Direction Training Associates Limited, (referred to in these terms of use as: “DTASC”, “we”, “us“, “or “our”. DTASC is a limited liability company registered in England and Wales, with company registration number 8294782. Our registered office address is located at c/o ACS Accounting, Suite 3, Market House. Market Place. Wokingham. RG40 1AP. United Kingdom.
DTASC are registered with the UK Information Commissioner’s Office (“ICO”) on ZA142952
We have appointed an internal company representative who will deal with all aspects of privacy and may be contacted in relation to any queries you may have in relation to this Privacy Policy or more details on your data held by us. You can contact Graeme Clarke at privacy@dtasc.co.uk
If you have any questions about our privacy policy or your information, or to exercise any of your rights as described in this privacy policy or under data protection laws, you can also contact us:
By telephone: + 44 (0) 1252 890995 By email: privacy@dtasc.co.uk
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’)
‘an identifiable natural person’ is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
Direction Training Associates adheres to the following GDPR principles when processing your personal data:
You may exercise the following rights under the conditions and within the lawful limits
DTASC being a data controller and taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, we shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with the General Data Protection regulation (GDPR). Those measures shall be reviewed and updated where necessary.
Our privacy promise
Transparency – We will always tell you what data we’re collecting about you and how we use it. We only share your data with trusted partners and will never sell your data.
Secure – We are committed to always follow industry best practices to ensure your data is stored safely and securely. We protect the confidentiality, accuracy and availability of the information we collect about you.
Control – We will always give you control over the marketing you receive from us. You can choose the types of messages you receive and whether you want to stop receiving any marketing communications.
If any legal basis for processing needs to be changed or updated over time, or if we have a new purpose which we did not originally anticipate, we will update this section as long as new purpose is compatible with the original purpose.
The lawful bases for processing are set out in Article 6 of the GDPR.
(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
(d) Vital interests: the processing is necessary to protect someone’s life.
(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)
We will not process your personal data if we do not have a proper justification foreseen in the law for that purpose. Therefore, we will only process your personal data if:
– we have obtained your prior consent to collect your data;
– the processing is necessary to perform our contractual obligations towards you or to take pre-contractual steps at your request;
– the processing is necessary to comply with our legal or regulatory obligations; or
– the processing is necessary for our legitimate interests and does not unduly affect your interests or fundamental rights and freedoms.
Please note that, when processing your personal data on this last basis, we always seek to maintain a balance between our legitimate interests and your privacy. Examples of such ‘legitimate interests’ are data processing activities performed:
We always process your personal data for a specific purpose and only process the personal data which is relevant to achieve that purpose. In particular, we process your personal data for the following purposes:
DTASC hold your data and we will not sell, share, or otherwise transfer your personal data to any other third parties other than those indicated in this Privacy Notice without your prior
consent to do so.
In the course of our activities and for the same purposes as those listed in this Privacy Notice, your personal data can be accessed by or transferred to the following categories of recipients on a need to know basis to achieve such purposes:
The above third parties are contractually obliged to protect the confidentiality and security of your personal data, in compliance with applicable law.
Your personal data can also be accessed by or transferred to any national and/or international regulatory, enforcement, public body or court, where we are required to do so by applicable law or regulation or at their request.
The personal data we collect from you may also be processed, accessed or stored in a country outside the UK, which may not offer the same level of protection of personal data.
If in the case we are required to transfer any of your personal data to external companies, legal entities in other jurisdictions, we will make sure to protect your personal data by applying the level of protection that is required under the local data protection/privacy laws applicable to the UK, acting in accordance with our policies and standards and, for entities located in the European Economic Area (i.e. the EU Member States plus Iceland, Liechtenstein and Norway, the “EEA”), unless otherwise specified, only transferring your personal data on the basis of standard contractual clauses approved by the European Commission. You may request additional information in relation to international transfers of personal data and obtain a copy of the adequate safeguard put in place by exercising your rights.
We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
At the end of that retention period, your data will either be deleted or anonymised (so that it can no longer be associated with you) for research or statistical purposes.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances you may be entitled to ask us to delete your data: see your rights below for further information.
The criteria we use for retaining different types of personal data, includes the following:
Our website and business operations is not intended for or directed at children under the age of 16 years and we do not knowingly collect data relating to children under this age.
For email marketing to an individual subscriber (that is, a non-corporate email address) with whom we have not previously engaged as a client, we need your consent to send you any unsolicited email marketing.
Where you do provide consent, you can withdraw your consent at any time, but without affecting the lawfulness of processing based on consent before its withdrawal.
You have the right to opt out of receiving email marketing communications from us at any time by:
– contacting our Privacy Manager using the contact details set out above; or
– using the “unsubscribe” link in emails.
We transfer only non-personal data outside the UK or the European Economic Area (EEA).
We have implemented appropriate technical and organisational controls to protect your personal data against unauthorised processing and against accidental loss, damage or destruction. You are responsible for choosing a secure password when we ask you to set up a password to access parts of our sites or apps. You should keep this password confidential and you should choose a password that you do not use on any other site. You should not share your password with anyone else, including anyone who works for us. Unfortunately, sending information via the internet is not completely secure. Although we will do our best to protect your personal data once with us, we cannot guarantee the security of any personal data sent to our site while still in transit and so you provide it at your own risk.
We use industry standard physical and procedural security measures via our third-party provider to protect information from the point of collection to the point of destruction. This includes encryption, firewalls, access controls, policies and other procedures to protect information from unauthorised access.
Where data processing is carried out on our behalf by a third party provider, we take steps to ensure that appropriate security measures are in place to prevent unauthorised disclosure of personal data.
Despite these precautions, however, DTASCI cannot guarantee the security of information transmitted over the Internet or that unauthorised persons will not obtain access to personal data.
Our website may, from time to time, contain links to and from third-party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and DTASC does not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
The Privacy and Electronic Communications Regulations (PECR) sit alongside the previous Data Protection Act and the GDPR. They give people specific privacy rights in relation to electronic communications.
There are specific rules on: marketing calls, emails, texts and faxes; cookies (and similar technologies); keeping communications services secure; and customer privacy as regards traffic and location data, itemised billing, line identification, and directory listings.
We will, under the GDPR, abide under these rules to insure compliance is met.
Whilst every member of the DTASC team has a personal private email address, email which you send to us or which we send to you may be monitored to ensure compliance with professional standards and our internal compliance policies. Monitoring is not continuous or routine, but under the GDPR, this may be undertaken to insure the usage of company emailing is in line with compliance. Occasional spot checks or audits may also be undertaken to insure ongoing compliance.
The Institute of Hospitality endorses all our training modules and programmes.
Sign up for our newsletter!
