Privacy Notice
1. About this notice
This notice explains how First Class Support Ltd, collects, uses, shares, retains and protects personal information. It applies to students and other service users, support workers and applicants, employees and job applicants, institutional and professional contacts, website users and people who contact us.
For most activities described in this notice, First Class Support is the data controller and decides why and how personal information is used. In some arrangements, we process information on behalf of a university, college, employer, funding body or other organisation. Where we act only as a processor, that organisation is the controller and its privacy notice will provide the primary information about the processing.
2. Who we are and how to contact us
First Class Support, company number 09789560. Our registered data-protection fee reference is ZA186340.
Our contact details are:
Data Protection Lead: Business Operations Manager
Address: East Quay House, Sutton Harbour, Plymouth, Devon, PL4 0HX
Email: admin@firstclass-support.co.uk
Telephone: 01752 358641
3. The information we collect
The information we collect depends on your relationship with us and the services involved.
It may include:
• identity and contact information, including names, addresses, telephone numbers, email addresses, dates of birth and identifiers;
• education, course, institution, workplace, funding, referral and needs-assessment information;
• health, disability, access, communication and support-needs information;
• support records, including agreed support, session dates, attendance, engagement, support plans, progress information, notes, correspondence, feedback and complaints;
• financial and transactional information, including funding approvals, purchase orders, invoices, payment records, bank details and tax-related information;
• support-worker, applicant and employee information, including employment history, qualifications, professional memberships, references, training, availability, right-to-work evidence, background checks and performance or conduct records;
• safeguarding, incident, risk-management and emergency-contact information;
• institutional and professional contact information;
• telephone-call, email, SMS and other communications; and
• technical and website information, including IP address, device, browser, cookie and website-usage data.
Some of this information is special category data and requires additional protection. This includes information about health, disability, racial or ethnic origin, religious or philosophical beliefs, trade-union membership, sex life or sexual orientation. We may also process criminal-offence information where this is necessary and lawful, including information connected with appropriate background checks or safeguarding.
4. Where information comes from
We may obtain information directly from you and, where relevant, from:
• universities, colleges, employers, funding bodies and needs assessors;
• parents, carers, advocates or authorised representatives;
• support workers, employees and professional referees;
• professional bodies, disclosure and barring services and identity or right-to-work checking services;
• publicly available professional sources;
• our systems, portal and website; and
• other organisations where you have authorised disclosure or where disclosure is otherwise lawful.
5. Why we use information and our lawful bases
We only use personal information when we have a lawful basis. The bases used will depend on the purpose and our relationship with you.
| Purpose | Likely lawful basis |
|---|---|
| Arranging, delivering, monitoring and funding support services | Contract; steps before a contract; legal obligation; legitimate interests in delivering and administering services |
| Matching service users with suitable support workers | Contract; legitimate interests in providing safe, suitable and effective support |
| Communicating with service users, workers, institutions and professionals | Contract; legal obligation; legitimate interests in administering relationships and services |
| Recruitment, engagement and employment administration | Contract; steps before a contract; legal obligation; legitimate interests in workforce management |
| Payments, invoicing, accounting, audit and fraud prevention | Contract; legal obligation; legitimate interests; recognised legitimate interests where applicable |
| Quality assurance, service improvement, training and complaint handling | Legal obligation; legitimate interests in maintaining and improving services |
| Safeguarding, health and safety, risk management and emergencies | Legal obligation; vital interests; legitimate interests; recognised legitimate interests where applicable |
| Legal claims, regulatory requirements and enforcement of agreements | Legal obligation; legitimate interests in protecting legal rights |
| Website operation, security and essential cookies | Legitimate interests in operating and securing our website; consent where required |
| Optional marketing communications | Consent, or legitimate interests where permitted by data-protection and electronic-marketing law |
Where we rely on legitimate interests, we assess whether the processing is necessary and balance our interests against the rights and interests of the people affected. You may ask for further information about a legitimate interests assessment.
6. Special category and criminal offence information
In addition to an ordinary lawful basis, we must identify an additional legal condition before using special category information. Depending on the activity, we may rely on:
• explicit consent where consent is genuinely appropriate and can be freely withdrawn;
• employment, social security and social-protection law obligations and rights;
• vital interests where a person is physically or legally incapable of giving consent;
• the establishment, exercise or defence of legal claims;
• substantial public interest conditions, including supporting individuals with a particular disability or medical condition, counselling, safeguarding, preventing unlawful acts and meeting regulatory requirements; and
• health or social-care conditions where the legal requirements for relying on those conditions are met.
Where required by the Data Protection Act 2018, we maintain an appropriate policy document explaining our safeguards and retention arrangements. Criminal-offence information is only processed where authorised by law and subject to appropriate safeguards.
7. Who we share information with
We only share information where it is necessary, proportionate and lawful. Recipients may include:
• the university, college, employer, funding body, needs assessor or commissioning organisation connected with the service;
• support workers and other professionals involved in arranging or delivering support;
• employees and contractors who need the information for their role;
• IT, hosting, portal, CRM, communications, document-storage, payment, accounting, professional-advice and other service providers acting under appropriate contractual controls;
• professional, regulatory, accreditation, audit or insurance bodies;
• safeguarding partners, emergency services, healthcare professionals or local authorities where necessary to protect someone; and
• courts, law-enforcement bodies, regulators, government departments and other parties where disclosure is required or permitted by law.
We do not sell personal information.
8. International transfers
We aim to store and process personal information in the United Kingdom. Some suppliers may process information in other countries. Before making a restricted international transfer, we use an appropriate legal safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any necessary risk assessment and supplementary measures.
9. How long we keep information
We keep personal information only for as long as it is needed for the purpose for which it was collected and to meet legal, regulatory, contractual, safeguarding, audit and insurance requirements. Our Data Retention and Secure Disposal Policy sets out the standard periods that apply to different records.
Information may be retained for longer where a complaint, safeguarding concern, audit, investigation or legal claim is ongoing or reasonably anticipated. When information is no longer required, it is securely deleted, destroyed or anonymised.
10. Security
We use appropriate technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include role-based access, authentication controls, staff training, secure systems, confidentiality requirements, supplier checks, backups and incident-management procedures, as appropriate to the risk.
11. Your rights
Depending on the circumstances, you may have the right to:
• be informed about how your information is used;
• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion of information;
• request restriction of processing;
• object to processing, including direct marketing;
• receive information you provided in a portable format and ask for it to be transferred where the right applies;
• withdraw consent at any time where processing is based on consent; and
• not be subject to a decision based solely on automated processing where the legal conditions for that right apply.
These rights are not absolute and exemptions may apply. We may need to confirm your identity before acting on a request. We normally respond without undue delay and within one month, although the law permits an extension in certain circumstances.
To exercise a right, contact the Data Protection Lead using the details in section 2. You will not usually have to pay a fee.
12. Automated decision making
First Class Support does not currently make decisions that produce legal or similarly significant effects about individuals using solely automated processing. If this changes, we will provide the information and safeguards required by law before beginning that processing.
13. Data protection complaints
If you are concerned about how we have used your personal information, please contact the Data Protection Lead at admin@firstclass-support.co.uk or using the postal address in section 2. Please provide enough information for us to understand the concern and identify the relevant records.
We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate and tell you the outcome. Our general Complaints Policy may also apply where the concern relates to the service you received.
You also have the right to complain to the Information Commissioner’s Office. We would appreciate the opportunity to address your concern first, but this does not affect your right to contact the ICO.
Website: www.ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
14. Website and cookies
Our website may use essential cookies needed for operation and, subject to your choices, analytics or other non-essential cookies. Non-essential cookies will only be used where the required consent has been obtained. You can manage your preferences through the cookie controls made available on the website. Links to third-party websites are governed by those organisations’ own privacy information.
15. Children and young people
Our services may occasionally involve a person under 18. Where this applies, we take account of the person’s age, understanding and best interests, provide privacy information in an appropriate form and apply additional safeguards. Our website is not designed to collect personal information directly from children for marketing purposes.
16. Changes to this notice
We review this notice regularly and update it when our services, systems, suppliers or legal obligations change. The effective date and version number at the beginning of the notice show when it was last updated.