WORKSTART DATA AND PRIVACY POLICY

1. Introduction

WorkStart is a skills training and employment placement platform operated by BlueBow Research & Consultancy Ltd (trading as BlueBow). We are committed to protecting your privacy and ensuring the security of your personal information in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Data and Privacy Policy explains how we collect, use, share, and protect your personal data when you use the WorkStart platform, whether you are a learner, employer partner, or visitor to our website.

2. Who We Are

BlueBow Research & Consultancy Ltd is the data controller responsible for your personal information collected through WorkStart. Our details are:

3. Information We Collect

3.1 Information from Learners

When you register and use WorkStart as a learner, we collect:

• Personal identification information: name, email address, phone number, date of birth, address
• Educational background: qualifications, training history, skills assessments
• Employment information: work history, employment status, career aspirations
• Demographic information: gender, ethnicity (optional, for monitoring purposes only)
• Learning progress: course completion, assessment results, certificates earned
• Platform usage: login times, pages visited, features used, device information
• Communications: messages exchanged through the platform, support enquiries

3.2 Information from Employer Partners

When you register as an employer partner, we collect:

• Business information: company name, registration number, business address
• Contact details: primary contact name, email, phone number
• Job opportunities: vacancy details, required skills, employment terms
• Recruitment activity: candidate views, interview requests, hiring decisions
• Platform usage: login activity, search queries, system interactions

3.3 Information Collected Automatically

We automatically collect certain technical information when you use WorkStart:

• Device information: IP address, browser type, operating system
• Usage data: pages accessed, time spent, click patterns, navigation paths
• Location data: approximate geographic location based on IP address
• Cookies and tracking technologies: as detailed in our Cookie Policy

4. How We Use Your Information

We process your personal data for the following purposes:

4.1 Service Provision

• Creating and managing your account
• Providing access to training courses and learning materials
• Tracking your learning progress and issuing certificates
• Facilitating connections between learners and employer partners
• Processing job applications and placement opportunities
• Communicating about your account, courses, and opportunities

4.2 Platform Improvement

• Analyzing platform usage to improve features and user experience
• Conducting research to enhance training effectiveness
• Testing new features and functionality
• Identifying and fixing technical issues

4.3 Communications

• Sending service updates and important notifications
• Providing customer support and responding to enquiries
• Sharing relevant job opportunities with learners
• Sending marketing communications (with your consent)
• Conducting surveys and gathering feedback

4.4 Legal and Regulatory Compliance

• Complying with legal obligations and regulatory requirements
• Preventing fraud and ensuring platform security
• Responding to legal processes and government requests
• Enforcing our terms of service and policies
• Producing anonymized statistics for grant funding and impact reporting

5. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following legal bases:

Where we process your data based on legitimate interests, we balance our interests against your rights and freedoms. You have the right to object to processing based on legitimate interests.

6. How We Share Your Information

We may share your personal information with the following categories of recipients:

6.1 Employer Partners

With your explicit consent, we share relevant learner information with employer partners when you:

• Apply for job opportunities through the platform
• Give permission for your profile to be visible to employers
• Accept an introduction or referral to an employer

Information shared typically includes your name, contact details, qualifications, skills, work history, and relevant certificates.

6.2 Service Providers

We engage trusted third-party service providers who process data on our behalf, including:

• Cloud hosting providers for platform infrastructure
• Email service providers for communications
• Payment processors for financial transactions
• Analytics providers to understand platform usage
• Customer support tools
• Security and fraud prevention services

All service providers are contractually obligated to protect your data and use it only for specified purposes.

6.3 Funding Bodies and Grant Providers

We may share anonymized and aggregated data with funding organizations to demonstrate program effectiveness and impact. This data cannot identify individual users.

6.4 Legal Requirements

We may disclose your information when required by law or to:

• Comply with legal obligations, court orders, or regulatory requests
• Protect our rights, property, or safety, or that of others
• Prevent or investigate fraud, security issues, or technical problems
• Respond to emergency situations

6.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity. You will be notified of any such change.

7. Data Security

We implement robust technical and organizational security measures to protect your personal data:

• Encryption: Data is encrypted in transit (using TLS/SSL) and at rest
• Access controls: Role-based access restrictions and multi-factor authentication
• Regular security assessments: Vulnerability scans and penetration testing
• Staff training: All personnel receive data protection training
• Incident response: Documented procedures for data breach management
• Backup systems: Regular backups with secure storage

While we use industry-standard security measures, no system is completely secure. We cannot guarantee absolute security but continuously work to enhance our protections.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

After the retention period expires, we securely delete or anonymize your data. Some information may be retained longer if required by law or for legitimate legal purposes.

9. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

9.1 Right of Access

You can request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR).

9.2 Right to Rectification

You can ask us to correct inaccurate or incomplete personal data.

9.3 Right to Erasure

You can request deletion of your personal data in certain circumstances, including when data is no longer necessary for its original purpose or if you withdraw consent.

9.4 Right to Restrict Processing

You can request that we limit how we use your data in certain situations, such as while we verify data accuracy or assess your objection to processing.

9.5 Right to Data Portability

You can request your data in a structured, commonly used format and have it transferred to another organization where technically feasible.

9.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds.

9.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal.

9.8 Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. WorkStart does not currently use automated decision-making systems.

To exercise any of these rights, please contact us at privacy@workstart.app. We will respond within one month of receiving your request.

10. International Data Transfers

Your personal data is primarily processed and stored within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place:

• Transfers to countries with adequacy decisions from the UK government
• Use of Standard Contractual Clauses approved by the UK ICO
• Binding Corporate Rules for intra-group transfers
• Other appropriate safeguards as permitted by UK data protection law

We will inform you of any international transfers and the safeguards applied.

11. Children's Privacy

WorkStart is designed for users aged 16 and over. If you are under 16, you must have parental or guardian consent to use the platform. We do not knowingly collect personal data from children under 13.

If we become aware that we have inadvertently collected data from a child under 13 without proper consent, we will take steps to delete that information promptly.

12. Cookies and Tracking Technologies

WorkStart uses cookies and similar tracking technologies to provide and improve our services. These include:

• Essential cookies: Required for platform functionality and security
• Performance cookies: Help us understand how users interact with the platform
• Functional cookies: Remember your preferences and settings
• Marketing cookies: Used to deliver relevant advertisements (with consent)

You can manage cookie preferences through your browser settings or our cookie consent tool. Please refer to our separate Cookie Policy for detailed information.

13. Third-Party Links

WorkStart may contain links to third-party websites, services, or applications. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

14. Changes to This Policy

We may update this Data and Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of significant changes by:

• Posting the updated policy on our website with a new effective date
• Sending email notification to registered users
• Displaying a prominent notice on the platform

Continued use of WorkStart after policy changes constitutes acceptance of the updated policy. For material changes, we may seek your explicit consent.

15. Contact Us

If you have questions, concerns, or requests regarding this policy or our data practices, please contact us:

We aim to respond to all enquiries within 5 business days and to fulfill data subject requests within one month.

16. Complaints and Regulatory Authority

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

However, we would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first.

17. Glossary of Terms

For clarity, the following terms have specific meanings in this policy: