In this policy, the references to ‘we’ and ‘us’ are to Grofar Ltd (company number 09505988) . Our Data Protection Registration Number is ZA147283.
The Grofar Careers and Work placement solutions are governed by a contract between us and the schools, Multi-Academy Trust, College or a Local Education Authority (“Grofar Customer”), and also the Terms and Conditions that you agree with when you sign up via our website or email web forms (“Grofar User”).
We process your personal data for the following purposes:
If we plan to introduce further processes for the use of your information, we will provide information about that purpose prior to such processing.
Under Data Protection Law, there are various grounds which are considered to be a ‘legal basis for processing’. The legal basis for processing should be determined by the Data Controller.
Where we are the Data Processor, the legal basis is determined by the Customer. Typically, the legal basis in this scenario is:
Where we are the Data Controller, the legal basis for processing is based on:
It should be noted that in some circumstances this legal basis may vary, however, we always operate in full compliance with Data Protection Law and will only process data with a fair and reasonable legal basis for doing so.
The information we collect via our website, any sign-up forms or from a client school or college may include:
In the case of this third type of information detail can be found in the relevant product data sharing document. This data is provided by the school or college using the Groupcall XoD system, a CSV upload or an API. In all cases the school or college has full control of what data is shared and can change this consent at any time.
We use your personal information, and some of our employees have access to such information, only to the extent required to carry out the services for you and on behalf of the Customer.
We have introduced appropriate technical and organisational measures to protect the confidentiality, integrity and availability of your personal information during storage, processing and transit.
Some of our supporting services (for example Capsule CRM), might use cloud platforms that operate from Third Countries outside of the EEA. Where this is the case, we ensure that adequate safeguards are established to protect your data.
You have the right of access to your personal information that we process and details about that processing.
You can usually access that information directly within the Grofar Products and Services (self-service). However, should this not be possible, you can raise a Subject Access Request (SAR) to receive this information in another format.
You have the right to request that information is corrected if it’s inaccurate. You can usually update your own information using the Grofar Products and Services (self-service). However, should this not be possible the school or college will need to correct the data held by them and provided to us for processing.
You have the right to request that your information is removed; depending on the circumstances, we may or may not be obliged to action this request.
You have the right to object to the processing of your information; depending on the circumstances, we may or may not be obliged to action this request.
You have the right to request that we restrict the extent of our processing activities; depending on the circumstances, we may or may not be obliged to action this request.
You have the right to receive the personal data which you have provided to us in a structured, commonly used and machine-readable format suitable for transferring to another controller.
If you think we have infringed your privacy rights, you can lodge a complaint with the relevant supervisory authority. You can lodge your complaint in particular in the country where your live, your place of work or place where you believe we infringed your right(s).
You can exercise your rights be sending an e-mail to [email protected]. Please state clearly in the subject that your request concerns a privacy matter, and provide a clear description of your requirements.
Note: We may need to request additional information to verify your identity before we action your request.
We use a range of trusted service providers to help deliver our services. All of our suppliers are subject to appropriate safeguards, operating in accordance with our specific instructions and limitations, and in full compliance with Data Protection Law.
These service providers include:
We may also have access to your personal information as part of delivering the service.
If we need to change or add additional third parties, we will always update our Privacy Notice accordingly.
We will only disclose your information to other parties in the following limited circumstances
We will only retain information for as long as is necessary to deliver the service safely and securely. We may need to retain some records to maintain compliance with other applicable legislation – for example finance, taxation, fraud and money laundering law requires certain records to be retained for an extended duration, in some cases for up to seven years.
This policy will be reviewed regularly and updated versions will be posted on our websites.
All enquiries about individual Privacy or GDPR matters should be made to our Data Protection Officer. Please email [email protected]