1. Introduction

Ginger Nut Media Limited (Trading as Ginger Nut Training) is committed to protecting your personal data and respecting your privacy.

This policy explains how we collect, use, share, and protect your information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data Use and Access Act 2025 (DUAA), which strengthens individuals' rights regarding data access, transparency, and digital accountability.

2. Who We Are

3. What Data We Collect

We may collect the following categories of personal data:

• Identity Data: Name, date of birth, gender, national insurance number
• Contact Data: Address, email, phone number
• Education & Employment Data: Qualifications, employment history, apprenticeship details
• Personal Circumstances: Information about your family or personal circumstances, for example where this is relevant to the assessment of your suitability to receive a bursary or in order to provide you with appropriate pastoral care
• Special Category Data: Ethnicity, disability status
• Usage Data: Website interactions, cookies, IP address
• Financial Data: Bank details (for funding or bursaries)

4. How We Use Your Data

Purpose	Lawful Basis	Special Category Basis
Enrolling learners	Contract	Explicit consent
Providing training and support	Legitimate interests	Substantial public interest
Reporting to funding bodies	Legal obligation	Legal obligation
Monitoring equality and diversity	Consent	Explicit consent
Website analytics	Consent (via cookies)	N/A
Marketing communications	Legitimate interests	N/A

The purposes for which we may use personal data (including sensitive personal data) we collect during a student's association with us include:

• Recruitment and admissions
• Academic matters, including the provision of our core teaching and learning services (e.g. registration, assessment, attendance, managing progress, academic misconduct investigations, certification)
• Maintaining student records
• Assessing your eligibility for additional funding
• Providing IT and information services
• Monitoring equal opportunities
• Safeguarding and promoting the welfare of students
• Administering finance (e.g. funding returns)
• Other administrative purposes, including carrying out research and statistical analysis
• Carrying out audits (e.g. to ensure compliance with our regulatory and legal obligations)
• Dealing with grievances and disciplinary actions
• Dealing with complaints and enquiries

4.1 Data Access Transparency

In accordance with the Data Use and Access Act 2025, we maintain an internal register of all access to personal data. This includes which members of staff or third parties have accessed your personal data and when. You may request a summary of this access log at any time, subject to verification of identity and relevance.

5. Marketing Communications

We may contact you if:

• You are an apprentice with Ginger Nut Training
• Your organisation has previously engaged with us
• You are responsible for apprentices at your organisation

You can opt out of marketing communications at any time by contacting us at: delivery@gingernuttraining.co.uk

6. Automated Decision-Making

We do not use profiling or automated decision-making for eligibility or assessment purposes. If this changes, you will be informed and have the right to request human intervention.

In accordance with the Data Use and Access Act 2025, if we introduce any automated decision-making systems in the future, you will be informed and have the right to request a human review of any significant decisions made about you.

7. Data Sharing

We may share your data with:

• Awarding bodies
• Funding agencies (e.g., ESFA, DfE)
• Employers (for apprenticeships)
• IT service providers (e.g., OneFile)
• Regulatory authorities
• End Point Assessment Organisations

All third parties are contractually bound to comply with data protection laws. We do not sell or rent your personal information.

We maintain records of data access and sharing in accordance with the DUAA 2025. You may request information about when and with whom your data has been shared.

8. International Transfers

If data is transferred outside the UK, we will use approved safeguards such as:

• International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses (SCCs)

9. Data Retention & Security

We will hold your information securely. To prevent unauthorised disclosure or access to your information, we have implemented strong organisational and technical security safeguards.

We retain personal data only as long as necessary:

• Learner records: 6 years after completion
• Financial records: 7 years
• Marketing consent: Until withdrawn

We retain only the minimum personal data necessary for each purpose, and we structure our systems and formats to promote interoperability and data reusability in line with the DUAA 2025.

10. Your Rights

You have the right to:

• Access your data
• Rectify inaccurate data
• Erase your data (where applicable)
• Restrict or object to processing
• Data portability
• Withdraw consent
• Lodge a complaint with the ICO

Where applicable, we will provide your data in a structured, commonly used, and machine-readable format to support data portability and interoperability, in line with the DUAA 2025.

11. Accessing or Updating Your Information

To request access to or update your personal data, contact:

You can contact our DPO for rights-related requests, including:

• Access to your personal data
• A copy of your data in a structured, machine-readable format
• A summary of access records showing when and by whom your data was accessed (as required under the DUAA 2025)

12. Children's Data

Ginger Nut Training does not provide training to individuals under the age of 16, in line with apprenticeship funding rules. As such, we do not knowingly collect or process personal data for children under 16.

In the rare event that we engage with learners aged 16 or 17, their data is processed with additional care and safeguards in accordance with the UK GDPR and Education & Skills Funding Agency (ESFA) and Department for Education (DfE) guidance.

13. Cookies and Tracking Technologies

Our website uses cookies to enhance your experience and to help us understand how visitors use our site. We comply with the UK Privacy and Electronic Communications Regulations (PECR), requiring user consent before placing non-essential cookies.

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help us remember your preferences, improve site performance, and deliver relevant content.

Types of Cookies We Use

• Essential Cookies: Required for the website to function properly
• Analytics Cookies: We use Google Analytics to collect anonymised data about how visitors use our site
• Remarketing Cookies: We use cookies to show relevant ads to users who have previously visited our site

Cookie Consent

When you first visit our website, you will see a cookie banner asking for your consent to use non-essential cookies. You can choose to accept or reject these cookies.

Managing Cookies

You can control and delete cookies through your browser settings. Please note that disabling cookies may affect the functionality of our website.

14. Security Measures

We use encryption, access controls, and secure servers to protect your data. We only collect and retain the minimum amount of personal data necessary for the purposes outlined in this policy.

15. Complaints or Queries

If you have any questions or concerns about our use of personal data, please contact:

16. Changes to This Privacy Policy

We review this policy regularly and update it as necessary to reflect changes in law, including the Data Use and Access Act 2025 and any future UK digital legislation. Updates will be posted on our website.