Privacy policy
How do we collect personal information?
Personal information is anything that can identify you, for example your name, address, personal details in an email to us, or email address for a newsletter subscriber. We collect information about you if you have:
Contacted us to discuss how we might offer support
Instructed us as a client
Applied to us for a role as a Tutor or Employee
Attended an event
Signed up to our newsletter
Accessed our website
Worked with us as a partner
Contacted us
When you contact us to discuss how we might support your child then we will work through a detailed assessment of your child’s needs and design a plan of support. This will include some sensitive information, for example any particular health needs, or personal matters that might be relevant to educational development. We keep all of this information securely on our purpose-built database, and share it internally and with our expert tutors so that your child can receive the support to achieve their educational goals.
The legal basis for us to process your information is our legitimate interests in offering support to clients.
Instructed us as a client
If you become a client then you will sign a contract which sets out our relationship, and each of our rights and responsibilities. We will gather financial data from you as required to receive fee payment, and as required by UK law.
The legal basis for us to process this information is the performance of a contract, and compliance with legal obligations.
Accessed our website
Whilst using our website we collect anonymous information about your browsing session to help us improve our website.
We use a tool called Google Analytics to collect this data. All of the data is stored securely on Google’s servers. In order to track your browsing across sessions, Google analytics will place a ‘cookie’ on your machine (a small text file that websites use to track and remember information across several browsing sessions). You can tell your web browser not to accept cookies if you don’t your data to be collected in this way (refer to your web browser’s help file for more information).
For further details on Google Analytics, and the Google Analytics privacy policy, please visit the Google Analytics website.
Partners
We work with schools, colleges and universities to develop links to support our students. We also facilitate student work experience placements with businesses and organisations. We gather contact information from individuals within these establishments.
The basis on which we process this information is our legitimate interests in building relationships with schools and other educational establishments to support students in their educational goals, and our interests in building a network of partner organisations to provide work placements to our students.
How do we share your information?
We believe that to trust another person with private and personal information is a significant matter. When you give us information in confidence, we will only use it for the purpose you share it, and will only share it with other people in the specific situations.
Consent
You may ask us to share your information, for example if you ask us to make contact with a partner organisation on your behalf.
Safeguarding concern
We have a safeguarding policy in place which deals with how we respond to disclosures of abuse or neglect from children or young people. We have a legal duty to report safeguarding concerns, although we would ask for consent from the parent (in the case of a child) or individual (if a young person) first, and only share information without consent if we feel under a duty to share it because of the risk, or exceptionally if there is no time to get consent, or if we are legally prevented from speaking to the parent/individual concerned.
Data processors
Professional advisors may have access to EJC Education Consultancy data in the course of performing their duties (these may include lawyers, auditors, insurers, bankers, accountants, HR and IT support).
Where we do share data in this way, we have contracts in place which protect the security of your personal data and ensure that your data is only processed for specific purposes and in accordance with our instructions.
How do we look after your information?
EJC Education Consultancy has taken suitable measures to safeguard and secure data collected. These are compliant with the General Data Protection Regulation (GDPR).
In the unlikely event that your personal information is compromised, you will be informed as required in the GDPR.
How long do we keep your information?
We will only keep personal data for as long as necessary to fulfil the purpose for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. In deciding how long to keep data, we consider:
The amount, nature, and sensitivity of the personal data
The potential risk of harm from unauthorised use or disclosure of personal data
The reason why we are processing the personal data and whether it is possible to achieve those ends through other means
The applicable legal requirements
Description of data: Information about clients, and prospective clients - Period to keep: Six years from the date we last had contact with you
Description of data: Unsuccessful job applicants - Period to keep: Six months from the date of the recruitment decision
Description of data: Information about staff, including tutors who work with us - Period to keep: Six years from the date you finish working with EJC Education Consultancy
Description of data: Personal information within the finance records, for example invoices, or if a bank transfer discloses the name of the transferor - Period to keep: Six years from the end of the financial year to which the record relates
Description of data: Name and contact details for partner agencies - Period to keep: Six years after last contact
Description of data: Name and email address for mailing list subscribers - Period to keep: For as long as consent is in force. Subscribes may opt-out at any time, at which point their details are deleted
Your rights
Under certain circumstances, you have rights under data protection laws. These include the right to:
Request access to your personal data
Request correction of your personal data
Request erasure of your personal data
Object to processing of your personal data
Request restriction of processing of your personal data
Request transfer of your personal data (where it has been processed using automated means, which does not apply to us)
Withdraw consent for processing
These rights are set out fully here. You always have the right to complain to the Information Commissioners Office.
If you would like to see what information we hold about you, or exercise any of these rights, just contact us.
Where in the world does your information go?
Countries outside of the European Economic Area (EEA) do not always offer the same levels of protection to personal data, so European law has forbidden transfers of personal data outside of the EEA unless the transfer meets certain criteria.
We makes use of some third party service providers based in the United States so that processing of your personal data will involve a transfer of data outside the EEA. In order to protect you, such transfers only take place with providers who have signed up to the EU –US Privacy Shield: These are:
Google (provides Google Analytics on our website)
Mailchimp (newsletter / campaigns service)
EJC Education Consultancy operates in countries outside the EU, including the US and Russia. The GDPR does not apply to non-EU residents, but we process all client data in the same way, save that data for overseas clients will of course be transferred outside the EU in the process of our communication.
In the course of supporting students to make university applications outside the EU we may need to transmit personal data to organisations based outside the EU. We will do this as required for the performance of our contract with you, and on the basis that you understand that non-EU countries have different standards of protection for personal data, and you are content to assume the associated risk.