The General Data Protection Regulation (GDPR) / Data Protection Act 2018
The GDPR came into force on 25th May 2018 and the Data Protection Act 2018 is the UK's implementation of it. This page is to tell you what EduCare Learning Ltd has in place to ensure we remain fully compliant.
Questions |
Comments |
| Name of Supplier | |
| Is EduCare a Data Controller? | Yes |
| Is EduCare a Data Processor? | Yes |
| Does EduCare have a Data Protection Officer? | No. Due to the nature of EduCare’s service and data management, there is no requirement for this post. |
| Who is the senior person responsible for information security and data protection at EduCare? |
Information security and data protection is a standing agenda item for EduCare Board Meetings. |
| Who is the senior person with overall responsibility for security at EduCare? | |
| What service is EduCare providing? | EduCare provides customers with licensed access to its Online Learning Service – www.myeducare.co.uk - whereby learners can gain essential knowledge on a wide variety of duty of care and safeguarding topics. Learners complete training modules and answer corresponding questionnaires with access to additional learning resources to support the learning. Downloadable personalised certificates evidence course completion and confirm the CPD credits achieved. The robust reporting suite provides organisations with learner status reports on training progress and completions. |
| In providing this service, is EduCare processing personal data belonging to its customers? |
Yes. The organisation data (organisation name, address, URL, key business and contact information) is stored securely on EduCare’s Customer Relationship Management (CRM) system for the purpose of managing the relationship and service, ensuring satisfaction and awareness of products and developments. The organisation’s individual learner data (first/last name and email) is stored on EduCare’s Learner Management System (LMS) to enable learners to access the LMS, complete courses, questionnaires, access resources, record learning progress and download personalised certificates. |
| Does EduCare process sensitive special category data? | No. |
| What security standards does EduCare have in place to keep personal data secure? |
We take customers’ privacy and security very seriously.
EduCare’s robust quality processes meet the ISO 9001:2015 British Standards Institute. To achieve the above standards, EduCare has:
|
| What policies and procedures are in place and how does EduCare ensure they are followed? |
Our policies
|
| How often are EduCare policies and procedures reviewed? | Annually. |
| Does EduCare appoint other companies or organisations to process personal data? |
Yes. EduCare works with external third-party service providers to support and host the LMS, the IT infrastructure and website, plus professional services such as accountants, auditors and marketing agencies who assist us in carrying out business activities. EduCare carries out due diligence on third-party suppliers related to their position on GDPR. All our systems are located Access to organisation data and individual learner data is only allowed when required by law. We do not, and will never, sell your personal information with third parties for marketing purposes. EduCare Learning Ltd may contact you via email to invite you to review any services and/or products you received from us in order to collect your feedback and improve our services and products (the “Purpose”). We use an external company, Trustpilot A/S (“Trustpilot”), to collect your feedback which means that we will share your name, email address and reference number with Trustpilot for the Purpose. If you want to read more about how Trustpilot process your data, you can find their Privacy Policy here. EduCare Learning Ltd may also use such reviews in other promotional material and media for our advertising and promotional purposes. |
| Does EduCare ever transfer personal data outside the UK? If so, please specify where. | We may process some data outside of the EU. Our LMS stores data with Amazon Web Services (AWS) and they meet the EU-US Privacy Shield framework adopted by the European Commission. This complies with data protection requirements and GDPR legislation when transferring data outside of the EU. For more information, please see here. |
| Who has access to the data regarding customer data subjects? | Our customer services team have access to the data for the purpose of service set-up, training and to support learners with day-to-day needs. Our LMS stores data with Amazon Web Services (AWS) and they meet the EU-US Privacy Shield framework adopted by the European Commission. We have suppliers who support and develop our systems, but they do not process any data. All EduCare third-party suppliers are GDPR compliant or are working towards it. |
| Does EduCare have signed contracts and statements of works between the data controller, data processor and third parties? | Yes. Contracts are reviewed annually, or when renegotiating continuity of service. |
| Does EduCare, as the data processor, have a written contract? |
Yes. The agreement and Service Level Agreement (SLA) form part of EduCare’s quotation process, which customers agree when finalising the sale. Please also view EduCare’s general terms and conditions here. These would have been signposted to you and agreed at the point of quotation and service delivery. |
| How is this data gathered? |
Learner data is currently uploaded via CSV file with our customer services team. The purpose of the CSV file is to enable our staff to upload your learners to the LMS so they can start their training. Once this upload is completed, the CSV is securely stored on our Customer Relationship Management system for record keeping and future amendments. CSV files can be encrypted on customer request. |
| How does EduCare ensure consent for the data’s use has been obtained by the Data Controller? | When the customer confirms their agreement to purchase the service from EduCare, consent is agreed between the parties at this stage, as mentioned in the T&Cs. |
| How will data be provided in response to |
A subject access request will follow our internal process and be responded to within the period required by law. Please view our privacy statement here. |
| What happens to personal data when the service contract ends? |
EduCare
|
.jpg)
