Privacy Notice

This Privacy Notice explains how t2 group collects, uses, stores, shares, and protects personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended, and the Privacy and Electronic Communications Regulations (PECR), and other applicable legislation.

This Privacy Notice explains:

• What personal data we collect
• How and why, we use personal data
• Who we share information with
• How long we keep information
• Your rights in relation to your personal data
• How to contact us regarding privacy matters

This Privacy Notice should be read alongside our Cookie Policy, Data Protection Policy and other related policies.

t2 group is a data controller responsible for determining how and why your personal data is processed.

This Privacy Notice applies to personal data provided to us, by individuals themselves or by others, including but not limited to information collected through our services, websites, apprenticeship and training programmes, recruitment activities, business relationships, and communications.

We process personal data only where we have a lawful basis to do so and for the purposes described in this Privacy Notice or as otherwise stated at the point of collection.

We collect and process personal data necessary for providing our services and operating our business activities, including:

Identity Data – Name, date of birth, national insurance number, and employee or learner identification numbers.

Contact Details – Home address, phone number, and email address.

Employment Data – Job role, employer details, payroll information, attendance records, performance and training records.

Apprenticeship & Training Data – Course details, qualifications, assessments, learning support information, and funding-related records.

Technical Data – IP addresses, cookies and tracking technologies, and website usage

Marketing & Communications Data – Marketing preferences, communication records and enquiry information.

Where necessary and permitted by law, t2 group may process special category personal data, including:

• Health information
• Equality and diversity information
• Safeguarding information
• Learning support requirements

Such processing will only occur where an appropriate condition under Article 9 UK GDPR and Schedule 1 of the Data Protection Act 2018 applies.

Where relevant to safeguarding, compliance, recruitment, regulatory obligations, or training requirements, t2 group may process criminal offence data, including DBS check information.

Such processing will only occur where permitted by Article 10 UK GDPR and the Data Protection Act 2018.

We may obtain personal data from:

• Individuals directly
• Employers
• Government departments and funding bodies
• Awarding organisations
• Publicly available sources
• Regulatory authorities
• Third-party service providers
• Recruitment agencies
• Website and online interactions

Where personal data is not obtained directly from the individual, we will process the information in accordance with applicable transparency obligations.

We process personal data for the following lawful purposes:

Purpose: Managing employment relationships.
Lawful Basis: Contract / Legal obligation.

Purpose: Delivering apprenticeship and training services.
Lawful Basis: Contract / Legal obligation.

Purpose: Compliance with funding and regulatory requirements.
Lawful Basis: Legal obligation.

Purpose: Safeguarding and learner welfare.
Lawful Basis: Legal obligation / Vital interests.

Purpose: Managing payroll and finance.
Lawful Basis: Contract / Legal obligation.

Purpose: Service improvement and internal analysis.
Lawful Basis: Legitimate interests.

Purpose: Website analytics and security.
Lawful Basis: Legitimate interests / Consent.

Purpose: Marketing communications.
Lawful Basis: Consent / PECR soft opt-in where applicable.

Purpose: Recruitment and onboarding.
Lawful Basis: Contract / Legitimate interests.

Where we rely on legitimate interests, we will ensure that our interests do not override individuals’ rights and freedoms.

Where required under PECR and UK GDPR, we will only send electronic marketing communications where:

• valid consent has been obtained; or
• another lawful exemption applies

You may withdraw consent or opt out of marketing communications at any time by:

• using the unsubscribe link within communications; or
• contacting us directly

Marketing preferences can be updated at any time

Our website uses cookies and similar technologies to:

• enable website functionality;
• improve user experience;
• analyse website performance;
• support website security; and
• provide advertising where appropriate

Non-essential cookies will only be used where you have provided consent through our cookie preference tools.

Further information is available within our Cookie Policy.

We may share personal data with:

Government and Funding Bodies (e.g., Department for Education (DfE), Welsh Government, HMRC)

Awarding Bodies (e.g., City & Guilds, TQUK, Pearson, ILM, OCR)

Regulatory Authorities (e.g., Ofsted, ICO, and other competent authorities)

Third-party service providers (for IT services, Compliance, Payroll, Security and Training platforms)

We require third parties processing personal data on our behalf to implement appropriate security and confidentiality measures.

We do not sell personal data.

Some service providers may process personal data outside the UK.

Where international transfers occur, t2 group will ensure appropriate safeguards are implemented in accordance with UK data protection legislation, including:

• adequacy regulations;
• the UK International Data Transfer Agreement (IDTA);
• approved contractual clauses; or
• other lawful transfer mechanisms where required

We retain personal data for no longer than is necessary to fulfil the purposes for which it was collected, including legal, contractual, safeguarding, funding, reporting and regulatory obligations.

Examples include:

Record Type: Apprenticeship and learner records.
Retention Period: In accordance with funding body requirements.

Record Type: Employee records.
Retention Period: Typically, up to 6 years after termination.

Record Type: Financial records.
Retention Period: Typically, 6 years (per HMRC requirements).

Record Type: Marketing records.
Retention Period: Until consent is withdrawn or objection received. Limited information may be retained on a suppression list to ensure marketing preferences continue to be respected.

Record Type: CCTV and security records.
Retention Period: In accordance with operational retention schedules.

Retention periods may be extended where necessary for legal claims, investigations, safeguarding, or regulatory obligations.

t2 group implements appropriate technical and organisational measures designed to protect personal data against:

• accidental loss;
• unauthorised access;
• unlawful disclosure;
• destruction;
• alteration; or
• misuse

Security measures may include:

• role-based access controls;
• encryption;
• secure storage;
• staff training;
• monitoring and audit processes;
• password protection / management; and
• data minimisation practices

Under UK GDPR, individuals may have the right to:

Access personal data – You have a right of access to your own personal data held by t2 group. A request to see the personal data held by t2 group can be made through a Subject Access Request by emailing or writing to us using the contact details provided below.

Rectify inaccurate personal data – You have the right to have inaccurate personal data held by t2 group rectified or completed if it is incomplete. This can be done by emailing or writing to us using the contact details provided below.

Erase personal data – Once personal data collected by t2 group is no longer necessary for the purpose for which it was collected and processed, you may have the right to have the data erased (subject to legal exceptions). t2 group manages the retention period of data held through its retention schedule.

Restrict personal data – In certain circumstances, you have the right to restrict the processing of your personal data. This is likely to arise when there is an issue concerning the accuracy or the legitimate grounds for processing of the personal data.

Object to processing – Object to processing for marketing purposes. t2 group will stop processing the personal data unless there are compelling legitimate grounds for the processing, which override your interests, rights and freedoms.

Data portability – You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format.

Withdraw consent – You have the right to withdraw your consent at any time where processing is based on consent.

Object to direct marketing – You have the right to object to processing of your personal data for direct marketing purposes at any time. Where you object, we will stop processing your personal data for direct marketing purposes.

Automated decision-making – Request human review of automated decisions where applicable

These rights are subject to applicable legal exemptions and limitations.

To exercise these rights, contact us at:
Email: dataprotection@t2group.co.uk

t2 group does not ordinarily make decisions based on automated processing that produce legal or similarly significant effects on individuals.

Where automated processing is introduced, appropriate safeguards will be implemented in accordance with UK GDPR requirements.

If you have concerns regarding how your personal data has been handled, please contact us in the first instance. We have a process for handling data protection complaints and will investigate and respond in accordance with applicable data protection legislation.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.

You can contact the ICO at: Information Commissioner’s Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL

Telephone: 0303 123 1113

Website: https://ico.org.uk

t2 group may review and update this Privacy Notice periodically to reflect legal, technical, or operational changes. Updates will be published on our website.

For questions regarding this Privacy Notice or your privacy rights, please contact:

Data Protection Officer:
Email: dataprotection@t2group.co.uk
Address: t2 group, Fern House, Unit 1, Links Court, Fortran Road, St. Mellons, CARDIFF CF3 0LT