How National Learning Group protects your personal data

This Privacy Notice applies to students, parents and guardians, tutors, teachers, internal staff, and any other individual or business that uses NLG products or services or participates in research programmes conducted by the National Learning Group.

• Students, parents and guardians, referred to as Clients.
• Tutors, teachers and internal staff.
• Any other person or business using NLG services or taking part in NLG research activity.

NLG uses personal data to provide individually tailored tutoring and learning support. This may include contacting approved representatives to discuss progress, learning needs, privacy matters or safeguarding concerns where appropriate.

• To provide suitable tutoring and learning support.
• To match students with appropriate tutors and services.
• To communicate with clients, approved representatives and relevant staff.
• To support safeguarding, quality assurance and service improvement.
• To research the impact of NLG services on student learning outcomes using minimal necessary data.

NLG will never sell personal data or use it to market or sell non-NLG products or services. Non-personal data may be shared in aggregated or anonymised form, provided that individuals cannot be identified from that data.

NLG does not keep personal data for longer than is necessary. Personal data is retained while a Client is active. When a user stops using NLG, their data is retained only for as long as necessary to meet reporting, safeguarding, legal or operational requirements.

• When personal data is no longer required, it will be deleted or stripped of identifying data.
• Where re-identification is not possible, data may no longer be personal data and may be retained by NLG.
• Video lesson recordings are secured for 90 days before being deleted.
• Calls are held only for as long as necessary.

NLG collects data that is necessary to provide safe, suitable and effective tutoring services. We do not collect unnecessary data and we do not process personal information in ways that are not specified in this notice.

Through tutoring services, some special category information may be accidentally captured or disclosed during contact or recorded tutoring sessions. Where this creates a safeguarding or privacy concern, NLG will take appropriate steps, including discussing data destruction options where relevant.

NLG processes personal data using the following lawful bases, depending on the context and the type of data being handled.

NLG follows the core data protection principles when handling personal data.

• Lawfulness, fairness and transparency.
• Purpose limitation.
• Data minimisation.
• Accuracy.
• Storage limitation.
• Integrity and confidentiality.

Depending on the circumstances, data subjects may have the following rights over their personal data.

• Access: request access to personal data.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of data under certain conditions.
• Restriction: request restriction of processing under certain conditions.
• Data portability: request transfer of data to another organisation.
• Objection: object to processing under certain conditions.
• Consent: withdraw consent at any time where relevant.
• Complaint: complain to the Information Commissioner’s Office in the United Kingdom.

NLG implements appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.

• Encryption of sensitive data in transit and at rest where appropriate.
• Access controls that restrict access based on roles and responsibilities.
• Regular security audits and risk assessments.
• Safeguarding-aware handling of education, health and sensitive information.

NLG ensures that third-party vendors comply with GDPR requirements by taking appropriate steps before and during supplier relationships.

• Due diligence before engaging vendors.
• Data processing agreements outlining GDPR obligations.
• Regular monitoring and review of vendor compliance with data protection standards.

NLG does not collect special categories of information via third-party vendors without due notification. Where a partner service uses NLG, or where NLG refers a Client to a partner service, relevant privacy notices and data-sharing arrangements apply.

In the event of a data breach, NLG will take appropriate steps to contain, assess and respond to the incident.

• Contain and recover: immediately contain the breach and begin recovery procedures.
• Assess impact: assess the potential impact on data subjects.
• Notify authorities: notify the Information Commissioner’s Office within 72 hours, if required.
• Communicate: inform affected data subjects if the breach poses an elevated risk to their rights and freedoms.

To provide NLG services through a web browser, NLG and associated third parties may place cookies on users’ devices. Cookies are used to collect standard internet logs and user behaviour information.

• To arrange and improve website content.
• To support website security.
• To track use of NLG services.
• To compile statistical reports.
• To support online advertising or marketing where consent and settings allow.

This policy will be reviewed annually or when there are significant changes in the workplace, a new workplace is added, or relevant legislation requires a review.

This policy is approved by the Data Protection Officer of the National Learning Group, reporting operationally to the Managing Director of the National Learning Group, and updating the Human Resources Manager with all non-sensitive changes.

This policy requires all changes to be tracked and reviewed. The current version should always be noted, with quality control completed by the Data Protection Officer where required.