Common use of Processing, Personal Data and Data Subjects Clause in Contracts

Processing, Personal Data and Data Subjects. Description Details Subject matter of the Processing The subject matter is the Personal Data of Apprentices on education or training programmes administered by the ESFA that are subject to this Agreement as defined in the ESFA privacy notice and ILR specification and its appendices. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ Duration of the Processing The duration of the Processing covers the Academic Year data returns to the ESFA as defined in Appendix A of the ILR specification to enable funding and audit of the learning programmes defined in this Agreement. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ Nature and purposes of the Processing The nature and purposes of the processing is defined in the ESFA privacy notice. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice The processing of data in this Agreement refers to the submission of ILR data to the ESFA only and the processing of data that is inputted into the Apprenticeship Service. The processing does not include the processing of Personal Data collected from the Apprentices by the Training Provider for the purposes of enrolling Apprentices onto programmes or delivering education or training, e.g. e-portfolios. The Training Provider will be required to submit the data to the ESFA as set out in Clause 20 (Submission of Apprentice Data through the ILR) of this Agreement. Type of Personal Data The Personal Data to be processed is defined in the ILR specification. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ Categories of data subject The data subjects are Apprentices on education or training programmes administered by the ESFA that are subject to this Agreement. Retention and destruction of the data once the processing is complete UNLESS requirement under union or member state law to preserve that type of data Information on how the data must be supplied to the ESFA is detailed in the ILR specification and its appendices. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ For the purposes of the DfE as a data controller of the data, the Training Provider is required to retain the data for the funding and audit purposes set out in this Agreement for 6 years from the end of the financial year in which the last payment is made under this Agreement. For the purposes of the Department for Work & Pensions as a data controller, where Apprentice data is used as match on the 2014-20 ESF programme, the data must be retained securely until 31st December 2030. The Training Provider (and any other data controller) is responsible for determining any further need to process the data, including its retention, prior to secure destruction. ESFA Apprenticeship Agreement for Training Providers, Spring 2020, Version 2.0 Education & Skills Funding Agency

Processing, Personal Data and Data Subjects. Description Details Subject matter of the Processing The subject matter is the Personal Data of Apprentices Learners on education or training programmes administered by the ESFA that are subject to this Agreement Contract as defined in the Department Personal Information Charter, the ESFA privacy notice and the ILR specification privacy notice and its appendicesdocumentation. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ Personal information charter - Department for Education - XXX.XX (xxx.xxx.xx) ESFA: privacy notice - XXX.XX (xxx.xxx.xx)(xxx.xxx.xx) ILR Specification: ILR Privacy Notice 2021 to 2022 version 1 May 2021 (xxxxx.xxx.xx) Duration of the Processing The duration of the Processing covers the Academic Year data returns to the ESFA as defined in Appendix A Contract period. Specification of the ILR specification Individualised Learner Record for 2021 to enable funding and audit of the learning programmes defined in this Agreement. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ 2022 (xxxxx.xxx.xx) Nature and purposes of the Processing The nature and purposes of the processing is defined in the ESFA ILR privacy notice. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice : ILR Specification: ILR Privacy Notice 2021 to 2022 version 1 May 2021 (xxxxx.xxx.xx) The processing of data in this Agreement the Contract refers to the submission of ILR data to the ESFA only and the processing of data that is inputted into the Apprenticeship Serviceonly. The processing does not include the processing of Personal Data collected from the Apprentices Learners by the Training Provider Contractor for the purposes of enrolling Apprentices Learners onto programmes or delivering education or training, e.g. e-portfolios. The Training Provider Contractor will be required to submit the data to the ESFA as set out in Clause 20 18 (Submission of Apprentice Data through the ILRLearner Data) of this AgreementContract. Type of Personal Data The Personal Data to be processed is defined in the ILR specification. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ : Specification of the Individualised Learner Record for 2021 to 2022 (xxxxx.xxx.xx) Description Details Categories of data subject The data subjects are Apprentices Learners on education or training programmes administered by the ESFA that are subject to this AgreementContract. Retention and destruction of the data once the processing is complete UNLESS requirement under union or member state by (UK) law to preserve that type of data Information on how the The Contractor is required to retain ILR data must be supplied to the ESFA is detailed in the ILR specification and its appendicesfor 3 years for business operational purposes. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ For the purposes of the DfE ESFA (on behalf of the Secretary of State for Education) as a data controller Data Controller of the data, the Training Provider Contractor is required to retain the Learner Records data for the funding and audit purposes set out in this Agreement Contract for 6 six (6) years from the end of the financial year in which the last payment is made under this AgreementContract. For the purposes of the Department for Work & Pensions as a data controllerData Controller, where Apprentice Learner Records data is used as match on the 2007-13 ESF programme, the data must be retained securely until at least 31 December 2022 and where Learner data is used as match on the 2014-20 ESF programme, the data must be retained securely until 31st December 2030. The Training Provider Contractor (and any other data controllerData Controller) is responsible for determining any further need to process the data, including its retention, prior to secure destruction. ESFA Apprenticeship Agreement for Training Providers, Spring 2020, Version 2.0 Education & Skills Funding AgencyThe Contractor shall comply with clause 26 (Transfer of Responsibility on Expiry or Termination) which sets out provisions that will apply to Learner Records after this Contract has been terminated or has expired.

Processing, Personal Data and Data Subjects. Description Details Subject matter of the Processing The subject matter is the Personal Data of Apprentices on education or training programmes administered by the ESFA Department that are subject to this Agreement Contract as defined in the Department Personal Information Charter, the ESFA privacy notice and the ILR specification privacy notice and its appendicesdocumentation. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ Personal information charter - Department for Education - XXX.XX (xxx.xxx.xx) ESFA: privacy notice - XXX.XX (xxx.xxx.xx) ILR Privacy Notice 2022 to 2023 version 1 January 2022 (xxxxxx-xxxxxxx-xxxx.xxxxxxx.xxx.xx) Duration of the Processing The duration of the Processing covers the Academic Year data returns to the ESFA as defined in Appendix A of the ILR specification to enable funding and audit of the learning programmes defined in this AgreementContract period. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ Nature and purposes of the Processing The nature and Contractor will be required to submit the data to the Department for the purposes as set out in Clause 17 (Submission of the processing is defined in the ESFA privacy noticeApprentice Data) of this Contract. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice The processing of data in this Agreement the Contract refers to the submission of ILR data to the ESFA only and the processing of data that is inputted into the Apprenticeship ServiceDepartment only. The processing does not include the processing of Personal Data collected from the Apprentices by the Training Provider Contractor for the purposes of enrolling Apprentices onto programmes or delivering education or training, e.g. e-portfolios. The Training Provider will be required to submit the data to the ESFA as set out in Clause 20 (Submission of Apprentice Data through the ILR) of this Agreement. Type of Personal Data The Personal Data to be processed is defined in the ILR specification. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ : Individualised Learner Record (ILR) technical documents, guidance and requirements (submit-learner- xxxx.xxxxxxx.xxx.xx) Categories of data subject The data subjects are Apprentices on education or training programmes administered by the ESFA Department that are subject to this AgreementContract. Description Details Retention and destruction of the data once the processing is complete UNLESS requirement under union or member state by UK law to preserve that type of data Information on how the The Contractor is required to retain ILR data must be supplied to the ESFA is detailed in the ILR specification and its appendicesfor 3 years for business operational purposes. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ For the purposes of the DfE Department (on behalf of the Secretary of State for Education) as a data controller Data Controller of the data, the Training Provider Contractor is required to retain the Apprentice Records data for the funding and audit purposes set out in this Agreement Contract for 6 six (6) years from the end of the financial year in which the last payment is made under this AgreementContract. For the purposes of the Department for Work & Pensions as a Data Controller, where Apprentice Records data controlleris used as match on the 2007-13 ESF programme, the data must be retained securely until at least 31 December 2022 and where Apprentice data is used as match on the 2014-20 ESF programme, the data must be retained securely until 31st December 20302034. The Training Provider Contractor (and any other data controllerData Controller) is responsible for determining any further need to process the data, including its retention, prior to secure destruction. ESFA Apprenticeship Agreement for Training Providers, Spring 2020, Version 2.0 Education & Skills Funding AgencyThe Contractor shall comply with Clause 25 (Transfer of Responsibility on Expiry or Termination) which sets out provisions that will apply to Apprentice Records after this Contract has been terminated or has expired. SCHEDULE 5: Sub-Contracting General

Processing, Personal Data and Data Subjects. Description Details Subject matter of the Processing The subject matter is the Personal Data of Apprentices on education or training programmes administered by the ESFA Department that are subject to this Agreement Contract as defined in the ESFA Department Personal Information Charter, the Privacy information: key stage 4 and 5 and adult education and the ILR privacy notice and documentation. Personal information charter - Department for Education - XXX.XX (xxx.xxx.xx) Privacy information: key stage 4 and 5 and adult education - XXX.XX (xxx.xxx.xx) ILR specification and its appendices. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ Privacy Notice 2023 to 2024 version 1 May 2023 (xxxxxx-xxxxxxx-xxxx.xxxxxxx.xxx.xx) Duration of the Processing The duration of the Processing covers the Academic Year data returns to the ESFA as defined in Appendix A of the ILR specification to enable funding and audit of the learning programmes defined in this AgreementContract period. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ Nature and purposes of the Processing The nature and Contractor will be required to submit the data to the Department for the purposes as set out in Clause 17 (Submission of the processing is defined in the ESFA privacy noticeApprentice Data) of this Contract. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice The processing of data in this Agreement the Contract refers to the submission of ILR data to the ESFA only and the processing of data that is inputted into the Apprenticeship ServiceDepartment only. The processing does not include the processing of Personal Data collected from the Apprentices by the Training Provider Contractor for the purposes of enrolling Apprentices onto programmes or delivering education or training, e.g. e-portfolios. The Training Provider will be required to submit the data to the ESFA as set out in Clause 20 (Submission of Apprentice Data through the ILR) of this Agreement. Type of Personal Data The Personal Data to be processed is defined in the ILR specification. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ : Individualised Learner Record (ILR) technical documents, guidance and requirements (submit-learner- xxxx.xxxxxxx.xxx.xx) Categories of data subject The data subjects are Apprentices on education or training programmes administered by the ESFA Department that are subject to this AgreementContract. Retention Plan for return and destruction of the data once the processing The Contractor is complete UNLESS requirement under union or member state law required to preserve that type of retain ILR data Information on how the data must be supplied to the ESFA is detailed in the ILR specification and its appendicesfor 3 years for business operational purposes. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ For the purposes of the DfE Department (on behalf of the Secretary of State for Education) as a data controller Data Controller of the data, the Training Provider Contractor Description Details the processing is complete is required to retain the Apprentice Records data for the funding and audit purposes set out in this Agreement Contract for 6 six (6) years from the end of the financial year in which the last payment is made under this Agreement. For the purposes of the Department for Work & Pensions as a data controller, where Apprentice data is used as match on the 2014-20 ESF programme, the data must be retained securely until 31st December 2030Contract. The Training Provider Contractor (and any other data controllerData Controller) is responsible for determining any further need to process the data, including its retention, prior to secure destruction. ESFA Apprenticeship Agreement for Training Providers, Spring 2020, Version 2.0 Education & Skills Funding AgencyThe Contractor shall comply with Clause 25 (Transfer of Responsibility on Expiry or Termination) which sets out provisions that will apply to Apprentice Records after this Contract has been terminated or has expired. SCHEDULE 3 POST 16 PROVIDER RELIEF FOR COVID-19 SCHEME (IF APPLICABLE) SCHEDULE 4 POST 16 PROVIDER COVID-19 RELIEF SCHEME 2 (IF APPLICABLE) SCHEDULE 5 SUBCONTRACTING 1 The Contractor must comply with;

Processing, Personal Data and Data Subjects. Description Details Subject matter of the Processing The subject matter is the Personal Data of Apprentices on education or training programmes administered by the ESFA Department that are subject to this Agreement Contract as defined in the ESFA Department Personal Information Charter, the privacy notice for Key Stage 5 and adult education and the ILR privacy notice and documentation. Personal information charter - Department for Education - XXX.XX (xxx.xxx.xx) Privacy notice for Key Stage 5 and adult education - XXX.XX (xxx.xxx.xx) ILR specification and its appendices. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ Privacy Notice 2023 to 2024 version 1 May 2023 (xxxxxx-xxxxxxx-xxxx.xxxxxxx.xxx.xx) Duration of the Processing The duration of the Processing covers the Academic Year data returns to the ESFA as defined in Appendix A of the ILR specification to enable funding and audit of the learning programmes defined in this AgreementContract period. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ Nature and purposes of the Processing The nature and Contractor will be required to submit the data to the Department for the purposes as set out in Clause 17 (Submission of the processing is defined in the ESFA privacy noticeApprentice Data) of this Contract. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice The processing of data in this Agreement the Contract refers to the submission of ILR data to the ESFA only and the processing of data that is inputted into the Apprenticeship ServiceDepartment only. The processing does not include the processing of Personal Data collected from the Apprentices by the Training Provider Contractor for the purposes of enrolling Apprentices onto programmes or delivering education or training, e.g. e-portfolios. The Training Provider will be required to submit the data to the ESFA as set out in Clause 20 (Submission of Apprentice Data through the ILR) of this Agreement. Type of Personal Data The Personal Data to be processed is defined in the ILR specification. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ : Individualised Learner Record (ILR) technical documents, guidance and requirements (submit-learner- xxxx.xxxxxxx.xxx.xx) Categories of data subject The data subjects are Apprentices on education or training programmes administered by the ESFA Department that are subject to this AgreementContract. Retention Description Details Plan for return and destruction of the data once the processing is complete UNLESS requirement under union or member state English law to preserve that type of data Information on how the The Contractor is required to retain ILR data must be supplied to the ESFA is detailed in the ILR specification and its appendicesfor 3 years for business operational purposes. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ For the purposes of the DfE Department (on behalf of the Secretary of State for Education) as a data controller Data Controller of the data, the Training Provider Contractor is required to retain the Apprentice Records data for the funding and audit purposes set out in this Agreement Contract for 6 six (6) years from the end of the financial year in which the last payment is made under this Agreement. For the purposes of the Department for Work & Pensions as a data controller, where Apprentice data is used as match on the 2014-20 ESF programme, the data must be retained securely until 31st December 2030Contract. The Training Provider Contractor (and any other data controllerData Controller) is responsible for determining any further need to process the data, including its retention, prior to secure destruction. ESFA Apprenticeship Agreement for Training Providers, Spring 2020, Version 2.0 Education & Skills Funding AgencyThe Contractor shall comply with Clause 25 (Transfer of Responsibility on Expiry or Termination) which sets out provisions that will apply to Apprentice Records after this Contract has been terminated or has expired. Schedule 5: Sub-Contracting 1.1. The Contractor must comply with;

Processing, Personal Data and Data Subjects. Description Details Subject matter of the Processing The subject matter is the Personal Data personal data of Apprentices Learners on education or training programmes administered by the ESFA that are subject to this Agreement Contract as defined in the ESFA privacy notice and ILR specification and its appendices. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ xxxxx://xxx.xxx.xx/government/collections/individualised- learnerrecord-ilr Duration of the Processing The duration of the Processing covers the Academic Year data returns to the ESFA as defined in Appendix A of the ILR specification to enable funding and audit of the learning programmes defined in this AgreementContract. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ xxxxx://xxx.xxx.xx/government/collections/individualised- learnerrecord-ilr Nature and purposes of the Processing The nature and purposes of the processing is defined in the ESFA privacy notice. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice The processing of data in this Agreement refers to the submission of ILR data to the ESFA only and the processing of data that is inputted into the Apprenticeship Service. The processing does not include the processing of Personal Data collected from the Apprentices by the Training Provider for the purposes of enrolling Apprentices onto programmes or delivering education or training, e.g. e-portfolios. The Training Provider Contractor will be required to submit the data to the ESFA as set out in Clause 20 (16 Submission of Apprentice Learner Data through the ILR) of this AgreementContract. Type of Personal Data personal data The Personal Data personal data to be processed is defined in the ILR specification. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ xxxxx://xxx.xxx.xx/government/collections/individualised- learnerrecord-ilr Categories of data subject The data subjects are Apprentices Learners on education or training programmes administered by the ESFA that are subject to this AgreementContract. Description Details Retention and destruction of the data once the processing is complete UNLESS requirement under union or member state law to preserve that type of data Information on how the data must be supplied to the ESFA is detailed in the ILR specification and its appendices. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ xxxxx://xxx.xxx.xx/government/collections/individualised- learnerrecord-ilr For the purposes of both the DfE and the Department for Work & Pensions as a data controller controllers of the data, the Training Provider Contractor is required to retain the data for the funding and audit purposes set out in this Agreement for 6 years from the end of the financial year in which the last payment is made under this Agreement. For the purposes of the Department for Work & Pensions as a data controller, where Apprentice data is used as match on the 2014-20 ESF programme, the data must be retained securely Contract until 31st 31 December 2030. 2030 The Training Provider Contractor (and any other data controller) is responsible for determining any further need to process the data, including its retention, prior to secure destruction. ESFA Apprenticeship Agreement for Training Providers, Spring 2020, Version 2.0 Education & SPECIFICATION INVITATION TO TENDER: 30399 Supply of Skills Funding AgencySupport to the Unemployed DATE: 2018 ESF: Skills Support to the Unemployed

Processing, Personal Data and Data Subjects. Description Details Subject matter of the Processing The subject matter is the Personal Data of Apprentices Learners on education or training programmes administered by the ESFA Department that are subject to this Agreement Contract as defined in the ESFA Department Personal Information Charter, the privacy notice for Key Stage 5 and adult education and the ILR privacy notice and documentation. Personal information charter - Department for Education - XXX.XX (xxx.xxx.xx) Privacy notice for Key Stage 5 and adult education - XXX.XX (xxx.xxx.xx) ILR specification and its appendices. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ Privacy Notice 2023 to 2024 version 1 May 2023 (xxxxxx-xxxxxxx-xxxx.xxxxxxx.xxx.xx) Duration of the Processing The duration of the Processing covers the Academic Year data returns to the ESFA as defined in Appendix A of the ILR specification to enable funding and audit of the learning programmes defined in this AgreementContract period. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ Nature and purposes of the Processing The nature and Contractor will be required to submit the data to the Department for the purposes as set out in Clause 18 (Submission of the processing is defined in the ESFA privacy noticeLearner Data) of this Contract. xxxxx://xxx.xxx.xx/government/publications/esfa-privacy-notice The processing of data in this Agreement the Contract refers to the submission of ILR data to the ESFA only and the processing of data that is inputted into the Apprenticeship ServiceDepartment only. The processing does not include the processing of Personal Data collected from the Apprentices Learners by the Training Provider Contractor for the purposes of enrolling Apprentices Learners onto programmes or delivering education or training, e.g. e-portfolios. The Training Provider will be required to submit the data to the ESFA as set out in Clause 20 (Submission of Apprentice Data through the ILR) of this Agreement. Type of Personal Data The Personal Data to be processed is defined in the ILR specification. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ : Individualised Learner Record (ILR) technical documents, guidance and requirements (submit-learner- xxxx.xxxxxxx.xxx.xx) Categories of data subject The data subjects are Apprentices Learners on education or training programmes administered by the ESFA Department that are subject to this AgreementContract. Retention Description Details Plan for return and destruction of the data once the processing is complete UNLESS requirement under union Union or member state Member State law to preserve that type of data Information on how the The Contractor is required to retain ILR data must be supplied to the ESFA is detailed in the ILR specification and its appendicesfor 3 years for business operational purposes. xxxxx://xxxxxxxx.xxxxxxxxxxxxxxxxxxxxx.xxxxx.xxx.xx/ For the purposes of the DfE Department (on behalf of the Secretary of State for Education) as a data controller Data Controller of the data, the Training Provider Contractor is required to retain the Learner Records data for the funding and audit purposes set out in this Agreement Contract for 6 six (6) years from the end of the financial year in which the last payment is made under this AgreementContract. For the purposes of the Department for Work & Pensions as a data controllerData Controller, where Apprentice Learner data is used as match on the 2014-20 ESF programme, the data must be retained securely until 31st December 20302034. The Training Provider Contractor (and any other data controllerData Controller) is responsible for determining any further need to process the data, including its retention, prior to secure destruction. ESFA Apprenticeship Agreement for Training Providers, Spring 2020, Version 2.0 Education & Skills Funding AgencyThe Contractor shall comply with Clause 26 (Transfer of Responsibility on Expiry or Termination) which sets out provisions that will apply to Learner Records after this Contract has been terminated or has expired.