Apprenticeships privacy notice | University of Westminster, London

Personal data means any information relating to a person who could be directly or indirectly identified by that information. This definition provides for a wide range of ways that a person may be identified by their data. This includes their name, identification number, location data or an online identifier.  Some information is considered to be ‘Special Category’ information and needs more protection because of its sensitivity.

The University of Westminster is the Data Controller for the personal information held in relation to apprentices, apprenticeships programmes and the organisations that sponsor and support apprentices. This Privacy Notice is in addition to the University’s privacy notice and our Student Data Privacy Statement will also apply to the use of personal information for apprentices whilst you are studying with us.

How we collect information

We collect information about you when

You apply for an apprenticeship.
You complete further surveys and questionnaires such as individualised learner records (ILR) through our apprenticeship management system Aptem.
We verify your information with your employer.
We conduct functional skills and personal learner record (PLR) checks.
We monitor attendance and completion of monthly learning plans.
You change employers.
You complete End Point Assessments.
You subscribe to groups, emails, or newsletters relating to the course studied.

Confidentiality

Information provided will only be shared with internal colleagues related to your apprenticeship.

What information we collect and hold

Personal information collected includes:

Name, address, date of birth and age, contact details, legal sex, National Insurance Number, Unique Learner Number, nationality, disabilities, health problems, country of residence, country of birth, visa requirements, employer information, past training, care leaver status, prior attainment.
Next of kin details.
Evidence of your eligibility to undertake an apprenticeship programme including your education, employment history, job description and employment contract.
UKVI checks.
Full Individualised Learner Records including personal details, learning aims, achievements, and funding.
Results of Initial Assessments online in English and maths.
Training plan and attendance.
Payment history.

Special category information collected includes:

Ethnicity.
Health.

How the personal information we hold is used

Your personal information will be used to:

Assure your eligibility for your apprenticeship programme.
Complete the onboarding process.
Contact you during this process and send you information on the course studied.
Record your apprenticeship status and documents for internal and external reporting and auditing purposes.
Submit learner data to the Department for Education to claim funding.
Register you with the End Point Assessment Organisation and any subcontractors who deliver additional training.
Monitor progress on the apprenticeship.

Profiling and automated decision making

During the apprenticeship application process, applicants will be required to undertake Initial Assessments online in English and maths. These assessments produce a result based on the information and answers provided by the apprentice during the online Initial Assessment process.

The apprentice applicant will get a breakdown of their result following their online assessment, so that they can see how the outcome was reached. The Apprenticeship Team do not use any other automated decision-making processes – that is, decisions made by computer without human intervention – related to your application and eligibility to join an apprenticeship programme.

Our reason for processing your personal data

We process your personal data for the following reasons

Contract: the processing is necessary for the apprenticeship agreement.
Consent: you give clear consent to sign up for newsletters.

Special category data is processed for the following reason

Consent: you give clear consent for ethnicity and health data to be processed.

Organisations we may share your information with in relation to this processing

We may share your information with the following organisations:

Your Individualised Learner Record (ILR) will be submitted to the Department for Education (DfE) under the provisions of Article 6 (1) (e) as a task carried out in the public interest regarding the Skills, Children and Learning Act 2009. The University, as a publicly funded Higher Education Institution, must collect data about learners and learning undertaken, in the form of an Individualised Learner Record (ILR). This data is collected and returned the Department for Education (DfE).

For more information on the ILR and how the DfE use your information, please see:

Additionally, the Office for Standards in Education, Children’s Services and Skills (Ofsted) is responsible for the inspection of apprenticeships and reviewing the quality of the training provision. Your personal data may be shared with them and the Department for Education during inspections.

For more information please see: Ofsted Guidance: Further Education and Skills Handbook.

The University also shares personal data with third parties involved in the delivery of apprenticeships and with consultants who quality assures our processes.

We also share relevant progress information with your employer. This could happen at any time when concerns arise. This includes whether you have passed or failed university modules or the End Point Assessment (EPA). We also notify your employer if you fail to record off-the-job training or do not attend scheduled progress reviews. Any non-attendance at scheduled training sessions will be reported to your employer by name. Your overall progress will be regularly reviewed and discussed with both you and your employer during the tripartite progress reviews.

How we protect your information

The personal information we hold will be processed with appropriate security and used in accordance with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). Your information may be held outside of the UK. Where this is the case, we ensure that appropriate measures are in place to protect your data.

Our data retention policy

We will retain this information only for as long as necessary. We may aggregate and anonymise data for wider internal management reporting or research purposes. Personal data will be kept in line with the university’s retention schedule.

Disclosure of information to third parties

Personal information will not be disclosed to external organisations other than those acting on the instructions of the University. Where this is the case, a written contract will be put in place between the University and the third party setting out appropriate data protection obligations.

We use several commercial companies and partners to either store personal information or to manage it on our behalf. Where we have these arrangements, we ensure that there is a contract or data sharing agreement is in place to ensure that the requirements of data protection legislation are met.

Sometimes we have a legal duty to disclose personal information. We may share your information:

for the detection and prevention of crime and fraudulent activity
if there are serious risks to the public, our staff or to other professionals
to protect a child
to protect adults who are thought to be at risk

Your rights

The law gives you several rights to control which personal information is used by us and how it is used by us.

How can you access the information we hold about you?

You are legally entitled to ask to see any records we hold about you. If you wish to request access to the personal information we hold about you, please contact the Information Compliance Team through the University’s subject access procedure.

How can you request correction of inaccurate information?

Whilst we try to ensure that any personal data we hold about you is correct, there may be situations where the information we hold is no longer accurate. If this is the case, please contact the department holding the information so that any errors can be investigated and corrected. If you don’t know which department to contact please contact the Information Compliance Team.

You can ask to delete information (right to be forgotten)

In some circumstances you can ask for your personal information to be deleted, for example, in instances where:

your personal information is no longer needed for the reason why it was collected in the first place
you have removed your consent for us to use your information (where there is no other legal reason for us to use it)
deleting the information is a legal requirement

Please note that there are situations where the right to be forgotten does not apply. Please contact the Information Compliance Team to make a request.

You can ask to limit what we use your data for

In some circumstances, you have the right to restrict what processing an organisation carries out or ask that they stop processing your personal data. When processing is restricted, the organisation may continue to store your data but not process it further. Please contact the Information Compliance Team to make a request.

You can ask to have your information moved to another provider (data portability)

You have the right to ask for your personal information to be given back to you or another service provider of your choice in a commonly used format. Please contact the Information Compliance Team to make a request.

You can object

You have the right to object to processing of your personal data at any time. This means that you can stop or prevent an organisation from using your data. However, it only applies in certain circumstances. Please contact the Information Compliance Team to make a request.

Automated decision making and profiling

You have a right to request that decisions based solely on automated processing, including profiling, which may produce a legal effect or affect them significantly, to have some form of human input so they are not automatically generated by a computer. Please contact the Information Compliance Team to make a request.

Right to complain

You have the right to complain about how we use your personal data. In the first instance, please contact the Information Compliance Team.

How to contact us?

If you would like further information or if you have any concerns about how we handle your data, these can be raised with our Information Compliance Team by emailing [email protected] or writing to:

Information Compliance Team
University of Westminster
32-38 Wells Street
London W1T 3UW

Independent advice

Independent advice can be sought from the UK regulator for data protection, the Information Commissioner’s Office (ICO).

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

T: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.

Alternatively, visit www.ico.org.uk or email [email protected].

This privacy notice and updates

If you have any queries about this privacy notice, or about how we hold and use your data, please contact the Information Compliance Team.

We will review and update this privacy notice to reflect changes in our processes and procedures. When such changes occur, we will revise the 'last updated' date on this notice. We encourage you to periodically review this notice to remain informed.

Last reviewed and updated June 2025.