DSA STUDENTS

BEACON SUPPORT LTD.

Introduction

This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

Important information and who we are

Beacon Support Ltd, company registration number 10484873 of Cwmfelin Goitre Coed Road, Quakers Yard, Treharris, United Kingdom, CF46 5BB is the controller and is responsible for your personal data (collectively referred to as “Company”, “we”, “us” or “our” in this policy).

Contact details

Our full details are:

• Email address: admin@beaconsupport.co.uk

• Telephone number: 07831 516468

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues.

Changes to the privacy policy and your duty to inform us of changes

We keep our privacy policy under regular review. It may change and if it does, these changes will be posted on this page and, where appropriate, notified to you when you next log onto your Pathway student portal. The new policy may be displayed on-screen and you may be required to read and accept the changes to continue your use of the App or the Services.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.

Third party links

Our Sites may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. Please note that these websites and any services that may be accessible through them have their own privacy policies and that we do not accept any responsibility or liability for these policies or for any personal data that may be collected through these websites or services, such as Contact Data. Please check these policies before you submit any personal data to these websites or use these services.

The data we collect about you

We may collect, use, store and transfer different kinds of personal data about you as follows:

• Identity Data.

• Contact Data.

• Transaction Data.

• Content Data.

• Profile Data.

• Usage Data.

• Marketing and Communications Data.

We also collect or use the following special category information:

• Health information.

This is in order to ensure the services we provide are appropriate and specialist. This information is subject to additional protection due to its sensitive nature and may include details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, information about your health, and genetic and biometric data.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific service. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

We do not collect any information about criminal convictions and offences. We may collect Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, information about your health, and genetic and biometric data).

How is your personal data collected?

We will collect and process the following data about you:

• Information you give us. This is information (including Identity, Contact and Marketing and Communications Data) you consent to giving us about you by filling in feedback forms, or by corresponding with us (for example, by email or chat) or providing to us, or (where applicable) causing to be provided to us a copy of your DSA2 letter, Needs Assessment Report or during coaching sessions when notes will be drafted and retained. It includes information you provide when you report a problem with an App, our Services, or any of Our Sites. If you contact us, we will keep a record of that correspondence.

• Information we collect about you and your device. Each time you visit one of Our Sites or use one of our Apps we will automatically collect personal data including Device, Content and Usage Data. We collect this data using cookies and other similar technologies.

• Information we receive from other sources including third parties and publicly available sources. We may receive personal data about you from various third parties and public sources including Device Data from the following parties: analytics providers such as Google based outside the UK; advertising networks inside or outside the UK; and search information providers based inside or outside the UK.

Cookies

We use cookies to distinguish you from other users of the App, App Site, the distribution platform (Appstore) or Services Sites and to remember your preferences. This helps us to provide you with a good experience when you use the App or browse any of Our Sites and also allows us to improve the App and Our Sites.

Our Sites may place and access certain first party Cookies on your computer or device. First party Cookies are those placed directly by Us and are used only by Us. We use Cookies to facilitate and improve your experience of Our Sites and to provide and improve Our products/services. We have carefully chosen these Cookies and have taken steps to ensure that your privacy and personal data is protected and respected at all times.

By using Our Sites you may also receive certain third party Cookies on your computer or device. Third party Cookies are those placed by websites, services, and/or parties other than Us. Third party Cookies are used on Our Sites for advertising purposes and providing marketing analytical information. For more details, please refer to section 6, above, and to section 13.6 below. These Cookies are not integral to the functioning of Our Sites and your use and experience of Our Sites will not be impaired by refusing consent to them.

All Cookies used by and on Our Sites are used in accordance with current Cookie Law.

Before third party Cookies that use your personal data are placed on your computer or device, you will be shown a popup requesting your consent to set those Cookies. By giving your consent to the placing of Cookies you are enabling Us to provide the best possible experience and service to you. You may, if you wish, deny consent to the placing of Cookies; however certain features of Our Sites may not function fully or as intended. You will be given the opportunity to allow only first party Cookies and block third party Cookies which use your personal data.

Certain features of Our Sites depend on Cookies to function. Cookie Law deems these Cookies to be “strictly necessary”. These Cookies are shown below in section 13.6. Your consent will not be sought to place these Cookies, but it is still important that you are aware of them. You may still block these Cookies by changing your internet browser’s settings as detailed below in section 13.10, but please be aware that Our Sites may not work properly if you do so. We have taken great care to ensure that your privacy is not at risk by allowing them.

The following first party Cookies may be placed on your computer or device:

• A control cookie to allow us to block other optional cookies

• Cookies to assist with the functionality of the website, such as remembering the contents of your basket, if you’ve logged into the website, language, currency and other similar preferences and the following third party Cookies may be placed on your computer or device:

• Google Analytics – Anonymous Data Collection

• Facebook Pixel

• Google Conversion/Remarketing

Our Sites use analytics services provided by Google Analytics. Website analytics refers to a set of tools used to collect and analyse anonymous usage information, enabling Us to better understand how Our Sites is used. This, in turn, enables Us to improve Our Sites and the products/services offered through it. You do not have to allow Us to use these Cookies, however whilst Our use of them does not pose any risk to your privacy or your safe use of Our Sites, it does enable Us to continually improve Our Sites, making it a better and more useful experience for you.

In addition to the controls that We provide, you can choose to enable or disable Cookies in your internet browser. Most internet browsers also enable you to choose whether you wish to disable all cookies or only third party Cookies. By default, most internet browsers accept Cookies but this can be changed. For further details, please consult the help menu in your internet browser or the documentation that came with your device.

You can choose to delete Cookies on your computer or device at any time, however you may lose any information that enables you to access Our Sites more quickly and efficiently including, but not limited to, login and personalisation settings.

It is recommended that you keep your internet browser and operating system up-to-date and that you consult the help and guidance provided by the developer of your internet browser and manufacturer of your computer or device if you are unsure about adjusting your privacy settings.

How we use your personal data

We will only use your personal data when the law allows us to do so. Most commonly we will use your personal data in the following circumstances:

• Where you have consented before the processing.

• Where we need to perform a contract we are about to enter or have entered with you or a third party who is contracting with us on your behalf.

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

• Where we need to comply with a legal or regulatory obligation.

We will only send you direct marketing communications by email or text if we have your consent. You have the right to withdraw that consent at any time by contacting us.

Special Categories of Personal Data

Where Special Categories of Personal Data is processed this is done to tailor advice to you about your disability, assist in support/coaching sessions and assist with delivering educational advice to you including wellbeing mentoring. The lawful processing basis for processing such data relating to health is that it is necessary for the performance of a contract with the Data Subject (Article 6(1)(b), Data Protection Act 2018). The processing condition for Special Categories of Personal Data is that it is necessary for the purposes of health or social care purposes (Paragraph 2, Schedule 1, DPA 2018.)

Disclosures of your personal data

When you consent to providing us with your personal data, we will also ask you for your consent to share your personal data with the third parties set out below for the purposes set out in the table:

• External Third Parties as set out in the Glossary.

• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

Sharing information outside of the UK

AWS hosts Our App ‘Pathway’ which is our operational platform used to store and process your personal information and to facilitate in the delivery of support sessions. The GDPR-compliant AWS DPA incorporates the commitments of AWS as a data processor. In doing so AWS makes sure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above

AWS’s privacy policy is available to access online: https://aws.amazon.com/privacy/

Monday.com is also used to store and process your personal information.Monday.com is headquartered in Israel, a jurisdiction that is considered by the European Commission, the UK Secretary of State and the Swiss Federal Data Protection and Information Commissioner (FDPIC) as affording an “adequate” level of protection for personal data originating from the EEA, UK and Switzerland, respectively. Accordingly, transfers of personal data from Europe to monday.com Israel are done in reliance on this “adequacy” status as a lawful transfer mechanism, without the need for additional safeguards.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above

Monday’s privacy policy is available to access online: https://monday.com/l/privacy/privacy-policy/

Data security

All information you provide to us is stored on our secure servers. Where we have given you (or where you have chosen) a password that enables you to access certain parts of Our Sites, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Once we have received your information, we will use strict procedures and security features to try to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator when we are legally required to do so.

Data retention

We take the security of Special Categories of Personal Data very seriously. We have administrative, physical and technical safeguards in place to protect Personal Data against unlawful or unauthorised Processing, or accidental loss or damage. We will ensure, where Special Categories of Personal are Processed that:

(a) The Processing is recorded, and the record sets out, where possible, a suitable time period for the safe and permanent erasure of the different categories of data in accordance with our Data Retention Policy.

(b) Where we no longer require Special Categories of Personal Data for the purpose for which it was collected, we will delete it or render it permanently anonymous as soon as possible.

(c) Where records are destroyed we will ensure that they are safely and permanently disposed of.

By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes and for the purposes of asserting our rights and/or defending our position in respect of any legal action.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint