Privacy Policy

1.1 Policy Owner

The policy owner is the Board of Directors.

This privacy notice aims to provide information and transparency regarding Cenit College UK’s data protection obligations to comply with data protection regulations, including the UK General Data Protection Regulation (GDPR), Data Protection Act 2018. It applies to data collected and stored for all learners and other stakeholders. 

This privacy notice applies to processing activities concerning personal and sensitive data carried out by Cenit College UK in the normal course of its business. 

The following personnel are responsible for Data Management within Cenit College UK.

Role

Responsibility

Board of Directors

Overall responsibility for Data Management within Cenit College UK.

Management Committee

Responsibility to execute the policy.

Head of Finance

Maintaining all financial records.

Staff

Ensuring compliance in their respective roles and duties.

Director of Technology

  • maintaining our server where data is held, i.e., security, configuration and maintenance. 
  • Back-up(s) 
  • VLE and storage of data 
  • Monitor the IT environment and perform regular maintenance checks 

Head of Training

Responsible for preparing reports.

Examinations Officer

Transferring results into the awarding body’s system.

Head of Quality 

Responsible for all data concerning the quality assurance of Cenit College UK activities.

Data Protection Manager (DPM)

We have appointed a Data Protection Manager who has the following responsibilities:

• to inform and advise Cenit College UK and the employees who carry out processing of their obligations according to UK GDPR and to other data protection legislation.

• Monitor compliance with the UK GDPR, other data protection legislation, and the policies of Cenit College UK concerning the protection of personal data, including the assignment of responsibilities, awareness-raising, and training of staff involved in processing operations, as well as related audits.
• To provide advice, where requested, as regards data protection impact assessment (DPIA) and to monitor their performance according to Article 35 of the GDPR.
• To cooperate with the Information Commission (IC).
• To act as a contact point for the Information Commission (IC) on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where
appropriate, regarding any other matter.
• To liaise with the Information Commissioner (IC) regarding personal data breaches, when requested by Cenit College UK. In performing their tasks, they consider the risk associated with processing operations and the nature, scope, context, and purposes of processing.

Data Protection Officer (Seetec)

Provides specialist data protection support and guidance to the Data Protection Manager and Director of Technology, including assisting with the review and update of data protection policies, procedures and related documentation; advising on GDPR and data protection compliance matters; supporting responses to data subject rights requests, breaches and regulatory queries where required; and helping to ensure Cenit College UK’s data protection practices remain aligned with group requirements and current legislation.

This Privacy Notice explains what personal data Cenit College UK collects, why it is collected, who it may be shared with, how long it is kept, and how individuals can exercise their data protection rights. It applies to learners, website visitors, job applicants, suppliers, client partners and other individuals whose personal data may be processed by Cenit College UK. This notice is to be displayed on our websites and all relevant external sites. 

Cenit College UK is committed to data security and the lawful, fair and transparent processing of personal data.  This privacy notice sets out how we manage and protect your personal data in compliance with applicable data protection law, including the UK/EU General Data Protection Regulation (EU) 2016/679.   

It explains how and why we collect, store, use and share (process) personal data, how to contact us and the supervisory authority should you need further information or wish to report a concern about the way in which we process your data. 

We will never sell your personal data to third parties. 

Cenit College UK Ltd.
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

Company Registration No: 15635921

For the purposes of GDPR, Cenit College UK Ltd may act in the capacity of Controller or Processor when processing your personal data.

Visitors to our website 

When visiting our website, you can select and save your cookie preferences on the home page.  We use essential cookies, which are necessary for the operation and security of our website, as well as optional performance and advertising cookies.  

For details of the types and functionality of the cookies and the information we collect https://www.cenitcollege.co.uk/cookie-overview/ 

Enquiries  

We collect your contact details, content and copies of your communications with us by email and telephone, or when you complete our Contact Us or Enquiry form.    

We use your personal and contact information to respond to enquiries and to manage our relationship with you 

Recruitment 

When you apply for a vacancy we will obtain your name, address, email address, telephone number(s), employment history, details of your qualifications and your CV.   

We will also retain details (and copies) of your communications and interactions with us via our recruitment team or otherwise, including by email, telephone and post. 

We will record details of the documents you provide as proof of identity, such as a driving licence and a passport, required as part of the recruitment process, or where there is a legal reason to request this from you. 

(Cenit College UK acts as a controller in respect of the personal data of our employees.  Employee data is processed in compliance with employment laws to meet our legal obligations as an employer.  Further information is provided in our Employee Privacy Notice. 

Suppliers and Client Partners 

We collect personal and contact information when you contact us online or apply to join our preferred supplier list.  The information we collect will include the name of the company contact, their job title, company details, email address, and telephone number(s). 

Depending on the service you provide, we may also collect: VAT registration number, bank details, UTR number (if applicable) and credit references. 

Details (and copies) of communications and interactions between us, by email, telephone, post or via our website, including through our Shared Services teams (including Finance). 

Information about how you use our website, and if applicable, which websites you were redirected from. For more information, see the Visitors to our website page. 

We may receive personal data directly from you or from various third parties and public sources, including from social media channels (if you interact with us through those channels). 

Commercial Activity  

Cenit College UK also acts as a Controller for certain commercial activities. This includes, but is not limited to: 

  • Direct course enrolments by individuals or employers 
  • Marketing and promotional communications 
  • Customer relationship management 
  • Internal analytics and service improvement 

In these cases, Cenit College UK determines the purpose and means of processing personal data.   We collect and process this data under the lawful bases of contract, legitimate interest, or consent, depending on the nature of the interaction. 

Skills Bootcamp Courses 

When delivering courses on behalf of commissioners, such as the Department for Education, for our Skills Bootcamp courses, Cenit College UK will act as a processor.  We process personal data in accordance with their instructions.   

Personal information we may collect

  • Title 
  • Name 
  • Email address 
  • Phone number 
  • Address 
  • Post code 
  • Date of birth 
  • Age 
  • Gender 
  • National insurance number 
  • Carer status 
  • Emergency contact name, relationship and phone number 
  • Record of previous qualifications 
  • Employment status 
  • Name of employer 
  • Workplace postcode 
  • Job title 
  • Job industry 
  • Hours worked per week 
  • Salary 
  • Benefits received 

Special Category Data 

We may collect special category data based on contractual requirements from our commissioners, which for Skills Bootcamp may include: 

  • Ethnic group 
  • Criminal conviction status 
  • Disability, learning difficulty or long-term health conditions 

For further information, please refer to the DfE privacy notice.  https://www.cenitcollege.co.uk/wp-content/uploads/2026/08/dfe-privacy-notice-for-skills-bootcamps.pdf  

Why do we collect your personal information (Lawful Basis) 

  • To enable us to meet our contractual obligations with our clients or commissioners when you enrol on a training or apprenticeship programme (performance of a contract)  
  • Where you have provided our commissioners with your explicit consent to process your special category data. 
  • Where you have provided consent on our website in relation to cookies. 
  • Where you have provided your consent to receive marketing information 
  • We may share your details with potential employers if you provide us with your consent to do so.   
  • To respond to any communications which we may receive from you – legitimate interest. 
  • We will also use your data when recording lessons – legitimate interest. 

You can withdraw consent at any time by emailing dataprotection@cenitcollege.co.uk 

Video Conferencing and recording of online lessons 

To enable video conferences and online lessons or meetings in the context of increased flexible and remote working, Cenit College UK will use the approved Microsoft Teams and Zoom, which have recording capabilities.  

To enhance the learning experience, learners are encouraged to keep their cameras on during online training sessions. Sessions may be recorded for educational purposes, and learners will be notified before recording begins. Recorded sessions will be securely stored and only available to participants on the course through our learning platform (Moodle).  

  1. How do we collect your personal information 

When you: 

  • Use or view our website via your browser. 
  • Complete our Contact Us or Enquiry Form and/or Course Application form 
  • CCTV images may be captured when visiting some of our locations 

How will we use your data? 

We will use your information to 

  • Process your enquiry and application for a course 
  • To manage the delivery of the course 
  • Provide potential employers with your details for job applications 
  • Online lessons may be recorded  

We process personal data to provide administrative and support services to our learners.  Additionally, we process personal data because it is necessary for the performance of a contract or to take steps at an individual’s request prior to entering a contract. For example, this may include interacting with individuals before they are enrolled as a learner as part of the onboarding process. 

How do we store your data? 

cenitcollege.co.uk, my.cenitcollege.co.uk and www.cenitsys.co.uk are hosted on a secure dedicated server with multiple levels of hardware redundancy (RAID) within the UK/EEA. This provides the best performance and server uptime for learners. We may need to undertake routine maintenance from time to time, resulting in our websites going offline for a period (typically a few minutes) or for more non-routine maintenance, where there is hardware failure (usually an hour). 

In the event of a scheduled upgrade to the Moodle platform, a banner message will be posted on the Cenit College UK Moodle platform (my.cenitcollege.co.uk) advising of the upgrade date and time and its estimated duration. In the event of a full outage of the Moodle platform, a banner message will be posted on the Cenit College UK website advising of the estimated duration of the outage. 

We follow industry standards for information security management and the safeguarding of sensitive information. Our information security systems apply to people, processes, and information technology systems on a risk-management basis.  Our security controls are designed to maintain the confidentiality, integrity, and Availability of personal information at all times.  

We have technical measures in place, such as password complexity requirements, antivirus and antimalware software, firewalls, encryption, and multifactor authentication. 

We conduct regular audits and tests to ensure the security of your information. 

No method of internet transmission or electronic storage is 100% secure. Therefore, we cannot 100% guarantee the absolute security of your personal information. Although we take all necessary security measures, we remain as proactive as possible. 

Therefore, we cannot 100% guarantee your personal information’s absolute security. Although we take all the security measures, we ensure we are as proactive as possible.

Where necessary, we may transfer personal information outside the UK, but it will remain within the EEA. When doing so, we comply with the UK GDPR and EU GDPR, ensuring appropriate safeguards are in place.  

We will only keep your personal data for as long as necessary. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. 

Where Cenit College UK is the Processor, we will keep your data for the retention period specified by the Controller (e.g., 7 years for Skills Bootcamp courses, as per DfE guidelines).   

At the end of the retention period, personal data will be returned to the Controller (e.g. DfE) if requested, deleted or anonymised (so that it can no longer be associated with you) for research or statistical purposes.  

In some circumstances, you may be entitled to ask us to delete your data: see Data Subject Rights below for further information. 

This will depend on our relationship with you  

Learners: 

We may share personal data in the following circumstances: 

  • With commissioning bodies (e.g. DfE, SOLAS and other funding bodies)
  • With the Office for Standards in Education, Children’s Services and Skills (Ofsted) 
  • With third parties for the purchase of licences for course materials, etc. (e.g. uCertify). 
  • With certifying/awarding bodies (e.g. Digital Marketing Institute, ILM, Certiport) for the purposes of examination registration and assessment. 
  • With content providers, such as ICDL, PeopleCert, MeasureUP, Percipio  
  • Cloud and external providers of software systems, IT solutions and services used by the group, such as Adobe Creative Cloud, Microsoft Office. 
  • Professional advisers, including lawyers, bankers, auditors, and insurers, for the purposes of providing consultancy, legal, insurance and accounting services. 
  • Police or other such regulatory authority, as part of an investigation or otherwise, for legal or regulatory purposes.

Job Applicants: 

We may share personal data in the following circumstances: 

  • As a successful applicant, with external pension, vetting and business support services, as part of your contract of employment and our legal obligations.  (Further information is provided in our Employee Privacy Notice. 
  • Cloud and external providers of software systems, IT solutions and services used by the group. 
  • Professional advisers, including lawyers, bankers, auditors, and insurers, for the purposes of providing consultancy, legal, insurance and accounting services. 
  • Police or other such regulatory authority – as part of an investigation or otherwise for legal or regulatory purposes. 
  • External auditors – to audit our systems and processes for the purposes of ensuring efficiency, or regulatory or contractual compliance 

Suppliers and Client Partners: 

  • We will disclose personal information in connection with your company and its employees to third parties if we are under a duty to disclose or share personal information to comply with any other legal or regulatory obligation, including any safeguarding concerns.  
  • Client Partner information may be shared with the Department of Education, Ofsted and various combined authorities as required.  

Legal and Regulatory Disclosures 

  • We will disclose personal information to third parties where we are under a duty to disclose or share personal information to comply with a legal or regulatory obligation, including where this relates to safeguarding concerns.  

Automated Decision-Making and Profiling 

Cenit College UK does not engage in automated decision-making or profiling as defined by Article 22 of the GDPR. 

All learner enrolment, assessment, certification, or employment decisions are reviewed and processed by qualified personnel. Should this change in the future, data subjects will be notified, and additional protections will be implemented in accordance with GDPR requirements. 

Use of Artificial Intelligence (AI) 

Cenit College UK may use AI-powered tools to support its educational and administrative functions. These tools help improve the learner experience, provide support, and enhance operational efficiency. Where used, AI tools do not make final decisions that affect individuals without human oversight. 

Examples include: 

  • AI-enabled chat support to respond to common learner queries 
  • Analytics tools that help us better understand learner engagement 
  • Email tools that tailor content based on course activity or interests 

Cenit College UK do not currently use AI for: 

  • Automated grading or certification 
  • Automated admissions or job application decisions 

Any use of AI is subject to human review and is regularly assessed to ensure fairness, accuracy, and compliance with data protection legislation. Where AI tools are used, they are configured to minimise bias and are not permitted to override human decision-making. 

If the use of AI significantly impacts a learner’s rights or experience, Cenit College UK will provide prior notice and offer a human point of contact to review decisions or clarify the process

Under data protection laws in the UK, you have the right: 

  • to ask us not to use your personal data for direct marketing.  
  • to ask us not to process your personal data where it is processed on the basis of legitimate interests if there are no compelling reasons for that processing. 
  • to request from us access to personal information held about you (see below). 
  • to ask for the information we hold about you to be rectified if it is inaccurate or incomplete. 
  • to ask that we stop any consent-based processing of your personal data after you withdraw that consent. 
  • to ask, in certain circumstances, to delete the personal data we hold about you. 
  • to ask, in certain circumstances, for the processing of that information to be restricted; and 
  • to ask, in certain circumstances, for your data to be moved to another controller 

If you submit a request, we will respond as soon as possible and within one month of receipt, or on receipt of proof of identity if requested. If the request is complex, we may extend this period by up to two additional months.  In such cases, we will inform you of the extension and the reasons for the delay within 30 days of receipt of your request.

If you require this notice in an alternative format, please get in touch with us at dataprotection@cenitcollege.co.uk.

If you have any queries or concerns relating to this Privacy Notice, the processing of your personal data, or you wish to exercise any of your data subject rights, please contact the Data Protection Manager. 

 

To help us process your request, please provide the following information: 

  • Your Full Name 
  • A description of the data you are requesting, including dates if applicable. 
  • Your relationship with Cenit College UK 

Please note that verification of your identity may be required. 

Requests should be sent to: 

  • Data Protection Manager 
  • Email:  dataprotection@cenitcollege.co.uk 
  • By post to:  Cenit College UK Ltd., 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ  

If you remain dissatisfied after receiving our response, you have the right to escalate a complaint to 

The Information Commission (ICO) (formerly the ICO).  The ICO contact details are available on their website: https://ico.org.uk/concerns/   

Or by writing to: Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF 

Helpline: 03031231113 

We periodically update our privacy notice, which is published on our website (https://www.cenitcollege.co.uk/). The last update was in September 2026. 

The DPM will monitor this policy as part of their annual quality audit to ensure the currency and relevance of this policy. In conjunction with the Board of Directors, the DPM will continuously monitor and approve this policy using the following mechanisms.

  • Review of data protection enquiries, complaints, requests, breaches, withdrawals of consent.
  • Integration with other policies and procedures such as Subject Access Request Procedure,

Records Retention schedule as contained in our Information Management Policy (Refer to policy 8.2).

3.1 Version

 

VersionDateRevision AuthorSummary of Changes
131/07/2024DPMNew Policy
208/05/2025DPM & ITMRewritten to suit new funded programmes.
322/08/2025DPM & ITMCategories of data subjects extended, amended to reflect regulatory changes.
428/01/2026DPM & ITM

Added – CCTV images may be captured when

visiting some of our locations.

515/09/2026DPM, DPO & DoT
  • Change the role title to Head of Quality 
  • Added section on Legal and Regulatory Disclosures 
  • Added information to the Who we share information with – Learner section 

3.2 Classification

*Use the information fields in MS Word to auto-update these fields.

Document ClassificationPublic
PrintingUncontrolled when printed
Document ReferenceQA 8.3.1
Version5
Last Approval Date15/09/2026