How Step8Up collects, uses and protects personal information

1. Who we are

Step8Up Ltd is a UK-based training, skills, business growth and workforce development organisation. In this policy, “Step8Up”, “we”, “us” and “our” refer to Step8Up Ltd.

We provide services including practical training, skills bootcamps, funded and co-funded programmes, paid courses, employer engagement, learner support, leadership and AI workshops, events, podcasts, media activity, digital resources and business support.

For questions about this policy or how we handle personal information, please contact: academy@step8up.co.uk.

2. Scope of this policy

This policy applies when you interact with Step8Up as a website visitor, learner, applicant, employer, partner, trainer, contractor, speaker, podcast guest, event attendee, business contact, newsletter subscriber, customer or stakeholder.

It covers personal information collected through:

• our website and landing pages;
• contact, enquiry, diagnostic, safeguarding, application and registration forms;
• learning platforms, online classrooms and course systems;
• email, phone, WhatsApp, video calls and direct messages;
• employer and learner engagement activity;
• events, webinars, podcasts, interviews and media activity;
• social media platforms and advertising channels;
• CRM, email marketing, booking, analytics, payment and administration systems.

3. Types of personal information we may collect

The information we collect depends on how you interact with us. We may collect and process:

4. How we collect personal information

We may collect information directly from you when you complete a form, register for a course, contact us, book a call, attend an event, subscribe to updates, use our learning platform, submit work, buy a product, join a webinar or interact with us online.

We may also receive information from:

• employers, referral partners, funders, local authorities, colleges or delivery partners;
• trainers, assessors, mentors, safeguarding contacts or support staff;
• social media platforms, advertising platforms, CRM systems and website analytics tools;
• public sources such as Companies House, business websites, LinkedIn or professional directories;
• learning platforms, booking tools, video platforms, forms and payment providers.

5. Why we use personal information

We use personal information for legitimate and lawful purposes connected with our services. These may include:

• responding to enquiries and providing information you request;
• assessing eligibility for funded, co-funded or paid programmes;
• registering learners and managing course participation;
• delivering training, assessments, learner support and certification;
• managing attendance, progress, outcomes and learner records;
• supporting safeguarding, Prevent, wellbeing, accessibility and reasonable adjustments;
• matching learners with employer opportunities, where appropriate;
• supporting employers with training, hiring, talent pipelines and workforce development;
• running events, webinars, podcasts, community activity and media projects;
• sending updates, newsletters, resources, invitations and relevant communications;
• processing payments, purchases, invoices, refunds and administration;
• improving our website, learning platforms, resources and services;
• meeting contractual, legal, funding, audit, regulatory and quality obligations;
• protecting our business, systems, learners, staff, partners and website users.

6. Lawful bases we rely on

Under UK data protection law, we need a lawful basis to process personal information. Depending on the activity, we may rely on:

Where we process special category data, such as health, disability, ethnicity, safeguarding or wellbeing information, we will rely on an additional condition under data protection law, such as explicit consent, employment/social protection, substantial public interest, legal claims, safeguarding, equality monitoring or provision of support services where applicable.

7. Learners, applicants and funded training

If you apply for or join a Step8Up programme, we may process information needed to assess eligibility, enrol you, deliver training, provide support, track attendance and progress, evidence outcomes and meet funder or audit requirements.

This may include information about identity, employment status, education, prior experience, address, right to study/work where relevant, eligibility, learner support needs, attendance, assignments, assessments, certificates and outcomes after completion.

For funded or co-funded programmes, we may be required to share certain information with funders, local authorities, audit bodies, awarding organisations, quality assurance partners or government-related bodies where this is required for programme delivery, eligibility, monitoring, funding claims, audit or evaluation.

8. Safeguarding, Prevent, wellbeing and support

Step8Up takes safeguarding and learner wellbeing seriously. We may process personal information where needed to identify, record, manage, escalate or respond to safeguarding, Prevent, wellbeing, accessibility or learner support concerns.

This information may be sensitive and may include details about health, disability, wellbeing, risk, incidents, support needs, reasonable adjustments or concerns raised by learners, staff, employers, partners or third parties.

Where necessary, we may share safeguarding or serious concern information with appropriate internal staff, designated safeguarding leads, emergency services, local authorities, Prevent contacts, funders, regulators or other appropriate bodies.

9. Employers, partners and business contacts

If you interact with us as an employer, partner, referrer, client, sponsor, speaker, business contact or stakeholder, we may process your contact details, organisation details, communication history, training needs, event participation, hiring interests, partnership opportunities and commercial relationship information.

We use this information to respond to enquiries, manage relationships, provide services, invite you to relevant opportunities, arrange meetings, support employer engagement and develop appropriate Step8Up programmes or partnerships.

10. Learning platforms, online classrooms and digital tools

Step8Up may use learning platforms, LMS systems, webinar tools, video platforms, assessment tools, cloud storage, CRM systems and digital collaboration tools to deliver training and support.

These systems may process information such as login activity, attendance, participation, course progress, submissions, messages, recordings, quiz results, certificates and technical information.

Where third-party platforms are used, they may process data as our processor or as an independent controller depending on the service and circumstances. Their own privacy policies may also apply.

11. Social media, advertising and online communities

Step8Up uses social media and online platforms to share updates, promote programmes, engage with learners, employers and communities, and build awareness of our work.

These platforms may include LinkedIn, Facebook, Instagram, YouTube, Vimeo, WhatsApp, podcast platforms, Google, Meta, Microsoft, community platforms and other networks we use from time to time.

If you interact with us on these platforms, we may see information such as your profile name, public profile details, comments, messages, reactions, shares, event responses or advert interactions. The platform provider may also process your personal information under its own privacy policy and terms.

We may use platform tools to measure engagement, understand campaign performance, create audiences, respond to messages or share relevant updates. Where law requires consent or opt-in for direct marketing, we aim to follow those requirements.

12. Podcasts, videos, testimonials, events and media

If you take part in a podcast, video, interview, webinar, event, testimonial, learner story, Big Pitch, case study or media activity, we may process your name, role, organisation, image, voice, biography, story, comments, recordings and related media assets.

We will normally explain how recordings or media may be used before publication or collection. Depending on the activity, we may rely on consent, contract, legitimate interests or another lawful basis.

Published media may remain available for a long time and may be shared on websites, social media, podcasts, video platforms, event pages, marketing materials and partner channels. If you have concerns about a published item, contact us and we will review the request.

13. Marketing and communications

We may send you communications about resources, programmes, events, funded training, employer opportunities, learner support, podcasts, community activity, business support and related Step8Up services.

We may send marketing where you have consented, where you have requested information, where there is an existing relationship, or where we have a legitimate interest and the law allows it. PECR may apply to electronic marketing such as emails, texts and similar communications. :contentReference[oaicite:1]{index=1}

You can unsubscribe from marketing emails using the unsubscribe option where available, or contact us at academy@step8up.co.uk. We may still send important non-marketing messages about services you use, such as course access, safeguarding, bookings, payments or learner administration.

14. Cookies, analytics and website tracking

We use cookies and similar technologies to operate our website, improve performance, understand usage, support embedded tools and measure campaigns.

For more information, please read our Cookie Policy: https://www.step8up.co.uk/policies-procedures/cookie-policy/

15. Who we share personal information with

We may share personal information where necessary and lawful with:

• trainers, assessors, mentors, staff, contractors and delivery partners;
• funders, local authorities, government-related bodies, auditors and quality assurance partners;
• awarding bodies, certification providers and assessment organisations;
• employers or placement organisations, where appropriate and relevant to learner progression;
• CRM, email, form, learning platform, video, webinar, analytics, payment, booking, cloud storage and IT providers;
• professional advisers, accountants, insurers, legal advisers and compliance consultants;
• social media, advertising, community and media platforms where you interact with us or where campaigns are run;
• safeguarding, Prevent, emergency, regulatory or law enforcement bodies where required or appropriate;
• successor organisations if Step8Up is involved in a restructure, merger, sale or transfer of part of its activities.

We do not sell personal information to third parties.

16. International transfers

Some service providers and platforms we use may process data outside the United Kingdom. This may include global technology, cloud, CRM, social media, video, analytics, email, booking and learning platform providers.

Where personal information is transferred internationally, we aim to use appropriate safeguards where required, such as adequacy regulations, approved contractual clauses, supplier due diligence, security measures or other lawful transfer mechanisms.

17. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose it was collected, including to provide services, meet legal or funding obligations, resolve disputes, evidence learner outcomes, support safeguarding records, comply with audit requirements and maintain business records.

Exact retention periods may vary depending on the programme, funder, legal requirement, platform, risk level or nature of the relationship.

18. How we protect personal information

We use reasonable organisational and technical measures to protect personal information. These may include access controls, password protection, secure systems, staff guidance, limited access, backups, supplier review, internal procedures and appropriate retention practices.

No system is completely secure, but we work to protect information against accidental loss, unauthorised access, misuse, alteration or disclosure.

19. Your data protection rights

Depending on the circumstances and applicable law, you may have rights including:

• the right to be informed about how your data is used;
• the right of access to your personal information;
• the right to rectification of inaccurate information;
• the right to erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to object to processing in certain circumstances;
• the right to data portability in certain circumstances;
• rights relating to automated decision-making and profiling;
• the right to withdraw consent where processing is based on consent.

These rights are not absolute and may depend on the lawful basis, the type of data, legal obligations, safeguarding responsibilities, funding requirements or other relevant circumstances.

To exercise your rights, contact us at academy@step8up.co.uk.

20. Automated decision-making and profiling

We do not use personal information to make solely automated decisions that have a legal or similarly significant effect on individuals.

We may use forms, tags, CRM workflows, diagnostics, analytics or segmentation to help us organise enquiries, send relevant information, understand learner or employer needs, improve services and prioritise follow-up. We aim to keep this proportionate and transparent.

21. Children and young people

Some Step8Up activities may involve young people, schools, learners under 18 or vulnerable individuals. Where this applies, we take extra care with personal information and may require parental, guardian, school, funder or responsible adult involvement where appropriate.

We aim to process children’s and young people’s information only where necessary, proportionate and appropriate for the activity, safeguarding, learning, support or legal requirement.

22. Complaints

If you are concerned about how we handle personal information, please contact us first so we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection matters. The ICO oversees data protection law, UK GDPR, the Data Protection Act 2018 and PECR in the UK. :contentReference[oaicite:2]{index=2}

ICO website: https://ico.org.uk

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, platforms, legal obligations, funder requirements, social media activity, learning systems, marketing tools or business operations.

The latest version will be published on this page with the updated date shown above.