Privacy Notice

We process personal data for the purposes of providing training and consultancy services. We are:

Tkm Consulting (Craigellachie) Ltd, Ratagan, Glenshiel IV40 8HP, info@tkmconsulting.co.uk
Company number SC472017
ICO registration reference ZA104480
Director – Liz Taylor

The Associates are:

• Heather Jack of HJBS Ltd, 3/2, 76 Albert Avenue, Glasgow, G42 8RD (ICO registration reference ZA503385)
• Frank Rankin, sole trader, 11 Viaduct Road, Clarkston G76 8BN (ICO registration reference ZA284616)

We process personal data relating to clients, clients’ employees, training attendees and business contacts including:

• Name and contact details including telephone number, postal address, email address
• Correspondence and notes of discussions and meetings
• Feedback, appeals and complaints
• Bank account and payment details relating to sole traders

This personal data is used for the purposes of delivering and accrediting training, providing consultancy services, invoicing and keeping accounts, and marketing our services. These activities are necessary in our legitimate interests to run training and consultancy businesses, and in the legitimate interests of our clients to receive training and consultancy support.

We may will also use your information to continuously improve our services and may use it for market research including conducting surveys where it is in our legitimate interests to do so.  Feedback provided about our services may be anonymised and used for promotional purposes also where it is in our legitimate interests.  Occasionally we may ask you if your feedback can be attributed in promotional material and we will only do this with your consent.

Personal data is held on our externally hosted systems, including:

• Microsoft Office 365 applications
• Quickfile and FreeAgent account platforms
• Mailjet for sending out email newsletters and other group communications to those using our services.

Personal data of clients and training attendees is shared between Tkm and the Associates for the purposes of managing and delivering training and supporting clients.

We retain records of training and consultancy for six years from the end of the contract or end of the current financial year before securely deleting them.

Some of our services require the processing of other personal data which is detailed below.

Providing DPO as a Service

When providing DPO as a service, Tkm does not routinely collect any personal data although will undertake a number of tasks that can involve the processing of personal data. Some tasks are laid down by the UK General Data Protection Regulation (the UK GDPR) and include:

• Monitoring of compliance. This will include processing personal data through audits and other checks. Personal data is only recorded or retained as part of audit documentation by exception
• Being accessible to people whose data is being processed by clients. Data subjects may wish to send Tkm correspondence which will be processed according to the topic of the correspondence. The DPO is legally required to be available to data subjects for the purposes of:
  • All issues related to processing of their personal data
  • Exercising rights under the GDPR

Where the service is being provided to an organisation, any personal data processed for the purposes of managing and fulfilling the contract is processed using legitimate interests as it is in the interests of both parties to a contract for the contract to be delivered as agreed. Where a client is a sole trader or partnership, this information is processed as it is necessary for the performance of a contract.

Tasks of a DPO are a legal obligation placed on the DPO, which provides the legal basis for processing personal data. Records will be retained to comply with Tkm’s legal obligation under Article 5(2) of the UK GDPR (accountability).

When fulfilling the role of Data Protection Officer, Tkm Consulting may be under a legal obligation to hold or pass on minimal personal data relating to complaints, breaches, accountability or monitoring duties.

Training Course Attendees

For those that attend our courses, in addition to the personal information listed above, Tkm Consulting will process:

• Records of attendance at training and records of progress where your course includes access to our learning management system (Training Post)
• Examination scripts and marks, presented portfolio content and recordings of certificated assessments where there is an assessed element of the course
• Details of specific support requirements for training attendees
• In the context of support requirements for training attendees, we may hold small amounts of special category data, relating to health and ability, in order to meet our legal obligations under equalities legislation to make reasonable adjustments.

This information is collected and processed to administer training courses and comply with awarding body requirements.

Where course attendance is booked by an organisation, any personal data processed for the purposes of providing training courses is processed using legitimate interests as it is in the interests of both the client and Tkm for the training to be delivered as agreed.  Where a course attendee is an individual booking for their own CPD, sole trader or partnership, this information is processed as it is necessary for the performance of a contract.

For externally validated courses, information about attendees and training information may be provided to the Scottish Qualifications Authority or the British Computer Society for the validation and audit of the courses they accredit as well as for the purposes of certification.

Our learning management system is provided by Training Post, which hosts our online learning resources.  Where your course has hard copy materials, your contact information may be passed to the courier used to deliver your materials so that you can track delivery.

Exam scripts, recordings of assessments and portfolios are retained for a maximum of 18 months.  Information about support requirements including special category personal data will be destroyed as soon as it is no longer required.

Ordering Online

When you place an online order, we will collect and retain information about your online transaction.

Where the order is being placed on behalf of an organisation, any personal data processed for the purposes of managing and fulfilling the order is processed using legitimate interests as it is in the interests of both parties for an order to be fulfilled and delivered as agreed. Where a client is a sole trader or partnership, this information is processed as it is necessary for the performance of a contract.

Our website and online commerce is managed through WordPress and WooCommerce (see separate cookies notice on our website).

Marketing

Tkm occasionally runs competitions and will collect names and addresses of those that wish to participate.  Information for those that do not subsequently sign up for marketing or Tkm’s services will be held for a maximum of 13 months.

The majority of Tkm’s marketing is to those representing organisations and Tkm may use information that is publicly available to send out marketing.  Where you sign up to Tkm’s marketing as an individual, Tkm will be using consent to send you marketing which you can withdraw at any time.

Those on our marketing lists can also unsubscribe at any time.

Your Rights

You have statutory rights relating to your own personal data:

• Access – you have the right to know what data is held relating to you and why, and to receive a copy of it;
• Rectification – you have the right to have inaccurate information about you corrected;
• Objection – you have the right to object to the use of your information;
• Erasure, restriction – in specific circumstances, you have the right to have your personal data deleted or to put limits on what can be done with it.

For more information on your rights under the UK General Data Protection Regulation see For the public | ICO

To exercise any of these rights or for more information, please contact us using the details above.

If you consider we have infringed data protection law, you have the right to complain to The Information Commissioner: Make a complaint | ICO

V0.2 Sep 2024