Privacy Policy
Summary — what this policy covers
- Who we are and how to contact us.
- What personal data we collect and why.
- The legal basis on which we process your data.
- How long we keep your data.
- Who we share your data with.
- Your rights under UK GDPR.
- Cookies and how we use them.
- How to make a complaint.
1. Who we are
Learning for Change (‘Learning for Change’, ‘LfC’, ‘we’, ‘us’, or ‘our’) is a learning, skills and employment provider and social enterprise delivering English and digital skills programmes.
We are registered with the Information Commissioner’s Office (ICO) as a data controller.
Contact details for data matters
- Data Controller: Learning for Change
- Email: info@learningforchange.org
- Phone: +44 7762 913366
- Website: www.learningforchange.org
- ICO Registration Number: ZC145764
2. What personal data we collect
We collect personal data in the following circumstances:
2.1 When you enquire about or apply for a course
- Name, email address, and phone number.
- Your current English level or digital skills level (where you provide it).
- The course or programme you are interested in.
- How you heard about us.
- Any additional information you choose to include in a free-text field.
2.2 When you enrol on a course
- Full name, date of birth, and address.
- National Insurance number (where required for funded provision).
- Prior qualifications and employment status.
- Ethnicity, disability status, and other equality monitoring data (optional — used for statistical reporting only, never for eligibility decisions).
- Emergency contact details.
- Attendance, assessment, and progression records.
2.3 When you contact us directly
- Name and contact details provided in your message.
- The content of your enquiry.
2.4 When you apply to work or volunteer with us
- Name, contact details, and CV.
- Employment history and qualifications.
- References (with your permission).
2.5 When you use our website
- IP address and browser type (via cookies — see Section 8).
- Pages visited and time spent on the site (anonymised analytics).
3. Why we collect your data and our legal basis
| Purpose | Data used | Legal basis (UK GDPR) |
|---|---|---|
| Responding to course enquiries | Contact details, course interest | Legitimate interests |
| Processing course applications and enrolment | Personal, educational, and equality data | Contract / Legal obligation |
| Delivering and managing your course | Attendance, assessment, progression records | Contract |
| Reporting to funding bodies (e.g. ESFA, GLA) | ILR data including personal and equality data | Legal obligation |
| Sending course updates and information | Contact details | Legitimate interests / Consent |
| Processing bursary applications | Financial and personal circumstances | Legitimate interests |
| Recruitment and volunteer applications | CV, employment history | Legitimate interests |
| Improving our website and services | Anonymised analytics | Legitimate interests |
| Safeguarding | Relevant personal data where a concern arises | Legal obligation / Vital interests |
4. Special category data
Some of the data we collect is ‘special category’ data under UK GDPR — this includes ethnicity, disability status, and health information. We collect this data only:
- Where you choose to provide it for equality monitoring purposes.
- Where it is necessary for us to make reasonable adjustments to support your learning.
- Where it is required by a funding body as part of our statutory reporting obligations.
Special category data is treated with the highest level of care, accessed only by authorised staff, and never used for eligibility decisions.
5. How long we keep your data
| Type of data | Retention period |
|---|---|
| Course enquiry data (no enrolment) | 12 months from last contact, then deleted |
| Learner enrolment and ILR data | 6 years from end of funding year (ESFA requirement) |
| Assessment and qualification records | 6 years from date of award |
| Bursary application records | 6 years from date of award |
| Recruitment and volunteer applications (unsuccessful) | 6 months from decision, then deleted |
| Recruitment records (successful appointments) | Duration of employment/volunteering + 6 years |
| Website analytics data | 26 months (anonymised) |
| Financial records | 6 years (Companies Act requirement) |
6. Who we share your data with
We do not sell your personal data. We share it only where necessary:
Funding bodies and regulators
- Education and Skills Funding Agency (ESFA) — ILR data for funded provision.
- Greater London Authority (GLA) — where delivery is GLA-funded.
- Ofsted — on inspection, as required by law.
- Information Commissioner’s Office — in the event of a data breach, as required by law.
Awarding organisations
- Where you are registered for a qualification, your data is shared with the relevant awarding organisation (e.g. Cambridge Assessment English for CELTA, BCS for Digital Skills qualifications).
Technology and service providers
- Our website is hosted on HostGator. Our CRM system is HubSpot. We use Microsoft Teams for online delivery. These providers process data on our behalf under data processing agreements and are bound by UK GDPR.
- We use TranslatePress for website translation. No personal data is shared with translation services.
Employers (with your consent)
- Where you are enrolled on an employer-funded programme, we share relevant attendance and progress data with your employer. You will be informed of this at enrolment.
- We will never share your data with a prospective employer without your explicit consent.
Safeguarding
- Where we have a safeguarding concern, we may share relevant information with statutory authorities (e.g. local authority children’s services, adult safeguarding teams, or the police) without your consent, where required by law or where your safety or the safety of others is at risk.
7. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right of access — you can request a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct inaccurate or incomplete data.
- Right to erasure — you can ask us to delete your data, subject to our legal obligations to retain certain records.
- Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
- Right to data portability — you can ask us to provide your data in a structured, commonly used format.
- Right to object — you can object to processing based on legitimate interests.
- Right to withdraw consent — where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at: info@learningforchange.org
We will respond within one calendar month. If your request is complex or you have made multiple requests, we may extend this by a further two months, and will inform you accordingly.
8. Cookies
Our website uses cookies to improve your experience and to help us understand how the site is used.
Essential cookies
These are required for the website to function. They cannot be disabled. They include session cookies that keep you logged in and security cookies that protect the site.
Analytics cookies
We use anonymised analytics (via Google Analytics) to understand how visitors use the site. No personally identifiable information is collected. You can opt out of analytics cookies via the cookie banner when you first visit the site.
Translation cookies
TranslatePress sets a cookie to remember your language preference. This does not collect personal data.
You can manage or disable cookies in your browser settings at any time. Note that disabling essential cookies may affect the functionality of the site.
9. Data security
We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include:
- Password protection and role-based access controls for all systems holding personal data.
- Encrypted transmission of data via HTTPS.
- Regular review of data access permissions.
- Staff training on data protection and confidentiality.
In the event of a data breach that is likely to affect your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay.
10. International transfers
We do not routinely transfer personal data outside the UK. Where any of our service providers process data outside the UK (for example, in the USA), we ensure that appropriate safeguards are in place, including Standard Contractual Clauses or an adequacy decision by the UK Government.
11. Children and young people
Our courses are primarily for people aged 19 and over. Where we deliver provision for young people aged 16–18, we take additional care with their personal data and apply enhanced safeguarding procedures. We do not knowingly collect data from anyone under the age of 16 through our website.
12. Changes to this policy
We review this Privacy Policy regularly and will update it when our practices change or when required by law. The effective date at the top of this page will be updated accordingly. We will notify learners and staff of any significant changes.
13. How to make a complaint
If you have a concern about how we have handled your personal data, please contact us in the first instance at: info@learningforchange.org
If you are not satisfied with our response, you have the right to make a complaint to the Information Commissioner’s Office (ICO):
ICO contact details
- Website: www.ico.org.uk
- Phone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF