Privacy Policy

1. Introduction

Maya Rail Technical Training & Consultancy Ltd (‘Maya Rail’, ‘we’, us’ or ‘our’) is committed to protecting your personal information and respecting your privacy. This notice explains when and why we collect personal information, how we use and protect it, who we may share it with, how long we keep it, and the rights available to you.

We process personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations (PECR).

This notice should be read alongside any additional privacy information provided for a particular funded programme, commissioner, awarding organisation, assessment body or service. Where publicly funded learner data is submitted to another controller, that organisation’s own privacy notice will also apply.

2. About Maya Rail

Maya Rail Technical Training & Consultancy Ltd is a UK technical and vocational training provider delivering funded and commercial training, assessment and consultancy services, with expertise in the rail sector.

Registered Company Name	Maya Rail Technical Training & Consultancy Ltd
Company Number	09450171
ICO Registration Reference	ZB311003
Registered Office	Canberra House, First Avenue, Doncaster Finningley Airport, Doncaster, England, DN9 3GA
Website	www.mayarail.co.uk
Telephone	0330 016 9779
Email	compliance@mayarail.co.uk

3. What this Privacy Notice covers

 

This notice applies when you work with, contact or receive services from Maya Rail, whether online, by telephone, in person, through paper or electronic forms, through learning or assessment systems, through our website, or through our social media channels.

• Prospective and current learners, candidates and participants
• Individuals undertaking commercially funded or publicly funded training
• Employers and employer representatives
• Commissioners, funding bodies, referral partners and delivery partners
• Customers, suppliers and professional contacts
• Website users, enquirers and marketing subscribers
• Other individuals whose information we process in connection with our training and business activities.

This privacy notice does not cover the following use of personal data, unless stated otherwise:

• Personal data which we process about employees of Maya Rail (Information about how we handle employee data can be found on our staff induction booklet)

Where a more specific privacy notice is supplied for a particular activity, it should be read together with this notice.

4. Who is responsible for your information?

Maya Rail will normally act as the data controller for the personal information described in this notice. This means we determine the purposes and means of processing that information.

For some funded programmes or contractual arrangements, Maya Rail may act as a processor, joint controller, or one of several independent controllers alongside a commissioner, government department, combined authority, local authority, employer or other organisation. Where another organisation acts as a controller for its own purposes, its privacy notice will also apply.

Data protection enquiries and requests may be sent for the attention of the Data Protection Officer at Maya Rail using compliance@mayarail.co.uk or the postal address above.

5. The personal information we collect

Personal information means information relating to an identified or identifiable individual. Depending on your relationship with Maya Rail, we may collect, use, store or share the following categories of information:

Identity and contact data

• Name, title, date and place of birth, age, gender, nationality and image where relevant
• Home, billing or delivery address, postcode, email address and telephone number
• National Insurance number, Unique Learner Number (ULN), learner/candidate identifiers and identification documents where required
• Emergency contact details
• Education, training and employment data
• Qualifications, prior attainment and previous learning
• Employment status, job title, employer, employment history, references, salary or occupational information where relevant
• Initial and diagnostic assessments, recognition of prior learning and training needs
• Attendance, participation, progress reviews, assessment evidence, results, achievement, certification, learner feedback and survey responses
• Destination, progression and employment outcome information

Funding and eligibility data

• Residency, nationality, right-to-study or eligibility evidence where required
• Benefit or employment status, funding history and supporting evidence
• Information required by the relevant funding rules, grant, contract or commissioner

Financial and payment data

• Bank account or payment details where you purchase services, receive payments or refunds, or where financial evidence is required
• Transaction, invoice and payment history
• Financial status information where specifically required by a funded programme or service

Technical, profile and usage data

• IP address, browser type/version, device and operating system information, time zone and similar technical information
• Account or login information where systems require an account
• Website usage, preferences, feedback and communications preferences

Marketing and communications data

• Preferences for receiving marketing or service communications
• Records of subscriptions, consent, opt-outs and communications

Special category and criminal offence data

Where necessary and lawful, we may process information that receives additional protection under data protection law. This may include racial or ethnic origin, religious or philosophical beliefs, health, disability or learning difficulty information, sexual orientation, and other equality or support information. We will only process such information where an Article 9 UK GDPR condition applies.

In limited circumstances, we may process information relating to criminal convictions or offences where this is necessary for safeguarding, suitability, contractual, regulatory or legal purposes and where an appropriate condition and legal authority apply.

Aggregated and anonymised data

We may create statistical, demographic or other aggregated information from personal information.

Information that has been effectively anonymised so that an individual is no longer identifiable is not personal data.

If aggregated information is combined with other information in a way that makes an individual identifiable, we will treat it as personal information and apply this notice.

6. How we collect your personal information

We collect information in several ways.

Directly from you

• When you make an enquiry, request information or download a brochure
• When you apply, enrol, register or undertake training or assessment
• When you provide evidence, complete forms, surveys, evaluations or feedback
• When you create or use an account on a learning, assessment or customer system
• When you purchase a service or make a payment
• When you subscribe to communications or request marketing
• When you correspond with us by post, telephone, email, website, social media or in person

From other organisations

• Employers and prospective employers
• Referral partners, Jobcentre Plus or employment support organisations where applicable
• Commissioners, local authorities, combined authorities and funding organisations
• The Department for Education (DfE) and other government bodies
• Awarding organisations, assessment organisations, licensing or competence bodies
• Subcontractors, delivery partners and previous education or training providers
• Technology platforms and portals into which you or an authorised organisation has entered your information
• Publicly available sources, where relevant to a legitimate business purpose

Where we obtain personal information about you from another source, we will provide privacy information within the timescales required by law unless an applicable exemption applies.

7. Why we use your personal information

We use personal information only where we have a lawful reason to do so. Our purposes may include:

• Responding to enquiries and providing information about courses and services
• Assessing suitability, prior learning and eligibility for training or public funding
• Enrolling and registering learners and candidates
• Planning, delivering and administering training, assessment and consultancy services
• Monitoring attendance, participation, progress, achievement and outcomes
• Providing learning support, safeguarding support and reasonable adjustments
• Registering learners with awarding, assessment, licensing or competence organisations
• Claiming, evidencing, reconciling and auditing public or commercial funding
• Maintaining learner, customer, qualification and compliance records
• Issuing or facilitating certification and competence records
• Providing careers information, advice and guidance and supporting progression
• Communicating appropriately with employers, commissioners and referral partners
• Meeting commissioner, funding body, regulatory, inspection, audit and quality-assurance requirements
• Preventing and detecting fraud, error, misuse of public funds, security incidents and unlawful activity
• Fulfilling safeguarding, health and safety and welfare responsibilities
• Handling complaints, appeals, enquiries, data protection requests and legal claims
• Managing payments, invoices, refunds, debt recovery and financial administration
• Improving our services through quality assurance, feedback, evaluation, research and statistics
• Managing our systems, website, information security and business operations
• Communicating relevant Maya Rail training, services and opportunities as permitted by law
• Complying with legal, regulatory and contractual obligations

8. Our lawful basis for processing

The lawful basis depends on the particular purpose and relationship. We may rely on:

• Contracting, where processing is necessary to enter or perform a contract with you
• Legal obligation, where processing is necessary to comply with a legal or regulatory obligation
• Public task, where processing is necessary for a task carried out in the public interest or in the exercise of official authority
• Legitimate interests, where processing is necessary for our legitimate interests, or those of a third party, and your interests, rights and freedoms do not override those interests. Examples include effective service administration, quality assurance, information security, business-to-business relationship management, debt recovery and establishing or defending legal claims.
• Consent, where this is the appropriate basis, for example certain electronic marketing or optional processing. You may withdraw consent at any time; withdrawal does not affect processing carried out lawfully before withdrawal.
• Vital interests, only in exceptional circumstances where processing is necessary to protect someone’s life

Special category information

Where we process special category information, we must also meet a condition under Article 9 UK GDPR. Depending on the circumstances, this may include substantial public interest under UK law, employment/social protection law, vital interests, legal claims, or explicit consent. We will identify and document the appropriate condition for the relevant processing.

Criminal offence information

Criminal offence information will only be processed where permitted by Article 10 UK GDPR and the Data Protection Act 2018 and where an appropriate policy document or other safeguard is required.

9. Publicly funded training and learner records

Where you participate in publicly funded education or training, Maya Rail may be required by the relevant funding agreement, contract or grant to collect and return information about you through the Individualised Learner Record (ILR) or another commissioner or funding system.

The ILR contains information about learners and the learning they undertake. The Department for Education uses ILR information for functions including funding, administration, monitoring, statistics, research and evaluation. Where an ILR return is required, Maya Rail will provide or make available the current DfE ILR Privacy Notice as part of enrolment.

Where applicable, information may also be supplied to or obtained from the Learning Records Service (LRS), including for the creation and management of a Unique Learner Number and Personal Learning Record. The relevant LRS privacy information will be made available where applicable.

Depending on the programme, personal information may also be supplied to the relevant combined authority, local authority, commissioner or other funding body. Those organisations may act as separate controllers and their own privacy notices will explain their processing.

10. Who we may share your information with

We only disclose personal information where there is a lawful and legitimate reason. Depending on the service or programme, recipients may include:

• The Department for Education, the Department for Work and Pensions, and other government departments or agencies
• Local authorities, combined authorities, commissioners and funding organisations
• Employers or prospective employers where appropriate and lawful
• Referral organisations and employment support services
• Awarding organisations, end-point assessment organisations, licensing, competence and external quality assurance bodies
• Ofsted and other regulators, inspectors or auditors
• Subcontractors, consultants, training delivery partners and professional advisers
• IT, hosting, learner management, e-portfolio, assessment, communications and other technology providers
• Banks, payment providers, insurers, accountants, auditors, lawyers, debt recovery or fraud-prevention services
• HM Revenue & Customs, law enforcement, courts, regulators or public authorities where required or permitted by law
• Safeguarding agencies, emergency services and statutory services where necessary
• Other organisations where you have authorised disclosure or another lawful basis applies

Where a third-party processes personal information on our behalf, we require appropriate contractual and security controls. Processors may only use the information for specified purposes and in accordance with our instructions.

We do not sell personal information. If Maya Rail is involved in a sale, transfer, merger, restructuring or acquisition of all or part of its business or assets, personal information may be disclosed to relevant parties subject to appropriate confidentiality and data protection safeguards.

11. Employers, commissioners and referral partners

Where training is arranged, funded, referred or supported by an employer, commissioner or referral partner, we may share information that is necessary and proportionate for the programme. This may include enrolment, eligibility, attendance, participation, progress, assessment, achievement, completion, employment or progression outcomes, and information required by the relevant contract or funding rules.

We will not share information merely because another organisation requests it; a lawful basis and appropriate purpose must exist.

12. Marketing and communications

We may send information about Maya Rail training, courses, services and opportunities where we are permitted to do so under data protection law and PECR.

Where consent is required for electronic marketing, we will seek a clear opt-in. We will obtain express consent before sharing personal information with another organisation for that organisation’s own direct marketing where consent is required.

You can opt out of marketing at any time by using an unsubscribe link in a message or by contacting us. Opting out of marketing does not prevent us from sending necessary service, training, contractual, safeguarding, funding or compliance communications.

13. Website, cookies and third-party links

When you use our website, we may collect technical and usage information through server logs, cookies and similar technologies. Strictly necessary technologies may operate without consent where permitted. Where consent is required for non-essential cookies or similar technologies, we will seek it before they are used.

Further information about the cookies and similar technologies used on our website is provided through our Cookie Policy and/or cookie preference tool.

Our website, emails or documents may contain links to third-party websites, plug-ins or services. Those third parties may collect or share information about you. Maya Rail does not control third-party websites and is not responsible for their privacy notices. We encourage you to read the privacy information provided by any external service you use.

14. Change of purpose

We will normally use personal information only for the purpose for which it was collected. If we intend to use it for a new purpose, we will assess whether that purpose is compatible with the original purpose and whether another lawful basis is required. Where the law requires us to do so, we will provide updated privacy information before the new processing begins.

We do not always rely on your consent to process your personal information. Where permitted by data protection law, we may process your information on another lawful basis, for example where this is necessary to comply with a legal obligation, fulfil a contract, protect someone’s vital interests, perform a task in the public interest, or pursue a legitimate interest. In limited circumstances, the law may also permit us to process or disclose information without informing you at the time, for example where informing you could prejudice the prevention or detection of crime.

15. International transfers

Some suppliers or technology providers may process personal information outside the United Kingdom. Where personal information is transferred internationally, Maya Rail will ensure that a lawful transfer mechanism and appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another recognised mechanism.

You may contact us for information about the safeguards relevant to a particular transfer.

16. Data security

We use appropriate technical and organisational measures designed to protect personal information from accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access. Measures may include access controls, secure systems, staff training, confidentiality requirements, supplier due diligence, backups and secure disposal.

Access is limited to employees, contractors and other authorised parties who have a business need to know. We maintain procedures to identify, investigate and respond to suspected personal data breaches and will notify the Information Commissioner’s Office (ICO) and affected individuals where the law requires us to do so.

17. Data retention

We keep personal information only for as long as necessary for the purposes for which it was collected and to meet legal, accounting, funding, audit, certification, safeguarding, contractual and reporting requirements.

When deciding an appropriate retention period, we consider the amount, nature and sensitivity of the information, the risks associated with unauthorised use or disclosure, the purposes of processing, whether those purposes can be achieved by other means, and applicable legal or contractual requirements.

Publicly funded learner records may need to be retained for periods specified by the relevant funding body or commissioner. Qualification, assessment and competence records may also be subject to awarding, licensing or regulatory retention requirements.

Details of retention periods for different aspects of your personal data are available

in our retention policy which you can request from us. In some circumstances you can ask us to delete your data. Please see ‘request erasure’ below for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you

   18. If you do not provide personal information

Where information is required by law, a funding rule, regulatory requirement or contract, or is necessary to deliver a service, failure to provide it may mean that we cannot determine eligibility, enrol or register you, claim funding, provide training or assessment, issue certification, process a transaction or otherwise perform the relevant service. We will explain where providing information is mandatory and the consequences of not providing it.

   19. Keeping your information accurate

It is important that the personal information we hold is accurate and current. Please tell us if your information changes during your relationship with Maya Rail

   20. Your data protection rights

Depending on the circumstances and the lawful basis used, you may have the following rights:

Access

To request a copy of personal information we hold about you and information about how it is processed.

Rectification

To ask us to correct inaccurate information or complete information that is incomplete.

Erasure

To ask us to delete personal information in certain circumstances. This right does not apply where we have a lawful reason or obligation to retain the information.

Restriction

To ask us to restrict processing in certain circumstances, for example while accuracy or an objection is being considered.

Data Portability

To receive certain information, you provided to us in a structured, commonly used, machine-readable format, and in some circumstances have it transferred to another controller. This right generally applies to automated processing based on consent or contract.

Object

To object to processing based on legitimate interests or public task in certain circumstances, and to object at any time to processing for direct marketing.

Withdraw Consent

Where we rely on consent, to withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

NOTE REGARDING YOUR RIGHT TO OBJECT   You have the right to object to direct marketing at any time. You may also object to certain processing based on legitimate interests or public task, subject to the circumstances and any compelling lawful grounds for continuing the processing. You will not normally have to pay a fee to exercise your rights. However, where permitted by law, we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive. We may ask for information necessary to confirm your identity and protect personal information from unauthorised disclosure. We may also ask for clarification where this is needed to respond to your request. We will respond to valid requests within the timescales required by law, normally within one month. Where a request is complex or numerous, the law may allow an extension; if so, we will tell you.

   21. Automated decision making and profiling

Maya Rail does not currently make decisions about learners or customers that produce legal or similarly significant effects solely by automated means. If this changes, we will provide appropriate information about the logic involved, the significance and likely consequences of the processing, and the safeguards and rights available to you.

   22. Children and young people

Where Maya Rail processes personal information relating to children or young people, we will take account of their age and understanding and provide privacy information in clear and accessible language. Where appropriate and lawful, information may also be provided to a parent, guardian or person with parental responsibility, while respecting the data protection rights of the young person.

   23. Contact us

If you have a question about this notice, our privacy practices, or wish to exercise a data protection right, please contact:

Data Protection Officer

Maya Rail Technical Training & Consultancy Ltd

Canberra House

First Avenue

Doncaster Finningley Airport

Doncaster

DN9 3GA

Email: compliance@mayarail.co.uk

Telephone: 0330 016 9779

   24. Complaints

If you are concerned about how Maya Rail has handled your personal information, please contact us first so that we can investigate and respond.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator. Current contact details and information about raising a concern are available at www.ico.org.uk/concerns

Contacting Maya Rail first does not affect your right to approach the ICO.

   25. Changes to this privacy notice

We will review this notice regularly and update it where our processing activities, services, systems, contractual arrangements or legal and regulatory requirements change. The current version will be published on our website.

Where a change materially affects how we use personal information, we will take appropriate steps to bring the change to the attention of affected individuals before the new processing begins where required.

   Appendix A: Typical purposes for lawful basis

The table below provides a high-level summary. The precise lawful basis depends on the circumstances, and the role Maya Rail is performing under the relevant programme or contract.

Purpose	Typical Information	Potential Lawful Basis
Enquiries and course information	Identity, contact, enquiry and communications data	Legitimate interests; steps prior to contract
Commercial training and assessment	Identity, contact, education/training, payment and assessment data	Contract; legal obligation where applicable; legitimate interests
Publicly funded training	Identity, contact, eligibility, education/training, employment, outcomes and required equality/support data	Legal obligation and/or public tasks where applicable; contract/funding requirements; relevant Article 9 condition for special category data
Learner support, safeguarding and reasonable adjustments	Identity, contact, health/support, safeguarding and training data	Legal obligation; vital interests in emergencies; legitimate interests/public task where applicable; relevant Article 9/10 condition
Awarding, certification, competence and quality assurance	Identity, training, assessment, achievement and evidence	Contract; legal/regulatory obligation; legitimate interests; public task where applicable
Employer, commissioner and referral-partner reporting	Identity, eligibility, attendance, progress, achievement and outcome data	Contract; legal obligation; public task or legitimate interests as applicable
Payments and financial administration	Identity, contact, payment and transaction data	Contract; legal obligation; legitimate interests
Website operation and security	Technical, usage and contact data	Legitimate interests; consent where required for non-essential cookies
Direct marketing	Contact, marketing preferences and communications data	Consent where required; legitimate interests where law permits
Complaints, legal claims, fraud prevention and regulatory compliance	Relevant identity, contact, service, financial, safeguarding or evidential data	Legal obligation; legitimate interests; legal claims; relevant Article 9/10 condition where applicable

Appendix B: Additional privacy notices for funded provision

Where relevant to your programme, Maya Rail will provide or signpost additional privacy information issued by the relevant controller. This may include:

• The current Department for Education Individualised Learner Record (ILR) Privacy Notice
• Learning Records Service (LRS) privacy information
• Privacy notices issued by a combined authority, local authority, commissioner or other funding body
• Awarding, assessment, licensing or competence-body privacy information where those organisations act as separate controllers

These notices supplement this Maya Rail Privacy Notice and explain how those organisations use personal information for their own purposes.