Privacy and cookies notice

Last updated – 31/05/2024

This privacy notice explains how we, Construction Skills Certification Scheme Limited (“Construction Skills Certification Scheme”/“we”/“us”/”our“), process your personal data when you use our services, including our website, card, app, content, or otherwise engage with us online or offline.

Please read the following carefully and contact us if you have any questions by email to communications@cscs.co.uk or by using the details set out in section 15 below.

Construction Skills Certification Scheme privacy notice and cookies notice

1 – Who we are

Construction Skills Certification Scheme Limited is the “controller” under data protection law in respect of the data processing described in this privacy notice.
We are a not-for-profit limited company registered in England and Wales under registered number 03024675. The address of our registered office is Floor 8, 71 Queen Victoria Street, London, England, EC4V 4AY.
Construction Skills Certification Scheme Limited is registered as a data controller with the UK Information Commissioner’s Office (“ICO“) under registration number f.
All rights in the “CSCS” name and logos are owned by us.
We grant licences to the CSCS Alliance or licensees operating card schemes which meet the requirements set out in the Construction Leadership Council’s One Industry Logo action and other rules (“CSCS Licence Rules“) to use the CSCS logo(s) (“CSCS Certification Logo“) on their card schemes (“Card Scheme“) .
A key aspect of the Card Schemes is the provision of cards bearing the CSCS Certification Logo issued under the relevant Card Schemes (“Scheme Card“), which is a voluntary system that provides validation that the cardholders have the required occupational training and qualifications for the type of work that they carry out and enables the matching of cardholder details for identity verification.
We are the parent company of CSCS Cards Limited, which operates the CSCS Card Scheme under licence from us.

2 – Who this notice applies to

This notice applies to you if you act in your personal capacity, for example, as our customer, or if you act in your professional capacity, for example, as an employee or agent of our suppliers, licensees or clients.

Specifically, we may process personal data relating to:

a licensee or an applicant for a licence to use the CSCS Certification Logo;
a Scheme Card holder or an applicant who applied for a Scheme Card ;
a user of our services such as our website, app or content;
third party agent such as employer or training provider who make`s an application for a Scheme Card on behalf of their employee or another individual;
a supplier or business partner or a licensee;
a corporate service user and their IT partners purchase a licence to use our services; and
anyone else who interacts with us, when they call, email or visit us or our websites or otherwise interact with us.

The categories of personal data which we may process about you

We may collect, use, transfer or otherwise process different kinds of personal data, including the following main groups of personal data:

Identity and Contact Data: including your name, title, date of birth, national insurance number, home and/or business address (postal and email), proof of name change (if relevant), telephone number, photograph, Scheme Card number, gender, nationality, Scheme Card issue date, type of Scheme Card issued, number of years in that card category, prior card category, occupation(s), employment information, Scheme Card usage information which may include corresponding GPS location.
Qualification Data: highest qualification held, qualification achievement(s) and level(s), date qualification obtained, qualification certificates and details and training history.
Transaction Data: details of your purchases and other transactions and details of payments made through our payment processor.
Technical and Usage Data: including internet protocol (IP) addresses, the type of browser used while visiting the website, the numbers of users who visit the website, details of your visits to the website including, but not limited to, usage session dates and duration, page views, and how you use the website and our services, traffic data, location data, weblogs and the resources that you access,.
Marketing Data: including your preferences in receiving marketing from us and your communication preferences.
General Data: information relating to your general enquiries or complaints and all other personal data.

Please do not provide personal data about other individuals unless they have read this privacy notice and provided their consent.

How your personal data are collected

We collect data from and about you in various situations including as set out below.

Card Scheme administrators, licensees, Applicants, Scheme Card holders and users	Direct Interactions. You may give us your Identity and Contact Data, Transaction Data, Technical and Usage Data, Marketing Data and General Data when you: · sign up to our newsletter; · communicate with us by telephone, post, email, via your online account or the Webchat function; · meet our representatives in person; · make an application to us for a licence to use the CSCS Certification Logo and during the process of the licence application; · make enquiries about us, the Card Schemes or their members and/or cardholders; · are a user of our services; · use the CSCS Smart Check App; · report a problem with our websites including websites operated by our group companies; · complete our voluntary surveys; · respond to a request via our marketing materials; or · in other circumstances where you provide your personal data directly to us. Information from third parties. · We may receive your Identity and Contact Data and Qualification Data if our corporate service user verifies your identity by using services licensed from us. · We may also receive your Identity and Contact Data, Technical and Usage Data and other information from social media if you interact with our content. · We may also receive your Contact Data, Qualification Data, Transaction Data, Technical and Usage Data, General Data from your Card Scheme provider or third party databases engaged to verify your details or detect and prevent crime and in other situations envisaged in this notice, · We may also receive pseudonymised data from licensees, Card Schemes operators and other third parties about you to analyse and understand the state of the construction industry and its workforce, to support workers in the industry, to improve and promote the construction industry and the UK economy. Information about your device. We may process details of your interactions with our services including our website, communications or content and of the fulfilment of any of your requests; and/or information that is otherwise collected in the normal course of the provision of our services and the operation of our Scheme. Public information. We may process information about you that is drawn from publicly-available sources.
Employers, training providers, third parties	Direct Interactions. You may give us your Identity and Contact Data and General Data when you correspond with us. Information from third parties. We may receive your Identity and Contact Data from third parties such as your employer or from publicly available sources.
Suppliers, corporate users and similar parties	We collect your Identity and Contact Data, Transaction Data and General Data when we correspond with you about our services, and from publicly available sources such as Companies House.
Users	As you interact with us and our services such as our website, we may automatically collect Technical and Usage Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, traffic logs and other similar technologies. Please see the Cookies section 12 below for further information.

How we use personal data

We have set out below, in a table format, a description of the ways in which we may use your personal data, and which formal legal basis we rely on to do so. Personal data is only used for the specific purpose intended and we only use/store sufficient personal data to meet that purpose.

Data subject	Purpose/Activity	Category of Data	Lawful basis for processing, including basis of legitimate interest
All	To assist with your enquiries.	General	Necessary for our legitimate interest in responding to enquiries, complying with the law and best practices or, as the case may be, necessary for taking steps prior to entering into a contract or the performance of our contract with you.
Cards Schemes Administrators, licensees, Applicants, Scheme Card Scheme holders, and our service users	To provide our services to you or our customers, such as our website, app, user portal, content, products including Smart Checks.	Identity and Contact Qualification Technical and Usage General User details	Necessary for our legitimate interest in providing our services to the public, our users and customers, crime prevention, and complying with our legal obligations or, as the case may be, necessary for the performance of our contract with you.


Cards Schemes Administrators, licensees, Applicants, Scheme Card Scheme holders, and our service users	To record our calls with you for compliance, transaction records and crime prevention purposes.	General	Necessary for our legitimate interest in documenting enquiries and business transactions for compliance, governance and crime prevention purposes
Applicants and Scheme Cardholders	To verify the information provided by you, your employer, training provider, third party or obtained from the public domain as part of our investigations, which may involve appointing an external investigator to make enquiries with you and other stakeholders face-to-face or otherwise, carry out research from publicly available sources and share data with relevant stakeholders for verification and investigation purposes.	Identity and Contact Qualification Transaction Technical and Usage Data General	Necessary for our legitimate interests in detecting and preventing crime, fraudulent applications, credit risk reduction, preserving the integrity of the Card Schemes and providing the services in compliance with our legal obligations.
Card Schemes Administrators, licensees and our service users	To manage our relationship with you, including to: · Administer our contract with you · Send communications to you such as information, news or surveys about the Scheme · Manage and record our relationship with you, and to deal with any complaints that you may have about it · Monitor and improve the effectiveness of our services · Notify you about changes to our services, including contacting you by email, telephone or post · To maintain business records	Identity and Contact Transaction Marketing General	To perform our contract with you. Necessary for our legitimate interests to perform our contracts with your organisation, keep our records updated, to review how customers use our services and develop them and to ensure the proper administration of our business.
Card Schemes Administrators, licensees, Service users, Applicants and cardholders, our service users	To share anonymised data on a statistical basis with government and industry representatives, Card Schemes operators, our Licensees, other third parties and the general public to gain and share useful data insights into the construction industry	Pseudonymised and/or Anonymised data as is necessary and proportionate	Necessary for our legitimate interests in sharing data with third parties to analyse and understand the state of the construction industry and to support workers in the industry, to improve and promote the construction industry and the UK economy.
Cardholders	To share data for the interoperability of solutions, apps and technologies operated by third parties such as your employer, site manager, security contractor, etc. including, for example, ID verification solutions such as biometric facial recognition.	Identity and Contact Qualification General	Necessary for our legitimate interests in enabling the use of Scheme Cards for legitimate secondary use cases such as ID verification carried on by such third parties.

Suppliers, corporate users and similar parties	To carry out our contractual obligations owed to our suppliers, including to manage our payments to you.	Identity and Contact Transaction	Necessary for our legitimate interests in receiving products and services from our suppliers to ensure our business is run efficiently.
Card Schemes Administrators, licensees, Service users of ours and our customers’, Scheme Cardholders	To understand the audiences and customer profiles for product and service development, research, market intelligence, marketing, advertising, content personalisation and business administration. Depending on purpose, we use your profile information in anonymised or pseudonymised or, when it comes to marketing by say email, identifiable form, e.g. your email address. In some cases, this will include information observed or inferred from your activity or other information about you.	Anonymised or pseudonymised data as is necessary and proportionate Identity and Contact	Necessary for the legitimate interest or ours and our customers in understanding the typical customer profiles for service development, research, market intelligence, marketing, advertising, content personalisation and business administration. Where required by law, we rely on your consent to deploy cookies or similar technologies on your device or to read information on your device except where necessary for essential services (please see the Cookies section 12 below).
Card Schemes Administrators, licensees, Service users of ours and our customers’	To send you relevant marketing communications about our existing and new products and services by email, text, push, post or other channels if you sign up for a newsletter or if you are our existing customer.	Marketing Data Identity and Contact	We rely on your consent if you sign up or on soft opt-in (presumed consent) if you are our existing customer. You can unsubscribe at any time. Where required by law, we rely on your consent to deploy cookies or similar technologies on your device or to read information on your device except where necessary for essential services (please see the Cookies section 12 below).
Card Schemes Administrators, licensees, Service users of ours and our customers’	To engage our third party service providers who may process your personal data on our behalf or otherwise, to facilitate the provision of our services and the fulfilment of essential service functions such as troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data.	Identity and Contact Technical and Usage	Necessary for our legitimate interests in providing administration and IT services, to ensure our business is run efficiently, to study how customers use our services and our customers’ services and to develop them, to grow our organisation.
Card Schemes Administrators, licensees, Service users of ours and our customers’	To deliver personalised services to you based on information about you from different sources.	Pseudonymised data	Necessary for our legitimate interest in providing relevant services.
Card Schemes Administrators, licensees, Applicants, cardholders, and users of our services and our customers’ services	To use data analytics and tools to improve the website, our services and our customers’ services, marketing, customer relationships and experiences, to use data for product development, the training of algorithms and other service improvements and to share data with third parties for these purposes.	Anonymised or pseudonymised data as is necessary and proportionate	Necessary for our and our customers’ legitimate interests in providing relevant products and services, to develop them and to grow the organisations.
All	To monitor interactions and operations for fraud prevention and crime detection purposes, and share and receive information from law enforcement authorities, awarding organisations and other stakeholders to enable investigations.	All information as is lawful, necessary and proportionate	Necessary for our legitimate interest in detecting and preventing fraud and illegal conduct, upholding the integrity of services and necessary for compliance with a legal obligation to which we are subject.
All	To ensure the safety of people, security of our premises, the security of our systems and online services.	All information as is lawful, necessary and proportionate	Necessary for our legitimate interest in ensuring the security of our organisation, people and services and necessary for compliance with our legal obligations.
All	To ensure health and safety at our premises.	All information as is lawful, necessary and proportionate	Necessary for our legitimate interest in ensuring the health and safety of our staff and others, to comply with best practice or necessary for compliance with our legal obligations or activities in the substantial public interest.
All	To process and share information as is required for our compliance with the law or to establish, exercise or defend legal claims. To process and share information with other third parties where required by law, such as regulators, law enforcement agencies or where mandatory under a court order.	All information as is lawful, necessary and proportionate	Where processing or sharing your data is necessary for compliance with a legal obligation to which we are subject, to establish, exercise or defend legal claims, or, where necessary and proportionate, in order to satisfy our legitimate interest in complying with best practice or applicable laws.

We will update you about any new purposes of processing of your personal data from time to time, and we will obtain your prior consent for such new purposes where we are required to do so at law.

Other parties with whom we may share personal data

We may share or disclose your personal data with/to third parties as follows:

Our payment processor(s) who handles all payments and transactions on our behalf.
Other suppliers who provide services or advise us.
Our marketing, advertising and analytics providers and partners.
Investigators, law enforcement agencies, sector representative organisations, Card Schemes operators, the CSCS Alliance, licensees and other stakeholders to investigate suspicious information and for fraud investigation and crime prevention.
CSCS Alliance, Card Schemes operators, licensees for our “Big Data Project” which aims to analyse and understand the state of the construction industry and to support workers in the industry, to improve and promote the construction industry and the UK economy.
The Construction Industry Training Board (CITB), to enable CITB to manage the Construction Training Register.
A person such as your employer, staffing agency or other party presented with your a Scheme Card or cardholder details for verification will access your name, image, registration number, occupational qualifications, expiry date and other data using our Smart Check service. Verification can occur by automated or manual means, for example, through a card-reader, smartphone (with near-field communications (NFC) or other capability) or similar device, by calling Us or interrogating a database or otherwise.
Our licensees, corporate users and their IT providers who licence from us our service and technology to integrate it in their processes and equipment, such as site access control devices;
To third parties:

if we are under a duty to disclose or share your personal data in order to comply with any legal obligation;
in order to establish, exercise or defend legal claims including to enforce or apply our terms of use and other agreements;
to protect the rights, property, integrity or safety of ourselves including our group companies and their members, our clients or others (this includes exchanging information with other organisations and law enforcement for the purposes of detection and prevention of crime, fraud protection and credit risk reduction);
with whom you request us to share your personal data such as your employer;
to help us or our affiliates analyse and/or improve our communication or relationship with you; and/or
in the event that all or substantially all of our business or assets are or are intended to be sold or otherwise assigned to another entity.

If you have provided consent.

What we do to keep your personal data secure

We use a variety of technological, physical and organisational protections and procedures to help protect your personal data from unauthorised access, use, or disclosure, such as encryption, passwords, physical security, etc.

In addition, we limit access to your personal data to those employees, agents, contractors and suppliers who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

While we strive to protect your personal data, no website, product, device, online application or transmission of data, computer system or wireless connection is completely secure, and we cannot ensure or warrant that the personal data or private communications you transmit to us will always remain private, and you do so at your own risk.

If a password is used to help protect your accounts and personal data, it is your responsibility to keep your password confidential. Do not share this information with anyone. If you are sharing a computer with anyone you should always log out before leaving the website to protect access to your information from subsequent users.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Transferring and processing your personal data outside the European Economic Area

Some of our suppliers and partners may hold your personal data outside of the UK. We will only transfer your personal data to countries outside the UK (which may not provide the same level of data protection as within it) in accordance with applicable laws.

Accessing your personal data and other rights you have

We want to help you keep your personal data accurate and current.

You have the right to access information we hold about you. Please keep us informed if your personal data changes during your relationship with us. To review, verify or correct your personal data, please contact our customer service department detailed in section 15.

We will collect, store and process your personal data in accordance with your rights under any applicable data protection laws. Under certain circumstances, you will or may have the following rights in relation to your personal data:

Right to information about matters set out in this notice. You may also contact us for further details about our data retention policy and international data transfers.
Subject access: the right to request details of the personal data which we hold about you and copies thereof.
Right to withdraw consent: (where you have consented to our processing of your personal data), the right to withdraw such consent at any time. If you wish to withdraw your consent to processing, please contact us using the details provided in section 15. This will not affect processes that had been carried out before your consent was withdrawn.
Data portability: the right to request us to port (i.e. transmit) your personal data directly to another organisation.
Rectification: the right to require us to rectify or update any incorrect or inaccurate personal data about you.
Erasure (‘right to be forgotten’): the right to have your personal data ‘erased’ in certain specified situations.
Restriction of processing: the right in certain specified situations to require us to stop processing your personal data.
Object to processing: the right to object to specific types of processing of your personal data, such as where we are processing your personal data for the purposes of direct marketing.
Prevent automated decision-taking: the right not to be subject to decisions being taken solely on the basis of automated processing.

If you wish to exercise any of the above rights under applicable data protection laws, please contact us by using the details set out in section 15. We will respond to your request without undue delay and by no later than one month from receipt of any such request, unless a longer period is permitted by applicable data protection laws, and, if permitted to do so by applicable data protection laws we may charge a reasonable fee for dealing with your request which we will notify to you.

If you are concerned that we have not complied with your legal rights under applicable data protection laws, you may contact the ICO (www.ico.org.uk) which is the data protection regulator in the UK. Alternatively, if you are based outside the UK, you may contact your local data protection supervisory authority. We would, however, appreciate the chance to deal with your concerns before you approach the ICO (or other data protection supervisory authority) so please contact us in the first instance.

Data retention – how long will we store/keep your personal data

We retain personal data for as long as necessary to fulfil the purposes for which they have been collected as outlined in this privacy notice unless a longer retention period is required by law. This may include historical Scheme Cards information for fraud investigations and crime prevention purposes.

When your personal data are no longer required for the said purposes or as required by applicable law, they will be deleted and/or returned to you in accordance with applicable law or anonymised and used for research and statistical purposes.

Third-party links

This website may from time to time include links to third-party websites, plug-ins and applications.

Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit or to which you may provide your personal data.

Cookies

When you use our website, online services, essential cookies and similar technologies which are required to provide our services will be automatically set on your device.

Other cookies will also be set if you accept those cookies and similar technologies by selecting your choices in the cookie panel. As some cookies are provided by third parties, your acceptance of cookies will extend to such third parties. A ‘cookie’ is a name for a small text file, usually of letters and numbers, which, if you agree to them, are downloaded onto your computer, mobile phone, tablet or other device when you visit a website. This notice also covers similar technologies such as pixels, tags, URL tracking, local storage and digital fingerprints. Cookies and these technologies contain information that is transferred to your device’s hard drive or are otherwise stored and are used to distinguish you from other website users.

Like most organisations with online presence, we use cookies and similar technologies to:

provide our services which is not possible without certain essential cookies;
remember your settings and preferences to improve your experience, speed up your searches, recognise you when you return to our service or track the pages that you visit on the website and to ensure that you do not see the same information repeatedly through functional cookies; and
understand the number of website visits and tracking patterns of page viewing, to monitor the performance of the website and make improvements to it, use navigational data for system administration and to report aggregate information to our partners or other stakeholders through performance cookies.

To accomplish this, we will, in certain cases, also link information from cookies and similar technologies with personal data held about you.

We will deploy cookies and similar technologies ourselves. However, our services may also include cookies and similar technologies deployed by third parties. For example, third party cookies will enable our analytics providers to find out how you used our services. Personalisation and analytics are only possible because of a certain level of profiling carried out with information collected through cookies and similar technologies. This may include your preferences, characteristics and behaviour.

You do not have to accept cookies (apart from the essential ones), but without accepting them the functionality of our services will be reduced. If you do not want cookies sent to or stored on your system, you can choose to turn cookies off by setting your cookies preferences in the website cookies settings. Please see our Cookies Policy for further information and the list of cookies used. If you choose to reject some of our cookies, then we will only store those essential or ‘strictly necessary’ cookies.

While we try to ensure that your choices are fully respected, this may not always be possible, particularly where third parties are involved. For example, if you do not agree to “functional cookies” but you still interact with a third party service plugin (e.g. YouTube plugin) in our online services, such third party may set certain essential and non-essential cookies outside our control. As explained in our privacy notice, you should read the privacy notice of our third parties such as LinkedIn for more detail.

For this reason, aside from relying on our cookie settings, please also consider:

turning off the automatic download feature in your browser, as described at allaboutcookies.org;
opting out from third party services that deploy cookies and similar technologies, such as Google Analytics, by visiting www.google.com/settings/ads or by downloading the opt-out add-on at https://tools.google.com/dlpage/gaoptout.
In addition, most Internet browsers will allow you to delete or block cookies from your computer hard drive, prevent them from being stored or signal a warning before a cookie is stored. You should refer to your browser instructions or help screen to learn more about these functions.

To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit allaboutcookies.org.

Your choices (e.g. marketing related emails or otherwise)

We may use your Identity and Contact Data and Marketing Data (such as your contact details (e.g. name, address, email address, telephone number)) to send you marketing-related correspondence related to our Services by email. When we process your personal data for marketing purposes, we do so on the basis that it is in our legitimate interests to do so.

We may also use your personal data to personalise and to target more effectively our marketing and communications to ensure, to the extent possible, that any marketing-related correspondence is relevant to you.

To opt-out of receiving marketing-related correspondence specifically, please click “Unsubscribe” from any marketing or promotional email you receive from us, or contact us as explained in section 15 below.

Changes to this Privacy Notice

Any changes we may make to our privacy notice in the future will be posted on this page . We encourage you to periodically review this privacy notice to be informed of how we are processing your personal data.

Contact us

If you have any questions about this privacy notice or the processing of your personal data, or if you wish to exercise any of your rights set out in this privacy notice, please contact us by email as set out above or in the following ways:

By post: Customer Services Team, The Construction Skills Certification Scheme Limited, Unit A2 and B, Mease Mill, Westminster Trading Estate, Measham, DE12 7DS

By telephone: 0344 994 4777

Privacy and Cookies Notice