This Privacy Notice was posted on May 23, 2018. It is effective from May 25, 2018 for all users.
Global Vocational Skills Ltd (GVS) is committed to your privacy. This privacy notice explains our collection, use, disclosure, retention and protection of your personal information.
This privacy notice applies to GVS website, the cloud-based platform GVS PiLOT, content editing tool known as Content Management System (CMS) and service or tool (collectively "Products") where this privacy notice is referenced, regardless of how you access or use them, including through mobile devices, LTI and API connection.
This privacy notice also applies to the provision of GVS Products through any GVS third-party/partner's website, application, platform, Learning Management System (LMS) or service where it is referenced and where your listings and their content are published or advertised in accordance with the terms of this privacy notice.
This privacy notice may be amended at any time by posting the amended version on this site including the effective date of the amended version. We will announce any material changes to this privacy notice through the News section of GVS Website, on our social networks and/or via email.
What is Personal Information?
Personal Information is information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
We do not consider personal information to include information that has been anonymised or aggregated so that it can no longer be used to identify a specific natural person, whether in combination with other information or otherwise.
We collect personal information from you and any devices you use when you: use our Products, register for an account with us, provide us information on a web form, update or add information to your account, or when you otherwise correspond with us.
Some of this personal information, such as a way to identify you, is necessary to enter into our Agreements, Terms and Conditions, Purchase Orders or Payment Claims. The provision of all other personal information is voluntary but may be necessary in order to best use our Products, such as logging in or generating meaningful progress reports.
We may also collect personal information from other sources, as described below.
Personal information you give us when you use our Products or register for an account with us
- Identifying information such as your name, organisation, position, learner ID, telephone numbers and email addresses when you register for an account with us.
- Buying or selling information you provide during a transaction, or other transaction-based content that you generate as a result of a transaction you are involved in.
- Other content that you generate, or that is connected to your account (such as adding new users as tutors, learners or observers to your account, creating and assigning new content using the Content Management System (CMS), generating Assessment Completion Records and Certificates by using the interactive learning modules, and opting in for group reports, such as the Leader board).
- Financial information (such as debit/credit card or bank account numbers) in connection with a transaction.
- Billing and other information used to purchase or send an item (such as Tax ID or other identification numbers).
- In some instances, when you use our Products such as participating in research-related activities, you may provide age, gender, interests and favourites.
- You may also provide us other information through a web form, by updating or adding information to your Profile in your account, through your participation in Messenger discussions, or when you otherwise communicate with us regarding our Products.
- Additional information we are required or authorised by applicable national laws to collect and process in order to authenticate or identify you or to verify the information we have collected.
Personal information we collect automatically when you use our Products or register for an account with us
- We collect information about your interaction with our Products, such as usage statistics and your communications with us. This is information we receive from devices (including mobile devices) you use when you access our Products. This information could include the following: Device ID or unique identifier, device type, browser type and times of access.
- Computer and connection information such as statistics on your attempts, access to interactive modules, time spent using the Products and your IP address information.
Personal information we collect using cookies and similar technologies
- For more information about our use of these technologies, and how to control them, see the GVS Cookies Policy.
Personal information from other sources
- We do not collect any personal information from social media sites or use social media sites to create your account or to connect your account with the respective social media site. You control the personal information you allow us to have access to through your profile settings which is retained within the GVS Products and are protected by password.
- If you give us personal information about someone else, you must do so only with that person’s authorisation. We will contact them directly and inform them of how we collect, use, disclose, and retain their personal information according to our privacy notice (in the case of a non-affiliated third party).
We use the personal information we collect from you for a range of different business purposes and according to different legal bases of processing. The following is a summary of how and according to which legal bases we use your personal information.
We use your personal information to fulfil a contract with you and provide you with our Products, to comply with our legal obligation, protect your vital interest, or as may be required for the public good. This includes:
- To provide payment processing and account management, operate, measure and improve our Products, keep our Products safe, secure and operational, and customise site content that includes the content that you have been assigned by your administrator.
- To contact you regarding your account, to troubleshoot problems with your account or as otherwise necessary to provide you customer service.
- When contacting you for such purposes as outlined above, we may contact you via email and/or telephone.
- To provide other services requested by you as described when we collect the information.
- To prevent, detect, mitigate, and investigate fraud, security breaches or other potentially prohibited or illegal activities.
- To enforce our Terms and Conditions, this privacy notice, or other policies, and to monitor for violations of our policies or applicable laws.
We use your personal information to pursue our legitimate interests where your rights and freedoms do not outweigh these interests. We have implemented controls to balance our interests with your rights. This includes to:
- Improve our Products, for example by reviewing information associated with stalled or crashed pages experienced by users allowing us to identify and fix problems and give you a better experience.
- Personalise, measure and improve our content based on your feedback.
- Contact you via email in order to poll your opinions through surveys or questionnaires and inform you about our Products, as authorised by applicable law.
- Monitor and improve the information security of our site on various devices.
With your consent, we may use your personal information to:
- Provide you with Products upgrade and development information via email.
- Monitor your usage reports and metrics and include your report statistics for research and analysis for designing better Products.
You have the right to withdraw your consent at any time.
We will not make automated-decisions about you that would significantly affect you, unless such a decision is necessary as part of a contract we have with you, we have your consent, or we are required by law to use such technology.
You have choices about how we use your personal information to generate group reports, and whether you want to stay signed into your account.
Personal data in group reports, such as the Leader board
You can control your preferences on whether your details show in the Leader board report by going to ‘My Progress’ – ‘Leader board’ and ticking the ‘Opt out’ box if you do not want your name to be shown in your group report. Please note that your name will not show on the Leader board, even if you are the current progress leader in your group.
Staying Signed in
When you sign in to your account on our Products, your browser might the option to stay signed in to your account for certain amount of time. If you are using a public or shared computer, we encourage you not to choose to stay signed in. You or any other user of the computer/browser you signed in on will be able to view and access most parts of your account and take certain specific actions during this signed in period without any further authorisation. The specific actions and account activities that you or any other user of this computer/browser may take include:
- View your Profile page
- View your progress and reports
- View the groups of learners and/or tutors and their personal data you might have
- View your Messenger page
- Send member-to-member messages
- Work with the Products on your behalf
If you attempt to change your password, User ID, update any other account information or attempt other account activity beyond those listed above, you may be required to enter your password.
You can typically end your signed in session by either logging out and/or clearing your cookies. If you have certain browser privacy settings enabled, simply closing your browser may also end your signed in session. If you are using a public or shared computer, you should sign out and/or clear your cookies when you are done using our Services to protect your account and your personal information.
We respect your right to access, correct, request deletion or request restriction of our usage of your personal information as required by applicable law. We also take steps to ensure that the personal information we collect is accurate and up to date.
- You have the right to know what personal information we maintain about you
- We will provide you with a copy of your personal information in a structured, commonly used and machine-readable format on request
- If your personal information is incorrect or incomplete, you have the right to ask us to update it
- You have the right to object to our processing of your personal information
- You can also ask us to delete or restrict how we use your personal information, but this right is determined by applicable law and may impact your access to some of our Products
Access, correction and deletion of your personal information
You can see, review and change most of your personal information by signing in to your account Profile. Please, update your personal information if it changes or is inaccurate. Keep in mind that all your reports, Certificates and Assessment Completion Records will always show the current information provided in your Profile.
We will honour any statutory right you might have to access, modify or erase your personal information. To request access and to find out whether any fees may apply, if permitted by applicable national laws, please contact us following the instructions in the Contact Us section below. Where you have a statutory right to request access or request the modification or erasure of your personal information, we can still withhold that access or decline to modify or erase your personal information in some cases in accordance with applicable national laws.
If you request that we stop processing some or all of your personal information or you withdraw (where applicable) your consent for our use or disclosure of your personal information for purposes set out in this privacy notice, we might not be able to provide you all of the Products and customer support offered to our users and authorised under this privacy notice and our Terms and Conditions.
Upon your request, we will close your account and remove your personal information from view as soon as reasonably possible, based on your account activity and in accordance with applicable national laws.
We may disclose your personal information to the following parties for the following purposes:
GVS Staff members, who may use it to:
- Provide joint content and services (like registration and customer support)
- Help detect, investigate, mitigate and prevent potentially fraudulent and illegal acts, violations of our Terms and Conditions and data security breaches
- Improve our products, sites, services and tools
Authorised Service Providers as follows:
- Third party service providers who help us to develop our Products, to assist us with the prevention, detection, mitigation, and investigation of potentially illegal acts, violations of our Terms and Conditions, fraud and/or security breaches and other business operations.
Law enforcement, legal proceedings and as authorised by law
- To comply with our legal requirements, enforce our Terms and Conditions, respond to claims or protect anyone's rights.
- To law enforcement or governmental agencies, or authorised third-parties, in response to a verified request or legal process relating to a criminal investigation or alleged or suspected illegal activity or any other activity that exposes us, you, or any other of our users to legal liability. We will only disclose information we deem relevant to the investigation or inquiry, such as name, city, state, postcode, telephone number, email address, User ID history, IP address, fraud complaints, usage reports.
- To third parties involved in a legal proceeding, if they provide us with a subpoena, court order or substantially similar legal basis, or we otherwise believe in good faith that the disclosure of information is necessary to prevent imminent physical harm or financial loss or to report suspected illegal activity.
Other GVS Products’ users as authorised by you or your use of our Products
- When being registered by another user, such as your tutor or supervisor, the other user will request you to provide him/her with information about you necessary to complete the registration, such as your name, account ID, email address, contact details or other information from you needed to to complete the registration and set up your profile.
- If a registration fails, is put on hold, or is later invalidated, we may also provide users with details of the uncompleted registration, such as email address and a temporary password
- Both tutor or supervisor receiving your information should only use it for purposes related to the registration and monitoring.
- Contacting other users via the Messenger with unwanted or threatening messages is a violation of our Terms and Conditions.
Change of Ownership
If we are subject to a merger or acquisition with/by another company, we may share information with them in accordance with the GVS privacy standards. Should such an event occur, we will require that the new combined entity follow this privacy notice with respect to your personal information. If we intend to handle your personal information for any purposes not covered in this privacy notice, you will receive prior notification of the processing of your personal information for the new purposes.
We retain your personal information for as long as necessary to provide the Products you have requested, or for other essential purposes such as complying with our legal obligations, resolving disputes, and enforcing our policies.
Our specific retention times for personal information are documented in our internal records retention schedules. How long we retain personal information can vary significantly based on context of the Products and services we provide and on our legal obligations. The following factors typically influence retention periods:
- How long is the personal information needed to provide our Products? This includes such things as maintaining and improving the performance of our products, keeping our systems secure, and maintaining appropriate business records. This is the general rule that establishes the baseline for most of our data retention periods.
- Is the personal information sensitive? If so, a shortened retention time is generally appropriate.
- Have you provided consent for a longer retention period? If so, we will retain data in accordance with your consent.
- Are we subject to a legal, contractual, or similar obligation to retain your personal information? Examples can include mandatory data retention laws in the applicable jurisdiction, government orders to preserve data relevant to an investigation, or personal information retained for the purposes of litigation.
After it is no longer necessary for us to retain your personal information, we will notify you and dispose of it in a secure manner according to our data retention and deletion policies.
The incoming General Data Protection Regulation (GDPR) Regulation (EU) 2016/679 of the European Parliament will apply to all organisations that control or process personal data as of 25 May 2018. Where Global Vocational Skills Ltd. processes Personal Data on behalf of the User, Global Vocational Skills Ltd. acknowledges that the User is the Data Controller and the owner of such Personal Data, and that Global Vocational Skills Ltd. is the Data Processor.
The Data Controller shall indemnify the Data Processor against all liabilities, costs, expenses, damages and losses (including reasonable professional costs and expenses) suffered or incurred by the Data Processor as a result of the Data Controller’s breach of its obligations.
Data Processing Obligations
In respect of any Personal Data to be processed by the Data Processor for which the Customer is Data Controller, the Data Processor shall:
- have in place and at all times maintain appropriate technical and organisational measures in such a manner as is designed to ensure the protection of the rights of the data subject and to ensure a level of security appropriate to the risk;
- not engage any sub-processor without the prior specific or general written authorisation of the Customer (and in the case of general written authorisation; the Data Processor shall inform the Customer of any intended changes concerning the addition or replacement of other processors and the Customer shall have the right to object to such changes);
- ensure that each of the Data Processor’s employees, agents, consultants, subcontractors and sub-processors are made aware of the Data Processor’s obligations under this Schedule and enter into binding obligations with the Data Processor to maintain the levels of security and protection required under this Schedule. The Data Processor shall ensure that the terms of this Schedule are incorporated into each agreement with any sub-processor, subcontractor, agent or consultant to the effect that the sub-processor, subcontractor, agent or consultant shall be obligated to act at all times in accordance with duties and obligations of the Data Processor under this Schedule. The Data Processor shall at all times be and remain liable to the Customer for any failure of any employee, agent, consultant, subcontractor or sub-processor to act in accordance with the duties and obligations of the Data Processor under this Schedule;
- process that Personal Data only on behalf of the Customer in accordance with the Customer’s instructions and to perform its obligations under this Agreement or other documented instructions and for no other purpose save to the limited extent required by law;
- upon the request of the Customer, within 30 days of expiry or termination of this agreement, Global Vocational Skills Ltd. shall make available to the Customer for download a full and complete file of the Customer's Data.
How we protect your Personal Information
We protect your personal information using technical and administrative security measures to reduce the risks of loss, misuse, unauthorised access, disclosure and alteration. Some of the safeguards we use are firewalls and data encryption, physical access controls to our data centres, and information access authorisation controls.
GVS Privacy Standards
GVS are committed to protect your personal information and honour our privacy obligations within our company. We have updated our Cooperation Agreements with colleges, defined our internal and external processes, and implemented technical changes to our products and services, to help both our partners, clients and GVS meet the new requirements:
- A new Addendum on Data Processing Obligations has been issued to supplement the Cooperation Agreements with Global Vocational Skills Ltd. which will come into force on 25 May 2018
- The ways in which such data is handled have been verified against the legal requirements
- The internal and external processes have been optimised and GVS staff have received appropriate training on information security, data protection and data encryption
- Steps have been taken to minimise the processing of personal information
- All our company internal and external documentation has been updated to reflect the security policies related to handling of various types of personal data
- USB encryption and enhanced in-house IT infrastructure and cloud security have been introduced
- SSL encryption has been activated for GVS PiLOT and GVS CMS
- Data Protection Policy statements from authorised service providers have been obtained
This section describes some additional privacy information related to your use of our Products that you may find important.
Your responsibilities over personal information you control through GVS Products
If you hold an administrator, supervisor or a tutor profile, you control the personal information of the other users (such as their name, account ID, email address and contact details) for registration and monitoring purposes. Independent from us, you are the controller of such data and we encourage you to inform the other user about your privacy practices and respect their privacy. In all cases, you must comply with the applicable privacy laws, and must give the other user a chance to remove them from your database and them a chance to review what information you have collected about them.
Using personal information of other users that you have access to for any other purpose constitutes a violation of our Terms and Conditions.
Unwanted or threatening email
We do not tolerate abuse of our Products. You do not have permission to add other users to your mailing list (email or postal), call, or send him/her text messages for commercial purposes, even if this user purchased something from you, unless the user has given his/her explicit consent. Sending unwanted or threatening email and text messages is against our Terms and Conditions. To report GVS-related spam or spoof emails please forward the email to firstname.lastname@example.org.
The GVS website, the cloud-based platform GVS PiLOT and the content editing tool known as Content Management System (CMS) are educational Products which are specifically designed and intended for 16+ year-old users. We do not knowingly collect personal information from users below 16 years old.
Third Party Privacy Practices
This privacy notice addresses only our use and handling of personal information we collect from you in connection with providing you our Products. If you disclose your information to a third party, or visit a third party website via a link from our website, their privacy notices and practices will apply to any personal information you provide to them or they collect from you.
We cannot guarantee the privacy or security of your personal information once you provide it to a third party and we encourage you to evaluate their privacy and security policies before choosing to share your personal information.
US Privacy Shield
All personal information made available to any US company will be managed and stored in line with US Privacy Shield – a US counterpart of the GDPR.
If you have a question or a complaint about this privacy notice, the GVS privacy standards, or our information handling practices, you can reach the GVS Data Protection Officer in writing at: 42-44 Clarendon Road, Watford, Hertfordshire, WD17 1JJ.
You can also find more information on how to contact us on the GVS website or email at email@example.com.
Your right to file complaints with a data protection supervisory authority remains unaffected.