Privacy Notice

Cenit College UK is committed to data security and the lawful, fair and transparent processing of personal data.  This privacy notice sets out how we manage and protect your personal data in compliance with applicable data protection law, including the UK/EU General Data Protection Regulation (EU) 2016/679. 

It explains how and why we collect, store, use and share (process) personal data, how to contact us and the supervisory authority should you need further information or wish to report a concern about the way in which we process your data.

We will never sell your personal data to third parties.

Company Details

Cenit College UK Ltd.

71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

Company Registration No:  15635921

For the purposes of GDPR, Cenit College UK Ltd may act in the capacity of Controller or Processor when processing your personal data.

2.1 Visitors to our website

When visiting our website, you will be able to select and save your cookie preference when accessing the home page.  We use essential cookies, which are necessary for the operation and security of our website, and optional performance and advertising cookies.

For details of the types and functionality of the cookies and the information we collect https://www.cenitcollege.co.uk/cookie-overview/

2.2 Enquiries

We collect your contact details, content and copies of your communications with us by email and telephone, or when you complete our Contact Us or Enquiry form.  

We use your personal and contact information to respond to enquiries and to manage our relationship with you

2.3 Recruitment

When you apply for a vacancy we will obtain your name, address, email address, telephone number(s), employment history, details of your qualifications and your CV. 

We will also retain details (and copies) of your communications and interactions with us via our recruitment team or otherwise, including by email, telephone and post.

We will record details of the documents you provide as proof of identity, such as driving licence and passport, required as part of the recruitment process, or where there is a legal reason to request this from you.

(Cenit College UK acts as a controller in respect of the personal data of our employees.  Employee data is processed in compliance with employment laws to meet our legal obligations as an employer.  Further information is provided in our Employee Privacy Notice).

2.4 Suppliers and Client Partners

We collect personal and contact information when you contact us online or apply to join our preferred supplier list.  The information we collect will consist of the name of the company contact, their job title, company details, email address and telephone number(s).

Depending on the service you provide we may also collect; VAT registration number, bank details, UTR number (if applicable) and credit references.

Details (and copies) of communications and interactions between us, by email, telephone, post or via our website, including through our Shared Services teams (including Finance).

Information about how you use our website, and if applicable which websites you were redirected from.

We may receive personal data directly from you or from various third parties and public sources, including from social media channels (if you interact with us through those channels).

2.5 Commercial Activity

Cenit College UK also acts as a Controller for certain commercial activities. This includes, but is not limited to:

• Direct course enrolments by individuals or employers
• Marketing and promotional communications
• Customer relationship management
• Internal analytics and service improvement

In these cases, Cenit College UK determines the purpose and means of processing personal data.  We collect and process this data under the lawful bases of contract, legitimate interest, or consent, depending on the nature of the interaction.

2.6 Skills Bootcamp Courses

When delivering courses on behalf of commissioners, such as the Department for Education for our Skills Bootcamp courses, Cenit College UK will act as a processor.  We process personal data according to their instructions. 

2.6.1 Personal information we may collect

• Title
• Name
• Email address
• Phone number
• Address
• Post code
• Date of birth
• Age
• Gender
• National insurance number
• Carer status
• Emergency contact name, relationship and phone number
• Record of previous qualifications
• Employment status
• Name of employer
• Workplace postcode
• Job title
• Job industry
• Hours worked per week
• Salary
• Benefits received

2.6.2 Special Category Data

We may collect special category data based on contractual requirements from our commissioners, which for Skills Bootcamp may include:

• Ethnic group
• Criminal conviction status
• Disability, learning difficulty or long-term health conditions

For further information, please refer to the DfE privacy notice.  https://www.cenitcollege.co.uk/dfe-privacy-notice-for-skills-bootcamps

 2.6.3 Why do we collect your personal information (Lawful Basis)

• To enable us to meet our contractual obligations with our clients or commissioners when you enrol on a training or apprenticeship programme (performance of a contract)
• Where you have provided our commissioners with your explicit consent to process your special category data.
• Where you have provided consent on our website in relation to cookies.
• Where you have provided your consent to receive marketing information
• We may share your details to potential employers if you provide us with your consent to do so.
• To respond to any communications, we may receive from you – legitimate interest.
• We will also use your data when recording lessons –legitimate interest.
• You can withdraw consent at any time by emailing dataprotection@cenitcollege.co.uk

2.6.4 Video Conferencing and recording of online lessons

To enable video conferences and online lessons or meetings to take place in the context of increased flexible and remote working, Cenit College UK will use approved Microsoft Teams and Zoom, which have recording capabilities.

To enhance the learning experience, learners are encouraged to keep their cameras on during online training sessions. Sessions may be recorded for educational purposes, and learners will be notified before recording begins. Recorded sessions will be securely stored and only available to participants on the course through our learning platform (Moodle).  

2.6.5 How do we collect your personal information

When you:

• Use or view our website via your browser.
• Complete our Contact Us or Enquiry Form and/or Course Application form

2.6.6 How will we use your data?

We will use your information to

• Process your enquiry and application for a course
• To manage the delivery of the course
• Provide potential employers with your details for job applications
• Online lessons may be recorded

We process personal data to provide administrative and support services to our learners.  Additionally, we process personal data because it is necessary for the performance of a contract or to take steps at an individual’s request prior to entering a contract. For example, this may include interacting with individuals before they are enrolled as a learner as part of the onboarding process.

2.6.7 How do we store your data?

cenitcollege.co.uk, my.cenitcollege.co.uk and www.cenitsys.co.uk are hosted on a secure dedicated server with multiple hardware redundancy levels (RAID) within UK/EEA borders. This provides the best performance and server uptime for learners. We may need to undertake routine maintenance from time to time, resulting in our websites going offline for a period (typically a few minutes) or for more non-routine maintenance, where there is hardware failure (usually an hour).

In the event of a scheduled upgrade of the Moodle platform, a banner message will be posted on the Cenit College UK Moodle platform (my.cenitcollege.co.uk) advising of the date and time of the upgrade and its estimated duration. In the event of a full outage of the Moodle platform, a banner message will be posted on the Cenit College UK website advising of the estimated outage duration.

We follow industry standards on information security management and safeguarding sensitive information. Our information security systems apply to people, processes and information technology systems on a risk management basis.  Our security controls are designed to maintain the Confidentiality, Integrity and Availability of personal information at all times.

We have technical measures such as password complexity requirements, anti-virus and anti-mailware software, firewalls, encryption, and multifactor authentication in place.

We perform regular audits and testing to ensure your information’s safety.

No method of transmission over the internet or method of electronic storage is 100% secure. Therefore, we cannot 100% guarantee your personal information’s absolute security. Although we take all the security measures, we ensure we are as proactive as possible.

Where necessary, we may transfer personal information outside of the UK, but it will remain within the boundaries of the EEA. When doing so, we comply with the UK GDPR and EU GDPR, ensuring appropriate safeguards are in place.

• We will only keep your personal data for as long as necessary. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

  Where Cenit College UK are the Processor, we will keep your data for the retention period specified by the Controller (e.g. 7 years for Skills Bootcamp courses as per DfE guidelines). 

  At the end of the retention period, personal data will be returned to the Controller (e.g. DfE) if requested, deleted or anonymised (so that it can no longer be associated with you) for research or statistical purposes.

  In some circumstances you may be entitled to ask us to delete your data: see Data Subject Rights below for further information.

This will depend on our relationship with you

6.1 Learners:

We may share personal data in the following circumstances:

• With commissioning bodies (e.g. DfE, other funding bodies)
• With the Office for Standards in Education, Children’s Services and Skills (Ofsted)
• With third parties for the purchase of licences for course materials, etc. (e.g. uCertify).

6.2 Applicants:

We may share personal data in the following circumstances:

• As a successful applicant, with external pension, vetting and business support services, as part of your contract of employment and our legal obligations. (Further information is provided in our Employee Privacy Notice).
• Cloud and external providers of software systems, IT solutions and services used by the group.
• Professional advisers including lawyers, bankers, auditors, and insurers – for the purposes of providing consultancy, legal, insurance and accounting services.
• Police or other such regulatory authority – as part of an investigation or otherwise for legal or regulatory purposes.
• External auditors – to audit our systems and processes for the purposes of ensuring efficiency, or regulatory or contractual compliance

6.3 Suppliers & Client Partners:

• We will disclose personal information in connection with your company and its employees to third parties if we are under a duty to disclose or share personal information to comply with any other legal or regulatory obligation, including any safeguarding concerns.
• Client Partner information may be shared with the Department of Education, Ofsted and various combined authorities as required.

7.1 Automated Decision-Making and Profiling

Cenit College UK does not engage in automated decision-making or profiling as defined by Article 22 of the GDPR.

All learner enrolment, assessment, certification, or employment decisions are reviewed and processed by qualified personnel. Should this change in the future, data subjects will be notified, and additional protections will be applied under GDPR requirements.

7.2 Use of Artificial Intelligence (AI)

Cenit College UK may use AI-powered tools to support its educational and administrative functions. These tools assist with improving the learner experience, providing support, and enhancing operational efficiency. Where used, AI tools do not make final decisions that affect individuals without human oversight.

Examples include:

• AI-enabled chat support to respond to common learner queries
• Analytics tools that help us better understand learner engagement
• Email tools that tailor content based on course activity or interests

Cenit College UK do not currently use AI for:

• Automated grading or certification
• Automated admissions or job application decisions

Any use of AI is subject to human review and is regularly assessed to ensure fairness, accuracy, and compliance with data protection legislation. Where AI tools are used, they are configured to minimise bias and are not permitted to override human decision-making.

If the use of AI significantly impacts a learner’s rights or experience, Cenit College UK will provide prior notice and offer a human point of contact to review decisions or clarify the process.

Under data protection laws in the UK, you have the right:

• to ask us not to use your personal data for direct marketing.
• to ask us not to process your personal data where it is processed on the basis of legitimate interests if there are no compelling reasons for that processing.
• to request from us access to personal information held about you (see below).
• to ask for the information we hold about you to be rectified if it is inaccurate or incomplete.
• to ask that we stop any consent-based processing of your personal data after you withdraw that consent.
• to ask, in certain circumstances, to delete the personal data we hold about you.
• to ask, in certain circumstances, for the processing of that information to be restricted; and
• to ask, in certain circumstances, for your data to be moved to another controller

If you submit a request, we will respond as soon as possible and within one month of receipt, or on receipt of proof of identity if requested. If the request is complex, we may extend this period by up to two additional months.  In such cases we will inform you of the extension and the reasons for the delay within 30 days of receipt of your request.

If you require this notice in an alternative format, please get in touch with us at dataprotection@cenitcollege.co.uk.

If you have any queries or concerns relating to this Privacy Notice, the processing of your personal data, or you wish to exercise any of your data subject rights please contact the Data Protection Manager.

To help us process your request, please provide the following information:

• Your Full Name
• A description of the data you are requesting, including dates if applicable.
• Your relationship with Cenit College UK

Please note that verification of your identity may be required.

Requests should be sent to:

Data Protection Manager

Email:  dataprotection@cenitcollege.co.uk

If you remain dissatisfied, you have the right to lodge a complaint with  the Information Commission (IC) (formerly the ICO).  The IC contact details are available on their website: https://ico.org.uk/concerns/

Or by writing to: Information Commission, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF

Helpline: 03031231113

We periodically update our privacy notice, which is published on our website (https://www.cenitcollege.co.uk/). The last update was in August 2025.

The DPM will monitor this policy as part of their annual quality audit to ensure the currency and relevance of this policy.

In conjunction with the Board of Directors, the DPM will continuously monitor and approve this policy using the following mechanisms.

• Review of data protection enquiries, complaints, requests, breaches, withdrawals of consent.
• Integration with other policies and procedures such as Subject Access Request Procedure, Records Retention schedule as contained in our Information Management Policy (Refer to policy 8.2).