ºÚÁϳԹÏÍø

Skip to main content
  1. Home
  2. CEC Privacy Notice & Cookies

CEC Privacy Notice & Cookies

This document is the Careers and ºÚÁϳԹÏÍø Company’s general Privacy Notice. It provides information about our processing of your personal data, summarises your data rights and explains how to contact us or complain about our data processing.

1. Introduction to CECÌý

The Careers and ºÚÁϳԹÏÍø Company Ltd (CEC) is the national body for careers education in England, supporting schools and colleges to deliver modern, 21st century careers education.Ìý

Our mission is to help every young person find their best next step. Our work is evidence-led so data is essential in achieving this mission.ÌýÌý

We achieve our mission by working with primary, secondary and special schools, pupil referral units, colleges, Independent Training Providers (ITPs) and employers to improve careers education and secure better outcomes for young people.Ìý

2. Using our Privacy Notice and Contacting Us about Your DataÌýÌý

We have structured this Privacy Notice to make it easier to understand how we process your personal data based upon your relationship with CEC. It was built upwards from the records of processing activities (ROPA) maintained by each team to give a transparent picture of the personal data we process in our work and our purposes for doing so.Ìý

If you engage with us in a new way, we may provide additional information about how we will process your personal data for that purpose. The additional information acts as a supplement to this general Privacy Notice.ÌýÌýÌý

If you have questions about CEC’s data processing not answered by this Privacy Notice, please contact our Data Protection Officer. Email dpo@careersandenterprise.co.uk or write to:ÌýÌý

Claire Stevenson, Data Protection Officer, The Careers and ºÚÁϳԹÏÍø Company Limited, 1st Floor, Work.Life, 120 Aldersgate St, Barbican, London EC1A 4JQÌý

Cookie Policy

View our Cookie Policy

3. The Data we process, our Purposes, and our Lawful Basis for processing data

Sections: A. Young People B. Careers Leaders and Education Provider StaffC. Employer Contacts and VolunteersD. Partners and Supplier StaffE. Job ApplicantsF. EmployeesG. Website visitors

A. Young People

i. CEC’s use of Young People’s data

We process data about Young People for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:

Ìý

  • To support schools, special schools, colleges and independent training providers in their careers education provision, recording and improvementÌý
  • To plan, deliver and measure the effectiveness of CEC programmes and eventsÌý
  • To safeguard young people involved in CEC programmes and eventsÌý
  • To conduct research related to our missionÌý
  • To promote and publicise work to achieve our mission (photography, video. audio recordings which you have granted us a license to use)Ìý
  • To give Young People a voice in the governance of CECÌýÌý
  • To manage work experience at CECÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposes
ii. Categories of personal data CEC processes about Young People

We process the following types of personal data about Young People:

Ìý

  • Personal identifiers including name and date of birthÌý
  • Educational establishment(s) attendedÌý
  • Email addressÌý
  • Career education engagement and experiencesÌý
  • Career interests, intentions and readinessÌý
  • Post-compulsory education destinations and Employment, Education or
  • Training (NEET) statusÌý
  • Special category and other sensitive information including SEND status and indicators of disadvantage such as free school meal status, Pupil Premium status, low school attendance, exclusions, EHE (elective home education) status, English as an Additional LanguageÌý
  • Attainment data (if Young Person takes part in a CEC programme)Ìý
  • Opinions (responses to surveys and other research)Ìý
  • Photographs, video and audio recordings (If you have been involved in a CEC project and granted us a license to use these)Ìý
iii. Lawful basis for processing data about Young People

The lawful bases for processing Young People’s personal data are:Ìý

Ìý

  • Necessity for the performance of our task in the public interest related to our mission to help every young person to find their best next stepÌý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security, safeguarding and legal risk.Ìý
iv. Sharing Young People’s personal data

Our work is at national scale and delivered through our network of Careers Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership with local democratic authorities to connect with local skills needs.Ìý

Ìý

Organisations who enable us to deliver our work have access to Young People’s personal data only where necessary. Data protection law calls these organisations Data Processors. They include IT partners who host or develop our databases or support systems security. We take steps to verify that Data Processors can protect your data, ensure that appropriate contractual agreements are in place, and we monitor their performance.ÌýÌý

Ìý

If you are invited to take part in CEC research or a project, we will provide more information to you and your school about how your data will be used for that work. Where we work with partner or supplier organisations on these projects, it may be necessary to provide your personal data to enable them to deliver and evaluate the project, or to keep you safe when you take part.Ìý

Ìý

We do not share young people's individual personal data with other organisations for their own purposes unless we are legally required to.

B. Careers Leaders and Education Provider Staff

This category includes Careers Leaders and Educational Institution Staff.Ìý


i. CEC’s use of Careers Leaders and Education Provider Staff data

We process data about Careers Leaders for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:Ìý

Ìý

  • To support schools, colleges and independent training providers in their careers education provision, recording and improvementÌý
  • To promote and publicise work to achieve our missionÌý
  • To plan, deliver and measure the effectiveness of CEC programmes and eventsÌý
  • To conduct research related to our missionÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposes
ii. Categories of personal data CEC processes about Careers Leaders and Education Provider Staff

We process the following types of personal data about Careers Leaders and Education Provider Staff:Ìý

Ìý

  • Personal identifiers including your name, job title and the name of the school or college which is your employerÌý
  • Contact details including your email address, telephone number and employer’s addressÌý
  • The CEC digital products you are registered to use and your user type (for example, whether you are your institution’s primary user with admin rights)Ìý
  • Records of your engagement with our digital products, Customer Management services, training, programmes and other services and eventsÌý
  • Your responses to surveys and other researchÌý
  • Your image and comments for a case study or articleÌý
iii. Lawful basis for processing data about Careers Leaders and Education Provider Staff

The lawful bases for processing Careers Leaders and Education Provider Staff personal data are:Ìý

Ìý

  • Performance of our task in the public interest which is related to our mission to help every young person to find their best next stepÌý
  • Performance of a contractÌý
  • Consent to receive marketing communicationsÌý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security and legal risk.Ìý
iv. Sharing Careers Leaders and Education Provider Staff personal data

Our work is at national scale and delivered through our network of Careers Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs.Ìý

Ìý

We provide access to Careers Leader personal information where necessary to enable partnership working towards our mission and to enable our suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý

C. Employer Contacts and Volunteers

This category includes Employer Contacts and Volunteers

Please note that the organisation which hosts the Careers Hub which is a Volunteer’s main point of contact conducts recruitment and verification activities for volunteers from industry. Similar personal data processing activities to those described in section 3E for Job Applicants also verify volunteers' suitability.Ìý


i. CEC’s use of Employer Contacts and Volunteers’ data

We process data about Employer Contacts and Volunteers for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:Ìý

Ìý

  • To support links between employers and schools, colleges and independent training providersÌýÌý
  • To promote and publicise work to achieve our missionÌý
  • To plan, deliver and measure the effectiveness of CEC programmes and eventsÌý
  • To conduct research related to our missionÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposesÌý
  • Applicants for volunteer positions should also refer to section 3.E.i relating to job applicants for details of additional processing purposes.Ìý
ii. Categories of personal data CEC processes about Employer Contacts and Volunteers

We process the following types of personal data about Employer Contacts and Volunteers:Ìý

Ìý

  • Personal identifiers including your name, job title and the name of the Employer you representÌý
  • Contact details including your email address, telephone number and employer’s addressÌý
  • Your volunteer statusÌý
  • Your engagement with our products, training, programmes and other services and eventsÌý
  • Your responses to our surveys and other researchÌý
  • Applicants for volunteer positions should also refer to section 3.E.ii relating to job applicants for details of additional categories of personal data processed.Ìý
iii. Lawful basis for processing data about Employer Contacts and Volunteers

The lawful bases for processing Employer Contacts and Volunteers data are:Ìý

Ìý

  • Performance of our task in the public interest related to our mission to help every young person to find their best next stepÌý
  • Performance of a contractÌý
  • Consent to receive marketing communicationsÌý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security and legal riskÌý
  • Applicants for volunteer positions should also refer to section 3.E.iii relating to job applicants for details of additional lawful bases.Ìý
iv. Sharing data about Employer Contacts and Volunteers

Our work is at national scale and delivered through our network of Careers Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs.Ìý

Ìý

We provide access to Employer Contacts and Volunteers personal information where necessary to enable partnership working towards our mission and to enable our suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý

Ìý

Applicants for volunteer positions should also refer to section 3.E.iv relating to job applicants for details of the additional data sharing involved.Ìý

D. Partners and Supplier Staff

This category includes the staff of suppliers and other organisations we work with, including organisations hosting Career Hubs and our funders.


i. CEC’s use of Partners and Supplier Staff data

We process data about Partners and Supplier Staff for the following purposes:Ìý

Ìý

  • To manage our contract and partnership working with your employerÌý
  • To communicate with you in order to facilitate operationsÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposes.Ìý
ii. Categories of personal data CEC processed about Partners and Supplier Staff

We process the following types of personal data about Partners and Supplier Staff:Ìý

Ìý

  • Personal identifiers including your name, job title and the name of the Employer you representÌý
  • Contact details including your email address, telephone number and employer’s addressÌý
  • Your role in relation to our contractÌý
  • Records of our communicationsÌý
iii. Lawful basis for processing data about Partners and Supplier Staff

The lawful bases for processing Partners and Supplier Staff data are:

Ìý

  • Performance of a contractÌý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security and legal riskÌý
iv. Sharing data about Partners and Supplier Staff

Our work is at national scale and delivered through our network of Careers Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs.Ìý

Ìý

We provide access to Partners and Supplier Staff personal information where necessary to enable partnership working towards our mission and to enable other suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý

E. Job Applicants

i. CEC’s use of Job Applicant data

We process data about Job Applicants for the following purposes:Ìý

Ìý

  • To assess the fit of the Job Applicant to the position applied forÌý
  • To communicate with the Job Applicant (or recruiter where applicable) regarding their applicationÌýÌý
  • To arrange and manage our selection processesÌý
  • To verify the suitability of candidates offered a position subject to verificationÌý
  • To monitor CEC’s equity, diversity and inclusionÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposesÌý
ii. Categories of personal data CEC processes about Job Applicants

We process the following types of personal data about Job Applicants:Ìý

Ìý

  • Personal identifiers including your name and date of birthÌý
  • Contact details including your email, telephone number and home addressÌý
  • QualificationsÌýÌý
  • Employment historyÌý
  • Other information volunteered by you within application and selection processÌý
  • Application scoringÌý
  • Special category data including ethnic/ racial origin, nationality, disability status, sexual orientation, marital status (for CEC’s EDI monitoring)Ìý

Ìý

Additionally, we process the following types of personal data about successful Job Applicants who have been offered a position subject to verification of suitability:Ìý

Ìý

  • Criminal record data (if a criminal record check via the Disclosure and Barring Service is required due to the nature of the role this will be noted within the vacancy advert and/ or job description)Ìý
  • Health data, sickness absence record and reasonable adjustment requestsÌý
  • Employment and/ or educational/character references provided by your nominated refereesÌý
iii. Lawful basis for processing data about Job Applicants

The lawful bases for processing Job Applicants’ personal data are:Ìý

Ìý

  • CEC’s legitimate interest in recruiting job applicants who provide the best fit to role requirementsÌý
  • Performance of a contract (successful Job Applicants who accept a role offered subject to verification of suitability)Ìý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security and legal risk.Ìý
iv. Sharing Job Applicant personal data

We provide access to Job Applicant personal information where necessary to enable our suppliers to support our recruitment and suitability verification processes. In such cases we take steps to verify that suppliers provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý

Ìý

Verification for successful candidates also requires us to provide your nominated referees with your personal identifiers and details of the position you have been offered subject to verification.Ìý

Ìý

We do not share Job Applicant personal data with other organisations for their own purposes unless we are legally required to.

F. Employees

In addition to the personal data processing described in this section, CEC process employees’ personal data described at section 3.E for Job Applicants.


i. CEC’s use of Employee data

We process data about Employees and other workers for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:Ìý

Ìý

  • To communicate with Employees and support employee relationsÌý
  • To provide salary, pension and other benefitsÌý
  • To reward and manage performanceÌý
  • To assess training and development requirementsÌý
  • To facilitate HR managementÌý
  • To monitor CEC’s equity, diversity and inclusionÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposesÌý
ii. Categories of personal data CEC processes about Employees

We process the following types of personal data about Employees:Ìý

Ìý

  • Personal identifiers including name and date of birthÌý
  • Contact information including personal email address, telephone number and home addressÌý
  • Bank details, tax code and national insurance numberÌý
  • Benefit selectionsÌý
  • Absence records including sickness absence, annual, parental and other types of leave/ absenceÌý
  • Performance dataÌý
  • Grievance and Disciplinary recordsÌý
  • Records of requests for reasonable adjustments and flexible working arrangementsÌý
  • Health and disability informationÌý
  • Data about use of CEC IT assets and compliance with our Acceptable Use PolicyÌý
  • Special category data including ethnic/ racial origin, nationality, disability status, sexual orientation, marital status (for CEC’s EDI monitoring)Ìý
  • The name and contact details of your next of kin/ emergency contactÌý
iii. Lawful basis for processing data about Employees

The lawful bases for processing Employees’ personal data are:Ìý

Ìý

  • Necessity for CEC’s legitimate interest in managing employees to facilitate our mission of helping every young person to make their best next stepÌý
  • Performance of a contractÌý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security and legal risk.Ìý
iv. Sharing Employee personal data

We provide access to employee personal information where necessary to enable our partners and suppliers to support the delivery of our work. In such cases we take steps to verify that organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý

G. Website visitors

For information about data processing in relation to the use of our digital products for education, please see section 3B.


i. CEC’s use of Website Visitor data

We process data about website visitors for the following purposes:Ìý

Ìý

  • To provide essential website functionalityÌý
  • To understand how the website is usedÌý
  • To improve performance of the website and user experienceÌý
  • To respond appropriately to information you enter into our web formsÌý
  • To enable systems management and securityÌý
  • For CEC’s legal and compliance purposes.Ìý
ii. Categories of personal data CEC processes about Website Visitors

We process the following types of data about Website Visitors:Ìý

Ìý

  • Information you enter in our web forms. This may include:Ìý
  • Personal identifiers including your name and date of birthÌý
  • Contact details including your email, telephone number and home addressÌý
  • Your employerÌý
  • Your query or a registration for CEC training, a service or other eventÌý
  • Other information you have chosen to enter into a web formÌý
  • Cookies and similar technologies which provide information about your system, pages visited, and content accessedÌý

Ìý

When you browse our website you will be presented with a pop up which provides information about Cookie options. Only cookies which are strictly necessary for the basic functioning of our website are essential and cannot be refused. More information about CEC’s use of Cookies is available in our Cookie Policy

iii. Lawful basis for processing data about Website Visitors

The lawful bases for processing Website Visitors’ personal data are:Ìý

Ìý

  • Your consent when you register to receive marketing communicationsÌý
  • Your consent to set cookiesÌý
  • Performance of our task in the public interest related to our mission to help every young person to find their best next stepÌý
  • Our legitimate interest in processing the data you enter into our web forms and responding appropriately.ÌýÌý
  • Please also see the appropriate section relating to the forms’ purpose. For example, Section 3B if you are a Careers Leader who used a form on our website to register for an eventÌý
  • Necessity for compliance with a legal obligationÌý
  • Necessity for CEC’s legitimate interests in relation to security and legal risk.Ìý
iv. Sharing Website Visitor personal data

Our work is at national scale and delivered through our network of Careers Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs.Ìý

Ìý

We provide access to Website Visitor personal information where necessary to enable partnership working towards our mission and to enable our suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place.Ìý

4. How long we keep your personal dataÌý

We will only keep your personal data for as long as we need it. CEC has a retention schedule for personal data based on the needs of the organisation, fairness to you, and applicable law.ÌýÌý

We take necessary steps to keep your information safe throughout the time we keep your data: CEC holds the international standard ISO 27001 certification for information security as well as the UK government’s Cyber Essentials Plus verification.ÌýÌý

5. Processing personal data outside the UKÌý

When CEC processes personal data outside the UK, we make sure we comply with data protection law and take necessary steps to keep your personal data safe.Ìý

6. Your data protection rightsÌý

Under data protection law, you have rights including:Ìý

  • Right of accessÌý

You have the right to ask us to see the personal information we are processing about you.Ìý

  • Right to rectification Ìý

You have the right to ask us to rectify personal information you think is inaccurate or incomplete.Ìý

  • Right to erasure Ìý

You have the right to ask us to erase your personal information in certain circumstances.Ìý

  • Right to restriction of processingÌýÌý

You have the right to ask us to restrict the processing of your personal information in certain circumstances.Ìý

  • Right to object to processing Ìý

You have the right to object to the processing of your personal information in certain circumstances.Ìý

The Information Commissioner’s Office (ICO) provides more information about each of these data protection rights on its web site: ÌýÌý

7. How to complainÌý

If you have concerns about our use of your personal information, you can make a complaint to the Data Protection Officer. Email dpo@careersandenterprise.co.ukÌýÌý

The ICO is the independent authority responsible for supervising compliance with data protection law in the UK. You may also complain to the ICO by writing to:ÌýÌý

ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.Ìý

Helpline number: 0303 123 1113ÌýÌý

ICO website: https:/ÌýÌý

8. Changes to this privacy noticeÌý

This privacy notice will be updated from time to time, and we encourage you to check our website for updates.Ìý

Date of last update: 17 September 2024Ìý