What personal data do we collect? 

• Name, age, email address, telephone number, home address/location; 
• Gender, ethnicity, whether you have a disability; 
• Any further training you have participated in, in the past; 
• Any personal information you volunteer about yourself within a training session or in communications with us; and 
• Where applicable within the nature of the training being delivered: 

• Identification; 
• Dietary requirements; and 
• An image of you. 

Where do we get your personal data? 

We will collect personal data from Trainees in a variety of ways. We refer to “direct data collection” when data is collected directly from you and we refer to “indirect data collection”.  We collect personal data about you in the following ways: 

• From yourself upon becoming a member of the Labour Party (“Members”) (direct data collection); 
• From yourself upon becoming a member staff at Labour (“Staff”) (direct data collection); 
• From yourself upon requesting training from Labour for activities you are participating in for Labour via our website or other means when you are not a Member and not Staff (direct data collection); 
• From Staff or a Member who has recommended yourself to us for training to be provided to you (indirect data collection); 
• From yourself within verbal or digital communications or conversations in (person/online/telephone) you have either with Labour or with a training partner organisation on Labour’s behalf (direct data collection); 
• From a training partner organisation on Labour’s behalf where Labour has not been the first point of contact for you (indirect data collection); and 
• From yourself via an online form or survey we have sent you (direct data collection). 

What do we use your personal data for and what is our lawful basis for using it? 

We will use your personal data for the following purposes and on the following lawful bases. The table below is relevant to all Trainees:

Purpose for using personal data	Lawful basis for using
To provide you with relevant training on behalf of Labour either in anticipation of activities you will be conducting, to refresh your training, to meet a regulatory or compliance requirement, or for best practices maintained by Labour.	If you are considered to be Staff (including external consultants and contractors) the lawful basis we will be relying on is in accordance with UK General Data Protection Regulation (“GDPR”), Article 6.1(b) where the use your personal data is necessary in the performance of a contract which you have agreed to or where we are working to enter into a contract with you i.e. your contract of employment or consultancy agreement etc. Where you are providing any services or activities for Labour there may be a legal obligation for us to provide relevant training to you before you participate in that activity or handle any personal data the lawful basis we will be relying on is in accordance with GDPR, Article 6.1(c) for laws which include, but are not limited to, the Children and Social Work Act 2017; Antisocial Behaviour Act 2003; Representation of the People Act 1983 etc. The lawful basis we shall be relying on for any other training is the legitimate interest of the Data Controller in accordance with UK GDPR Article 6.1(f).
To invite you to attend a training session either in person or online.	The lawful basis we shall be relying on is the legitimate interest of the Data Controller in accordance with UK GDPR Article 6.1(f).
To allow you access to online training materials and for training to be delivered to you online.
To monitor Trainee attendance and follow up any non-attendance.
Where training is in person we will use your personal data to ensure any accessibility requirements are met and, if applicable, we can account for dietary requirements.	The lawful basis we shall be relying on is the legitimate interest of the Data Controller in accordance with UK GDPR Article 6.1(f). Special categories of personal data used for the determination of any health related accessibility requirements will be under UK GDPR Article 9.2(h).
To update a regulatory body based on any relevant statutory requirements.	The lawful basis we shall be relying on is GDPR, Article 6.1(c) in which the relevant law will be specified in the lead up to the training.
To update a regulatory body or external assessor based on best practice or requirements of the type of training you are receiving.	The lawful basis we shall be relying on is the legitimate interest of the Data Controller in accordance with UK GDPR Article 6.1(f).
To send you a follow up questionnaire or survey so we are able to monitor effectiveness of the training provided or the training provider.
To send you any certificates or notification of qualification or outcomes of the training.
To notify you of further training you may like to attend. We will only send you these notifications if you have expressed an interest in receiving training from Labour either verbally or digitally or you have attended a training session in the past. Note: You can let us know if you no longer wish to receive these notifications by either, clicking ‘Unsubscribe’ if the email is from an emailing service we use, notifying the course leader, leaving a message within the digital training platform (if available), or by emailing [email protected]
Where you have expressed an interest in further participation in Labour’s activities as a result of training we will use your personal data to make contact with you to explore the options that may be available to you.   Note: Upon contact where you express a desire to participate in further activities with Labour, this privacy notice will no longer apply and you should refer to one of the privacy notices which can be accessed by clicking here for how your personal data will be used.
To identify personal data and take relevant action upon submission of a data subject rights request.	Compliance with a legal obligation under UK GDPR Article 6.1(c). The legal obligation is the UK General Data Protection Regulation to uphold your data protection rights. Special categories of personal data used for the purpose of Substantial Public Interest (Preventing or detecting unlawful acts; Protecting the public; Regulatory requirements) under UK GDPR Article 9.2(g).
To be able to assess any impact on individuals of a data breach involving personal data held on Labour Party systems or on third party systems.
To help protect an individual from neglect or physical, mental or emotional harm, or protect the physical, mental or emotional well-being of an individual.	Use of the personal data is necessary to protect the vital interests of an individual or individuals in accordance with UK GDPR Article 6.1(d). Special categories of personal data used for the purpose of Substantial Public Interest (Preventing or detecting unlawful acts; Protecting the public; Regulatory requirements) under UK GDPR Article 9.2(g).
To deal with legal claims and ongoing litigation cases.	Compliance with a legal obligation under UK GDPR Article 6.1(c). The legal obligation is the UK General Data Protection Regulation to uphold your data protection rights. Special categories of personal data used for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity under UK GDPR Article 9.2(f).

If you have interacted with Labour in a different way and if you expected to see something different to the list above, you can access all of our privacy notices by clicking here. If it is still not there, feel free to get in touch as mentioned below. 

Who do we share your personal data with? 

Any data shared with the below categories of recipients is the minimum necessary for the task they have been instructed to carry out on our behalf or in conjunction with us. Each category of recipient is subject to review by the Data Protection Team to make sure they have the right methods in place for keeping your personal data secure. 

Where the sharing of personal data is within the context of a product or service being supplied under contract to Labour, a Data Processing Agreement, in accordance with GDPR Article 28 is put in place. This makes sure the supplier cannot use your personal data outside of the list of uses above. 

Within the purposes of using your personal data, as listed above, we will share your personal data with the following: 

1. External training providers for in-person training; 

2. Online digital training platform service provider(s); 

3. Where relevant, the National, Regional and/or Local Labour Party offices; 

4. Digital communications and storage providers (for email and maintaining relevant records); 

5. Pre-approved online survey platform providers; 

6. If applicable, training location providers and/or catering providers; 

7. If applicable, regulatory bodies or certification providers; and 

8. If applicable, your employer. 

There may be scenarios where we are subject to a legal obligation to disclose or share your personal data, such as with law enforcement agencies, regulatory bodies or public authorities in order to prevent or detect crime, or prove we have adhered to their request. We will only ever disclose your personal data to these third parties to the extent we are required to do so by law. 

Data sharing with a third-party organisation that is not a supplier of a product or service to Labour does not occur unless there is a legal obligation or sound lawful purpose for such sharing.  For any such sharing we put a Data Sharing Agreement in place between Labour and the third-party containing specific information in accordance with the Information Commissioner’s Office ‘Data sharing code of practice’.  

This will include giving only relevant and often only geographically restricted access to your personal data to our local Labour Party organisations, Labour Candidates hoping to be elected, Labour Councillors, Labour Mayors and Labour Members of Parliament (MPs) so they can all conduct their democratic engagement activities. 

You can find further information on how local Labour Party organisations, Labour Candidates hoping to be elected, Labour Councillors, Labour Mayors and Labour Members of Parliament (MPs) use your personal data on their respective websites and more generally within our list of privacy notices which can be accessed by clicking here. 

Information on the meaning of ‘democratic engagement’ for national and local political parties, and their candidates and elected representatives can be found by clicking here. 

In all circumstances, the unlawful and unauthorised sharing of copies of personal data in which the Labour Party is the data controller is expressly prohibited. Any unauthorised sharing of Labour Party data is classified as a data breach which we will record and report to the ICO as required. 

How long will we keep your personal data? 

We keep your personal data for the minimum time necessary for the training to be provided successfully and for any necessary follow ups as required. 

Personal data shall be reduced, redacted, de-identified and deleted at appropriate times so we retain the minimum amount of personal data possible. For example, a paper based login sheet at a venue will be destroyed once added to a digitised spreadsheet or training platform. 

In general, unless any other laws are not in conflict with this, we will keep a record of your training with the minimum amount of data necessary for at least 7 years. If you are Staff or a Member, we will keep a record of your training for at least 7 years after you are no longer Staff or a Member. 

Local record keeping may differ where it is associated to a Local Labour Party known as a Constituency Labour Party (CLP) or a Member of Parliament’s Office (MPO). It is highly likely they will also keep you training records on file for at up to 7 years. Any training records shared with CLPs and MPOs from Labour are in alignment with a Labour data protection framework in place with them which governs such sharing, this means that they are able to make local adjustments to how long they keep your training data. To understand these differences either see their website or contact them directly.  

What are your rights and how can you express them? 

To understand your data privacy rights and to submit a rights request, the best way to do so is by visiting the ‘YOUR RIGHTS’ page on our website which you can get to by clicking here. 

How can you complain about our use your personal data? 

The best way to make a complaint is by visiting our page on ‘HOW TO MAKE A DATA PROTECTION COMPLAINT’ which you can access by clicking here.  

How can you contact us about this privacy notice? 

If you have any questions about the information in this privacy notice, then you can contact the Data Protection Team via email using [email protected] or by post within a letter to: 

Labour Statutory Data Protection Officer 

The Labour Party, Southworks, 20 Rushworth Street, United Kingdom, SE1 0SS 

When was this privacy notice last updated? 

We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify you of the changes where required by applicable law to do so.