Who We Are: COYO is a private company limited by shares. We are also a social business with social objects and restriction on distribution of profits entrenched in our company Articles. Our vision is to inspire all young people to reach their full potential through world-class education and opportunity. We deliver our Design Engineer Construct! (DEC!) Learning Programme in schools to this aim. We also help to facilitate sponsorship of this programme to schools through partnership with construction industry organisations via their corporate social responsibility (CSR) schemes, establishing sustainable relationships between industry and schools. This is COYO’s ‘Adopt A School Scheme’. COYO is based in the UK and our registered office is detailed on our website and at the bottom of this policy document.
The Purposes for Collecting Your Data: COYO mainly processes data which is covered by our core business activity such as administration and marketing of our own business and which does not require registration under the Data Protection Act. However, we do also intend to collect personal data relating to students, parents and teachers to enable us to provide education and training to our customers and clients, to help us improve our learning programme(s) and for the purposes of evaluation of our DEC! Learning Programme and for measuring related social, educational and economic outcomes and impact. COYO is, therefore, registered with ICO under the Data Protection Act 1998 as a ‘Data Controller’. Some of the data we will use for evaluation purposes will already be in the public domain, for example, some exam results. Where applicable, COYO will anonymise personal/sensitive data so that an individual cannot be identified.
COYO will also collect some personal data from business customers, suppliers and other business contacts which may be used for our own marketing purposes – for example to invite those individuals to DEC! events and to establish networks and partnerships which promote DEC! and our Adopt A School scheme. In addition, we will also process personal data when recruiting and in maintaining our own accounts and records and to support and manage our employees. We class these types of data as core business activity as described above.
Types of Data We Collect: ‘Personal data’ means data that allows someone to identify or contact students, parents and teachers, including, for example, their name, age, school address, email address, as well as any other non-public information about them that is associated with or linked to any of the foregoing data. Personal data also includes photographs and other images. Sensitive personal data includes data relating to a person’s race or ethnic origin. We will collect personal/sensitive data relating to DEC! students and their education whilst still at school. We will also ask DEC! students for information relating to their ongoing education and career pathways, such as university places, work placements and employment opportunities. Some of this data will be factual e.g. exam results, school location, other will be qualitative such as attitudes to learning, job prospects etc. This is to help us to measure the longer term benefits of the DEC! Learning Programme. We will also collect data relating to teacher training and continuing professional development (CPD). In respect of parents we will collect, for example, data re: demographics, attitudes, parental engagement etc. Some of this data will already be in the public domain.
In regard to recruitment of future COYO employees within our core business activity we may ask for cvs, covering letters and/or completion of application forms.
Anonymous Data: Anonymisation is the process of turning data into a form which does not identify individuals and where identification is not likely to take place – anonymous data. We may be able to anonymise data in some cases, for example relating to evaluation of comparatives across different regions of the UK.
Asking for Your Consent: We will seek permission from schools, teachers, parents/carers and/or students, as applicable, before processing any personal data which is not in the public domain. This includes photographs and/or other images. We will be clear on how we intend to use that personal/sensitive data. Signified consent will be through the use of a COYO consent form where consent has not already been obtained from the parents/students by the school. Where consent has been obtained by the school, COYO will gain signified consent from the school itself.
Where consent has been given to place student/teacher images on a restricted area of COYO’s website(s) we will ensure that we take care to give only the necessary level of access, maintain strong password control and stop access when it is no longer appropriate. COYO will also make sure it remains wary of metadata or deletions that could still be accessed in documents and images posted on our website. COYO will review all on a regular basis.
We will notify anyone applying for a job at COYO that we will use their personal data for the purposes of our recruitment only.
Website – Where your personal data is collected from any of our websites, we will use the information to contact you in relation to your request. We will not share this information with any other organisation or individual without your express consent. We will ask you to specifically ‘opt-in’ to signify your agreement to use of that data in specific ways.
How We Collect Personal Data: We will collect personal data in various ways but we will use the same method of consent from individuals when collecting such data in a specific ‘class’ of individual e.g. students, teachers, new recruits etc. Collection sources may include, for example, school class- lists and DEC! exam grades; COYO’s own feedback forms; industry Adopter feedback.
Website – We collect personal data through websites via our contact forms, call back forms and competition registration forms. Where your personal data is collected from any of our websites, we will use the information to contact you in relation to your request. We will not share this information with any other organisation or individual without your express consent.
When someone visits our website(s) we also collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site(s). We collect this information in a way which does not identify anyone. We do not attempt to find out the identities of those visiting any of our websites. We will not associate any data gathered from this site with any personally identifying information from any source. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it. Search queries and results are logged anonymously to help us improve our website and search functionality. No user-specific data is collected by either COYO or any third party relating to log and search information.
Sharing your Personal Data: Most schools share personal information with other organisations. As provider of the DEC! Learning Programme, COYO will ask schools (and any other educational providers) using DEC! to share information with us such as class-lists and other appropriate information. COYO will also share with schools any feedback from COYO-led DEC! training or workshops or Adopter-led industry support days. All such information may also be shared with relevant industry Adopters for the purposes of evidencing corporate social responsibility (CSR) and for the potential offer of work-placements etc. and with universities for the purposes of evaluating our programme. Where appropriate, we will pass across anonymised data.
We may share any evaluation reports on educational and social outcomes with other schools, industry ‘Adopters’ or potential investors, and government. These reports may contain anonymised data or personal data where that information is already in the public domain, for example, publicised exam results.
As detailed above, we will ask for the school’s, teacher’s, parents’, student’s consent as applicable before sharing any personal data and will transfer any such data securely.
ICO states that it is good practice to obtain an assurance about the use of personal data when it is shared with a third party, that it is used fairly and lawfully and takes account of the Data Protection Act principles. ICO suggests the use of a written contract. COYO will obtain a written contract in appropriate situations.
Website – Where your personal data is collected from any of our websites, we will use the information to contact you in relation to your request. We will not share this information with any other organisation or individual without your express consent.
We follow the Data Protection Act eight guiding principles: Personal data shall be:
1. Processed fairly and lawfully
2. Obtained only for one or more specified and lawful purposes
3. Adequate relevant and not excessive
4. Accurate and, where necessary, kept up to date
5. Kept no longer than necessary
6. Processed in accordance with the rights of the data subject
7. Kept secure
8. Not transferred to a country outside the EEA
COYO’s Data Protection Policy Statement is available here and our full Data Protection Policy and Guidance is available on request. We have followed ICO’s guidance in drafting our policy and guidelines.
Your right to access your Personal Data: You as an individual have a statutory right of access to any data we hold which relates to you. Please contact our Data Protection Officer at our registered office in writing or by email (email@example.com) if you have an enquiry or a complaint.
COYO’s Registered Office: The Institute, St Nicholas’ Hall, Wesley Street, Sabden, Clitheroe, BB7 9EH.