Privacy notice for Course Bookers

We want to make sure that you feel confident about how your data will be collected and reasonably used as part of your journey with NCT.  If you have any questions about how we use your personal data or believe any of your rights have been infringed, please contact our Data Protection Officer by emailing dataprotection@nct.org.uk. 

This privacy notice was updated December 2023. 

Who we are 

NCT is a registered charity (in England and Wales, no. 801395 and in Scotland, no. SC041592), and a company (in England and Wales, no.2370573).  Our registered address is Brunel House, 11 The Promenade, Clifton Down, Bristol BS8 3NG. 

We are registered with the Information Commissioner’s Office (ICO) as an organisation that collects and uses personal data (a “Data Controller”). 

Personal data we collect about you and how we obtain it 

Personal data is any information that relates to a person who is or can be identified from it.  NCT collects this information from you either directly (when you have given it to us) or indirectly (when someone else has given it to us). 

Throughout your course journey with NCT, we will collect and use your personal data which can include: 

• Name
• Postal address
• Email address
• Phone number 
• Payment details 
• Financial information to to support low income discount applications, e.g. pay slips, P60, self-assessment tax calculations, benefit award letter, or bank statement. 
• Baby/Babies due date 
• Physical and/or mental health information 
• Personal pregnancy arrangements/situations 
• Safeguarding information 
• Any other information you wish to disclose to us whilst on your course journey 

How we use your personal data 

We need your personal data to allow us to: 

• Make your course or session booking; 
• Amend the course or session booking(s) at your request; 
• Send you important information about the course and venue; 
• Set up your access to Parent Hub and send you your login details; 
• Send you important information about the resources, support, exclusive offers and discounts, that are only available to course bookers and members (these are also available in Parent Hub) including those from our corporate partners – please note we never share your data with our corporate partners; 
• Where you give us your consent, to send you targeted marketing and information about NCT’s charitable activities, fundraising, donations or campaigns, we never share your data for third party marketing purposes;  
• Invite you to take part in our research and surveys; 
• Deal with any enquiries or complaints you may have; and 
• To improve our course booking activities and the services we provide to parents.  This could be done by looking at demographics as statistics but will not identify you individually. 

If our purposes of processing change 

We will only use your personal data for the purposes set out above, unless we reasonably consider that we need to use it for another purpose that is compatible with any of the above.  If we need to use your personal data for an unrelated purpose, we will always inform you about this and explain the GDPR lawful ground which allows us to do so. 

The GDPR lawful grounds and special category conditions we rely on to collect and use your personal data 

Contractual Obligation 

We rely on this lawful ground to process your course or session booking, to deliver the course to you, and to invite you to participate in our course surveys and research. 

Legal Obligation 

We have certain duties to comply with under Finance & Tax Laws when processing your financial information in relation to course bookings. 

Legitimate Interests 

It is in both yours and our legitimate interests to provide you with important information that is only available to course bookers and members.  You have access to a wealth of resources and support as part of your course journey with NCT along with exclusive offers and discounts from NCT and from our Corporate Partners. 

Consent 

We rely on this lawful ground to send you our general marketing, offers and promotions about our other services (not included as part of the course booking journey or membership you have with us) and to send information about fundraising, campaigning, and making donations. 

Explicit Consent 

We will only process special category personal data when you have given your explicit consent for us to do so.  This type of personal data includes your physical/mental health, pregnancy arrangements or situation, due date, ethnicity, sexual orientation.  When completing our surveys or research you have the choice on whether to disclose this type of information. 

Vital Interests 

In rare situations, we might need to share your personal data with the emergency or care services if we believe it is in your ‘vital interests’, or those of another person (i.e. a child), to do so. For example: 

• if you are taken ill during the course, or 
• if any safeguarding concerns are raised. 

Am I under a Contractual or Legal obligation to provide my personal data? 

If you are not able to provide the specific personal data that is required to meet a contractual or legal obligation we have with you as part of your course journey we may not be able to continue making the course booking and unfortunately you will not be able to attend the course.   

Data Sharing 

We will only share your personal data with other organisations when required to by law or when GDPR allows us to do so. 

Data Processors 

There may be times when we need to work with other trusted businesses to help us process your personal data along your course journey with us.  These other businesses are known as “data processors” as they are acting on our behalf and under strict instruction from us on what they can and cannot do with the personal data. 

When we do use other businesses to process personal data on our behalf, we always ensure we have appropriate UK GDPR compliant contracts in place with each one.  

A data processor is not allowed to do anything with your personal data other than what we have instructed them to do with it. They will not share your personal data with any other business apart from us, unless they are required to do so by law. They will hold it securely and retain it for the period we instruct. 

We use the following data processors to help us with your course journey:  

• Practitioners – to deliver the NCT courses .  All Practitioners are trained by NCT and enter into a contract with us prior to delivering any of our courses. 
• Parentforce – CRM platform used to store your information and manage our interactions with course bookers. 
• Dotdigital – Emailing platform we use to send out emails, including marketing, to course bookers. 
• Tiledesk – Webchat function.  
• SurveyMonkey – platform used to send out surveys and research questionnaires to course bookers.  

Additionally, your course Practitioner will invite you to a WhatsApp group for your particular course so that you can connect with other parents on your course and receive information from the Practitioner.  You are not obliged to join a WhatsApp group and, in such cases, you will receive course information from your Practitioner by a mutually agreed communication method. 

Transferring personal data outside of the UK  

Sometimes it is not possible for us to process and store your personal data solely in the UK.  When your personal data does need to be transferred or stored outside of the UK, we make sure we comply with the specific requirements set out in UK GDPR for us to undertake this.  We will only transfer personal data outside of the UK when one of the following provisions are in place to safeguard your personal data: 

• An “adequacy decision” is in place with the country where the personal data is being transferred to. 
• An “appropriate safeguard” as set out in UK GDPR is in place.  These include using Standard Contractual Clauses and the UK’s International Data Transfer Agreements. 
• An “exception” as set out in UK GDPR can be relied on if there is no adequacy decision or appropriate safeguard in place. For example, we could rely on your explicit consent to make the transfer of personal data. 

How long we keep your personal data  

We only keep your personal data for as long as is necessary for us to fulfil the purposes we collected it for.  Our retention of personal data for course booking purposes is 6 years after the end of the financial year the course took place. 

There may be times when we anonymise personal data, this means you can no longer be identified.  We retain anonymised personal data for longer so that we can use it for long term trend analysis and reporting. 

Your rights 

Depending on the purpose and GDPR lawful grounds we rely on for processing your personal data, there are various rights available to you.  You can: 

• request access to the personal data we keep about you and be given specific information about the processing.  This right always applies regardless of the processing activity we undertake. 
• request we rectify personal data we hold about you if you believe it to be inaccurate.  This right always applies regardless of the processing activity we undertake.  
• request us to delete your personal data.  This right only applies in specific circumstances, this means we don’t always need to comply with this type of request.   
• request a restriction of the processing of your personal data.  This right only applies in specific circumstances, this means we don’t always need to comply with this type of request. 
• object to the processing when we have relied on the “legitimate interest” lawful ground to undertake the processing activity and you believe we have infringed your rights.  We don’t always have to comply with such objections if we can demonstrate compelling grounds to continue with the processing. 
• transfer your personal data from us to another service provider or give it to you.  This right only applies to personal data you have given to us and when the processing is based on your consent or contractual basis and the processing is automated.   

We do not undertake any solely automated decision making, including profiling, about you. 

To find out more about the rights that apply to individuals under GDPR please refer to the guidance on the Information Commissioner’s Office website - https://ico.org.uk/for-the-public/. 

If you want to exercise one of your rights, please contact our Data Protection Officer by emailing dataprotection@nct.org.uk.  We shall respond to a valid request within one month of receiving it. 

How to make a complaint about us to the Information Commissioner’s Office 

If you are not happy with how we are processing your personal data, or you believe we have not dealt with one of your rights correctly you are entitled to make a complaint to the Information Commissioners Office (ICO).  The ICO has several ways in which you can get in touch with them, including post, email, and online forms.  For full details how to make a complaint please refer to their website - https://ico.org.uk/make-a-complaint/.  

Changes to our Privacy Notice 

We keep our Course Bookers Privacy Notice under review to ensure it remains accurate and up to date and we reserve the right to modify it at any time.