1. Who we are
VestraPath (“we”, “us”, “our”) is a trading name of [Company legal name], a company registered in England and Wales with company number [company number] and its registered office at [registered office address].
We are the data controller of the personal information described in this notice. That means we decide how and why it is used. Our ICO registration number is [ICO registration number].
This notice applies when you visit our website, apply to VestraPath or take part in the programme. Our service is for people aged 18 or over [confirm minimum age].
For any question about this notice, or to use your rights, contact us at [privacy email] or write to [registered office address]. [Name and contact details of data protection officer or privacy lead, if one is appointed.]
2. The information we collect
We collect most of it from you directly. The categories are:
- Application details. Your name, email address, university, course, year of study and the banking roles you are interested in. [Confirm the fields collected.]
- Entrance-assessment answers and scores. Your answers to the entrance assessment and the snapshot we produce from them.
- Skill-assessment results. Results from the assessments you take during the programme.
- Account details. Your login email and a password, which we store in hashed form [confirm], and your account settings.
- Payment details. Payments are taken by our payment provider, [payment provider]. We receive confirmation of the payment, the amount and the date. [Confirm that we do not receive or store your full card details.]
- Communications. Messages you send to us or to your coach, support requests and any feedback you give.
- Technical data and cookies. Your IP address, browser and device type, the pages you visit and how you use the site. See section 9.
[Confirm whether any special category data is collected, for example information about a disability or the adjustments you need. If it is, state the condition relied on, such as explicit consent.]
3. How we use it and our lawful bases
UK data protection law requires us to have a lawful basis for each use of your information. This table sets out what we do and why.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Assessing your application | Application details; entrance-assessment answers and scores | Contract (steps taken at your request before you join). Legitimate interests (running a fair, selective admissions process). |
| Running the programme | Account details; skill-assessment results; communications | Contract. |
| Taking payment and keeping financial records | Payment confirmation; billing details | Contract. Legal obligation (accounting and tax records). |
| Service emails, such as decisions, reminders and changes | Name; email address; programme status | Contract. |
| Improving the programme | Assessment results and usage data, de-identified or aggregated where possible | Legitimate interests (understanding what works and improving it). |
| Keeping the service secure and preventing misuse | Technical data; account activity | Legitimate interests. Legal obligation where it applies. |
| Analytics cookies | Technical data | Consent. |
| Marketing emails | Name; email address; preferences | Consent. You can withdraw it at any time. |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object to this use (see section 8).
4. Who reviews your application
A person reviews every application. Your entrance-assessment score gives you an instant snapshot and helps the reviewer, but it does not decide the outcome on its own.
We do not make decisions about admission solely by automated means where they would have a legal or similarly significant effect on you. If you disagree with a decision, you can ask us to take another look by contacting [privacy email]. [Describe the review process and timescale.]
6. International transfers
Some of our providers may process information outside the United Kingdom. When that happens we make sure your information stays protected, for example by relying on UK adequacy regulations or by using the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. [List providers and countries involved.]
You can ask us for a copy of the safeguards we use by contacting [privacy email].
7. How long we keep it
We keep personal information only as long as we need it for the purposes above. Our current periods are:
- Unsuccessful applications: [12 months] after our decision.
- Programme participants: [12 months] after the programme ends.
- Payment and accounting records: [6 years], as required by law. [Confirm with your accountant.]
- Marketing preferences: until you withdraw consent, then a record of that choice for [period].
- Cookies: for the periods set out in our cookie settings.
When the period ends we delete the information or anonymise it so that it can no longer identify you.
8. Your rights
Under UK data protection law you have the right to:
- Access the personal information we hold about you and receive a copy.
- Correct information that is inaccurate or incomplete.
- Erase your information in certain circumstances.
- Restrict how we use your information in certain circumstances.
- Receive your information in a portable format, or ask us to send it to another organisation, where we use it on the basis of consent or contract.
- Object to uses based on legitimate interests, and to direct marketing at any time.
- Withdraw your consent at any time, where we rely on it. This does not affect what we did before.
To use any of these rights, email [privacy email]. We will reply within one month and will not charge a fee unless a request is clearly unfounded or excessive. We may ask you to confirm your identity first.
If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint.
10. Changes to this notice
We may update this notice from time to time. The date at the top shows when it last changed. If we make a significant change, we will tell you by email or on the website before it takes effect.
11. Contact us
Questions about this notice or your information:
- Email: [privacy email]
- Post: [Company legal name], [registered office address]