General Data Protection Regulation (GDPR) Policy


Bespoke Consultancy & Education Ltd (BCE) has created this policy as guidance to our commitment to the ‘The General Data Protection Regulation 2018’ (GDPR).

This policy sets out how we will use and process personal information.

Bespoke Consultancy & Education is registered with the Information Commissioners Office (ICO) as a ‘Data Controller’ under registration number ZA218910.

We lawfully process personal information to enable us to provide education and training to our customers and clients, to promote our services, to maintain our own accounts and records, to draw funding from our partners and to support and manage our employees.

Types of Information that we process

We process relevant information for us to provide Education, training and consultancy services, this may include the following information:

  • Personal Details
  • Family Details
  • Business activities of the person whose personal information we are processing
  • Lifestyle & social circumstances
  • Financial details
  • Previous & training details
  • Education & employment details
  • Goods & services

We also process sensitive classes of information that may include:

  • Physical & mental health details
  • Racial or ethnic origin
  • Religious or other beliefs
  • Trade union membership

Who the information is processed about

  • Customers
  • Clients
  • Students/Apprentices
  • Trainers
  • Employees
  • Suppliers
  • Professional advisers and consultants
  • Complainants, enquirers

Who the information is shared with

We often need to share the personal information we process with the individual themselves and also with other organisations. Where necessary we are required to comply with all the aspects of The General Data Protection Regulation 2018 (GDPR). We may need to share information with the following organisations for one or more reasons.

Where necessary we share information with the following organisations, for apprenticeships this should be read in conjunction with appendix f ESFA privacy notice:

  • Central Government:


  • Education & Skills Funding Agency
  • Ofsted
  • Learner Record Service  
  • Employer Data Service


  • Local Government:


  • Bristol City Council


  • Skills for Care – Funding & Health & Social Care workforce intelligence
  • Highfield Awarding Body for Compliance – Awarding Organisation
  • Qualsafe Awards – Awarding Organisation
  • iCQ – Awarding Organisation
  • OneFile – e-portfolio, storage & management of learner work
  • BKSB – Online learning resource
  • Embrace Learning – Online learning resource
  • kn office – Secure destruction and shredding
  • Microsoft Corporation – e-mail and data storage
  • Rakata Technology – IT Support
  • Kashflow– Accounting software
  • J & AW Sully- Accountants
  • Sub-contractors
  • Learner/Apprentices Employer


We will only share necessary statutory and proportionate information to deliver the agreed training, education or consultancy services, we do not share personal information with any third parties in relation to marketing or sales activities.

Children and Privacy

We do not knowingly solicit personal information from Children under the age of 13 or send them requests for personal information.


As part of our service, individuals can apply for and be kept informed of apprenticeship opportunities. Personal data is processed to match registered candidate requirements to vacancies for apprenticeships, including for those employers or providers offering a guaranteed interview scheme. We may act on behalf of employers to sift and shortlist candidates for interview that meet the criteria set by the employer. This service also enables the ESFA and organisations funded to deliver the National Careers Service, and the Department for Work and Pensions (including Jobcentre Plus) and their employees or agents to search apprenticeship vacancies and pass details to citizens and clients for the purpose of providing careers advice and guidance.

How long will we keep your data?

We do not keep any personal data longer than is necessary as stipulated by either legislation or our awarding organisations requirements.

We will keep records in either electronic or paper format for the following timescales:

  • Learner Files, tests and examinations – 3 Years from date of award
  • Financial Records – 6 years form the end of each reporting period (or longer if required)
  • Personnel Records – 5 Years


Your rights under GDPR

There are a number of new rights individuals have under the new regulation, they are:

  • The right to be informed – Details of how we will process your data are included in this policy
  • The right of access – Individuals can request a copy of the information we hold on them*
  • The right to rectification – If the data is incorrect please let us know and we will put it right
  • The right to erasure – Individuals can request that we erase the data we hold on them, except when there is a statutory requirement for us to keep it
  • The right to restrict processing – Individuals can restrict the processing of data we hold on them
  • The right to data portability – Individuals can request we transfer data to another provider**
  • The right to object; and
  • The right not to be subject to automated decision making

*Data access request’s will be processed free of charge and within 1 month, if there is something in particular that you would like to know please give us as much detail as possible as this will help us find the information you want quickly.

**The right to data portability:

It only applies to personal data an individual has provided to a controller; where the processing is based on the individual’s consent or for the performance of a contract; and when processing is carried out by automated means.


If you have a complaint regarding the data we hold on you, or the way that we have processed your data please contact:

Tony Webber –

Bespoke Consultancy & Education Ltd

The Hive

6 Beaufighter Road


BS24 8EE

01934 411260

If we receive a complaint, we will try to resolve it immediately if we can and notify you of the outcome. We will send: 

    An acknowledgement within two working days

    Details of who will be dealing with the complaint

    Final response within 10 working days


If we are unable to resolve the complaint immediately, we will:

  • Ask for any further information required

Within 10 working days:

  • Send a response
  • Update you and state when we hope to complete our investigations

If you are not satisfied with our response you can complain to the Information Commissioners Office

Online: Telephone: 0303 123 1113