Skip to main content
  1. Home
  2. CEC Privacy Notice & Cookies

CEC Privacy Notice & Cookies

This document is the Careers and Enterprise Company’s general Privacy Notice. It provides information about our processing of your personal data, summarises your data rights and explains how to contact us or complain about our data processing.

1. Introduction to CEC 

The Careers and Enterprise Company Ltd (CEC) is the national body for careers education in England, supporting schools and colleges to deliver modern, 21st century careers education. 

Our mission is to help every young person find their best next step. Our work is evidence-led so data is essential in achieving this mission.  

We achieve our mission by working with primary, secondary and special schools, pupil referral units, colleges, Independent Training Providers (ITPs) and employers to improve careers education and secure better outcomes for young people. 

2. Using our Privacy Notice and Contacting Us about Your Data  

We have structured this Privacy Notice to make it easier to understand how we process your personal data based upon your relationship with CEC. It was built upwards from the records of processing activities (ROPA) maintained by each team to give a transparent picture of the personal data we process in our work and our purposes for doing so. 

If you engage with us in a new way, we may provide additional information about how we will process your personal data for that purpose. The additional information acts as a supplement to this general Privacy Notice.   

If you have questions about CEC’s data processing not answered by this Privacy Notice, please contact our Data Protection Officer. Email dpo@careersandenterprise.co.uk or write to:  

Claire Stevenson, Data Protection Officer, The Careers and Enterprise Company Limited, 1st Floor, Work.Life, 120 Aldersgate St, Barbican, London EC1A 4JQ 

Cookie Policy

View our Cookie Policy

3. The Data we process, our Purposes, and our Lawful Basis for processing data

Sections: A. Young People B. Careers Leaders and Education Provider StaffC. Employer Contacts and VolunteersD. Partners and Supplier StaffE. Job ApplicantsF. EmployeesG. Website visitors

A. Young People

i. CEC’s use of Young People’s data

We process data about Young People for the following purposes, each of which relates to our overarching mission to help every young person find their best next step:

 

  • To support schools, special schools, colleges and independent training providers in their careers education provision, recording and improvement 
  • To plan, deliver and measure the effectiveness of CEC programmes and events 
  • To safeguard young people involved in CEC programmes and events 
  • To conduct research related to our mission 
  • To promote and publicise work to achieve our mission (photography, video. audio recordings which you have granted us a license to use) 
  • To give Young People a voice in the governance of CEC  
  • To manage work experience at CEC 
  • To enable systems management and security 
  • For CEC’s legal and compliance purposes
ii. Categories of personal data CEC processes about Young People

We process the following types of personal data about Young People:

 

  • Personal identifiers including name and date of birth 
  • Educational establishment(s) attended 
  • Email address 
  • Career education engagement and experiences 
  • Career interests, intentions and readiness 
  • Post-compulsory education destinations and Employment, Education or
  • Training (NEET) status 
  • Special category and other sensitive information including SEND status and indicators of disadvantage such as free school meal status, Pupil Premium status, low school attendance, exclusions, EHE (elective home education) status, English as an Additional Language 
  • Attainment data (if Young Person takes part in a CEC programme) 
  • Opinions (responses to surveys and other research) 
  • Photographs, video and audio recordings (If you have been involved in a CEC project and granted us a license to use these) 
iii. Lawful basis for processing data about Young People

The lawful bases for processing Young People’s personal data are: 

 

  • Necessity for the performance of our task in the public interest related to our mission to help every young person to find their best next step 
  • Necessity for compliance with a legal obligation 
  • Necessity for CEC’s legitimate interests in relation to security, safeguarding and legal risk. 
iv. Sharing Young People’s personal data

Our work is at national scale and delivered through our network of Careers Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership with local democratic authorities to connect with local skills needs. 

 

Organisations who enable us to deliver our work have access to Young People’s personal data only where necessary. Data protection law calls these organisations Data Processors. They include IT partners who host or develop our databases or support systems security. We take steps to verify that Data Processors can protect your data, ensure that appropriate contractual agreements are in place, and we monitor their performance.  

 

If you are invited to take part in CEC research or a project, we will provide more information to you and your school about how your data will be used for that work. Where we work with partner or supplier organisations on these projects, it may be necessary to provide your personal data to enable them to deliver and evaluate the project, or to keep you safe when you take part. 

 

We do not share young people's individual personal data with other organisations for their own purposes unless we are legally required to.

B. Careers Leaders and Education Provider Staff

This category includes Careers Leaders and Educational Institution Staff. 


i. CEC’s use of Careers Leaders and Education Provider Staff data

We process data about Careers Leaders for the following purposes, each of which relates to our overarching mission to help every young person find their best next step: 

 

  • To support schools, colleges and independent training providers in their careers education provision, recording and improvement 
  • To promote and publicise work to achieve our mission 
  • To plan, deliver and measure the effectiveness of CEC programmes and events 
  • To conduct research related to our mission 
  • To enable systems management and security 
  • For CEC’s legal and compliance purposes
ii. Categories of personal data CEC processes about Careers Leaders and Education Provider Staff

We process the following types of personal data about Careers Leaders and Education Provider Staff: 

 

  • Personal identifiers including your name, job title and the name of the school or college which is your employer 
  • Contact details including your email address, telephone number and employer’s address 
  • The CEC digital products you are registered to use and your user type (for example, whether you are your institution’s primary user with admin rights) 
  • Records of your engagement with our digital products, Customer Management services, training, programmes and other services and events 
  • Your responses to surveys and other research 
  • Your image and comments for a case study or article 
iii. Lawful basis for processing data about Careers Leaders and Education Provider Staff

The lawful bases for processing Careers Leaders and Education Provider Staff personal data are: 

 

  • Performance of our task in the public interest which is related to our mission to help every young person to find their best next step 
  • Performance of a contract 
  • Consent to receive marketing communications 
  • Necessity for compliance with a legal obligation 
  • Necessity for CEC’s legitimate interests in relation to security and legal risk. 
iv. Sharing Careers Leaders and Education Provider Staff personal data

Our work is at national scale and delivered through our network of Careers Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs. 

 

We provide access to Careers Leader personal information where necessary to enable partnership working towards our mission and to enable our suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place. 

C. Employer Contacts and Volunteers

This category includes Employer Contacts and Volunteers

Please note that the organisation which hosts the Careers Hub which is a Volunteer’s main point of contact conducts recruitment and verification activities for volunteers from industry. Similar personal data processing activities to those described in section 3E for Job Applicants also verify volunteers' suitability. 


i. CEC’s use of Employer Contacts and Volunteers’ data

We process data about Employer Contacts and Volunteers for the following purposes, each of which relates to our overarching mission to help every young person find their best next step: 

 

  • To support links between employers and schools, colleges and independent training providers  
  • To promote and publicise work to achieve our mission 
  • To plan, deliver and measure the effectiveness of CEC programmes and events 
  • To conduct research related to our mission 
  • To enable systems management and security 
  • For CEC’s legal and compliance purposes 
  • Applicants for volunteer positions should also refer to section 3.E.i relating to job applicants for details of additional processing purposes. 
ii. Categories of personal data CEC processes about Employer Contacts and Volunteers

We process the following types of personal data about Employer Contacts and Volunteers: 

 

  • Personal identifiers including your name, job title and the name of the Employer you represent 
  • Contact details including your email address, telephone number and employer’s address 
  • Your volunteer status 
  • Your engagement with our products, training, programmes and other services and events 
  • Your responses to our surveys and other research 
  • Applicants for volunteer positions should also refer to section 3.E.ii relating to job applicants for details of additional categories of personal data processed. 
iii. Lawful basis for processing data about Employer Contacts and Volunteers

The lawful bases for processing Employer Contacts and Volunteers data are: 

 

  • Performance of our task in the public interest related to our mission to help every young person to find their best next step 
  • Performance of a contract 
  • Consent to receive marketing communications 
  • Necessity for compliance with a legal obligation 
  • Necessity for CEC’s legitimate interests in relation to security and legal risk 
  • Applicants for volunteer positions should also refer to section 3.E.iii relating to job applicants for details of additional lawful bases. 
iv. Sharing data about Employer Contacts and Volunteers

Our work is at national scale and delivered through our network of Careers Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs. 

 

We provide access to Employer Contacts and Volunteers personal information where necessary to enable partnership working towards our mission and to enable our suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place. 

 

Applicants for volunteer positions should also refer to section 3.E.iv relating to job applicants for details of the additional data sharing involved. 

D. Partners and Supplier Staff

This category includes the staff of suppliers and other organisations we work with, including organisations hosting Career Hubs and our funders.


i. CEC’s use of Partners and Supplier Staff data

We process data about Partners and Supplier Staff for the following purposes: 

 

  • To manage our contract and partnership working with your employer 
  • To communicate with you in order to facilitate operations 
  • To enable systems management and security 
  • For CEC’s legal and compliance purposes. 
ii. Categories of personal data CEC processed about Partners and Supplier Staff

We process the following types of personal data about Partners and Supplier Staff: 

 

  • Personal identifiers including your name, job title and the name of the Employer you represent 
  • Contact details including your email address, telephone number and employer’s address 
  • Your role in relation to our contract 
  • Records of our communications 
iii. Lawful basis for processing data about Partners and Supplier Staff

The lawful bases for processing Partners and Supplier Staff data are:

 

  • Performance of a contract 
  • Necessity for compliance with a legal obligation 
  • Necessity for CEC’s legitimate interests in relation to security and legal risk 
iv. Sharing data about Partners and Supplier Staff

Our work is at national scale and delivered through our network of Careers Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs. 

 

We provide access to Partners and Supplier Staff personal information where necessary to enable partnership working towards our mission and to enable other suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place. 

E. Job Applicants

i. CEC’s use of Job Applicant data

We process data about Job Applicants for the following purposes: 

 

  • To assess the fit of the Job Applicant to the position applied for 
  • To communicate with the Job Applicant (or recruiter where applicable) regarding their application  
  • To arrange and manage our selection processes 
  • To verify the suitability of candidates offered a position subject to verification 
  • To monitor CEC’s equity, diversity and inclusion 
  • To enable systems management and security 
  • For CEC’s legal and compliance purposes 
ii. Categories of personal data CEC processes about Job Applicants

We process the following types of personal data about Job Applicants: 

 

  • Personal identifiers including your name and date of birth 
  • Contact details including your email, telephone number and home address 
  • Qualifications  
  • Employment history 
  • Other information volunteered by you within application and selection process 
  • Application scoring 
  • Special category data including ethnic/ racial origin, nationality, disability status, sexual orientation, marital status (for CEC’s EDI monitoring) 

 

Additionally, we process the following types of personal data about successful Job Applicants who have been offered a position subject to verification of suitability: 

 

  • Criminal record data (if a criminal record check via the Disclosure and Barring Service is required due to the nature of the role this will be noted within the vacancy advert and/ or job description) 
  • Health data, sickness absence record and reasonable adjustment requests 
  • Employment and/ or educational/character references provided by your nominated referees 
iii. Lawful basis for processing data about Job Applicants

The lawful bases for processing Job Applicants’ personal data are: 

 

  • CEC’s legitimate interest in recruiting job applicants who provide the best fit to role requirements 
  • Performance of a contract (successful Job Applicants who accept a role offered subject to verification of suitability) 
  • Necessity for compliance with a legal obligation 
  • Necessity for CEC’s legitimate interests in relation to security and legal risk. 
iv. Sharing Job Applicant personal data

We provide access to Job Applicant personal information where necessary to enable our suppliers to support our recruitment and suitability verification processes. In such cases we take steps to verify that suppliers provide adequate assurance to protect information and ensure that appropriate agreements are in place. 

 

Verification for successful candidates also requires us to provide your nominated referees with your personal identifiers and details of the position you have been offered subject to verification. 

 

We do not share Job Applicant personal data with other organisations for their own purposes unless we are legally required to.

F. Employees

In addition to the personal data processing described in this section, CEC process employees’ personal data described at section 3.E for Job Applicants.


i. CEC’s use of Employee data

We process data about Employees and other workers for the following purposes, each of which relates to our overarching mission to help every young person find their best next step: 

 

  • To communicate with Employees and support employee relations 
  • To provide salary, pension and other benefits 
  • To reward and manage performance 
  • To assess training and development requirements 
  • To facilitate HR management 
  • To monitor CEC’s equity, diversity and inclusion 
  • To enable systems management and security 
  • For CEC’s legal and compliance purposes 
ii. Categories of personal data CEC processes about Employees

We process the following types of personal data about Employees: 

 

  • Personal identifiers including name and date of birth 
  • Contact information including personal email address, telephone number and home address 
  • Bank details, tax code and national insurance number 
  • Benefit selections 
  • Absence records including sickness absence, annual, parental and other types of leave/ absence 
  • Performance data 
  • Grievance and Disciplinary records 
  • Records of requests for reasonable adjustments and flexible working arrangements 
  • Health and disability information 
  • Data about use of CEC IT assets and compliance with our Acceptable Use Policy 
  • Special category data including ethnic/ racial origin, nationality, disability status, sexual orientation, marital status (for CEC’s EDI monitoring) 
  • The name and contact details of your next of kin/ emergency contact 
iii. Lawful basis for processing data about Employees

The lawful bases for processing Employees’ personal data are: 

 

  • Necessity for CEC’s legitimate interest in managing employees to facilitate our mission of helping every young person to make their best next step 
  • Performance of a contract 
  • Necessity for compliance with a legal obligation 
  • Necessity for CEC’s legitimate interests in relation to security and legal risk. 
iv. Sharing Employee personal data

We provide access to employee personal information where necessary to enable our partners and suppliers to support the delivery of our work. In such cases we take steps to verify that organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place. 

G. Website visitors

For information about data processing in relation to the use of our digital products for education, please see section 3B.


i. CEC’s use of Website Visitor data

We process data about website visitors for the following purposes: 

 

  • To provide essential website functionality 
  • To understand how the website is used 
  • To improve performance of the website and user experience 
  • To respond appropriately to information you enter into our web forms 
  • To enable systems management and security 
  • For CEC’s legal and compliance purposes. 
ii. Categories of personal data CEC processes about Website Visitors

We process the following types of data about Website Visitors: 

 

  • Information you enter in our web forms. This may include: 
  • Personal identifiers including your name and date of birth 
  • Contact details including your email, telephone number and home address 
  • Your employer 
  • Your query or a registration for CEC training, a service or other event 
  • Other information you have chosen to enter into a web form 
  • Cookies and similar technologies which provide information about your system, pages visited, and content accessed 

 

When you browse our website you will be presented with a pop up which provides information about Cookie options. Only cookies which are strictly necessary for the basic functioning of our website are essential and cannot be refused. More information about CEC’s use of Cookies is available in our Cookie Policy

iii. Lawful basis for processing data about Website Visitors

The lawful bases for processing Website Visitors’ personal data are: 

 

  • Your consent when you register to receive marketing communications 
  • Your consent to set cookies 
  • Performance of our task in the public interest related to our mission to help every young person to find their best next step 
  • Our legitimate interest in processing the data you enter into our web forms and responding appropriately.  
  • Please also see the appropriate section relating to the forms’ purpose. For example, Section 3B if you are a Careers Leader who used a form on our website to register for an event 
  • Necessity for compliance with a legal obligation 
  • Necessity for CEC’s legitimate interests in relation to security and legal risk. 
iv. Sharing Website Visitor personal data

Our work is at national scale and delivered through our network of Careers Hubs that bring together schools, colleges, employers, and apprenticeship providers in local areas across England, working in partnership Mayoral and local authorities to connect with local skills needs. 

 

We provide access to Website Visitor personal information where necessary to enable partnership working towards our mission and to enable our suppliers to support the delivery of our work. In such cases we take steps to verify that these organisations provide adequate assurance to protect information and ensure that appropriate agreements are in place. 

4. How long we keep your personal data 

We will only keep your personal data for as long as we need it. CEC has a retention schedule for personal data based on the needs of the organisation, fairness to you, and applicable law.  

We take necessary steps to keep your information safe throughout the time we keep your data: CEC holds the international standard ISO 27001 certification for information security as well as the UK government’s Cyber Essentials Plus verification.  

5. Processing personal data outside the UK 

When CEC processes personal data outside the UK, we make sure we comply with data protection law and take necessary steps to keep your personal data safe. 

6. Your data protection rights 

Under data protection law, you have rights including: 

  • Right of access 

You have the right to ask us to see the personal information we are processing about you. 

  • Right to rectification  

You have the right to ask us to rectify personal information you think is inaccurate or incomplete. 

  • Right to erasure  

You have the right to ask us to erase your personal information in certain circumstances. 

  • Right to restriction of processing  

You have the right to ask us to restrict the processing of your personal information in certain circumstances. 

  • Right to object to processing  

You have the right to object to the processing of your personal information in certain circumstances. 

The Information Commissioner’s Office (ICO) provides more information about each of these data protection rights on its web site: https://ico.org.uk/for-the-public/  

7. How to complain 

If you have concerns about our use of your personal information, you can make a complaint to the Data Protection Officer. Email dpo@careersandenterprise.co.uk  

The ICO is the independent authority responsible for supervising compliance with data protection law in the UK. You may also complain to the ICO by writing to:  

ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. 

Helpline number: 0303 123 1113  

ICO website: https://www.ico.org.uk  

8. Changes to this privacy notice 

This privacy notice will be updated from time to time, and we encourage you to check our website for updates. 

Date of last update: 17 September 2024