We are the Construction Industry Training Board (CITB), a charity registered in England and Wales (number 264289) and in Scotland (number SC044875).

If you have any comments or concerns about an aspect of this policy or any privacy or data protection issue, please email our Privacy Team at privacy@citb.co.uk or write to:

Privacy Team
CITB
Bircham Newton
King’s Lynn
Norfolk
PE31 6RH

Our Data Protection Officer is Matt Smith, who you can contact at dpo@citb.co.uk or by writing to the address above.

These 8 principles summarise our commitment to protecting your privacy:

• We only collect and use the personal information we need to provide or improve our products and services
• You can check whatever information we hold about you
• We will keep your personal information safe
• We are fair and open about how we use your details
• We will never sell your details or share it except in the ways mentioned in this policy or unless you ask us
• We will let you know if there are important changes that affect your information or how we use it
• We take responsibility for the information we hold about you
• We only keep your information for as long as necessary.

When we review our privacy policy we will note the date it was last updated and try to let you know by email, if we have it, of any changes.

This privacy policy was last reviewed and updated in March 2018.

The legislation that applies to this privacy policy includes the:

• Industrial Training Act 1982 and any relevant Levy Order
• Data Protection Act 1998 (DPA)
• EU Data Protection Directive 95/46/EC
• Regulation of Investigatory Powers Act 2000
• Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000
• Electronic Communications Data Protection Directive 2002/58/EC
• Privacy and Electronic Communications (EC Directive) Regulations 2003
• General Data Protection Regulation ((EU) 2016/679) (GDPR) as introduced into national law on 25 May 2018
• All applicable laws, regulations and secondary legislation relating to the processing of personal data and privacy
• Guidance and codes of practice issued by the Information Commissioner
• Any successor legislation to the DPA and GDPR.

You give us information when you use our websites, products and services, including when you: 

• Submit one of our forms
• Correspond with us by phone, email or otherwise
• Register with us
• Subscribe to our services
• Search for a product
• Participate in our discussion boards, chat or social media
• Enter a competition or promotion
• Respond to a survey.

We collect information about you when you visit our websites through the use of cookies (read Cookies section below for full details).

We may also get information from other sources, including:

• Third parties, such as external training organisations
• Those websites and services we help to operate or contribute to 
• Closed circuit television (CCTV) (read CCTV section below for full details).

The information we collect from you could include your:

• Name, address, email and phone number
• Date of birth
• National Insurance number
• Financial and credit card information
• Personal description
• Photograph
• Family status
• Lifestyle
• Social circumstances
• IP address
• Geographical location
• Browser type
• Device type
• Operating system
• Browsing data, such as access times
• Navigation history.

We may also have sensitive information, including about your:

• Physical health
• Mental health
• Racial or ethnic origin
• Religious or other beliefs.

We use your information for many purposes, including to:

• Fulfil our statutory roles, duties and functions as an industrial training board
• Administer our membership records and accounts, including for levy raising
• Fundraise and promote our interests
• Manage our employees and volunteers
• Provide education, training, career awareness and advice services for our beneficiaries
• Carry out charitable trading
• Advertise, promote and market our services
• Undertake research
• Administer certification, qualification and card schemes
• Perform our duties as a registered data controller and public authority
• Confirm identities and prevent crime
• Notify you about a change to our service
• Carry out our contractual obligations
• Provide and improve our services
• Analyse your website behaviour
• Improve the operation, security and presentation of our sites
• Target our online advertising to your interests and preferences
• Measure and understand the effectiveness of our online content and marketing
• Enable you to participate in interactive features on our website.

How we keep it safe

We take the security of your personal information very seriously. 

We use technical measures, such as encryption, and carry out regular security reviews to keep our protections up to date. We also strictly control access and ensure staff who are authorised for access are adequately trained in keeping your information safe. 

Our procedures mean that we may ask you to prove your identity before we share your personal information with you.

Third-party websites you access through links on our websites will have their own privacy policies. We do not accept any responsibility or liability for them.

We do not share your information with others unless you have consented or it is necessary to do so because:

• Of our statutory role and duties as an industrial training board
• The law requires us to
• Of administrative or operational needs
• It is part of our terms of use.

When we do have to share information, it is likely to be with:

• Our service providers or agents
• Your employer or prospective employers
• Users of our card schemes and training registers
• Training providers
• Funding bodies
• Law enforcement agencies.

Sharing your achievements

We may want to share your CITB-accredited achievements with newspapers, websites and other media. Contact us on 0344 994 4333 or unsubscribe@citb.co.uk if you would prefer us not to.

Sometimes we may transfer your details to third parties outside of the European Economic Area (EEA). If this happens we will make sure the transfer and storage of your information still complies with UK or EEA laws and this privacy policy. 

When you visit CITB websites we place cookies on your device.

Cookies are small text files that help our websites to work and us to understand what information is most useful to our users. They also speed things when you come back to a site. We do not use them to identify you personally.

You can delete cookies stored on your device at any time.

What we collect

Cookies allow us to gather information about your visits to our site, including your:

• IP address
• Geographical location
• Browser type
• Device type
• Operating system
• Browsing data, such as access times
• Navigation history
• Preferences

How we use your information

Cookies enable us to use the tools and services of:

• Google Analytics
• iAdvize

Google Analytics helps us measure and analyse how users are using our sites so that we can improve their experiences.

iAdvize provides online interaction and chat services with users, analyses user behaviour, and lets us observe your navigation in real time. iAdvize collects data and stores it on their servers. iAdvize may communicate this data to third parties in case of legal obligation or when these third parties deal with iAdvize’s data on its behalf. 

Who has access to your information

Our staff and Google can access information related to Google Analytics cookies.
Our staff and iAdvize can access information related to iAdvize cookies.

Other third-party cookies

When we use internet tools from other companies to enhance our website, these companies may also put cookies on your device. They include:

• Facebook
• Google Maps
• Twitter
• YouTube

For further information, read about the cookie names they use. 

We record phone calls we make or receive for training, quality assurance and to help us to deal with enquiries; for example, where we might need to confirm the details of a previous conversation. We let you know if we are recording.

What we do

We identify recorded calls using the originating telephone number and the time and date of the call.

A recording may contain your personal information relating to the products and services we offer. 

We may ask you for some personal information over the phone to confirm your identity, depending on the nature of your enquiry to prevent fraud and protect your data.

We use a ‘pause and resume’ function so we don’t record any part of your call that involves payment details.

Who has access to your information

We keep recorded calls securely, and only specific CITB staff, or specific staff of CITB appointed processors, are authorised to review them.

We contract a company to maintain call recording and a ‘pause and resume’ function. The company is authorised to access recorded calls only for fault diagnosis, testing and administration purposes.

How long we keep it

We delete recorded calls after 24 months, unless they are part of an active investigation.

There are many ways you may communicate with us online, including by:

• Chat and instant messaging (such as Skype for Business)
• Email
• Scial media (such as Facebook, Yammer or Twitter)
• Video conferencing (such as GoToMeeting)
• File sharing platforms (such as OneDrive and SharePoint)

What we do

When you use email, chat, social media and other online platforms, it is likely you know what information you are sharing with us.

How we use and process your information, who accesses it, and how long we keep it, depends on the context in which we collected it, but follows the terms of our privacy policy and UK law.

The information is normally handled by our authorised staff, but if we intend to share it with third parties, we will make every effort to let you know. 

Images from closed circuit television (CCTV) of a recognisable person are treated as personal data in data protection law.

How we use CCTV

We use CCTV to:

• Maintain the safety and security of our property, premises, and people
• Prevent and investigate crime
• Monitor staff
• To assist disciplinary procedures in cases of serious misconduct.

Who has access to your information

Our CCTV system is operated from a self-contained security control room, access to which is strictly limited to the security supervisor, contract security staff, CITB Estates and Facilities Manager, CITB Estates Contract Compliance Officer, and CITB Receptionist.

Where necessary we may share CCTV image information with:

• The person in the image
• Employees and agents
• Services providers
• Police forces
• Security organisations
• Individuals making an enquiry.

How long we keep it

Unless we need them for an active investigation, we keep recorded images for 30 days. After that, the images are automatically overwritten by the recording equipment.

We destroy recordings that are part of an active investigation as soon as they are no longer needed.

Your rights

You can ask for a copy of your information recorded by CCTV, except in certain circumstances described by applicable legislation. You do not have the right to instant access.

We use your payment details to process orders, collect levy payments and distribute funds, such as training grants.

How we use your information

We do not use your information for any purpose you have not authorised, or disclose it to third parties without your permission. We process credit and debit card transactions following the Payment Card Industry Data Security Standard (PCI DSS).

Who has access to your information

CITB staff and contracted data processors have access to your payment details to carry out your transaction. 

What we do

For bank and building society account transactions, we may make a record of your:

• Name
• Branch address
• Sort code
• Account number
• Signature

Where possible, we only store the verification code of card transactions and other data needed to process the payment once the transaction is complete. Where this is not feasible, we use other security methods to keep your data secure. We may process data such as the:

• Cardholder’s name
• Card number
• Card security code (CSC)
• Validity and expiry dates
• Issue number

How long we keep it

We keep your bank or building society details for as long as you authorise and delete them when they are no longer needed. We do not keep payment card information.

Our websites, services and products are not aimed at children and we do not knowingly collect any information from them.

We ask children not to register with us or give us any of their information.

Where we have inadvertently collected information from a child, we will delete it as soon as possible.

If you know that a child has given their information to us, please contact us at privacy@citb.co.uk.

You have the right to:

• Ask for a copy of any information we hold about you
• Withdraw any consents you have given
• Lodge a complaint with us or the Information Commissioner’s Office or with any other relevant supervisory authority about how we handle your personal data
• Ask us to correct any inaccurate or incomplete information we have about you
• Ask us to delete your information from our records
• Ask us to send a copy of your information to a third party in a data portable format.

You can change your contact preferences or withdraw your consents at any time by writing to us at privacy@citb.co.uk or:

Privacy Team
CITB
Bircham Newton
King’s Lynn
Norfolk
PE31 6RH

To see the information we hold about you, you should make a Subject Access Request in writing, including your:

• Full name, including previous or other names, if appropriate
• Address
• Telephone
• Unique CITB registration or ID numbers, if appropriate
• Date of birth, if you don’t have a unique registration number

and send it to:

Privacy Team
CITB
Bircham Newton
King’s Lynn
Norfolk
PE31 6RH

We manage a booking system for construction training courses. 

How we use your information 

We use your information to find you the right course, venue and, if appropriate, accommodation, to deliver the course, and to process your booking. 

Who has access to your information

CITB employees who operate the course booking system or deliver training have access.

What we do

We use your:

• Contact details to administer the course
• Identification information to prevent fraud
• Profile data so we know your contact preferences and so on.

How long we keep it

We keep your profile information for no more than 6 years from the date you made your last booking, and we delete information about the courses you attended after 6 years.

We delete accommodation booking information 12 months after your departure date.

We manage a number of card schemes, which help to ensure the safety and proficiency of the UK construction workforce. Through them, it is possible to check someone’s identity and achievements or qualifications.

How we use your information

We record accredited achievements you get in a database, which our staff can access for the card schemes.Anyone who can provide us with certain search information about you, (such as your CITB Individual ID or Registration Number, National Insurance number and other personal details), can check your identity and CITB-accredited achievements using:

• Our Online Card Checker
• Our telephone validation service
• Local card readers to view information held on the card
• An application program interface (API) that we give to authorised employers so they can check your achievements from their own IT systems.

A successful search returns the following information about you:

• CITB Registration Number
• Surname and first initial
• Photo
• Memberships
• Health and safety test passes
• Courses.

Who has access to your information

Anyone with the right search information about you has access. This is usually:

• Our staff who process your information to run the card schemes and book courses
• Organisations that we run card schemes for
• Construction site administrators
• Employers
• Your family or friends.

What we do

We use your:

• Contact details to ask you to confirm our records about you
• Identification information to prevent fraud
• Achievement information to check that you have the necessary knowledge and skills to work in construction
• Profile data so we know your contact preferences and so on.

How long we keep it

We will keep your information for no longer than 50 years from the expiry date of your last achievement.

We offer a range of construction apprenticeships across Great Britain.

How we use your information

We use the information you give us to understand your career goals and development needs, so that we can place you with the right college and employer.

Who has access to your information

Your data will not be shared with external organisations other than those involved in your placement, including funding agencies, current and prospective employers and colleges.

What we do

We use your:

• Contact details to ask you to confirm our records about you and to process your apprenticeship application
• Identification information to prevent fraud
• Achievement information to check that you have the necessary knowledge and skills to work in construction
• Profile data so we know your contact preferences and so on.

How long we keep it

We may keep your personal data for as long as we need to fulfil our statutory functions.

We keep apprenticeship course records for at least 6 years. Funding providers that subsidise an apprenticeship may specify that they need to keep records for longer.

We keep a record of your achievements for up to 50 years, except where the achievement is for life. 

We provide 3 e-commerce websites to sell our products online:

• CITB Shop and CITB Training and courses, which are owned and managed by us
• CITB Marketplace, which is operated on our behalf by Pearson VUE

How we use your information

We use your information to process your order. This includes your name, contact and payment details.

Who has access to your information

Our order-processing staff receive details of all orders. Staff and systems at Pearson VUE use your data to process your order. We may transfer your details to Promotional Logistics Ltd, our fulfilment partner. 

How long we keep it

We keep order information for 2 years, and financial information for 7 years.

The Construction Training Register is an online database showing who has gained recognised construction-related training achievements and qualifications. 

Employers can search the register to check skills and manage their training needs.

How we use your information 

We use your information to fulfil our statutory role as an industrial training board. This includes maintaining a record of your training achievements and qualifications with an Approved Training Organisation (ATO). 

Who has access to your information

CITB staff, your employer when booking you on to a training course, and the relevant ATO can access your records.

Anyone who has your name and at least one other piece of identifying data unique to you, such as your Unique Learner Number or CITB Individual Identifier can access your records.  

What we do

We use your:

• Contact details to ask you to confirm our records about you
• Identification information to prevent fraud
• Achievement information to check that you have the necessary knowledge and skills to work in construction
• Profile data so we know your contact preferences. 

How long we keep it

We may keep and use your personal data for as long as we need to, to fulfil our statutory functions.

We keep a record of your achievements for up to 50 years, except where the achievement is for life. 

We provide grants and other funding to promote careers and support employers, federations, trade associations and training groups in the UK construction industry.

How we collect your information

Employers, federations, trade associations and training groups can express interest or apply for funding via a form on our website. We store this information in a secure database which is not shared with third parties. 

What we collect

The information we collect depends on the type of funding application submitted, but could include:

• Organisation type
• Eligibility for funding
• Funding option
• Basic company details
• Contact details
• Partnership details
• Project details
• Deliverables and beneficiaries
• Evidence of need.

Who has access to your information

Only our staff and contracted data processors have access to the information.

How long we keep it

We keep your information for at least 7 years, as required by accounting legislation, and longer if needed by the funding authority.

We conduct and commission research and analysis of the construction industry sector to help it improve and succeed, as authorised by the Industrial Training Act 1982.

How we use your information

Where possible we use anonymous information that cannot be linked to you, or pseudonymous information which replaces your name or other identifying data with something else to make it virtually impossible to identify you.

Who has access to your information

CITB staff and contracted data processors performing research for us have access. We may also share information with customers and clients, agents, service providers, and survey and research organisations if we need to.

What we do

We may use any of the information we have collected about you across our websites, products and services for our research, including your:

• Name
• Contact details
• Family status
• Lifestyle
• Social circumstances
• Financial details
• Interest in or use of our goods and services.

We may also use information gathered from surveys, which may be sensitive, including your:

• Physical health
• Mental health
• Racial or ethnic origin
• Religious or other beliefs.

How long we keep it

We keep research information in accordance with data protection legislation.

SkillBuild is a skills competition for construction trainees and apprentices, who can enter it by providing their details via our website. 

How we use your information

We use your information to administer and improve the competition. We may also contact you for your consent to take part in promotional activity for SkillBuild, such as case studies and blogs.

We store your information in a secure database which is not shared with third parties without your consent.  

Who has access to your information

CITB staff and contracted data processors who need the information to administer the competition have access.

What we collect

What we collect may include your:

• Name
• Contact details
• Date of birth
• Dietary information
• Clothing size
• Ethnicity
• Disability information
• Qualifications.

How long we keep it

We keep your information until 28 February of the year following your registration, except for competition results, which we keep until they are no longer necessary to maintain records for past achievers and to track progress through competition cycles. 

We have statutory powers to collect a levy (The Industrial Training Levy) from construction employers to fund training so that the sector has the skilled workforce it needs.

How we use your information

We keep a register of construction employers, which we use to collect the levy from those who are required by law to pay it.

Who has access to your information

Only CITB staff and contracted data processors have access.

What we do

We use your:

• Contact details to ask you to confirm our records about you, to process your levy assessment, to issue a levy collection notice and to process your payment
• Employer details to determine if you are eligible to pay the levy
• Profile data so we know your contact preferences and so on.

How long we keep it

We destroy Levy Returns after 7 years.  We keep your profile data for 7 years after you or your company are no longer required to complete a Levy Return.