otherwise;
Register with the ECITB;
Subscribe to ECITB’s services;
Search for a service (such as a course, a qualification or an apprenticeship); or
Respond to an ECITB survey.

The ECITB also collects information about you when you visit its websites through the use of cookies (see “Cookies” below).

The ECITB may also get information from other sources, including third parties, such as training providers and “in-scope” employers.

What the ECITB collects

The information the ECITB collects from you could include your:

Name, address, email and phone number;
Date of birth;
National Insurance number;
Financial and credit card information;
Personal description or CV
Photograph
IP address
Geographical location

The ECITB may also have Sensitive Personal Information concerning its employees, but with the consent of such individuals. The ECITB does not collect Sensitive Personal Information relating to other individuals.

Personal data created by the ECITB

ECITB also creates and processes Personal Data about you through your use of our website and services, through your attendance of our courses and as part of you maintaining your qualifications, including:

Course data includes data created through your registration and participation in our courses.
Examination data: includes data created when you register and undertake any examination in respect of our courses and qualifications. This data also includes certain sensitive data we processed about you for identification and proctoring services.
Usage data: includes information created about you through your use of ECITB’s website and services, including unique identifiers, activity logs and cookie data.
Technical data includes internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website or services.
Marketing and communications data includes your preferences in receiving marketing from us and our third parties, other interactions with us, such as feedback to surveys or with our technical support or customer services teams, as well as your communication preferences.

Further details on these various data types can be found in the How ECITB uses Personal Data section below.

How the ECITB uses personal data

Information relating to Data Subjects in connection with ECITB training courses, apprenticeships, awards and qualifications.

The ECITB collects information about individuals who have either attended the ECITB’s and other approved training courses, or have attained the ECITB’s qualifications (including vocational qualifications). The information is received from the individuals themselves, employers and ECITB’s network of approved providers and verifiers.

The ECITB holds and uses this information as a data controller (whether on its own account, or in-common with its approved providers and recipients of this information).

The collected information may include personal details (often including photographs) together with details relating to:

Completed training courses;
ECITB apprenticeships; and
The registration for, and achievement of, awards and qualifications.

The ECITB retains this information in its management information systems, and some information may be held in an online secure database.

Examples of the uses requiring your Personal Data are as follows:

The ECITB uses your contact details to ask you to confirm the ECITB’s records about you, and to process your applications, enquiries; awards and qualifications;
The ECITB uses identification information to prevent fraud;
The ECITB uses your achievement information to certify that you have the necessary knowledge and skills to work in the engineering construction industry; and
The administration of certification, qualification and card schemes.

Sharing data subjects’ training and qualifications information

The ECITB may share information relating to a Data Subject’s training and qualifications with parties that wish to verify that such individuals:

have undertaken the ECITB’s and other approved training programmes (including apprenticeships), or are in the process of such training;
hold valid cards issued under the ECITB’s card schemes;
hold awards and qualifications, or are in the process of working towards them.

When ECITB shares such information, it is likely to be with:

Training providers;
Our service providers, who assist us in providing aspects of our services, such as remote examination sessions;
Your employer or prospective employers;
The operators of sites at which you might work or visit;
Users of ECITB’s card schemes;
Regulatory bodies in the education sector (in accordance with the ECITB’s arrangements with such bodies); or
Funding bodies.

Such third parties who can provide the ECITB with certain search information about you (such as your name, ECITB individual ID or card registration number, National Insurance number or other personal details) can check your identity and your ECITB training, awards, tests and qualifications achievements by:

Submitting enquiries by email or telephone; or
By using an online portal interface that the ECITB made available to authorised employers, approved training providers and other parties.

The information shared with such parties may include:

Your surname and first name;
Your photograph;
Your ECITB Registration Number;
Health and safety test passes;
Training and assessment certificates;
Technical Test passes;
VQ achievements; and
ECITB training course attendance.

The ECITB may also share your ECITB-accredited achievements with newspapers, websites and other media.

Contact the ECITB’s Data Protection Officer (at dpo@ecitb.org.uk) if you would prefer us not to share your information.

The ECITB will not share other information with third parties unless required to do so for legal reasons.

Information relating to examinations

Many of ECITB’s courses require the completion of examinations as a prerequisite for obtaining a qualification or certification.

As part of ECITB’s provision of such examinations it will collect and create various information, including:

Various identification information, such as your photograph, passport, drivers licence or other valid identification;
Your examination score and associated record;
Any other information produced in the course of you sitting any ECITB examination, including records of your adherence to ECITB’s examination codes of practice.

Where ECITB offer candidates the ability to take a particular examination remotely, it will, in conjunction with its third party providers, implement proctoring services. Proctoring Services can be providing using various technologies, but broadly involves you sitting your exam remotely whilst a camera records you. It may also include automated software which is trained to detect any instances of possible cheating or outside interference.

Where Proctoring Services are utilised for your examination, we will also collect an audio-visual recording of your examination session. Where automated technologies are used as

part of the proctoring, any decision making made as to the detection of cheating or outside interference will exclusively be made by a human invigilator. Any such records shall be retain for a maximum period of 6-months, unless a verified instance of cheating or outside interference was detected.

Information relating to other data subjects

The ECITB uses Personal Data relating to other Data Subjects for the following purposes and reasons:

Administering its records and accounts relating to employers, including levy raising;
Managing its employees, contractors and service providers;
Providing educational, training, careers advisory services;
Undertaking charitable trading;
Advertising, promoting and marketing ECITB’s services;
Developing and improving ECITB’s services; and
Undertaking research;
Fulfilling its statutory roles, duties and functions as a public body and an industrial training board;
Fulfilling ECITB’s contractual obligations;
Performing ECITB’s duties as a registered data controller and public authority;
Confirming identities in connection with the ECITB’s legal obligations (for example, in connection with litigation, freedom of information requests or crime prevention); and
Analysing website users’ behaviour.

The ECITB may share information relating to Data Subjects with its service providers or agents or law enforcement agencies, if this contractually or legally required.

How the ECITB keeps personal data safe

The ECITB takes the security of your Personal Data very seriously.

ECITB uses technical measures in its IT systems, such as encryption, and carries out regular security reviews to keep its protections up to date. The ECITB also strictly controls access and ensures staff who are authorised for access are adequately trained in keeping your information safe. The ECITB’s procedures mean that you may be asked to prove your identity before ECITB shares your personal data with you.

Third-party websites you access through links on the ECITB’s website will have their own privacy policies. The ECITB does not accept any responsibility or liability for them.

How long personal data is kept

The ECITB will only retain Personal Data:

to enable it to meet its contractual responsibilities;
to enable it to meet its legal compliance obligations and purposes carried out in the public interest or in the exercise of official authority vested in the ECITB as a public body, or
for legitimate business use.

Such information will not be retained for longer than necessary for the purpose for which it was created or collected.

The ECITB has implemented a Data retention and Disposal Policy. This sets out the ‘default’ retention periods for different categories of personal and other data. In some cases certain data and will fall within an exemption to the default retention period where records should be kept for a longer or shorter period of time.

It is not always practical to permanently delete data when it is no longer required. When personal data cannot be deleted for practical reasons, certain techniques and safeguards will be applied put that personal data “beyond use”. This means that the ECITB:

will not, or will not attempt, to use the personal data to inform any decision in respect of any individual or in a manner that affects the individual in any way;
will not give any third party access to the personal data;
will surround the personal data with appropriate technical and organisational security; and
will permanently delete the information if, or when, this becomes possible.

Data transfer outside the EEA

Sometimes the ECITB may transfer your details to third parties outside of the European Economic Area (EEA). If this happens the transfer and storage of your information will still comply with UK or EEA laws and this Privacy Policy and, in particular, done on the basis of compliant data transfer mechanisms.

You have a right to request further information on the countries to which your data is transferred to and the specific nature of the transfer mechanisms in place and may do so by contacting the Data Protection Officer at dpo@ecitb.org.uk.

Cookies

When you visit the ECITB’s website cookies are placed on your device. Cookies are small text files that help the ECITB’s website to work and the ECITB to understand what information is most useful to the website’s users. They also speed things when you come back to a site. The ECITB does not use them to identify you personally.

You can delete cookies stored on your device at any time.

Cookies allow the following types of information to be gathered about your visits to the ECITB’s website, including your:

IP address;
Geographical location;
Browser type;
Device type;
Operating system;
Browsing data, such as access times;
Navigation history; and
Preferences.

Cookies enable the ECITB to use the tools and services of Google Analytics, which helps to measure and analyse how users are using the ECITB’s website. ECITB’s staff and Google can access information related to Google Analytics cookies.

When the ECITB uses internet tools from other companies to enhance its website, these companies may also put cookies on your device. They include:

Facebook;
Google Maps;
Twitter;
LinkedIn;
YouTube;
WordFence; and
WordPress.

Phone

The ECITB does not record telephone calls which it makes or receives.

Email and social media

There are many ways you may communicate with the ECITB online, including by:

Email;
Social media (such as Facebook, LinkedIn, YouTube, Google+ or Twitter);
Video conferencing (such as GoToMeeting, Webex, and Skype for Business); and
File sharing platforms.

When you use email, social media and other online platforms, it is likely you know what information you are sharing with the ECITB. How the ECITB uses and processes your information, who accesses it, and how long it is kept, depends on the context in which the information has been collected. For example, if you participate in video conferencing such proceedings may be recorded. However, in such circumstances the terms of the ECITB’s Privacy Policy and UK law will be followed.

Your payment details

The ECITB uses bank details to process orders (for example, for replacement cards), collect levy payments and distribute funds, such as training grants.

The ECITB does not use such information for any purpose authorised which has not been authorised, and does not disclose it to third parties without permission.

The ECITB processes credit and debit card transactions following the Payment Card Industry Data Security Standard. Only ECITB authorised staff and contracted data processors have access to your payment details to carry out your transactions.

For bank and building society account transactions, the ECITB may make a record of your:

Account name;
Branch address;
Sort code; and
Account number.

The ECITB keeps your bank or building society details only for as long as they are needed. When this is no longer the case, the information is deleted.

Insofar as payment card information and transactions are concerned, the ECITB accepts payments made by credit and debit cards. The ECITB processes data such as the:

Cardholder’s name;
Card number;
Card security code (CSC);
Validity and expiry dates; and
Issue number

The ECITB usually collects card data by telephone directly from the card holder. This information is immediately entered into the card payment system. The ECITB does not record payment card information. The relevant transaction report subsequently received from the card payment system provider only contains details of the amount, the card bearer’s name and the final 4 digits of the card number.

Children and young people

The ECITB’s website may include content designed to impart information to people of school age who may be interested in careers in engineering, and more particularly in the engineering construction industry. The ECITB also offers training courses, qualifications and apprenticeship support to young people aged between 16 and 18. In all other respects, the ECITB’s website, services and products are not aimed at children under the age of 16, and the ECITB does not knowingly collect any personal data information from children under 16.

If you are a young person aged between 16 and 18 and you find this policy difficult to understand, you can ask an adult such as a parent or teacher to help you.

If you have any queries or concerns regarding our processing of personal data please contact the ECITB’s Data Protection Officer at dpo@ecitb.org.uk.

C Your rights

Summary of your rights

You have the right to:

Ask for a copy of any information the ECITB holds about you;
Withdraw any consents you have given;
Lodge a complaint with the ECITB or the Information Commissioner’s Office or with any other relevant supervisory authority about how the ECITB handles your personal data;
Ask the ECITB to correct any inaccurate or incomplete information it has about you;
Ask the ECITB to delete your information from its records; and
Ask the ECITB to send a copy of your information to a third party in a data portable format.

Making a request to see your information

To see the information the ECITB holds about you, you should make a Subject Access Request in writing, including your:

Full name, including previous or other names, if appropriate;
Address;
Telephone;
Unique ECITB registration or ID numbers, if appropriate; and
Date of birth, if you don’t have a unique registration number

You should send the Subject Access Request to dpo@ecitb.org.uk.

D ECITB’s training courses and services

Card schemes

The ECITB manages card schemes, which help to ensure the safety and proficiency of the engineering construction workforce in Great Britain and abroad. Individuals undertake the ECITB’s safety training courses (for example, “CCNSG” safety training courses in GB, and “IHSP” safety training courses abroad) and take assessment tests, which lead to the award of cards certifying safety training and test achievements. Through these schemes it is possible to check someone’s identity and training achievements or qualifications.

The ECITB records your scheme achievements in a database. Your card scheme data may be shared with other parties (see “How ECITB uses Personal Data” above).

The ECITB will keep card scheme information for no longer than 50 years from the expiry date of your last achievement.

Apprenticeships

The ECITB offers support relating to apprenticeships in the engineering construction industry across Great Britain.

The ECITB receives Personal Data about you in connection with your participation in apprenticeship programmes relating to the ECITB apprenticeship frameworks and standards. The information may be provided to the ECITB by you, your employer or by a training provider involved in your training.

When you provide the information (for example, through an application process) the ECITB uses the information to understand your career goals and development needs, so that you can be placed with the right employer and/or training provider. Your data will not be shared with parties other than those involved in your apprenticeship, including relevant regulatory authorities in the education sector, current and prospective employers and training providers.

Your apprenticeship data may be shared with other parties (see “How ECITB uses Personal Data” above).

The ECITB keeps a record of your apprenticeship for up to 50 years.

Other ECITB training courses and awards

Additionally, the ECITB offers a range of training courses, awards, qualifications and other related services in Great Britain and abroad. The ECITB may receive Personal Data about you in connection with such services in the same way that it does in connection with Apprenticeships (see above). The ECITB collects and uses Personal Data in connection with its training courses and awards for the reasons and in the circumstances explained in section B of this Privacy Policy above.

Your training and awards data may be shared with other parties (see “How ECITB uses Personal Data” above).

ECITB keeps a record of your training and other achievements for up to 50 years.

Grants and funding

The ECITB provides grants and other funding in support of training and career development largely to learners, employers and training providers in the engineering construction industry in GB. In order to administer the agreement and payment of grants and other funding, the ECITB may collect Personal Data about you.

For example:

Employers and training providers can express an interest in or apply for grant funding to the ECITB. This may occur via the ECITB’s internet portal systems.
Evidence of training activity containing your Personal Data may be received and is required by the ECITB to demonstrate that agreed training activity has occurred as a condition of grant payment.

This information is stored in a secure database. Only the ECITB’s staff, contracted data processors and auditors have access to the information. The ECITB may keep your information for at least 7 years, in view of accounting requirements/legislation, and possibly longer if a funding authority is also involved.

Research

The ECITB conducts and commissions research and analysis relating to the engineering construction industry sector to help the industry improve and succeed (as permitted by the Industrial Training Act 1982) and to meet governmental requirements.

Whenever possible the ECITB and its commissioned contractors use anonymous information that cannot be linked to you, or pseudonymous information which replaces your name or other identifying data with something else to make it virtually impossible to identify you. However, if it is necessary to use your Personal data in connection with its research activities, the ECITB may use any of the information it has collected about you in the research.

ECITB staff and contracted data processors performing research have access. If necessary, the ECITB may also share information with agents, service providers, and survey and research organisations.

Levy

The ECITB has statutory powers to collect the industrial training levy from engineering construction employers to fund training in the sector. The ECITB keeps a register of engineering construction establishments and employers, which is used in connection with the assessment and collection of levy from those who are required by law to pay it.

In the administration of the industrial training levy the ECITB may use your:

Contact details to ask you to confirm the ECITB’s records about you or your employer; and
Employer’s details to determine if it is liable to pay the levy, to process levy assessments, to issue levy collection notices and to process levy payments.

Only ECITB staff, contracted data processors and the ECITB’s professional advisors have access to such information. The ECITB keeps levy data for 10 years after you or your company is no longer required to complete a levy return.

Privacy Statement

Share this page

Share by email