Reference Point Ltd (company number 02156356) ("We") are committed to protecting and respecting your privacy.
This notice sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. We keep certain basic information when you visit our website and recognise the importance of keeping that information secure and letting you know what we will do with it.
For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended and any regulations thereunder (“data protection legislation”):
- if you are an organisation (Booker or Provider or Industry Body) or individual Booker registering an account on CourseSight (Account) we are the data controller for any registration data you enter, information about your use of the system and our services and any correspondence we enter into with you;
- we are a data processor in respect of any data about individuals which such organisations provide to us and/or enter into CourseSight or which an individual Booker enters into CourseSight in order to book a Training Place – for example:
- in relation to Training Places you sell as Provider, the data in respect of individuals who are delegates on courses;
- in relation to Training Places you buy as an organisation Booker, the data in respect of individuals on behalf of whom you are booking a place;
- in relation to Training Places you book directly as an individual, your data you enter which we collect on behalf of the relevant organisation (which is the data controller)
This notice only applies to our site. If you leave our site via a link or otherwise, you will be subject to the notice of that website provider. We have no control over that notice or the terms of the website and you should check their notice before continuing to access the site.
If you are an individual delegate for whom an organisation Booker has booked a Training Place or an individual working for a Provider, details of how your personal data is processed should be available directly from the relevant organisation and/or on the Provider’s organisation page on this website.
Our Contact Details: Reference Point Limited, Shire House, West Common, Gerrards Cross, Buckinghamshire, SL9 7QN, +44 (0) 1753 279 927.
How we will use your personal information
We may collect information that you provide by filling in forms on our site or to gain access to our site. This includes information provided at the time of registering to use our site or requesting further services. We may also ask you for information when you report a problem with our site.
We may collect and process the following data about you and any course delegates you book Training Places for:
- When you book a Training Place, we will pass the following details about you and/or the delegate to the relevant Provider:
If you contact us, we may keep a record of that correspondence;
We may also ask you to complete surveys, although you do not have to respond to them;
Details of your visits to our site for system administration and to report aggregated information to Providers and Industry Bodies. This is statistical data about our users' browsing actions and patterns and use of CourseSight and does not identify any individual.
- email address;
- National Insurance number, if entered; and
- Other booking details
We use information held about you or course delegates for the following purposes and in the following ways:
- to ensure that content on CourseSight is presented in the most effective manner for you and for your computer;
- to provide you with information, products or services we believe may be of interest to you based on your use of CourseSight including courses;
- to carry out our obligations arising from the User Agreement entered into between you and us;
- to help enable Providers to manage Training Place bookings;
- to view and process that data to provide support to Training Providers, Organisation Bookers, Individual Bookers and Industry Bodies;
- to allow you to participate in interactive features of CourseSight, when you choose to do so;
- to notify you about changes to CourseSight;
- to maintain a record of Training Places that have been booked including for whom and by whom such places have been booked;
- to identify you / the delegate and cross reference your or their CourseSight account or registered details with any account you or the delegate or your or their employer has with us in connection with our suite of products which comprise databases of the holders (Cardholders) of construction and related industry smartcards. This suite of products includes but is not limited to SkillGuard, Validate and other client own-branded versions thereof. We may also pass such details to Providers so that they can identify and update training records for you / the relevant course delegate. We use information held about Cardholders in the manner set out in the terms and conditions and Privacy Notice for the particular product in question e.g. SkillGuard. We may also surface information about course outcomes including the qualifications achieved and the date they were achieved, where available, to anyone checking the delegate’s CSCS or compatible card online using the CSCS Go Smart apps or online card checker where the delegate’s card number was entered at the time of booking.
We may combine information held about you and/or Cardholders with other information we collect about you and/or Cardholders from other sources. We may use the combined information for the purposes set out above.
Credit or debit card information will not be stored or retained by CourseSight or Providers. All such data will be securely stored within the payment processor’s environment. For the avoidance of doubt, there may be occasions when a Booker calls us to book a Course and requests that we input credit or debit card information directly into payment processor Stripe’s system on their behalf but we do not record or retain these details in any circumstances.
The recipients or categories of recipients of personal data:
We will share your personal data with third parties where required by law or where we have another legitimate interest in doing so. We may disclose your personal information to third parties:
- In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
- to Training Providers, CSCS and other relevant construction and related industry card certification schemes for the purposes set out above.
- For e-learning courses only, we may pass the delegate’s name and e-mail address to Scorm Cloud (a service of Rustici Software LLC) which provides services facilitating the management of e-learning courses including the tracking of progress and recording of delegate outcomes.
- If we are under a duty to disclose or share your personal data in order to comply with any legal obligation to our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection.
We may disclose and make available information you give us about Cardholders to our sub-contractors in connection with the provision of our services to you.
Legal basis for processing:
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data to perform the contract we have entered into with you (Basis: Art 6(b) UK GDPR). We and any third parties with whom we share your personal data may also find it necessary to process your data for legitimate interests we pursue (Basis: Art 6(f) UK GDPR). For example, we may process your data for the legitimate interest of providing you with information, products or services we believe may be of interest to you based on your use of CourseSight including courses.
Where we store your personal data:
All information you provide to us is stored on our secure servers located in the UK.
We will not transfer any data that we collect or receive from you that constitutes personal data outside of the UK unless there are appropriate safeguards, the transfer is based on adequacy (decision or regulation), the data subject has enforceable rights and effective legal remedies or the transfer otherwise complies with the data protection legislation - such transfers may involve, for example, our use of third party services allowing us to send e-mails or automated SMS messages or facilitate the management of e-learning courses which make use of facilities in “third countries” to process data – except where a Booker (including an individual Booker) purchases a Training Place or Material Unit from a Provider based in the US or in other countries outside the UK which are not subject to an adequacy decision or regulation (“third countries”) and the Provider has agreed that it will incorporate the European Commission’s Standard Model Clauses for transfers of personal data outside the EEA (and any UK successor safeguard thereof) into the terms upon which it supplies Training Places and Material Units to you.
We will take all steps reasonably necessary to ensure that your data and any data relating to any course delegates you give us are treated securely and in accordance with our terms and conditions.
Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do what we reasonably can to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use reasonable procedures and security features to try to prevent unauthorised access.
Retention period and criteria used to determine the retention period:
Personal information collected will be retained for a maximum of 6 years. This retention period allows users returning to the site within this timeframe to view previous activity and continue to use the site without having to recreate their login or resupply their contact details. After this period, any identifying personal information held within CourseSight will be removed from existing user profiles and from any courses with which individuals are associated (as trainer or delegate). This time limit is set in line with the limitation period for possible legal claims which may require such data in order to be investigated and defended against. This retention period will apply from:
Delegates – from date of last course booked (whether by an employer or directly by the delegate themselves) or from last login date (whichever is the later)
Training Provider user accounts - from last login date (or from user profile creation date where no login has occurred)
Employer user accounts - from last login date (or from user profile creation date where no login has occurred)
Course Trainers – from date of last course linked to the trainer or from last login date (whichever is the later)
Encrypted backups: We will retain encrypted backup tapes containing personal data for a maximum of 3 years following deletion of your data from our database.
You have the right to:
- Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information (commonly known as “the right to be forgotten”). This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing.
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
Where our processing is based on your explicit consent to our processing, you have the right to withdraw such consent (this will not affect the lawfulness of processing prior to the withdrawal of your consent).
If you wish to exercise any of these rights please contact our Data Protection Officer at email@example.com.
Our site may, from time to time, contain links to and from the websites of our partner networks and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
Complaints to Information Commissioner: You have the right to lodge a complaint about our processing with the Information Commissioner.
Consequences of failure to provide personal data: Your provision of personal data to us is a requirement necessary for you to enter into a contract with us. If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you.
What are cookies?
A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer (or internet-enabled device) if you agree.
Cookies allow us to identify the computer or device you are using to access our website – but we cannot identify you personally. This information is sent back to our systems as you move around our website. Cookies are unique to the web browser you are using – so if you are using a desktop computer as well as a smart phone, different data will be collected for each.
Cookies we use
We use the following cookies:
Strictly necessary cookies: These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website and services.
Analytical/performance cookies: These allow us to recognise and count the number of visitors and to see how visitors move around our site when they are using it e.g. which pages are viewed by visitors most frequently. This helps us to improve the way our website and services work, for example, by ensuring that users are finding what they are looking for easily.
Functionality cookies. These are used to recognise you when you return to our site. This enables us to personalise our content for you and remember your preferences (for example, your choice of language or region).
We do not set targeting/advertising cookies. Cookies are not used in any Apps we provide.
Who sets cookies?
Cookies can be set by the owner of the website you are on. These are known as first party cookies. Please note that third parties may also set cookies of any type, over which we have no control – however, you can control them by managing your cookies (see below). Only the owner of the cookie can see the anonymous information it collects.
How can I manage cookies?
You may block cookies by activating the setting on your browser which allows you to refuse the setting of all or some cookies. However, if you select this setting you may be unable to access all or certain parts of our site.
You can find more information about cookies on the ICO Website ico.org.uk/global/cookies and you can find detailed information on how you can control cookies at AboutCookies.org
Changes to our privacy notice
Any changes we may make to our privacy notice in the future will be posted on the relevant page on our site and, where appropriate, notified to you by e-mail. However, we advise that you check on our site regularly to keep up to date with any necessary changes.