Information we hold about you and how we use it.

We collect personal information about you when you enquire about or make use of our services. The lawful reasons that
we process information varies depending on the purpose, but, depending on the use, we will only ever process your data
if:

• You have given us your consent, which you can remove at any time.
• We have a contractual obligation.
• We have a legal obligation.
• We have a vital interest.
• We need it to perform a public task.
• We have a legitimate interest.

In general, we may use your information to:

• Communicate with you.
• Keep our records up to date.
• Process payments.
• Ensure the safety of users.
• For research and statistical purposes.
• To fulfil our legal and regulatory obligations.
• Gain feedback from you.
• Prevent crime and meet our legal obligations.
• Prudentially manage our business using models and forecasts.
• Keep you informed of products or services that may be of interest to you where you have given us consent for us to do this.

We use different personal information for other purposes, depending on the type of services you use. For all users of our services, the information we collect, and hold may include:

• Basic information, such as your name, date of birth, address, telephone number and email address so that we can stay connected and manage your service. We may also use this information to verify your identity.
• Records of contact with you, such as system notes, emails, and letters.
• Your Internet Protocol (IP) address, together with cookies and other information about how you use our website, your browser, operating system, any plug-ins, and your time zone. We use this information to optimise our website.

For students, the information we collect, and hold may also include:

• Information about you, such as your gender, date of birth, year group, expected leaving year group, and information about your interests and skills to help employers evaluate your work experience placement.
• Some more sensitive detail about you, such as your ethnicity, information about any disabilities, special needs or learning difficulties, and basic details about your parents. This helps employers and workshop providers prepare an inclusive service.
• This information is also visible to staff at your school to help them give you personalised careers advice.

For school and college employees, the information we collect, and hold may also include:

• Personal information that you provide us with about students, including name, email address, year group, expected leaving year group, gender, medical needs, special education needs and parental details. This information will be visible to staff at your school.

For company representatives, the information we collect, and hold may also include:

• Details of the placements you offer such as job role, duration of placement and day-to-day activities.
• Information about your role, including job title, and answers to questions about the nature of the role. This information will be visible to your organisation’s administrator, the student assigned to your placement offer, and school staff member on Knvas once the administrator approves your profile for your organisation.

How we get your personal information

• We collect data through various methods, including our website, correspondence between us by phone or email. This could include information you provide when you register to use our site, subscribe to our services, take part in promotion, or survey, and when you report a problem with our site.
• Most of the personal information we process is provided to us directly by you. We will only collect, use, hold or disclose personal data where we have a lawful basis for doing so. This means the information needed to provide you with a product or service, to satisfy legal or regulatory requirements, or where we have your consent.

For schools:

• We also receive some personal information, from schools, colleges, universities, and employers that use our services, but only ever under the protection of a written agreement.

How long we keep your information

• We will keep your personal information only for as long as necessary in line with regulatory and legal requirements. We will either anonymise it or destroy it securely when we do not need it anymore.

How we protect your information

• The security of your information is important to us. We protect your information by maintaining physical, electronic, and procedural safeguards concerning collecting, storing, and disclosing personal data to prevent unauthorised access, accidental loss, disclosure, or destruction.
• No data transmission over the internet can be entirely secure, and therefore we cannot guarantee the security of your personal information and/or use of our sites. However, we use our reasonable endeavours to protect the security of your personal information from unauthorised access.

Where we process your information

Your data is stored securely on servers located within the UK, EU and in cloud-based applications.

How we share your information

From time to time, we may send information to, receive information from, or exchange your personal information with:

• Partners or agents who support us to deliver our products and services to you, or that we refer you to, or that refer you to us.
• Third-party organisations that conduct research, analysis, and marketing activities on our behalf.
• Regulators, courts, or other public authorities.
• The emergency services in the case of an accident or emergency.
• Law enforcement agencies for the prevention of crime.
• Appropriate authorities to ensure safety, especially considering safeguarding concerns.

We utilise some third-party companies to improve our website and platform’s experience, and some of your data might be passed to these providers. Some of these key suppliers include:

• Mailersend to manage our transactional and marketing emails. You can view their privacy notice at https://www.mailersend.com/legal/privacy-policy
• Google Analytics to track users on our website and capture the pages visited, duration of stay, user device and more. We use this information to optimise your experience of our site and identify any problems. You can view their privacy notice at www.privacy.google.com/businesses/compliance.
• Hubspot to manage our marketing database. You can view their privacy notice at www.legal.hubspot.com/privacy-policy.

We may share student information with schools and employers so that everyone can work together and give the student better and more targeted careers advice and build a better understanding of how well-suited opportunities may be for the students.

Our website may have links to and from the websites of our partner networks, advertisers, and affiliates. If you follow a link to any of these websites, please note that these websites have their privacy notices and that we do not accept any responsibility or liability for these policies. Please check these policies before you send any personal data to these websites.

If a third party delivers all or part of the service requested by you, whilst the information you provide will be disclosed to them, it will only be used to administer the service provided and maintain management information for business analysis. Where we have relationships with other organisations that process your information on our behalf, we always ensure they have high data security standards. We will not allow these organisations to use your personal information for unauthorised purposes.

If the business is reorganised or sold, we may transfer any personal information we hold to that organisation.

How you can manage the information we hold and how we use it

Data protection regulations mean you have rights in respect of the information we hold about you:

• Your right to transparency
You have the right to know what information is being processed about you and why.
• Your right to manage consents
You have the right to give your consent to us using your data for any activities we do not have another lawful basis to carry out, for example, sending you certain direct marketing communications. You can withdraw consent at any time.
• Your right to access your data
You have the right to request access to the information we hold about you; this is called a Data Subject Access Request.
• Your right to know about sharing
You have the right to know who your data is shared with and why.
• Your right to rectification
You have the right to have your details updated if they are inaccurate and for information not needed for lawful reasons to be deleted. You also have the right to ask us to complete information you think is incomplete.
• Your right to be forgotten
You have the right to ask us to erase your personal information in certain circumstances.
• Your right to object to processing
You have the right to object to the processing of your data in certain circumstances. In some circumstances, your information may be transferred to a secondary database in case you want to reactivate your account in the future, and it will be kept and securely destroyed in line with our Data Retention Policy.
• Your right to restrict processing
You have the right to have automated processing and profiling restricted. Profiling may be used to analyse or predict economic situations, health, personal preferences, interests, reliability, behaviour, location, or movements. Without it, you may find that the suggestions and guidance you receive from us do not reflect your circumstances very accurately.
• Your right to data portability
You have the right to ask us to send information that we process by automated means to you or another nominated data controller in a commonly used electronically readable format.

You do not have to pay any charge for exercising your rights. If you make a request, we will respond to you within one
month. If you wish to action any of the above, please contact us by:

Emailing info@knvas.co.uk
Writing to Knvas, 26 Allonby Way, Aylesbury, HP21 7JA
You can also complain to the ICO if you are unhappy with how we have used your data. You can contact them in writing
to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF or call their helpline on
0303 123 1113.

Changes to this policy

We regularly review this policy. Any changes that we may make in the future will be made available here, so you can
always view the most recent version there.

This Privacy notice is the February 2023 version.