Fair processing notice: AAT Bursary applicants
15 February 2022
This fair processing notice applies to AAT Bursary applicants. It describes data collected as part of your application and should be read alongside notices for professional members, licensed members and/or students depending on the nature of your existing relationship with us.
The data we collect about you
- Your name, date of birth and contact details.
- Any other relevant personal information contained in your application forms, supporting documents uploaded with your application, or that you may provide to us.
What we do with your data and on what grounds
We can only process your personal data if we have a basis to do so which is permitted by law. This may be that you have given your consent, or one of the other lawful bases for data processing outlined below.
- Necessary for our legitimate interests. We process your personal data as and when necessary to do so in order to conduct and manage our business to provide you with the best services and experience. We make sure we consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests. We don’t use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
- Necessary to meet our legal obligations. We process your personal data where it’s necessary for compliance with legal or regulatory obligations.
| Purpose/activity | Lawful basis for processing including basis of legitimate interest |
|---|---|
| Contacting you for marketing purposes in relation to the AAT bursary. | Your consent (if received) |
| To process your bursary application. | Performance of a contract with you |
| Contacting you in relation to your application and, where necessary, any ongoing administration of a bursary award. | Performance of a contract with you |
| Managing payments, fees and charges in relation to any bursary awarded. | Performance of a contract with you |
| Invite people to participate in surveys, research and focus groups to provide feedback about an AAT product or service, and process feedback received and follow up with responses if appropriate. | Necessary for our legitimate interests (for running our business) |
| To address enquiries and resolve issues | Your consent (if received) |
| For training purposes for our bursary judging panel in relation to assessing applications for the bursary scheme. | Necessary for our legitimate interests (for running our business) |
| To meet our legal obligations, including data management (to assess and maintain the quality of data stored and performing analysis on the completeness and correctness of data). | To comply with our legal obligations |
| To manage complaints and breaches of our regulatory framework and policies, including investigating incidents, publishing consent orders and sanctions and maintaining records for future reference. |
|
Automated decision making
No decisions will be taken about you or your application using solely automated means as a result of your application for a bursary.
Who we share your personal data with
With your approved training providers, where a bursary is awarded.
Our use of data processors
We use a third-party supplier to host our website, based within the EU.
We also use Microsoft Office 365 to process email and for file storage, hosted within the EU, and a third-party email archive system hosted within the UK. We also use a CRM system, Hubspot hosted in Europe. These transfers to the EU are based on the UK adequacy decision of EEA countries.
Anonymised data will be shared with external AAT members who have been selected as part of the awarding panel.
Where a third-party data processor is used, we ensure that they operate under contractual restrictions with regard to confidentiality and security, in addition to their obligations under data protection legislation. This means that they cannot do anything with your personal data unless we have instructed them to do it. They will not share your personal data with any organisation apart from us. They will hold it securely and retain it for the period we instruct.
Where we get your data from
From you directly. We reserve the right to follow up with employers, benefit providers, and any third parties to which evidence relates.
How long we keep your data
We will retain your data for up to 24 months following your application.
Transferring your data overseas
We transfer your data overseas as detailed above with regards to data processors, and where your training provider is based overseas.
Related content
