Data Protection and Information Governance Policy

Policy Overview and Purpose

Consoul Ltd is committed to processing all personal data securely, lawfully, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As a training provider and CMI Approved Centre, Consoul Ltd collects and processes personal information relating to learners, clients, contractors, and business contacts.

This policy outlines how Consoul Ltd collects, uses, stores, and protects personal data to ensure compliance with privacy laws and to safeguard individual rights.

Scope

This policy applies to:

• Conrad Mepham-Stone (Lead Trainer/Director & Data Protection Lead) and any associate trainers, assessors, or external contractors engaged by Consoul Ltd.
• All personal data collected, stored, or processed by Consoul Ltd across all training courses, workshops, qualification delivery, and business administration.

Data Protection Principles

Consoul Ltd adheres to the six data protection principles set out in UK GDPR, ensuring personal data is:

1. Lawful, Fair, and Transparent: Processed lawfully, fairly, and in a transparent manner in relation to individuals. 2. Purpose Limitation: Collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. 3. Data Minimisation: Adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. 4. Accuracy: Accurate and, where necessary, kept up to date. 5. Storage Limitation: Kept in a form which permits identification of data subjects for no longer than is necessary. 6. Integrity and Confidentiality: Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

Types of Data Collected & Purpose of Processing

Consoul Ltd collects personal information necessary to deliver training, process qualification registrations, and manage business operations:

• Learner & Client Identifiers: Full name, email address, phone number, physical address, and employer details.
• Qualification & Assessment Data: Awarding body candidate registration numbers (e.g., CMI numbers), assessment submissions, feedback records, attendance records, and RPL/special consideration claims.
• Special Category Data: Health, medical, or disability disclosures submitted strictly for processing Reasonable Adjustments or Safeguarding concerns (processed under explicit consent or legal duty).
• Financial Information: Billing details, transaction history, and invoicing data for course registrations.

Data Security and Storage

• Digital Security: Personal data stored digitally is protected using strong password controls, multi-factor authentication (MFA), role-based access, and modern encryption standards.
• Cloud & Platform Security: Qualification and assessment records submitted to awarding bodies are managed through secure portals (such as CMI Partner Connect) in compliance with awarding body protocols.
• Physical Security: Any paper-based records, signed authenticity declarations, or physical logs are stored in locked storage facilities accessible only by authorized personnel.

Data Sharing & Third Parties

Consoul Ltd does not sell or lease personal data to third parties. Personal data is shared only when necessary and lawful:

• Awarding Bodies & Regulators: Shared with awarding organisations (such as CMI) and qualification regulators (e.g., Ofqual) for candidate registration, certification, quality assurance, and auditing.
• Legal & Safeguarding Authorities: Disclosed where required by law, court order, or statutory safeguarding duty (e.g., Police, Social Care, or Prevent authorities).

Data Retention Schedule

• Standard Qualification & Assessment Records: Retained for up to 5 years post-completion to support external quality audits and verification.
• Permanent Integrity Records: Decisions resulting in candidate withdrawal, academic misconduct, or certificate revocation are retained indefinitely for attestation purposes.
• Financial & Accounting Records: Retained for 6 years in line with statutory UK tax requirements.
• General Enquiries: Deleted or archived after 12 months if no active contract or training registration proceeds.

Individual Rights (Data Subject Rights)

Under UK GDPR, learners and clients have the following rights regarding their data:

• Right of Access: Request a copy of the personal data held by Consoul Ltd (Subject Access Request).
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ('Right to be Forgotten'): Request deletion of data where legal retention periods have expired and processing is no longer required.
• Right to Restrict or Object: Object to processing based on direct marketing or legitimate interests.

To exercise any of these rights, contact Conrad Mepham-Stone directly at conradmstone@consoulnlp.com. Requests will be acknowledged within 3 working days and fulfilled within one calendar month.

Data Breach Management

In the event of a suspected or actual personal data breach (e.g., unauthorized access, loss, or leak of personal information):

1. Conrad Mepham-Stone will immediately assess the risk to individual rights and freedoms. 2. Containment and recovery actions will be executed immediately. 3. If a high risk to individuals is identified, the Information Commissioner's Office (ICO) and affected data subjects will be notified within 72 hours in accordance with statutory guidelines.

Monitoring and Review

This policy is reviewed annually by Conrad Mepham-Stone to reflect evolving UK data protection legislation, technological updates, and awarding body guidelines.