This Privacy Notice is dated 16 November 2023.
The QA group of companies (“QA”, “we”, “our” or “us”) are committed to ensuring that your privacy is protected. This Privacy Notice describes how we use the personal information that we collect from you, or that you provide, when you:
QA may act as:
within our relationship depending on the nature of services that we are providing to you.
Please read this notice carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.
We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR). We are also subject to the EU General Data Protection Regulation (EU GDPR) in relation to services we offer to individuals and our wider operations, as applicable, in the European Economic Area (EEA). We may also be subject to other rules and regulations pending the services we offer in other countries.
We collect personal information from you:
Generally, the personal data we collect about you depends upon the particular services we provide to you. It may include, although is not limited to:
Certain personal data is considered to be more sensitive and is treated as a special category to which additional protections apply under data protection law. Special category data includes information about your racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, biometric or genetic data. Special Category data is dealt with in more detail below.
We collect this information for the purposes described in this privacy notice.
When you visit our Websites, we may collect certain information automatically from your device. The information we collect automatically may include information like your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g. country or city-level location) and other technical information. We may also collect information about how your device has interacted with our Website, including the pages accessed and links clicked.
Collecting this information enables us to better understand the visitors who come to our Website, where they come from, and what content on our Website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Website to our visitors.
Some of this information may be collected using cookies and similar tracking technology, as explained further under the heading ‘Cookies’, below.
We may receive personal information about you from third party sources (such as your employer or other third parties if they enrol you on a course or create an account on your behalf), or agencies if you apply for study or employment, but only where we believe that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us. We collect only the minimum amount of information required from these third parties to enable us to provide the requested service or process any application you send to us (for example, your educational or employment history). We only use the information we receive from these third parties as set out in this Privacy Notice.
The information that we collect and store relating to you is primarily used to enable us to provide our Services to you. In addition, we may use the information for the following purposes:
We may also monitor or record telephone calls for training, customer service and quality assurance purposes, and to detect or prevent crime. These recordings will be retained for a maximum of 6 months.
In general, we will use the information we collect from you for the purposes described in this Privacy Notice or for purposes that we explain to you at the time we collect such information. However, we may also use your personal information for other purposes that are not incompatible with the purposes we have disclosed to you (such as statistical purposes and research purposes) if and where this is permitted by applicable data protection laws.
We set out below the grounds on which it may be necessary for us to process your personal data:
There may be circumstances in which we ask for your consent to process data. For example, if you do not want us to use your data for any marketing purposes, you will have the opportunity to withhold your consent to this when you provide your details to us.
Consent can be varied online via our consent portal at cp.qa.com.
Special category data and criminal conviction data require a higher level of protection under data protection laws. Where we process special category data, we will also ensure we are:
Sometimes there may be exceptional reasons for processing this data, for example when protecting your vital interests or for safeguarding purposes. In these circumstances it may be necessary to share data with third parties, even where the data has been provided in confidence (data in these instances would be subjected to minimisation, recipients of such data would be limited to those people or agencies able to assist). For example, where there is a serious risk to your health, data may need to be shared with the NHS or emergency services.
Listed below are some examples of processing activities that we regularly undertake in terms of special category data:
Heath (including disabilities)
We will process data about your health where it is:
Racial or ethnic origin, sexual orientation, and religion and beliefs
This data may be processed by us with your consent, in accordance with the terms of our contract with you, to protect our legitimate interests, in order to meet our statutory obligations under equality or other legislation and/or to comply with legal obligations relevant to any of our procedures, for example, investigating an allegation of racial discrimination. If the outcome of such a procedure is referred to a regulatory body, this processing will be subject to suitable safeguarding and is considered to meet a substantial public interest.
Criminal conduct (including convictions, proceedings or allegations)
Relevant criminal convictions data may be collected when you are applying for a course and are offered a place. For certain courses we are legally required to collect barring decision information. This will only be collected once you have applied for and been accepted on to such a course. We may also process data about criminal conduct while you are on a course. Processing of criminal conduct data may be carried out in accordance with the terms of our contract with you, in order to protect our legitimate interests and in order to meet our legal obligations. Any processing of this nature will be subject to suitable safeguards.
In order to process special category data we may need your explicit consent. In certain circumstances if you do not provide or if you withdraw your consent we may be unable to provide our Services to you. For example, where you require reasonable adjustments for examinations if we do not have your consent to process health data we cannot provided the service.
If at any time you want to vary your consent in relation to our processing of special category data you can do so via our consent portal at cp.qa.com.
The personal information you provided to us is stored within secure servers. We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information.
All QA email addresses support TLS email encryption, so it is advised that if you are concerned about the contents of any email to use this encryption.
Where we have given you (or where you have chosen) a password so that you can access certain parts of our sites and portals, you are responsible for keeping these passwords confidential.
Please note that the transmission of information via the internet (including email) is not completely secure and therefore, although we endeavour to protect the personal information you provide to us, we cannot guarantee the security of data sent to us electronically and the transmission of such data is therefore entirely at your own risk. We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).
When we have no ongoing legitimate business or statutory need to process your personal information, we will either delete or anonymise it.
If however, you would like your record deleted please send an email to QAHE.Marketing@qa.com and we will be more than happy to remove your data unless this not possible due to i) fulfilling any contractual obligations owed to you; ii) complying with our legal obligations; or iii) for our own legitimate interests.
We may disclose your personal information to any company within our corporate group. This includes, where applicable, our subsidiaries, our holding company and its subsidiaries. This will only be done where lawful bases exists.
We will also disclose, where required, your personal information with:
Where you are a customer or prospective customer, we may disclose your data to third parties for our marketing purposes so that we can identify products and services we think you will be interested in. Personal data used in this way may include contact details such as name, address, phone number, and email address. When sharing with third party marketing organisations, your data may be processed in countries inside or outside of the European Economic Area (EEA).
It is important that the personal information that we hold and which you provide to us is accurate and current. This is your responsibility to check and ensure we have the most up-date-date on our records.
You might find links to third party websites on our Websites or within documentation we provide.
If you access other websites using the links provided, the operators of these sites may collect information from you which will be used by them in accordance with their own Privacy Notices which you should review.
We do not accept any responsibility or liability for their policies whatsoever as we have no control over them.
The Website may offer you the opportunity to share or follow information about us (or the Website or our Services) using third party social networking functionality (such as through share this”, “like” or “follow” buttons).
We offer this functionality in order to generate interest in us, the Website and our Services among the members of your social networks, and to permit you to share and follow opinions, news and recommendations about us with your friends. However, you should be aware that sharing personal or non-personal information with a social network may result in that information being collected by the social network provider or result in that information being made publicly available, including through Internet search engines.
Please note that we do not exercise, endorse, secure or control the policies or practices of any third party social network whose functionality you may access through the Website.
You should always carefully read the Privacy Notice of any social network through which you share information in order to understand their specific privacy and information usage practices.
For some of our Services, your personal information may be transferred to, and processed in, countries outside of the EEA. However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Notice. These measures include transferring your personal data to third parties who are located in a country which the European Commission has determined has data protection laws that are at least as protective as those in Europe, and transferring your personal data to third parties who have entered into standard contractual clauses with us. For more information about these safeguards please contact us using the contact details provided below.
We are conscious of our requirements as of March 2022 in relation to international data transfers and seek to implement a risk assessment with respect to international transfers of personal data, either in accordance with EU Standard Contractual clauses with the additional of the UK addendum or the International Data Transfer Agreement; in each scenario to seek compliance with law and regulation.
Our lawful bases for collecting and using personal information will depend on the personal information being collected and the specific context in which we collect it.
However, we will normally collect personal information from you only:
A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. We carry out an assessment when relying on legitimate interests, to balance our interests against your own.
In respect of data processed within COVID-19 frameworks;
In some cases, we may also have a legal obligation to collect personal information from you.
If we ask you to provide personal information to comply with a legal requirement or to perform a contact with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).
If we collect and use your personal information in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our platform and communicating with you as necessary to provide our services to you and for our legitimate commercial interest, for instance, when responding to your queries, improving our platform, undertaking marketing, or for the purposes of detecting or preventing illegal activities. We may have other legitimate interests and if appropriate we will make clear to you at the relevant time what those legitimate interests are.
If you have questions about or need further information concerning the lawful bases on which we collect and use your personal information, please contact us using the contact details provided below.
We will use your personal data to send you updates (by email, text message, telephone or post) about our services including exclusive offers, promotions or new services.
We have a legitimate interest in using your personal data for marketing purposes. This means we do not usually need your consent to send you marketing information. If we change our marketing approach in the future so that consent is needed, we will ask for this separately and clearly.
You have the right to opt-out of receiving marketing communications at any time by:
We may ask you to confirm or update your marketing preferences if you ask us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.
We will always treat your personal data with the utmost respect and never sell it to other organisations outside the QA group including for marketing purposes.
We only allow certain organisations to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on them to ensure they can only use your personal data to provide services to us and to you.
We or these third parties occasionally also share personal data with:
You have the following data protection rights:
We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.
The data controller of your personal information will be the QA group entity that you are dealing with, and as such will be one of the following:
We welcome any queries, comments or requests you may have regarding this Privacy Notice. Please do not hesitate to contact us, or our DPO, via email at: QAHE.Marketing@qa.com
For our Degree and Higher Apprenticeship provision:
The registered office and postal address for all is International House, 1 St Katharine’s Way, London, E1W 1UN
We may change this Privacy Notice from time to time by updating this document. The online version is available at: https://qahighereducation.com/privacy-notice/.
You should check this page from time to time to ensure that you are happy with any changes.
If material changes are made to this Privacy Notice, we will notify you by placing a prominent notice on the Website or by contacting you to let you know via the contact details you have provided us with.