Version 3 – 11 August 2026. Effective on publication. FE HR Hub Limited, company number 15078239. Privacy contact: nicola.perkins@fehrhub.org. See also our Cookie Policy.
At a glance
This Policy explains how FE HR Hub Limited collects, uses, shares, stores and protects personal information across its website, online shop and customer accounts, membership, events, learning and development, coaching, behavioural profiling, Jobs Board, executive search, interim associate, payroll and HR consultancy services.
The information that applies to you will depend on your relationship with us. You do not need to read every service section, but the general sections on sharing, security, retention and your rights apply across our activities.
- FE HR Hub Limited is the controller for most information collected through its own website, membership, events, recruitment, associate and payroll activities.
- For some HR consultancy and commissioned services, a client college may remain the controller and FE HR Hub may act as its processor. We will explain the position where it is relevant.
- We do not sell personal information.
- We do not routinely share event attendee contact details with speakers, sponsors or strategic partners unless this is necessary for the event or the individual has agreed.
- Applicants for vacancies advertised on the Jobs Board will usually apply directly to the advertising organisation. FE HR Hub will not normally receive their application.
- Detailed coaching conversations and coaching notes are not routinely disclosed to the commissioning employer.
1. About this Policy
FE HR Hub Limited ("FE HR Hub", "we", "us" or "our") is committed to processing personal information lawfully, fairly, transparently and securely.
This Policy is intended to meet the requirements of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), including relevant amendments made by the Data (Use and Access) Act 2025, and other applicable UK data protection legislation, as amended from time to time.
This Policy applies to information processed through www.fehrhub.org and through our related services, systems, events, programmes and business activities. A separate Cookies Notice (our Cookie Policy) provides more detailed information about the cookies and similar storage or access technologies used on our website and is available from the website footer.
2. Who we are
FE HR Hub Limited is a company registered in England and Wales under company number 15078239. Our registered office is Druslyn House, De La Beche Street, Swansea, SA1 3HJ.
FE HR Hub is registered with the Information Commissioner's Office (ICO). Our ICO registration reference is:
ZB743337.
Our services include:
- FE HR Hub membership and community services;
- online shop, customer account, checkout and online payment facilities;
- Breakfast Club sessions, briefings and other events;
- learning and development, leadership development and facilitation;
- coaching and mentoring;
- behavioural and psychometric profiling, including Everything DiSC and related Catalyst learning services;
- HR consultancy and advisory services;
- Jobs Board advertising and vacancy alerts;
- executive search, candidate introduction and recruitment services;
- interim associate and consultant services; and
- payroll, pension and statutory reporting arrangements for interim workers engaged by FE HR Hub.
3. Our role under data protection law
3.1 When FE HR Hub is the controller
FE HR Hub is normally the controller where we decide why and how personal information is processed. This includes information collected for our website, membership, event administration, marketing, Jobs Board advertiser services, candidate and associate networks, executive search, our own contracts, and payroll administration.
3.2 When a client organisation is the controller
For some commissioned HR consultancy, investigation, programme or support assignments, a client organisation may decide the purposes and essential means of processing. In those circumstances, the client may be the controller and FE HR Hub may process information on its documented instructions as a processor.
In other assignments, FE HR Hub may act as an independent controller or, less commonly, a joint controller because we need professional discretion over how information is gathered, assessed or reported. The applicable contract, assignment terms or separate privacy information will clarify the position where necessary.
Where a client is the controller, the client is responsible for providing appropriate privacy information to its employees, workers, learners or other affected individuals. This Policy explains FE HR Hub's general approach but does not replace the client's own privacy notice.
4. Data Protection Lead and contact details
FE HR Hub is not currently required to appoint a statutory Data Protection Officer. We have appointed Nicola Perkins as our Data Protection Lead and Privacy Contact.
Questions about this Policy or our use of personal information, and requests to exercise data protection rights, should be sent to:
- Email: nicola.perkins@fehrhub.org
- General email: info@fehrhub.org
- Telephone: 0333 358 2499
- Post: Data Protection Lead, FE HR Hub Limited, Druslyn House, De La Beche Street, Swansea, SA1 3HJ.
5. Who this Policy applies to
Depending on our relationship with you, this Policy may apply if you are:
- a member, prospective member or representative of a member organisation;
- a website visitor, newsletter subscriber or social media contact;
- an online shop customer, purchaser or website account holder;
- an attendee, speaker, facilitator, sponsor or partner involved in an event;
- a participant in a leadership, learning, development, coaching or behavioural profiling programme;
- a representative or employee of a client or prospective client;
- an employee, worker, learner, witness, complainant, respondent or other person whose information is processed during an HR consultancy assignment;
- a Jobs Board advertiser or organisational contact;
- a job-alert subscriber or person browsing advertised vacancies;
- a candidate for an executive search, interim, consultancy or other opportunity;
- an interim associate, temporary worker or consultant engaged or considered by FE HR Hub;
- a referee, emergency contact, next of kin or other third party named by another individual;
- a supplier, contractor, professional adviser or strategic partner; or
- another person who communicates with or supplies information to FE HR Hub.
6. The personal information we may collect
The information we collect depends on the service and our relationship with you. It may include the following categories.
6.1 Identity and contact information
Name, title, postal address, personal or work email address, telephone number, date of birth, photograph, employer, job title, professional profile details and social media identifiers.
6.2 Business, membership and transaction information
Membership information, organisational details, contracts, service selections, correspondence, billing contacts, account and order information, billing and delivery details where applicable, invoice information, transaction references, discounts used, records of acceptance of relevant terms, attendance records, enquiries, complaints and records of products or services supplied.
6.3 Website and technical information
IP address, device and browser information, operating system, time zone, pages viewed, referring and exit pages, website account and login information, shopping-basket or checkout activity, form-submission metadata, cookie or similar technology identifiers, analytics and engagement information, interactions with forms and emails, and information needed to keep our website and systems secure.
6.4 Recruitment, candidate and professional information
CVs, employment and assignment history, qualifications, professional memberships, skills, availability, preferences, references, interview and assessment information, public professional profiles, remuneration expectations, right-to-work information, and correspondence about opportunities.
6.5 Interim worker and payroll information
Address, date of birth, National Insurance number, bank details, tax code, P45 or starter declaration information, pay and deduction records, pension information, timesheets, expenses, holiday-pay information, assignment dates, working arrangements, absence information, statutory payment information, student loan or attachment-of-earnings information, emergency contacts and records required for HMRC and other statutory reporting.
6.6 Learning, development and coaching information
Programme registration details, learning objectives, pre-programme questionnaires, development goals, attendance, cancellations, evaluation responses, personal commitments, facilitator observations, action plans, coaching notes, accessibility requirements, contributions to exercises and information generated through development activities.
6.7 Behavioural and assessment information
Responses to behavioural or development questionnaires, assessment results, individual profiles, comparison information, profile indicators or "thumbprints", team maps, group information and related facilitator observations.
6.8 HR consultancy and employment-relations information
Employment records, contracts, correspondence, meeting notes, witness accounts, allegations, grievance or disciplinary information, performance information, absence and health information, safeguarding concerns, investigation evidence, equality information, legal advice, outcomes and other records relevant to a client assignment.
6.9 Special category and criminal-offence information
Where necessary and lawful, we may process information about health, disability, racial or ethnic origin, religious or philosophical beliefs, trade union membership, sexual orientation or other special category information. We may also process information about criminal allegations, convictions, offences, safeguarding checks or Disclosure and Barring Service (DBS) matters.
Bank details, salary, pay information and National Insurance numbers are not special category information under the UK GDPR, but we treat them as highly confidential and apply additional security and access controls.
7. How we collect personal information
We may collect information:
- directly from you when you contact us, complete a form, create a website account, place an online order, register for an event, subscribe, enter into a contract, submit a CV, take part in an assessment or provide information during a programme, coaching session or assignment;
- from your employer, commissioning college, client, recruiter, referee, previous employer, professional adviser or another person involved in a service or assignment;
- from publicly available professional sources, including organisational websites and LinkedIn;
- from website, event, CRM, email, payment, learning, assessment, videoconferencing and analytics systems;
- from HMRC, pension providers, background-check providers or other official bodies where applicable;
- from witnesses, complainants, respondents or documents supplied during an HR consultancy or investigation assignment; and
- from strategic partners or suppliers where you have asked them to introduce you or where information- sharing is otherwise lawful. If you provide information about another person, such as a referee, next of kin, employee, colleague or case participant, you should only provide information that is relevant and that you are permitted to disclose. Where appropriate, you should make the person aware that their information may be shared with FE HR Hub.
8. Our purposes and lawful bases
We only use personal information where we have a lawful basis. The basis will depend on the purpose and circumstances. Our principal lawful bases are:
- Contract: where processing is necessary to enter into or perform a contract with you, or to provide a service requested by you.
- Legal obligation: where processing is necessary to comply with tax, payroll, pension, employment, safeguarding, accounting, regulatory or other legal duties.
- Legitimate interests: where processing is necessary for our legitimate business or professional interests, or those of a client or third party, and those interests are not overridden by your rights. We assess and document those interests where appropriate.
- Consent: where you have made a clear and informed choice, particularly for optional marketing, optional sharing or another activity where consent is the appropriate basis. You may withdraw consent at any time, although this does not affect processing that took place before withdrawal.
- Vital interests: in rare circumstances where processing is necessary to protect someone's life or physical safety.
- Legal claims and other statutory conditions: where additional conditions apply to special category or criminal-offence information. We may use more than one lawful basis for different aspects of the same relationship. We will not normally rely on consent where information is required to deliver a contract, administer payroll or meet a legal obligation.
9. Website, forms, accounts, cookies and analytics
When you use our website, we may collect technical, security, account, transaction and usage information to provide the site and requested services, maintain security, administer accounts and purchases, understand how the site is used and improve its performance and content.
9.1 Website operation and hosting
Our website is built using WordPress and Divi and is hosted by Krystal. Our website, hosting and technical providers may process IP addresses, device information, server logs and other technical information required to serve pages, operate website features, detect faults, maintain security and protect the site from misuse.
9.2 Forms, reCAPTCHA, website security and backups
We use Gravity Forms and other website forms to collect enquiries, registrations and information that you choose to submit. A copy of a form entry may be retained within the website and may also be sent to authorised FE HR Hub personnel or transferred to HubSpot or another system used to manage the relevant enquiry, registration, purchase, communication or service. Please do not include sensitive or unnecessary information in a general website form.
We may use Google reCAPTCHA or similar anti-spam and security technology on forms. This may process technical information such as an IP address, device or browser information and interaction data in order to distinguish genuine users from automated or malicious activity. Where storage or access technologies are used, they will be managed in accordance with PECR and our Cookies Notice.
Website security plugins, monitoring tools and backup services may process or temporarily retain website, account, form, order and log information for security, resilience, recovery and business-continuity purposes.
Access to backups and security records is restricted and they are retained in accordance with the relevant backup or security cycle.
9.3 Cookies, analytics and visitor tracking
We use a cookie-consent management tool to provide information and controls for cookies and similar storage or access technologies. We may use Google Analytics to understand website use and performance.
We may also use other technologies described in our Cookies Notice.
Some storage or access technologies may be used without consent where a statutory PECR exception applies, for example where they are strictly necessary to provide a service you have requested or, where all legal conditions are met, solely for permitted statistical purposes. Where no exception applies, we will obtain the required consent before activating the technology. If you reject or withdraw consent, non-exempt tracking technologies will not be activated, or will cease to operate, for the relevant purposes.
Our Cookies Notice explains the categories and purposes of cookies and similar technologies in use, the relevant providers, retention or lifespan information where appropriate, and how you can accept, reject, object to or change your preferences. It is available from the website footer.
9.4 Online accounts, shop, checkout and payments
Our website includes online account, shop and checkout functionality. If you create an account or place an order, we may process your name, email address, organisation, billing or delivery details where applicable, account and login information, order history, items or services purchased, discount information, transaction references, correspondence, and records showing acceptance of relevant website, sale or service terms.
We use this information to create and administer accounts, process and fulfil orders, provide purchased products or services, communicate about transactions, manage refunds or returns where applicable, prevent fraud or misuse, maintain contractual records, and comply with accounting, tax and other legal obligations.
Where card or other online payments are made through Stripe or another payment provider, that provider will process the payment details needed to complete the transaction under its own privacy and security arrangements. FE HR Hub does not intend to store full payment-card numbers or card security codes within its general systems.
If you create a website account, you are responsible for keeping your login credentials confidential and for telling us if you believe your account has been compromised. We may suspend or restrict an account where reasonably necessary to protect the user, FE HR Hub or the security of the website.
10. Membership and community services
We use member and organisational contact information to:
- administer applications, subscriptions, renewals, invoices and member access;
- deliver member communications, resources, recordings, events and benefits;
- manage participation in the FE HR Hub community;
- respond to enquiries and provide support;
- understand member engagement and improve the membership offer; and
- confirm membership status where a member chooses to use a partner benefit or discount. Where a membership is purchased by an organisation, we may communicate with named contacts and other authorised staff using their work contact details. We may share limited information with a strategic partner where this is necessary to deliver a benefit requested by the member. We will not routinely provide a general member contact list to partners.
11. Events and Breakfast Club sessions
11.1 Event administration
We process registration, attendance, contact and accessibility information to organise events, provide joining instructions, send reminders, manage capacity, send materials and collect feedback. We may use Eventbrite, HubSpot, Zoom, Microsoft Teams, Microsoft 365 and related systems for these purposes.
Participants may be able to see the display names, images, voices or chat contributions of other attendees depending on their settings and participation. Attendees should use an appropriate display name and avoid sharing unnecessary personal information about themselves or other people.
11.2 Recordings
Breakfast Club sessions and some other online events may be recorded. Unless we explain otherwise:
- the main session may be recorded from the start;
- breakout rooms will not be recorded;
- open discussion, questions, poll results, chat messages, participant names, voices and camera images may initially be captured in the raw recording;
- we will normally edit the recording before publication and aim to remove identifiable attendee contributions that are not part of the planned speaker or facilitator content;
- the edited recording will normally be available only through the member resource library; and
- attendees may keep cameras and microphones off and should use any alternative question-submission method made available if they do not wish to appear in the recording. Recording information will be provided at registration or in joining instructions and repeated at the start of the session through an announcement or platform notification. Where a discussion is likely to involve confidential or sensitive case information, we may pause the recording. Participants must not identify employees, learners or other third parties unnecessarily when discussing workplace examples. Real cases should be anonymised wherever possible.
11.3 Speakers, sponsors and partners
We do not routinely share attendee contact details with speakers, sponsors or strategic partners. We may share aggregated or anonymised attendance and evaluation information. We will only share identifiable contact details where this is necessary to deliver the event, where another lawful basis applies, or where the attendee has made an informed choice to permit the sharing.
12. Learning, leadership and development programmes
We process information about participants to design and deliver learning, leadership, team and organisational-development programmes. This may include attendance, development objectives, questionnaires, evaluation responses, facilitator observations, action plans, reasonable adjustments and contributions to group activities.
The commissioning organisation may receive:
- attendance, completion, missed-session and cancellation information;
- evaluation results;
- aggregated or anonymised programme themes;
- team maps or group-level development information; and
- other information expressly agreed as part of the programme design. Individual comments, personal reflections and facilitator notes will not normally be attributed to a participant in a report to the commissioning organisation unless the participant has been told and there is an appropriate basis for doing so. Participants should avoid naming colleagues, employees, learners or other people during case studies and group exercises unless identification is necessary and lawful. Group participants are expected to respect the confidentiality of contributions made by others, although FE HR Hub cannot guarantee the conduct of every participant after a session.
13. Coaching and mentoring
Coaching and mentoring may involve information about work, performance, relationships, career plans, wellbeing, personal circumstances, grievances or other confidential matters.
Detailed coaching discussions are treated as confidential. Where coaching is commissioned or funded by an employer, we will not normally disclose the content of the coaching conversation or the coach's detailed notes to the employer. Information shared with the commissioning organisation will normally be limited to agreed administrative information, such as attendance, completion, missed or cancelled sessions and, where agreed, high-level progress against programme objectives.
Information may be disclosed where:
- the participant has agreed to a particular disclosure;
- disclosure is required by law or a court or regulatory authority;
- the information is necessary to establish, exercise or defend legal claims;
- there is a serious safeguarding, safety or welfare concern; or
- another lawful and proportionate basis applies.
13.1 Coaching notes and AI-assisted note taking
Coaches may make contemporaneous electronic notes and may use an approved AI-assisted note-taking tool to support note creation. The participant will be informed where an AI-assisted tool is used. Coaching sessions are not intentionally recorded for playback and FE HR Hub does not ordinarily retain a session recording or full transcript as part of the coaching record.
An AI provider may need to process audio or text transiently to generate notes. We will assess the provider, restrict access, configure available privacy controls and seek to ensure that information is not used to train general-purpose AI models. Any temporary audio, transcript or source material will be handled under the provider's settings and our documented retention and security arrangements.
The relevant coach retains their coaching notes securely rather than placing them in a general central participant file. Coaches working for FE HR Hub must follow contractual confidentiality, security, retention and deletion requirements. Coaching notes are normally retained for six years after the coaching relationship ends, unless a shorter or longer period is justified.
14. Behavioural and psychometric profiles
We use development tools such as Everything DiSC, Agile EQ, Work of Leaders, Five Behaviours and the Catalyst learning platform. These tools may generate an individual behavioural or development profile from questionnaire responses.
The information may be used to:
- provide an individual report and learning experience;
- support coaching, facilitation, team development and leadership development;
- create comparison information, team maps and group insights;
- allow participants to understand how their working preferences compare with colleagues; and
- support future development activity where the profile remains relevant. Participants typically create a Catalyst account using their college email address. Within the relevant college or cohort environment, colleagues may be able to see profile indicators or "thumbprints", use comparison tools and access team maps. Catalyst privacy and sharing settings may allow participants to manage some colleague visibility, although authorised administrators may retain access. The commissioning employer does not ordinarily receive a separate copy of every full individual profile from FE HR Hub. Participants and the commissioning college may retain access to their Catalyst environment for as long as the relevant account and platform arrangements remain active. Wiley and the commissioning organisation may process information under their own contractual and privacy arrangements. FE HR Hub may retain copies of profiles and related development information within its own systems for programme delivery and future agreed development work. We do not use behavioural assessments to make solely automated decisions that produce legal or similarly significant effects on individuals.
15. Jobs Board services
15.1 Advertisers
We collect information from colleges, recruiters and other authorised advertisers to receive, review, publish, administer and invoice for vacancy advertisements. This may include the advertiser's name, job title, contact details, organisation details, billing information, advert content, logos, images, transaction information, approval records and correspondence.
Jobs Board payments are expected to be processed through Stripe. FE HR Hub does not intend to store full payment-card details. Stripe will process payment information under its own privacy and security arrangements. Membership subscriptions will normally be invoiced rather than paid through the Jobs Board checkout.
15.2 Jobseekers and applications
Most Jobs Board vacancies will direct applicants to the advertising college or organisation's own application page. In those circumstances:
- FE HR Hub does not receive or determine the use of the application submitted to the employer;
- the advertising organisation is responsible for its recruitment privacy information; and
- FE HR Hub is not responsible for the privacy practices or application systems of the external employer website. We may process limited technical information about visits to a vacancy page and information supplied when a person contacts us about a vacancy or subscribes to alerts. The Jobs Board will not normally require a jobseeker account or candidate profile.
15.3 Vacancy distribution
Approved vacancies may be distributed through LinkedIn, HubSpot email communications, newsletters, Instagram and other relevant social media or promotional channels. Advertisers should ensure that advert content, contact information and uploaded materials are accurate and authorised for public distribution.
16. Job alerts and Jobs Board communications
Jobseekers may subscribe separately to vacancy alerts. Colleges and other organisational contacts may also subscribe to Jobs Board information. We will use the information supplied to send the category of communication requested and to manage preferences, delivery and unsubscribes.
Job-alert subscriptions will be managed separately from general FE HR Hub news wherever practicable. Every marketing or alert email will provide a clear way to unsubscribe or change preferences. We may retain a minimal suppression record after an unsubscribe so that we do not contact the person again in error.
17. Executive search, interim candidates and professional networks
FE HR Hub may receive CVs and professional information by email from individuals interested in executive search, interim, consultancy or associate opportunities. We may also identify potential candidates through professional networks and public sources.
We may use candidate information to:
- respond to an enquiry and discuss availability, preferences and suitability;
- assess or match an individual to a current or future opportunity;
- contact referees and verify qualifications, experience or professional standing;
- introduce a candidate to a client organisation where the candidate has been informed or has agreed to the introduction;
- administer interviews, assessments, offers, contracts and assignments;
- maintain a proportionate network of potential interim associates, consultants and executive candidates; and
- establish, exercise or defend legal claims and maintain recruitment records. We will not generally publish a candidate's CV or send it indiscriminately. Before sharing detailed candidate information with a prospective client, we will normally explain the opportunity and the intended recipient. Limited professional information may be discussed with a client at an earlier stage where this is lawful and does not unfairly identify or disadvantage the individual. Candidates may ask us not to retain their information for future opportunities. Where we rely on legitimate interests to maintain a candidate or associate network, individuals have the right to object.
18. Interim associates, consultants and payroll
FE HR Hub may engage individuals as temporary or interim workers paid through PAYE, or contract with consultants who provide services through their own limited companies. The precise contractual, tax and employment-status arrangements will depend on the assignment.
For PAYE workers, FE HR Hub will process information necessary to:
- confirm identity, eligibility and right to work;
- enter into and administer the engagement and assignment;
- operate payroll and make payments;
- calculate and report tax, National Insurance, pension contributions, holiday pay and other deductions or statutory payments;
- meet HMRC, pension auto-enrolment, employment, safeguarding and record-keeping obligations;
- manage timesheets, expenses, availability, absence, assignment performance and client feedback;
- respond to complaints, conduct matters, disputes, claims or safeguarding concerns; and
- communicate with the worker, client college, payroll provider, accountant, pension provider and relevant authorities. Butterfield Morgan, whose business address is the same as our registered office, is expected to provide accounting and outsourced payroll support when this service becomes operational. NEST or another pension provider may receive information needed for workplace pension administration. HMRC and other statutory bodies will receive information where required by law. For consultants operating through their own limited companies, we may process company and representative details, contracts, invoices, bank details, assignment information, tax-status information, insurance information, timesheets, expenses and performance or compliance records. We may also need to consider off-payroll working or employment-status information where applicable. Access to bank, payroll, tax, pension, identity, health and safeguarding information will be restricted to people and providers who need it for their role.
19. HR consultancy and advisory assignments
Our HR consultancy work may require us to receive and use information about client employees, workers, applicants, learners, former employees, witnesses and other individuals. This can include sensitive employment, health, safeguarding, equality, conduct, grievance, disciplinary, performance or investigation information.
We may use this information to:
- provide HR advice, project support, policy development, organisational development or workforce services;
- conduct reviews, investigations, interviews, case analysis or fact finding;
- prepare advice, notes, correspondence, reports, recommendations or outcomes;
- support fair processes and respond to legal or regulatory obligations;
- manage the client contract and quality of the assignment; and
- establish, exercise or defend legal claims. Information may be received from the client, the individual concerned, witnesses, representatives, professional advisers, documents, emails, meeting recordings or other relevant sources. We will seek to process only information that is relevant to the assignment and will restrict access appropriately. The extent to which information is shared with the client or other participants will depend on the purpose of the assignment, procedural fairness, confidentiality, legal obligations and the applicable controller or processor arrangements. Confidentiality cannot always be guaranteed where information must be disclosed to conduct a fair process or meet a legal duty, but disclosures will be limited and proportionate.
20. Marketing and HubSpot communications
We use HubSpot as our primary CRM to manage contacts, event registrations, memberships, enquiries, job alerts and communications. A person who registers for an event may be added to HubSpot so that we can administer that event and send relevant joining information, reminders, materials and feedback requests.
Event administration does not automatically mean that a person has agreed to receive all wider marketing. We may send FE HR Hub news, future event information, membership updates, Jobs Board information or information about relevant services where:
- the person has given consent;
- the electronic-marketing "soft opt-in" applies and all of its conditions are met;
- the communication is sent to a corporate subscriber and our legitimate interests are not overridden; or
- another lawful basis and PECR permission applies. Where consent is required, marketing choices will be optional and should not be a condition of event attendance. We will provide a clear unsubscribe or preference-management mechanism. A person can object to direct marketing at any time, and we will honour that request. We may use information about email delivery, opens, clicks, event attendance and expressed interests to understand engagement and tailor communications. We will not use special category information to target marketing unless there is a specific lawful basis and condition.
21. Special category information
When we process special category information, we need both an Article 6 lawful basis and an additional condition under Article 9 of the UK GDPR and the Data Protection Act 2018. Depending on the circumstances, the additional condition may include:
- employment, social security and social protection law obligations or rights;
- explicit consent for a genuinely optional and clearly explained activity;
- protection of vital interests where the individual cannot give consent;
- information manifestly made public by the individual;
- the establishment, exercise or defence of legal claims; or
- another condition permitted by law. Where required, we will maintain an Appropriate Policy Document describing how we comply with the data- protection principles and our retention and deletion approach.
22. Criminal-offence, DBS and safeguarding information
Criminal-offence information is subject to separate legal safeguards. We will only process criminal allegations, convictions, offences, barred-list information or DBS information where we have an Article 6 lawful basis and a condition under the Data Protection Act 2018, and where the processing is necessary and proportionate.
We will not normally retain a full DBS certificate or detailed certificate information for longer than needed to make and review the relevant decision. We may retain limited information such as the type and date of the check, the certificate reference, the role for which it was obtained and the outcome of the suitability decision where this is lawful and necessary.
23. Who we share personal information with
We may share information with the following categories of recipient where necessary and lawful:
- client and commissioning colleges, prospective client organisations and authorised client personnel;
- individuals involved in an HR process, where disclosure is necessary for procedural fairness or the assignment;
- Butterfield Morgan and other accountants, payroll bureaux, auditors, tax advisers and professional advisers;
- HMRC, The Pensions Regulator, NEST or another pension provider, courts, regulators, law-enforcement bodies and other public authorities;
- banks, payment providers and Stripe;
- website, hosting, forms, online shop and account, cookie-consent, CRM, communications, cloud- storage, videoconferencing, event, scheduling, analytics, anti-spam, learning, assessment, backup, security and IT providers;
- WordPress, Divi, Krystal, Gravity Forms, HubSpot, Microsoft, Zoom, Eventbrite, Calendly, Google (including Google Analytics, Google Search Console and Google reCAPTCHA), Wiley/Catalyst, LinkedIn, Instagram, Stripe, and providers of our cookie-consent, online shop/account, website security and backup tools;
- coaches, facilitators, associates, consultants, investigators and subcontractors engaged to deliver services;
- occupational health, DBS, safeguarding, identity, right-to-work, background-check or insurance providers where applicable;
- referees, previous employers and professional bodies where checks are authorised and appropriate;
- speakers, sponsors and strategic partners where necessary for a service or where the individual has agreed; and
- a purchaser, investor or adviser involved in a business reorganisation, merger or sale, subject to appropriate confidentiality and safeguards. We require service providers that act as processors to protect personal information, maintain confidentiality, apply appropriate security and act only on documented instructions. Some recipients, including HMRC, regulators, banks, payment providers and platform operators, may act as independent controllers for their own purposes. We do not sell personal information.
24. International transfers
Some of our technology and service providers operate internationally or may store or access information outside the United Kingdom. This may include providers connected with HubSpot, Microsoft, Zoom, Google, Eventbrite, Calendly, Stripe, Wiley/Catalyst, LinkedIn, Instagram, online shop/account services, website security or backup services, or AI-assisted tools.
Where personal information is transferred outside the UK, we will take steps to ensure that the transfer is lawful. Depending on the destination and provider, safeguards may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where applicable, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, and supplementary contractual, organisational or technical safeguards.
Further information about a relevant transfer or safeguard can be requested from our Data Protection Lead, subject to commercial confidentiality and legal restrictions.
25. Data security
We use proportionate technical and organisational measures designed to protect personal information from unauthorised access, accidental loss, alteration, disclosure or destruction. Measures may include:
- role-based access and limiting information to people with a genuine need to know;
- passwords, multi-factor authentication and secure account management;
- encryption and secure transfer methods where appropriate;
- secure cloud storage, tested backups, timely software and plugin updates, security monitoring and malware protection;
- confidentiality and data-protection obligations in contracts;
- staff, coach, associate and contractor guidance and training;
- separate or restricted storage for payroll, coaching, health, safeguarding and case information;
- supplier due diligence and data-processing agreements; and
- incident response, breach assessment and notification procedures. No internet, email or cloud system can be guaranteed to be completely secure. Individuals should use secure channels where provided and should not send bank, identity, health or other highly sensitive information through a general enquiry form or unprotected email unless this has been agreed.
26. How long we keep personal information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, contractual, tax, payroll, pension, safeguarding, professional, insurance and claims requirements. We consider the amount, nature and sensitivity of the information, the risk of harm, whether the purpose can be achieved in another way and any statutory retention period.
Our normal retention periods are set out in Appendix 1. A record may be kept for longer where there is an ongoing contract, complaint, investigation, legal hold, audit, claim or regulatory requirement. We may delete information earlier where it is no longer needed. Anonymised information that no longer identifies an individual may be retained for research, trend analysis, service improvement or historical purposes.
27. Automated decision-making and profiling
We do not currently make solely automated decisions that produce legal or similarly significant effects on individuals.
We may use systems to search, organise, filter or identify information according to criteria chosen by a person. Behavioural assessments generate individual profiles and comparison information from questionnaire responses, but the results are used to support human-led learning, coaching and development.
A person remains involved in decisions about recruitment, assignment, programme delivery and professional advice.
If we introduce significant automated decision-making in the future, we will update this Policy and provide the information and safeguards required by law.
28. Your data protection rights
Depending on the circumstances and any applicable exemptions, you may have the right to:
- be informed about how your personal information is used;
- request access to your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information where there is no lawful reason to retain it;
- ask us to restrict processing in certain circumstances;
- object to processing based on legitimate interests;
- object at any time to the use of your information for direct marketing;
- receive information you provided to us in a structured, commonly used and machine-readable format, and ask us to transfer it, where the portability right applies;
- withdraw consent at any time where we rely on consent; and
- seek safeguards in relation to qualifying automated decision-making. Some rights do not apply in every situation. For example, information may need to be retained to comply with law, protect another person's rights, preserve legal privilege or establish, exercise or defend legal claims. We will normally respond to a valid request within one month. We may ask for information to confirm identity and clarify the scope of the request. We will not usually charge a fee, although the law permits a reasonable fee or refusal in limited circumstances, including manifestly unfounded or excessive requests.
29. Accuracy and your responsibilities
We take reasonable steps to keep personal information accurate and up to date. Please tell us promptly if your contact, payment, tax, employment, availability or other relevant information changes.
Where you create an account with a third-party platform such as Catalyst, Eventbrite or another service, you may also be able to update information and privacy settings directly through that platform.
30. Complaints
Please contact our Data Protection Lead first if you have a question or concern. We will investigate and seek to resolve the matter fairly and promptly.
You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection. Information about making a complaint is available at ico.org.uk. You may also have the right to seek a remedy through the courts.
31. Links and third-party services
Our website, emails, event materials and job adverts may link to third-party websites or platforms. Those organisations may collect and use information under their own privacy policies. We are not responsible for the privacy practices of an external employer, website or platform where it acts independently of FE HR Hub.
32. Changes to this Policy
We may update this Policy to reflect changes in law, guidance, technology, suppliers or our services. The latest version will be published on our website and the effective date will be shown at the beginning. Where a change materially affects how we use existing information, we will provide additional notice where appropriate.
Appendix 1: Normal retention schedule
These periods are our normal operational starting points. They may be shortened or extended where a different legal, contractual, professional or risk-based period applies.
| Record type | Normal retention period |
|---|---|
| General website enquiries and routine correspondence | Substantive enquiry records retained in HubSpot, Outlook or another business system are normally kept for up to two years after the enquiry or matter closes, where reasonably required. The separate website/Gravity Forms copy is retained for 12 months from submission as set out below. |
| Client, supplier and membership contracts | Six years after the contract or relationship ends. |
| Invoices, payments, tax and accounting records | Six years after the end of the relevant financial year, or longer where required by law. |
| Membership administration and access records | For the membership relationship and normally six years afterwards for contractual and financial records; routine engagement data may be deleted earlier. |
| Job advert submissions, advertiser details and advert instructions | Normally 12 months after the advert closes. Related contractual, accounting and payment records are retained under the applicable financial or contract retention period. |
| Published vacancy content | Removed from public view after expiry and may be retained for up to 12 months after the advert closes for administration, evidence and service management, unless a longer period is required for a dispute, complaint or legal claim. |
| Stripe transaction information held by FE HR Hub | Where the transaction relates to an online shop order or payment record, normally six years plus the current tax year. Other financial records are retained in accordance with the applicable accounting and tax retention period. FE HR Hub does not intend to retain full card details. |
| Job-alert and Jobs Board subscriber details | Until unsubscribe, objection or a documented inactivity review indicates that the subscription should end. |
| Marketing consent and preference records | For as long as marketing continues and afterwards for as long as needed to evidence the permission, preference or objection. |
| Marketing suppression records | Minimal information retained for as long as reasonably necessary to honour the opt-out. |
| Unsuccessful candidate information for a specific interim, consultancy or executive-search opportunity | Normally twelve months after the selection decision or closure of the process. |
| Candidate or associate CV retained for future opportunities | Normally two years after the last meaningful contact or update, followed by deletion or renewal of contact. |
| Successful placement and assignment records | Normally six years after the assignment, engagement or placement ends. |
| Interim worker contract and personnel file | Normally six years after the final engagement or assignment ends, subject to statutory and claims requirements. |
| Timesheets, pay, fees, expenses and payment records | Normally six years after the end of the relevant financial year. |
| PAYE and statutory payroll records | At least three years from the end of the tax year to which they relate; FE HR Hub may use a six-year operational period where records also support contractual, accounting or claims requirements. |
| Holiday and holiday-pay records | Normally six years from creation or the end of the relevant engagement. |
| Workplace pension records | Normally six years; opt-out notices are normally retained for four years. |
| Bank details for worker or consultant payments | For the active relationship and payment reconciliation, then deleted or restricted when no longer required. Necessary transaction records remain in financial systems. |
| Right-to-work check records | For the duration of the engagement and two years afterwards. |
| Full DBS certificate information | Normally no longer than six months after the relevant decision, unless a documented exception applies. |
| Limited DBS check and suitability metadata | For the period justified by the role, safeguarding obligations, audits and claims risk, with regular review. |
| Health, disability and reasonable-adjustment information | For as long as needed to provide the adjustment or manage the engagement, followed by review. Restricted records may be retained for up to six years where necessary. |
| Assignment performance, complaint, conduct or safeguarding records | Normally six years after the assignment or closure of the matter, subject to the nature and seriousness of the record. |
| Programme registration, administration and attendance | Normally three years after the programme ends. |
| Missed or cancelled coaching and programme sessions | Normally three years, or six years where needed for contractual, financial or dispute records. |
| Identifiable evaluation responses | Normally two years after the event or programme, after which they are deleted or anonymised. |
| Anonymised evaluation themes and reports | May be retained indefinitely where individuals can no longer be identified. |
| FE HR Hub copies of behavioural profiles and team information | Normally for the active programme or client relationship and three years after last use, unless a longer period is agreed or needed for continuing development work. |
| Information held within a college Catalyst environment | According to the college's and Wiley/Catalyst's account, platform and retention arrangements. |
| Coaching notes | Normally six years after the coaching relationship ends. |
| Event and Breakfast Club attendance records | Normally two years after the event, subject to membership and marketing records that have a separate purpose. |
| Raw Breakfast Club or event recordings | Normally up to 90 days to allow editing, checking and publication. |
| Edited member-library recordings | Normally four years, followed by a documented review of relevance, accuracy and continuing value. |
| Raw chats, transcripts, poll exports and Q&A files | Normally up to 90 days, unless required for event follow-up, complaint handling or another documented purpose. |
| HR consultancy assignment files | According to the client contract and controller instructions where FE HR Hub is a processor; otherwise normally six years after the assignment or closure of the matter, subject to legal privilege, claims and safeguarding needs. |
| Data-rights requests and complaints | Normally six years after closure. |
| Personal-data breach and security incident records | Normally six years after closure, with longer retention where required by an ongoing claim or regulator. |
| Website security and access logs | Normally up to twelve months, unless needed to investigate a security incident. |
| Routine system backups | According to the relevant backup cycle, normally overwritten within 30 to 90 days, subject to technical and security requirements. |
| Website and Gravity Forms entries | Routine form entries stored within WordPress/Gravity Forms are retained for 12 months from submission and then deleted where no longer needed. If the information is transferred into HubSpot, Outlook or another business system and becomes part of a substantive enquiry, contract, event, recruitment, safeguarding, complaint or other record, the retention period for that underlying purpose applies. |
| Website customer account information | For as long as the account remains active and normally up to two years after the last meaningful account activity or account closure, unless information must be retained longer as part of an order, contract, legal claim or financial record. |
| Online shop orders and payment records | Normally retained for six years plus the current tax year, including where required for HMRC, accounting, contractual, refund, chargeback or legal purposes. Unnecessary payment- card information is not retained by FE HR Hub. |
| Records of acceptance of website, sale or service terms | Normally six years after the relevant transaction, order or contractual relationship ends, so that FE HR Hub can evidence the terms that applied and the agreement made. |
| Cookie consent and tracking preferences | Retained for 12 months. At the end of that period, consent and preferences will be requested again, subject to any earlier change or withdrawal by the visitor. Individual cookie lifespans are described in the Cookies Notice. |
| Website security and anti-spam records | Normally up to twelve months, unless the information is needed for longer to investigate or evidence a security incident, abuse, fraud or legal claim. |
Appendix 2: Key service providers and platforms
The providers used may change over time. The main providers and categories currently expected or in use include the following. Where a particular website plugin or technical supplier is not named, the relevant service category is described so that the type of recipient remains transparent.
| Service category | Provider or example |
|---|---|
| Website and hosting | WordPress, Divi and Krystal hosting. |
| CRM and communications | HubSpot and Microsoft 365/Outlook. |
| Online events and meetings | Zoom and Microsoft Teams. |
| Event registration and scheduling | Eventbrite and Calendly. |
| Payments | Stripe and banking providers. |
| Learning and behavioural assessment | Wiley, Everything DiSC and Catalyst. |
| Analytics and search performance | Google Analytics and Google Search Console. |
| Professional and social platforms | LinkedIn and Instagram. |
| Accounting and payroll | Butterfield Morgan and relevant payroll software or services when the interim payroll service becomes operational. |
| Pension administration | NEST or another selected workplace pension provider. |
| Other specialist providers | Approved coaches, facilitators, consultants, AI-assisted note-taking tools, identity, right-to-work, DBS, occupational health and professional-advisory providers where required. |
| Website forms and anti-spam | Gravity Forms and Google reCAPTCHA. |
| Online shop and customer accounts | WordPress-based account, basket, checkout and order- management functionality, with Stripe or other approved payment providers for online payments. |
| Cookie consent and preference management | The website cookie-consent/banner tool used to record and apply visitor choices. |
| Website security and backups | The website security plugin and backup tools used to protect, monitor, back up and restore the website and its data. |