Privacy notice for capability building activities

Introduction

This privacy notice should be read alongside HM Treasury’s ‘Personal information charter’. The charter sets out:

the standards you can expect from HM Treasury when we use your personal information
the contact details for our Data Protection Officer
how to exercise your Data Protection Information Rights (including access)
how to exercise your right to complain to the Information Commissioner’s Office

This privacy notice supplements the ‘Personal information charter’ and outlines additional information in relation to events and conferences for Government Project Delivery fast stream candidates.

Data controller

A data controller makes decisions about processing activities. They exercise overall control of the personal data being processed and are ultimately in charge of and responsible for the processing.

The data controller for this processing activity is HM Treasury.

Data processors

A data processor is an organisation or company that handles personal information on our behalf, following our instructions. Data processors do not use your information for their own purposes; they only process it as directed by us.

The following organisations are directed to process your personal information on our behalf.

Name and function of each data processor
Processor name	Function
Microsoft	Provision of enterprise IT services including email, forms, document storage, collaboration tools, and infrastructure support
School of Management, Cranfield University	Provision and delivery of the Project Leadership Programme (PLP) and its related learning services including alumni offer
Oxford Said Business School, University of Oxford	Provision and delivery of the Major Projects Leadership Academy (MPLA), Orchestrating Major Projects (OMP) and its other related learning programmes and services including SRO Fundamentals, PD Fundamentals, Sponsoring Board Workshop and Ministerial programme plus alumni offer
Ernst and Young LLP (EY) and Coventry University	Provision and delivery of the Managing Projects Leading Workstreams programme and its related learning services

Who we process personal data about

The table below outlines the categories of individuals whose personal data we will process in this activity, alongside the types of personal data we will use.

Personal data categories
Category of individual	Types of personal data	Special category data
All participants who apply and participate in the leadership programmes and other related activities. Key officials who nominate, sponsor and undertake assessment of or administrative processes for participants. Teaching staff and speakers who deliver or contribute to the delivery of the programme learning services.	Name Email address Telephone number Position / role Grade Department Date of birth Gender Work experience and qualifications Government profession status Officials and faculty feedback and comments on participants’ performance Photos and video recordings Transcripts Assessment scores and pass / fail information Talent comments Academic assignments completed / scores 360 degree feedback (on participants or by participants) Personal development plans Leadership programme competency evidence CVs Feedback submitted by participants on the performance of others Personal opinion Events you have signed up for and attended	(Voluntary) Equality, Diversity and Inclusion data including: Dietary requirements (if applicable) Disability information (if applicable) Care responsibilities (if applicable) Requirements for reasonable adjustments (if applicable) Social mobility data

Source of your personal data

Personal data of the individuals listed above will be collected:

directly, from participants, teaching staff, speakers and key officials
indirectly, from participants, teaching staff and key officials, including feedback given on individuals by themselves and others

Purpose and lawful basis

We will process your personal data for the following purposes and using the specified lawful bases.

Purpose, additional information and lawful basis
Purpose and additional information	Lawful basis	Further information
The processing is for the registration, participation, completion of participants on NISTA project delivery leadership programmes and related activities and alumni activities; for the undertaking of official duties by non-participants in the delivery of the Services; for the appraisal of the impacts and benefits of the programme to participants and their departments; for internal civil service monitoring of the project delivery profession workforce.	Processing non-special category data: Article 6(1)(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller Processing special category data: Article 6(1)(c) processing is necessary for compliance with a legal obligation to which the controller is subject – this relates to Section 149(1) of the Equality Act 2010 – Public sector equality duty	Personal data processing is necessary to deliver the programme and related activities to participants and their departments. Special category personal data processing is necessary to ensure NISTA are meeting their equality, diversity and inclusivity duties in delivering the leadership programmes and related activities. Data will be fully anonymised for reporting and sharing. Personal data relating to accessibility needs and dietary requirements is given voluntarily by the data subject to assist their participation in person at the programmes or related activities.

Who we share your personal data with

Your personal data will only be shared internally with HMT staff who have a business need to access it.

We will share your personal data with the following types of external recipients:

individual’s Heads of Profession or official sponsor who require notification of programme results and are the senior escalation point for NISTA for any issues, appeals or complaints
departmental capability teams who require enrolment and graduation data
other government department senior officials assigned to undertake individual’s final assessment panels alongside NISTA and programme academic supplier

International transfers

Your personal data will not be transferred to an international recipient during any of the leadership programmes or related activities deliveries.

How long we hold your personal data

We will retain your personal data for as long as necessary to fulfil the purposes for which it was collected. The specific retention period/s for the majority of your personal data will be the duration of the programmes plus 2 years. This also applies where a participant’s training period is extended due to exceptional circumstances. Your name, email addresses, telephone number, LinkedIn profile details (if given) and programme outcome will be retained for alumni purposes, until such time that NISTA are made aware a participant has left the community.

If data subjects wish for HM Treasury to stop processing their data, including their basic contact details retained for alumni purposes, at any time, they can contact the NISTA Service Delivery team to request this.

Once your data is no longer required, it will be securely deleted or anonymised.

Automated decision-making and profiling

The leadership programme activities do not involve automated decision making or profiling. This means that decisions which may affect you are not made solely by automated means without human involvement, and your data is not subject to analysis intended to evaluate or predict aspects such as your behaviour, preferences, or interests.

Cookies on Government Project Delivery

Important