Privacy Notice & Cookie Statement

2. Policy scope

This policy and procedure covers all employees and freelance consultants working for Peeple. It is non-contractual but is designed to indicate how such matters should be dealt with within Peeple, although we reserve the right at our discretion to vary, replace or terminate the policy and associated procedures at any time. The policy and associated documents will be reviewed regularly. Whilst working for Peeple, freelance consultants have the same rights and responsibilities regarding data protection as employees.

The policy covers all personal data held by Peeple relating to employees, freelance consultants working with Peeple, trustees/volunteers, applicants, customers, suppliers and families attending Peeple group sessions or the Little Peeple nursery.

Further information regarding the protection of data relating to the Little Peeple nursery may be found on the Peeple website – peeple education and childcare policies | www.peeple.org.uk

Any questions regarding this policy and procedure should be addressed to the HR Manager. 

4. Work with families (including Peep groups)  

What we collect and why
Contact details: We collect information including your name, address, e-mail and contact phone number when you register to come to a Peep group. The lawful basis for collecting this information is legitimate interests. We use the information to contact you while we are providing services to you and your family.

Sensitive data: We also collect some sensitive data from you such as ethnicity and employment status which is only used for monitoring and evaluation purposes. The lawful basis for this is legitimate interests. We use the information to monitor our service delivery and provide funders with statistics that help them evaluate the benefits of funding Peep groups and to improve our services. Funders require this information as part of their contract with us to provide funding for groups. This data is given to funders as anonymous statistics. Your name is never given with it.

Occasionally we may collect sensitive data from you that helps our practitioners to support you better, or that is necessary for us to know medically, for example if your child has a nut allergy or has special educational needs and/or disabilities. This data is collected on the lawful basis of consent. The practitioner will fill in a form, usually after a discussion with you, which you will get to see and sign.

How we store your data, and your rights regarding it: All the information we collect from you is stored on our secure electronic database and in locked filing cabinets. We will keep this information until your child is five years old and then it will be deleted from our database and any paper records destroyed. For some projects, we may keep this information until your child finishes primary school in order to evaluate the effectiveness of our project. We will never pass your information on to a third party without your permission unless it is a matter of safety for you or your child.

Child protection: If we have any concerns about the safety or you or your child we have a legal duty to pass this on to someone who can help. We will not ask your permission if we are worried but will always tell you what we have done, unless doing so would cause further risk.

Receiving information from another organisation: If you and your family are referred to us by another organisation, with your consent that organisation may share information about you, including sensitive personal data, so that we can provide our services. We will handle and store your information in accordance with this Privacy Policy.

Safeguarding: If there are safeguarding concerns we are legally required to keep your data in accordance with safeguarding laws. The lawful basis for this is legitimate interests.

Dolly Parton Imagination Library: We collect information including your name, address and e-mail address on behalf of the Dolly Parton Imagination Library. This data is collected in order that the Imagination Library can send your child free books. The data is stored on the Imagination Library database and Peeple is the data processor not the data keeper. This data is therefore covered by the Imagination Library Privacy Notice.

Photos and video footage: Sometimes in our groups we take photographs or videos for the purposes of using in Peeple materials, leaflets, on the website or for professional evaluation of our work or staff. We do this using the lawful basis of consent. They are stored electronically on our server. Your pictures or videos will never be used without your permission and you can ask to see them or remove them at any time. We will keep them indefinitely unless you instruct us otherwise.

6. Practitioner Accreditation (AIM)  

As part of the registration, assessment and certification processes for the AIM award: Supporting Parents and Children to Learn Together, we collect information including your name, date of birth, address, e-mail, contact telephone number(s), completed portfolio and records of internal quality assurance activities.  This data is collected on the lawful basis of the contract we have with you to accredit your learning.  We use the information to provide you with services to support the completion of your accreditation. 

As indicated on the Learner Registration Form, the course is accredited through Peeple-Unit Framework (4000081) We use your name, date of birth and qualification information to enrol you on the course with AIM.  AIM assign you a unique learner number (ULN) which is used in relation to your learning, assessment and certification.

In exceptional circumstances we may also collect and transfer to AIM, sensitive personal data, such as:

• information about your physical or mental health condition – to comply with our duty under the Equality Act 2010 and enable us to administer requests for reasonable adjustments to support your learning and assessment.
• information relating to an investigation, complaint or appeal – to allow us and/or AIM to make an informed response.

This additional sensitive data is collected on the lawful basis of consent.  As such, you will need to complete a form following a discussion with a Peeple trainer/ staff member.  The form will require you to give your explicit consent for the sensitive personal data you have shared to be held by us and transferred to AIM for the purposes outlined above.

All the information we collect from you is stored on our secure electronic database and in locked filing cabinets to which only authorised staff have access.  Hardcopy portfolios are scanned and stored electronically for quality assurance activities.

We pass your information to freelance assessors who assess accreditation portfolios under contract from us as necessary to enable us to provide training and accreditation services to you.  Completed learner portfolios are shared securely with an allocated assessor either electronically, or sent and returned by post using the secure Royal Mail Signed For® service.  Assessors are required to store all off-site learner and assessment data in a secure and locked location throughout the assessment process; password protected equipment must be used for electronic assessment.  Once the assessment is complete, assessors are required to return, delete and/ or destroy all learner and assessment data.   

We acknowledge that the content of your portfolio, whether it be hardcopy, scanned or an e-portfolio, is your property and remains so after certification.  Hardcopy portfolios will be returned to you along with your certificate of achievement on successful completion of internal quality assurance activities.  At this point we may contact you to seek your permission to retain an anonymised copy of your portfolio for training and marketing purposes.  Scans of hardcopy portfolios, e-portfolios and additional evidence received as a result of remediation will be retained until the annual External Quality Assurance (EQA) visit from AIM has taken place following certification, after which it will be deleted.

All other information will be kept for 3 years following certification in case any issues arise and for regulatory compliance purposes.

All personal data and sensitive personal data transferred to AIM will be processed in accordance with their Learner and Apprenticeship Privacy Policy (www.cityandguilds.com/help/help-for-learners/learner-policy )

We will never pass your information on to a third party without your permission. 

Reviewed/ updated: July 2025

8. Parent/carer accreditation of learning: England, Wales, Northern Ireland and South Africa (SCQA)

Learners – what we collect and why

As part of the registration, assessment and certification processes for the units that are part of the SCQA Certificate in Supporting Parents and Children to Learn Together (Level 3,4 and 5 equivalent to Entry 3, Level 1 and Level 2 in England), the Centre delivering your course will collect data from you and pass it to Peeple for processing.

This data is collected on the lawful basis of the contract we have with you to accredit your learning.  We use the information to provide you with services to support the completion of your accreditation.  We collect and process the following data:

• Contact details including your full name, date of birth, address, e‑mail, contact telephone number. This is held as part of your accreditation record.  Peeple will transfer your full name, post code and date of birth to SCQA* (the Awarding Organisation) who will use this data to register you for unit accreditation.
• Sensitive data (special category personal data)

Employment status and Ethnicity are optional sections to complete on the Learner Registration Form.  If you choose to provide these, Peeple may process this data in order to monitor course enrolment, improve services and to provide partners and funders with statistics that help them evaluate the benefits.  The data is always anonymised and given as figures and/or percentages.

In exceptional circumstances we may also collect and transfer to SCQA* additional sensitive personal data.  This is collected on the lawful basis of consent and as such, you will need to complete a form following a discussion with the Centre and/ or Peeple staff.  This form will require you to give your explicit consent for the sensitive personal data you have shared to be held by Peeple and transfer to SCQA* for the purposes outlined below:

• Learning support requirements which may include Information about your medical conditions and/ or learning difficulties. This is to comply with our duty under the Equality Act 2010 and enables us to administer requests for reasonable adjustments to support your learning and assessment.
• Information relating to an investigation, complaint or appeal – to allow us and/ or SCQA to make an informed response.
• Evidence relating to the unit you are undertaking including your completed portfolio, course feedback/ evaluations and records of internal quality assurance activities. This will be used by the Peeple Internal Quality Assurer (IQA) for quality assurance processes and to approve certification.  It may also be shared with SCQA* if requested as part of their sample when carrying out the annual External Quality Assurance (EQA) visit.

All the information we collect from you is stored on our secure electronic database to which only authorised staff have access.  Hardcopy portfolios are scanned and stored electronically for quality assurance activities.

We acknowledge that the content of your portfolio, whether it be hardcopy, scanned or an e-portfolio, is your property and remains so after certification.  Hardcopy portfolios will be returned to you along with your certificate of achievement on successful completion of internal quality assurance activities.  At this point we may contact you to seek your permission to retain an anonymised copy of your portfolio for training and marketing purposes.  Scans of hardcopy portfolios, e-portfolios and additional evidence received as a result of remediation will be retained until the annual External Quality Assurance (EQA) visit from SCQA has taken place following certification, after which it will be deleted.

Information relating to assessment will be kept for 3 years following final certification in case any issues arise and for regulatory compliance purposes.

Your name, contact address and telephone number, details of your qualification/ units and dates chieved will be held for a period of at least seven years from the date of final certification.  This is to ensure that any claims for certification can be proven; to support any malpractice claims and respond to information requests from SCQA or regulatory bodies.

We will never pass your information on to a third party without your permission.

We may analyse our learners to determine common characteristics and preferences.  We do this by assessing various types of information including learning level or demographic information (e.g. location).  We may compile statistical data from time to time; this will never include any references to any individual.

* All personal data and sensitive personal data transferred to SCQA (the Awarding Organisation) will be processed in accordance with their Privacy Notice (https://www.sqa.org.uk/sqa/97458.html)

10. Communications 

Newsletters: Peep-trained practitioners and their managers will be sent Peep Postings newsletters and our general Peeple newsletter as part of their membership (see above). Other people may subscribe to our Peeple newsletter by opting in to join our mailing list (lawful basis: consent). We use the Mailchimp platform to create our newsletters, so we share limited personal data with them; here is the Mailchimp privacy policy.You  can unsubscribe from Peeple newsletters at any time by clicking the Unsubscribe button in the footer of every newsletter or by contacting us directly: [email protected].

Enquiries: If you enquire about Peep Training or resources, we keep your details on our internal system for up to two years, so that we can respond to follow-up enquiries.

12. Data retention

Employee records

We keep both electronic and paper details of employees to fulfil our legal obligations in relation to contracts of employment, payroll and pensions.

Your employee information is held within the People First system, which operates under contractual agreements with us to manage employee, payroll, and pension data. These agreements require full compliance with the UK General Data Protection Regulation (UK GDPR).

Additional details about the HR and payroll system can be found on SharePoint and within the People First application.

Employee data will not be kept longer than necessary to comply with legal and statutory obligations, which in the case of payroll is 6 years from the end of the relevant tax year.

Any additional information which is not required for the above purposes, e.g. use of photographs, will require employee consent.

Volunteer and trustee records

We keep both electronic and paper details of volunteers and trustees under the lawful basis of our legitimate interests.

Freelance consultants including Peep trainers and assessors

We keep electronic details of trainers and assessors (name, address, email, phone, CV) and each consultant signs a letter of agreement covering the nature of their work for Peeple, its duration etc. The lawful basis for this is contractual.  Consultant data will be kept for the duration of their work for Peeple and for a further 6 years from the end of the last relevant tax year in case it is needed for tax or related reasons.

Job applicants

Enquiries and application forms from unsuccessful candidates will be kept for a period of 6 months from the end of the selection process.

Register of interest

Anyone interested in hearing about future vacancies or volunteering opportunities (including unsuccessful job applicants) may register their interest on our Register of interest form. Details will be kept both electronically and on paper for a period of 18 months.

Historical records

We keep information on senior personnel such as trustees and directors indefinitely for the purpose of historical records.

14. Employee/ freelance consultant responsibilities

GDPR potentially applies to all use of ICT resources by Peeple employees and the use of personal computing and communication devices by freelance consultants working with Peeple.

Security

Do not attempt to gain unauthorised access to information or facilities.  If you do not have access to information resources you feel you need, contact  your manager.

Do not disclose personal system passwords or other security details to other staff or external agents, and do not use anyone else’s log-in; this compromises the security of Peeple. If someone else gets to know your password, ensure that you change it and inform your manager.

If you leave your PC or workstation unattended without logging off, you are responsible for any misuse of it while you are away. Logging off is especially important where members of the public have access to the screen in your absence.

Remember to lock your computer when you leave your workstation (Ctrl, Alt, Del for Windows computers).

Be aware of who may see your screen when dealing with personal information.

Always exercise caution when committing confidential information to email, since the confidentiality of such material cannot be guaranteed.

Printing

• Only print the minimum amount of information needed
• Remove prints from the printer immediately.
• Store the printed information securely until you can dispose of it securely.

Security breaches

Security breaches may occur if you fail to comply with the above and personal data is accessed or disclosed without authorisation. These may have serious implications for the person whose data has been accessed illegitimately, for Peeple and for you.

If you inadvertently breach security, even if you do not consider that there has been any data loss or illegitimate access, you must report the breach immediately to your line manager and HR.

Training

Every year, you are required to attend GDPR training or read the training documentation and confirm in writing that you have done so.