Full Data Protection Statement and Privacy Notice

What does this statement cover:

You can either scroll down to read this statement in its entirety, or click on one of the links below to go straight to the section you are interested in. 

Who we are

We are Upskill Global Limited, a company incorporated and registered in England and Wales with company number 11967077. Our registered office is at Floor 3, 6-8 Bonhill St, Shoreditch, London EC2A 4BX.

About Upskill Me

Our service, Upskill Me, delivered through our website upskillme.io, is aimed at school children aged 13 and older, and young adults up to 25 years of age. Upskill Me is an online platform assisting students in developing, recording and showcasing their employability skills. It enables students to record, track and reflect on their achievements and skill growth. It gives them access to information about work experience, career events, learning opportunities and resources.

How to contact us

If you have any questions, comments or complaints in regard to this statement or our processing of students’ personal data, please contact us at info@upskillme.io or the above address.
 

This document serves as our public statement on data protection. It sets out how we process the personal information of Upskill Me’s registered student users and non-student users of Upskill Me. It is aimed at schools and youth charities whose students use Upskill Me, the parents or guardians of such students, and any non-student registered users of Upskill Me (teachers of students who use Upskill Me, charities that work with students who use Upskill Me, and employees of third party organisations that offer opportunities to students through Upskill Me).

If you are a non-student registered user of Upskill Me and want to learn how we use your personal data, read section 6 (Privacy Notice) of this statement.

If you are a student user of Upskill Me, you may prefer to read our Privacy Notice for Students. If that notice is too basic for you, you are welcome to read this statement to learn more.
 

Our use of personal data is subject to the UK General Data Protection Regulation, the UK Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (together Data Protection Legislation).

For the purposes of the Data Protection Legislation we are the controller of registered users’ (data subjects) personal data processed in connection with their use of Upskill Me. This means that we are responsible for determining the purposes and means of the processing of their personal data.

Whilst we will take into consideration all reasonable requests from schools concerning the personal data of their students, we do not act as processors on behalf of schools or charities. Neither do we act as processors on behalf of schools, charities or third party organisations in respect of the personal data of their staff registered to use Upskill Me.
 

We aim to comply with the standards set out in the Information Commissioner’s Office Age Appropriate Design Code of Practice for Online Services.

  1. Best interests of the child

Upskill Me has been designed and developed with the best interests of students and respect of their rights in mind, including:

  • online safety;
  • privacy;
  • access to information and development opportunities;
  • freedom of expression;
  • encouraging self-development;
  • building confidence in their skills and abilities;
  • assisting them in developing and showcasing their professional personality;
  • providing them with tools to showcase their skills to potential employers;
  • equal opportunities and freedom from discrimination; and
  • freedom from economic exploitation. 

2. Data protection impact assessment

Under the Data Protection Legislation, offering online services directly to children mandates the use of data protection impact assessments.

We have undertaken a data protection impact assessment in order to assess and minimise risks to the rights and freedom of students, which may arise from our data processing. Our findings have been reflected in the development of Upskill Me.

3. Age appropriate application

Upskill Me is only available to students who are at least 13 years old. We recognise that needs and capacities of children differ depending on their age. Therefore, we have designed Upskill Me to reflect that.

We verify the age of children through our sign up process. Most children will sign up to Upskill Me through an invitation sent to them by their school. Other children will sign up by selecting their school on our sign up page and using their school email. We also allow students who participate in charity programmes for students to sign up through an invitation sent to them by the relevant charity.

We offer different service options to children and young adults in differing age groups:

  • Level 1, Basic (Ages 13 - 16)
  • Level 2, Advanced (Ages 16+)

We make only such features of Upskill Me available to students as we believe to be appropriate to their age group:

  • We enable students in all age groups to: record their achievements, qualifications and interests; monitor their skills progression, points and levels; earn progress badges; add and manage their goals; view work experience, events, career advice and e-learning opportunities; and receive direct messages from us about third party opportunities.
  • All students, will have the option to create their own public employment profile on Upskill Me and share it with their chosen teachers or prospective employers when applying for work experience or volunteering opportunities.
  • Students aged 16 and older will have the extra option to publish their employment profile on the Upskill Me employer talent pool and receive direct messages from potential employers. Their information, sourced from their profiles and applications, may appear in dashboards used by employers to manage information about targeted candidates for the purpose of their recruitment campaigns.

We screen content served to children within Upskill Me to ensure it is appropriate to their age.

We provide age appropriate privacy information (see section 4.4, Transparency, below).

We provide high privacy settings for all children by default (see section 4.7, Default settings, below).

We recognise that children aged 13-15 are particularly susceptible to peer pressure, and that their self-esteem may be adversely affected as they compare themselves with other children. As such, we do not make their profiles visible to other students.

4. Transparency

We provide age appropriate privacy information to children. This includes:

  • our Privacy Notice for Students; and
  • concise, just in time explanations provided within Upskill Me at the points at which use of that data is collected or activated (for example, on our sign up forms, within our privacy settings dashboard, and at the point of the publication of the student’s public employment profile).

Our Privacy Notice for Students adopts a layered approach. The first layer presents only limited, easy to understand information. However, students have the option to view more detailed information by selecting options provided within the document.

We prompt students within Upskill Me to speak to an adult before activating any new use of their data if they are uncertain on whether they should proceed.

5. Detrimental use of data

We observe the rules concerning marketing communications featuring or addressing children set out in the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing (CAP Code).

We provide our users with information about work experience, career events and learning opportunities offered by employers and other third party providers within the Upskill Me platform and by email and text. Except for direct messaging by employers to students aged 16+ who have published their public profiles on Upskill Me employer talent pool, in order to protect their privacy, we do not allow third parties to send marketing communication directly to children. We screen the content of all third party marketing communications before it is approved for publication within Upskill Me.

6. Policies and community standards

We operate our service and use personal data of children in compliance with our published terms and policies:

7. Default settings

Where we rely on consent to process personal data of students, we use privacy settings and the privacy dashboard to give students the choice over how their personal data is used and made accessible to other users and third parties.

We enable students to choose which optional elements of the service they wish to activate, and how much information to share in their public profiles.

8. Data minimisation

We collect and retain only the minimum amount of data required to provide our service and for the other purposes set out in section 5.3 (How and why we use personal data) of this statement.

9. Data sharing

See section 5.4 (Who we share personal data with) of this statement.

10. Geolocation

We use Google Analytics to provide us with information about how Upskill Me is used through the use of cookies. This includes tracking the location of the country and city from which Upskill Me is accessed. We do not track the exact location of students.

The use of all non-essential cookies (including those that collect geolocation data) is switched off by default and only activated if the user accepts such other cookies.

11. Parental controls

Upskill Me is only available to children who are at least 13 years old and legally capable of providing their own consent to the use of their personal data within online services. Furthermore, Upskill Me can only be used for educational and career development purposes. For these reasons, we did not introduce any parental controls that would allow parents or guardians to place limits on or monitor students’ activity on Upskill Me.

We do, however, use prompts within Upskill Me encouraging students to speak to a trusted adult before activating any new use of their data if they are uncertain on whether they should proceed.

12. Profiling

Certain in-service content can be of interest to students sharing certain characteristics (e.g. e-Learning content about empowering women to succeed professionally may be of interest to female users, or e-learning content concerning GSCEs may be of interest to pre-GSCE students). We may use automated processing to filter users by certain characteristics and offer targeted content to them within Upskill Me.

Similarly, employers may wish to offer specific opportunities to students who share certain characteristics (e.g. if they live in the geographical area where the opportunity is available, are in a specific age group, or have particular interests or skills). We do not allow employers to market their opportunities to students under 16 directly, but we may use automated processing to filter our users by the required characteristics and direct selected third party offers to such students.

The characteristic by which we may filter students for the purpose of targeted marketing may include their ethnicity, gender and free school meal allowance. This is to ensure that third parties can meet and monitor their compliance with non-discrimination legislation and offer equal opportunities to students of all backgrounds. This may include targeting specific opportunities to students with certain protected characteristics. Students can choose whether or not to provide such information and we will seek their consent to such use.

Targeted content and opportunities are optional and students must opt-in before such use is activated.

We do not use any other forms of profiling.

13. Nudge techniques

We do not encourage children to provide unnecessary personal data or weaken their privacy settings.

14. Online tools

We provide tools within the service to enable children to easily change their privacy settings (through our privacy dashboard).

We are also planning to introduce online tools that will make it easy for students to exercise their data protection rights (e.g. to download their data or ask that we delete their data, stop using their data or correct their data).
 

This section provides privacy information in respect of the personal data in our control. It covers personal data of student and non-student users of Upskill Me.

By non-student users of Upskill Me, we mean individuals acting in their capacity as representatives of their organisations. In particular:

  • teachers using Upskill Me to support their students;
  • youth charity leaders that use Upskill Me to help students showcase their participation in programmes run by the charities; and
  • employees of third party organisations (e.g. employers) that offer opportunities to our student users.
  1. The personal data we collect

We collect and process the following information about students:

  • name;
  • school email;
  • telephone number;
  • date of birth;
  • school (including whether it’s a state school);
  • year group;
  • gender (optional);
  • ethnicity (optional);
  • free school meal entitlement (optional);
  • employment profile picture (optional);
  • user name and encrypted password;
  • record of achievements, GCSE & A-Level qualifications and results, GCSE/A-Level subjects studied, interests, skills, extra-curricular activities, certificates, awards, multi-media projects, work experience photos;
  • achievement badges;
  • personal goals and progress;
  • details of usage of Upskill Me (e.g. time/duration and details of parts of the service accessed by the student);
  • event/job/course/career information the student attended or expressed interest in;
  • details of enquiries or other direct communication from/to a student; and
  • technical information (including the type of device used, a unique device identifier (for example, IP address, device’s IMEI number, or the mobile phone number used by the device), mobile network information, operating system and platform, the type of mobile browser used and time zone setting.

We collect and process the following information about non-student users:

  • name;
  • professional role;
  • professional email;
  • name of organisation;
  • in case of teachers, school group information (year group and tutor group);
  • in case of youth charity leaders, group information (youth group and point of contact);
  • encrypted password;
  • details of usage of Upskill Me;
  • details of enquiries or other direct communication from/to the user; and
  • technical information (including the type of device used, a unique device identifier (for example, IP address, device’s IMEI number, or the mobile phone number used by the device), mobile network information, operating system and platform, the type of mobile browser used and time zone setting.

We may also collect, use, and share anonymised, aggregated data of any registered users, such as statistical or demographic data, for any purpose. Anonymised data may be derived from personal data but is not considered personal information under the Data Protection Legislation because such information does not directly or indirectly reveal a person’s identity. For example, we may aggregate information on how students use Upskill Me to calculate the percentage of users accessing a specific feature of the service, or share statistical information about students from selected schools with the multi-academy trust or charity that runs the school to help them understand how their schools are performing.

2. How we collect personal data

We collect most personal data directly from the user (for example, when they complete our sign up form or input any other data onto our platform).

We may also collect personal information from the school or youth charity attended by the student (for example, email addresses of students to whom the school or youth charity wishes us to make Upskill Me available).

We may obtain certain personal data from third parties that offer opportunities to students via Upskill me (for example, career events attended by a student).

We also collect certain technical information about users through our use of automated technologies such as cookies, server logs and other similar technologies. For further information, please see our Cookies Notice.

3. How and why we use personal data

Under the Data Protection Legislation, we can only use personal data if we have a lawful basis to do so under Article 6 of the UK General Data Protection Regulation. These include: consent, contract, legitimate interests or legal obligation.

a) Consent. We may process personal data based on consent to:

  • place cookies and similar tracking technologies on the user’s device;
  • send our marketing communication to them (e.g. information about in-service e-Learning content which may be of interest to the student, information about our services to professional users; our newsletters to parents and non-student users);
  • send third party marketing communication to them (e.g. information for students about job, career, work experience or learning opportunities);
  • send targeted marketing communication from us or third parties to students (see section 4.12, Profiling of this statement for further information);
  • make the public employment profiles of students aged 13+ visible to employers; and
  • collect and use ethnicity, gender and free school meal entitlement information about students for the purpose of targeted marketing (see section 4.12, Profiling of this statement for further information).

Data revealing ethnic origin is classed under the Data Protection Legislation as a ‘special category of personal data’. Such data can be lawfully processed only if one of the conditions in Article 9 of the GDPR is met. The condition we rely on is explicit consent.

Upskill Me is only available to users who are at least 13 years old. In the UK, children who are 13+ can give their own consent to the use of their personal data in connection with online services.

Where we want to use personal data on the basis of consent, we will ask for such consent clearly and separately from the body of our terms and conditions or privacy policies.

Users have the right to withdraw their consent at any time by:

  • using the privacy settings within Upskill Me;
  • emailing us at: info@upskillme.io; or
  • in case of our marketing emails, by using the ‘unsubscribe link’ in the email.

b) Contract. We will use personal data of users (students and non-students) where it is necessary for the performance of our obligations under our Terms of Use for Students or other contractual documents. For example, if we need to:

  • register an individual as a new user or administer their account; and
  • provide our services to users.

c) Legitimate interests. We may process users’ personal data when we (or a third party) have a legitimate reason to use it, so long as this is not overridden by that user’s rights and interests. For example:

  • to enable teachers or youth charity leaders nominated by their school or youth charity to monitor the student’s progress and provide them with information that may assist the teachers or youth charity leaders in supporting the development of and the provision of career advice to the student;
  • to provide our services and manage our relationship with the organisation represented by the non-student user of Upskill Me;
  • to administer and protect our platform, website and business (including troubleshooting, data analysis, system maintenance, support, reporting and hosting of data);
  • to ask users to leave a review or complete a survey;
  • to create anonymous aggregated data derived from the users’ personal data and use it to promote and increase our business;
  • to conduct web analytics (via Google Analytics);
  • for the prevention and detection of fraud and spam; and
  • for the establishment, exercise or defence of legal claims.

d) Legal obligation. We may process personal data of users to comply with our legal obligations. For example:

  • we may use information about students’ ages to put age appropriate safeguards in place and offer age appropriate features to those students;
  • where we rely on a student’s consent as the lawful basis to process their personal data we will use their information to verify their age to ensure that they have legal capacity to provide such consent;
  • to notify users about changes to this Data Protection Statement, our Privacy Notice for Students, our Terms of Use for Students, or other terms, rules or policies that affect them;
  • to address a data protection request or complaint; or
  • to comply with a request of a competent authority.

4) Who we share personal data with

We may share personal data with third parties for the purposes set out in this statement.

Teachers. Teachers nominated by schools will be able to invite their students to join Upskill Me and see some of their personal data within Upskill Me. This includes the names and year group of the students who joined Upskill Me and the date of their last activity. The nominated teacher may also view their students’ interests, skills, qualifications and subjects studied, and application details when their student applies for opportunities. Students will be able to view the name and contact details of their teachers.

Youth Charities. Youth charity leaders nominated by the youth charity will be able to invite their students to join Upskill Me and see some of their personal data within Upskill Me. This includes the names and year group of the students who joined Upskill Me and the date of their last activity which relates to the youth charity. The nominated youth charity leader will only be able to view their students’ activities which relate to the youth charity programme which they are taking part in, rather than all of their students’ activity data which relates to other activities recorded. Students will be able to view the name and contact details of their youth charity leader.

Teachers and employers. Where a student chooses to share their public profile on Upskill Me, that profile will be visible to teachers, employers, universities and other third party organisations offering opportunities to students via Upskill Me.

Employers. Where a student applies through Upskill Me for an employment, work experience or other opportunity advertised by an employer or other third party, their application details will be shared with that party.

Suppliers. We share data with providers of cloud-based tools and services, which we use to operate Upskill Me, our website and our business. For example:

  • Amazon Web Services (AWS), based in the USA, who provides web hosting services to us. AWS host our data in the United Kingdom. We also use AWS to manage our website and database;
  • Google, based in the USA, who provide Google Analytics web analytics services to us through the use of cookies. The data collected by cookies does not directly identify any student. It includes information on the pages visited, duration of stay, device used, etc.;
  • SendGrid, Inc., based in the USA, who help our users to login and verify their email addresses; and
  • Revue Holding B.V., based in The Netherlands. We use their Revue tool to send newsletters and notification emails to our users.

We impose contractual obligations on the above providers to ensure that your personal data is protected.

Transfers of personal data outside the United Kingdom are subject to special rules under the Data Protection Legislation.

We may transfer your personal data to providers based in the European Economic Area (EEA). The UK Government has recognised the EEA as providing an appropriate level of protection to the data protection rights of individuals.

We may also transfer your personal data to the USA. To protect your information, we either:

  • enter into the standard contractual data protection provisions (Standard Contractual Clauses) with the third parties in those territories with whom we share your data; or
  • ensure that the third party to whom we may transfer your data have in place legally binding corporate rules (Binding Corporate Rules).

The Standard Contractual Clauses and Binding Corporate Rules are appropriate data transfer safeguards specified in the Data Protection Legislation.

Other sharing. We may also:

  • share personal data with members of our staff;
  • disclose personal data to professional advisers (e.g. lawyers, accountants, auditors or insurers) who provide professional services to us;
  • disclose and exchange certain information with law enforcement agencies and regulatory bodies to comply with our legal obligations; and
  • share some personal data with other parties, such as potential and actual investors or buyers of some or all of our business or during a re-structuring.

Such data recipients will be bound by confidentiality obligations.

5. How long we keep personal data

We will only retain personal data for as long as reasonably necessary to fulfil the purposes it was collected for. For example, we will usually keep personal data of students for six years from the last time they logged in to Upskill Me. We will do that in order to make it easily accessible by the students.

We may retain an individual’s personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with that individual (or their parent/guardian).

We may also anonymise personal data (so that it can no longer be associated with any specific student) for analytics, research or statistical purposes, in which case we may use this information indefinitely without further notice.

6. Information security

We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to personal data of individuals to those who have a genuine business need to access it. Those processing personal data will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach.

7. Data protection rights

Student and non-student users of Upskill Me have a number of rights in relation to their personal data, which allow them to access and control their information in certain circumstances. They can exercise these rights free of charge, unless their request is manifestly unfounded or excessive (in which case we may charge a reasonable administrative fee or refuse to respond to such request).

Your rights and explanations
on

Access: The right to receive a copy of the personal data we hold about the individual and to check that we are lawfully processing it.

Rectification: The right to require us to correct any inaccuracies in personal data.

Erasure (to be forgotten): The right to require us to delete personal data in certain situations.

Restriction of processing: The right to require us to restrict processing of personal data in certain circumstances (e.g. if the individual contests the accuracy of the data we hold).

Data portability: The right to receive, in certain situations, the personal data provided to us by the individual, in a structured, commonly used and machine-readable format and/or transmit that data to a third party.

To object: The right to object at any time to the personal data of an individual being processed for direct marketing (including profiling) or, in certain other situations, to our continued processing of your personal data (e.g. processing carried out for the purpose of our legitimate interests).

Not to be subject to automated individual decision-making: The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you, or similarly significantly affects you.

If you would like to exercise any of those rights, please contact us by email at info@upskillme.io. Please let us know what right you want to exercise and the information to which your request relates.

8. Complaints

We hope that we can resolve any query or concern you may raise about our use of your information. You may contact us by using any of the contact methods set out in section 1 (About us and our service, How to contact us) of this statement.


The Data Protection Legislation also gives you a right to lodge a complaint with the Information Commissioner, who may be contacted at https://ico.org.uk/make-a-complaint/, telephone on 0303 123 1113, or by post to: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance. 

We will only retain personal data for as long as reasonably necessary to fulfil the purposes it was collected for. For example, we will usually keep personal data of students for six years from the last time they logged in to Upskill Me. We will do that in order to make it easily accessible by the students.

We may retain an individual’s personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with that individual (or their parent/guardian).

We may also anonymise personal data (so that it can no longer be associated with any specific student) for analytics, research or statistical purposes, in which case we may use this information indefinitely without further notice.

.