Fair processing notice: AAT case studies

31 August 2023

This fair processing notice applies to participants in case studies. It describes data collected as part of your application and should be read alongside notices for professional members, licensed members and/or students depending on the nature of your existing relationship with us.

The data we collect about you

The data we collect, set out below, is as provided as part of a case study form and/or photography and video consent form or captured as part of photography or video.

Your name and contact details
Personal details like your date of birth, gender and background
Employment details like your organisation name, job title, sector and industry
Details of your membership with us and other awarding bodies, such as your AAT membership ID and membership status
Your education information, such as qualification records, level of education, association with a training provider, Unique Learner Number/Scottish Candidate Number, and English language ability
Ethnicity where captured as part of photography and video or optionally provided as part of your personal circumstances
Certain health information you may disclose in respect of your personal circumstances, such as details of disabilities/learning difficulties requiring reasonable adjustments for assessments
Basic records covering your name, date of birth, location, address history, member number, membership statuses and dates of initial registration, election and all status changes, qualification, work experience history, membership of other awarding bodies and practice management
Any other relevant personal information contained in your case study and/or photography and video consent forms and/or photography and/or video footage of you, or that you may provide to us with consent (eg responses to surveys and personal stories for marketing material)
Any personal data in the form of photography or video from a minor(s) needs to be consented by a parent or guardian via a Photography and video consent form, stating the relationship of the consenting adult to the minor(s)

What we do with your data and on what grounds

The data provided in a completed case study form and/or photography and video, along with photography and video consent forms, is used in our communications.

Please note that participation is voluntary. If you decide not to participate there will be no negative consequences on your future dealings with AAT. If you decide to participate, you may stop participating at any time. You can notify us by emailing casestudies@aat.org.uk.

Purpose/activity	Lawful basis for processing including basis of legitimate interest
Marketing and promotional communications, including using your case study to: have a bank of case studies available to contact for inclusion in marketing and promotional material market to existing students, members, training providers, employers as well as prospects via social media market to existing students, members, training providers, employers as well as prospects on behalf of third parties	Your consent Your explicit consent (in respect of any sensitive personal data you provide)

Marketing and promotional communications, including using your case study to:

have a bank of case studies available to contact for inclusion in marketing and promotional material
market to existing students, members, training providers, employers as well as prospects via social media
market to existing students, members, training providers, employers as well as prospects on behalf of third parties

Your consent
Your explicit consent (in respect of any sensitive personal data you provide)

Automated decision making

No decisions will be taken about you or your application using solely automated means as a result of your participation as a case study.

Who we share your personal data with

We publish case studies, with your consent, in the public domain, including:

on AAT website, AAT’s blog, AAT’s magazines, AAT’s offices and internal communications, membership and events materials, marketing and on AAT’s Facebook, Twitter, Instagram, Threads, LinkedIn, Snapchat, TikTok and YouTube channels published and stored in both EEA and non-EEA countries
in paid-for advertising which includes online paid advertising and boosted posts on AAT’s Facebook, Twitter, Instagram, Threads, LinkedIn, Snapchat, TikTok and YouTube
if you choose to use the "celebrate your achievement service" to have your name published on our website. We'll publish full names with designatory letters on our blog platform, AAT Comment, which is in the public domain and accessible worldwide. This is self-promotion of your new achievement and significant milestone, and is provided as an opportunity for you to enhance your career and employability. We will keep your name published for up to six months, but if at any point you wish to withdraw your name, we'll be happy to remove it from AAT services, but cannot guarantee removal from the public domain as websites may be captured elsewhere. To request removal of your name please email Contentteam@aat.org.uk.

Our use of data processors

We use carefully selected third party media representatives (eg Accounting Technician (AT) magazine journalists, photographers etc) from both EEA and non-EEA countries for national, regional, trade and consumer publications and/or broadcast. Where media representatives are based outside of the EEA we have Standard Contractual Clauses in place with these organisations to ensure the protection of individuals' data protection rights and freedoms.

We use a third-party supplier of a Digital Asset Management system, based in Europe, to record details of case studies.

We also use Microsoft Office 365 to process email and for file storage, hosted within the EU, and a third-party email archive system hosted within the UK . These transfers to the EU are based on the UK adequacy decision of EEA countries.

Where a third-party data processor is used, we ensure that they operate under contractual restrictions with regard to confidentiality and security, in addition to their obligations under data protection legislation. This means that they cannot do anything with your personal data unless we have instructed them to do it. They will not share your personal data with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

Where we get your data from

Other than directly from you, we may also receive personal data from the following third-party sources:

training providers
employers
our third-party media representatives.

How long we keep your data

Upon submitting a completed case study form and/or photography and video consent form to us, we’ll keep your details for up to five years after which you can renew your consent for AAT to keep your case study for a further five years by emailing casestudies@aat.org.uk.

Transferring your data overseas

We transfer your data overseas as detailed above with regards to data processors.

Published case studies will be available worldwide on social media platforms and other websites and may also be used as part of international marketing campaigns, for example our campaigns in Botswana. Our members are also international; membership materials are distributed/available to all of our members.