Data protection and privacy policy

t2 group is committed to protecting and respecting the privacy of individuals and handling personal data responsibly, securely, and transparently in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), as amended and the Privacy and Electronic Communications Regulations (PECR), and other applicable data protection legislation.

This policy explains how t2 group collects, uses, stores, shares, retains, and safeguards personal data and demonstrates the organisation’s commitment to accountability through appropriate governance, policies, technical and organisational measures, staff training, and ongoing monitoring.

The UK GDPR sets out the following key principles which t2 group will comply with:

• Lawfulness, fairness, and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality (security)
• Accountability

Personal data will only be processed where there is a clear lawful basis and where individuals would reasonably expect such processing to occur.

All personal data processing at t2 group will be conducted in compliance with applicable data protection legislation. This includes implementing appropriate technical and organisational measures to ensure personal data is processed securely, lawfully, and fairly.

This includes:

• Maintaining appropriate data protection policies and procedures
• Appointing a Data Protection Officer (DPO) with responsibility for overseeing data protection compliance
• Conducting Data Protection Impact Assessments (DPIA) where appropriate
• Ensuring staff receive data protection and information security training
• Managing and recording personal data breaches
• Monitoring compliance through periodic review and audit activities
• Applying privacy by design and default principles to systems and processes

All employees, contractors, consultants, and temporary staff are expected to comply with this policy and associated procedures.

t2 group processes personal data where an appropriate lawful basis applies under Article 6 UK GDPR.

3.1 Consent
Processing where a clear and freely given opt-in is required, including certain electronic marketing communications and optional activities.

Individuals may withdraw consent at any time where consent is relied upon.

3.2 Contract
Processing necessary:

• To fulfil contractual obligations with an individual
• To deliver training, education, employment, or support services
• To take steps prior to entering into contract

3.3 Legal Obligation
Processing required to comply with statutory, regulatory, safeguarding, employment, taxation, funding body, or other legal obligations.

3.4 Vital Interests
Processing necessary to protect the vital interests of an individual or another person, including emergency situations involving health or safety.

3.5 Public Task
Where applicable, processing may be undertaken in connection with activities carried out in the public interest or under statutory authority, including publicly funded educational or training activities.

3.6 Legitimate Interests
Processing necessary for legitimate organisational or business interests, except where overridden by rights and freedoms of individuals.

Where legitimate interests are relied upon, t2 group will assess:

• The purpose of the processing
• Whether the processing is necessary
• The impact on individuals’ rights and freedoms

Examples may include:

• Fraud prevention
• Information security
• Internal investigations
• Service improvement
• Administrative management
• Network and systems security

t2 group may process special category data where permitted under Article 9 UK GDPR and Schedule 1 of the Data Protection Act 2018.

This may include:

• Health data
• Equality and diversity data
• Safeguarding information
• Trade union membership information
• Biometric data where applicable

Processing will only occur where:

• Appropriate lawful conditions apply
• Processing is necessary and proportionate
• Appropriate safeguards are implemented

Criminal offence data will only be processed where authorised by law and subject to appropriate confidentiality and security measures.

t2 group maintains an Appropriate Policy Document (APD) where required under the Data Protection Act 2018.

Personal data will only be retained for as long as necessary to fulfil the purposes for which it was collected, including legal, regulatory, safeguarding, contractual, funding, and operational requirements.

Data will be securely deleted, anonymised, archived, or disposed of in accordance with the organisation’s Data Retention Policy and records management procedures.

5.1 Employee

• Retained in line with employment law, HMRC requirements, safeguarding obligations, and organisational retention schedules available on our website: www.t2group.co.uk
• Archived employee files are subject to restricted access controls and may only be accessed where necessary and authorised

5.2 Learner Data

• Retained in compliance with funding body regulations (typically six years after completion) in line with our Data Retention Policy, available on our website: www.t2group.co.uk
• Any variances to this will be expressly agreed accordingly with the individual

Under UK GDPR, individuals have the following rights regarding their personal data.

6.1 Right to Be Informed
Individuals have the right to receive clear and transparent information about how their personal data is processed.

6.2 Right of Access
Individuals may request access to their personal data.

Requests should be submitted to dataprotection@t2group.co.uk

t2 group will respond within the applicable statutory timeframe. Where permitted by law, response times may be extended or paused where further information or clarification is reasonably required.

6.3 Right to Rectification
Individuals may request correction of inaccurate data or incomplete personal data.

Where appropriate and feasible, relevant third parties will be informed of corrections.

6.4 Right to Erasure (“Right to be Forgotten”)
Individuals can request deletion of their data where there is no compelling reason for continued processing.

Requests will be assessed against applicable legal, contractual, safeguarding, funding, regulatory, and organisational purposes.

6.5 Right to Restriction of Processing
Individuals can request that processing of their personal data be limited in certain circumstances.

6.6 Right to Object
Individuals may object to processing based on legitimate interests in certain circumstances. Individuals have an absolute right to object at any time to the processing of their personal data for direct marketing purposes.

Objection requests can be submitted to dataprotection@t2group.co.uk

6.7 Right to Data Portability
Where applicable, individuals can request their personal data in a structured, commonly used, and machine-readable format.

6.8 Rights Related to Automated Decision-Making
Where solely automated processing is used to make a decision that produces legal or similarly significant effects, t2 group will ensure that an appropriate lawful basis and required safeguards are in place. These may include providing information about the decision, enabling the individual to make representations, obtain human intervention and contest the decision.

6.9 Right to Complain
Individuals have the right to raise concerns or make a data protection complaint directly with t2 group. Complaints will be handled in accordance with our Complaints Procedure and applicable data protection legislation. Individuals also have the right to lodge a complaint with the information Commissioner’s Office (ICO); available at: https://ico.org.uk

t2 group follows a Data Breach Response Plan to identify, assess, manage, and record personal data breaches.
This includes:

• Internal reporting and escalation requirements
• Breaches are assessed for risk to individuals’ rights and freedoms
• Containment and remediation measures
• Where notification is required, the ICO will be notified without undue delay and, where feasible, within 72 hours of t2 group becoming aware of the breach
• Affected individuals are informed where applicable
• Maintenance of breach records and lessons learned reviews

All staff must report suspected personal data breaches immediately.

t2 group implements Privacy by Design and Default principles when implementing systems, processes, and business activities.

Appropriate technical and organisational security measures may include:

• Role-based access controls
• Data encryption and anonymisation/pseudonymisation
• Regular security audits
• Multi-factor authentication where appropriate
• Secure storage and disposal controls
• Network and endpoint security measures
• Access logging and monitoring
• Vulnerability management and patching
• Backup and recovery procedures
• Confidentiality obligations for staff and suppliers

Data Protection Impact Assessments (DPIAs) will be undertaken where processing is likely to result in a high risk to individuals.

Where personal data is transferred outside the UK, t2 group will ensure appropriate safeguards are implemented in accordance with Chapter V UK GDPR.

Safeguards may include:

• UK adequacy regulations
• International Data Transfer Agreements (IDTAs
• The UK Addendum to approved Standard Contractual Clauses, where applicable
• Transfer risk assessments
• Additional technical and organisational safeguards where appropriate

t2 group will comply with the Privacy and Electronic Communications Regulations (PECR) when undertaking electronic marketing activities or using cookies and similar technologies.

This includes:

• Obtaining consent for non-essential cookies where required
• Providing clear cookie information through cookie notices and banners
• Respecting unsubscribe and marketing preference requests
• Ensuring electronic marketing communications are lawful and
• Managing consent and communication preferences appropriately

Further details are available within the organisation’s Cookie Policy and Privacy Notice.

Where third-party suppliers process personal data on behalf of t2 group, appropriate due diligence and contractual safeguards will be implemented.

This includes:

• Data processing agreements compliant with Article 28 UK GDPR
• Security and confidentiality obligations
• International transfer safeguards where applicable
• Ongoing supplier oversight where appropriate

All staff are responsible for protecting personal data and complying with this policy.

t2 group will provide appropriate data protection, privacy, cybersecurity, and information governance training to staff on a periodic basis.

Failure to comply with this policy may result in disciplinary action.

t2 group reserves the right to amend this policy as needed.

For any questions or concerns, contact our Data Protection Officer: Email: dataprotection@t2group.co.uk

Address: t2 group, Fern House, Unit 1, Links Court, Fortran Road, St. Mellons, Cardiff CF3 0LT.

This policy will be reviewed annually, or sooner where required, to ensure continued compliance with applicable UK data protection legislation and regulatory guidance.