Professional affiliate privacy notice

Who we are

The Engineering Council is the UK regulatory body for the engineering profession. The Engineering Council is a registered charity, number 286142, whose registered office is 10 Lower Thames Street, London, EC3R 6EN.

Contact details

The person responsible for data protection matters at the Engineering Council can be contacted by:

• email dpo@engc.org.uk
• post (to the above address)
• telephone: 020 3206 0500

Personal Data

What is personal data

Personal data is any information that can be used to identify an individual. 

What personal data do we collect 

The personal data that the Engineering Council collects and processes on you is:

What we use your personal data for

The personal data we collect will be used for the following purposes:

• The personal data we collect will be used to contact you / your organisation regarding a Professional Affiliate application, status and / or requirements. 

What the lawful basis is for processing your data

Our basis for processing your personal data is: 

• Legitimate Interest: The processing of your personal data by the Engineering Council is conducted on the basis of legitimate interest in order to effectively perform our role as the regulatory body for the UK engineering profession, to issue certificates of Registration, and to otherwise maintain contact with you where it may be appropriate to do so.

Special or sensitive data 

The Engineering Council does not collect or process special categories of personal data or sensitive data such as race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, etc. 

Consent 

There is no requirement for your consent to process your personal data as specified in this Notice unless it is outside the basis of: 

• Legitimate Interest

Data we request

The Engineering Council request data from organisations seeking Professional Affiliate status and current Professional Affiliates that need to have their status re-approved every five years. A submission of data can include, but is not limited to: 

Governance

• Code of Conduct
• Disciplinary Procedure
• Financial summaries for the previous three years
• Strategic Plan
• Risk Register and risk management procedures in relation to Professional Affiliate activities
• An appeals procedure for unsuccessful applicants for membership
• Terms of Reference for those committees concerned with engineering and/or Membership

Management and Self-Assessment

• Reports of Internal audit conducted in the last three years
• Current staff organisation chart (including staff, branches and committee structure)

Membership activities

• Membership grades, criteria and procedures
• Learned body activities
• Evidence to show these are aligned with the aims of Engineering Council, e.g. the promotion of engineering

CPD

• Policies and procedures dealing with CPD

Registration agreements

• A copy of the signed agreement

Sharing your data

The Engineering Council may pass your personal data to the following third parties, without first obtaining your consent, for the following purpose(s) as part of our processing activities:  

Retention 

The Engineering Council will process your personal data for as long as they are a staff member / volunteer at the organisation or until the organisation’s business details need to be changed.The Engineering Council will retain a submission of data for six years, which is until a Professional Affiliate status will be reviewed again. The Licensing team will ask for a submission every five years as part of a Review. In between times the Engineering Council may ask for further information regarding any outstanding actions which may be updated versions of the documents listed above. The Engineering Council do not specifically ask for personal data within the submission, therefore organisation’s / Professional Affiliates can redact personal data before sending the submission. If the personal data is not redacted, the Engineering Council does not take responsibility for this being provided.

Your data protection rights

Under data protection law, you have rights including:

• Right of access – you have the right to request a copy of the personal data that we hold about you.

• Right to rectification – you have a right to correct personal data that we hold about you that is inaccurate or incomplete.

• Right to erasure – in certain circumstances you can ask for the personal data we hold about you to be erased from our records.

• Right to restrict processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.

• Right to data portability – you have the right to have the personal data we hold about you transferred to another organisation.

• Right to object – you have the right to object to certain types of processing of your personal data such as direct marketing.

• Right to object to automated processing, including profiling – you have the right to be object to the legal effects of automated processing or profiling.

If we receive a request from you to exercise any of the above rights, we will forward them on as appropriate to any third party involved (as listed above) in the processing of your personal data.

Subject Access Request

A Subject Access Request form and copy of the procedure can be requested by emailing dpo@engc.org.uk Subject access requests may be forwarded on, where appropriate, to any third party involved (as stated above, where applicable) in the processing of your personal data.

Complaints

 If you wish to make a complaint about how your personal data is being processed by the Engineering Council (or third parties as listed above), you have the right to lodge a complaint;

• directly with the Engineering Council data protection lead; and/or
• the Information Commissioner’s Office

The details for each of these contacts are: 

Data Security:

All data held or processed by the Engineering Council is held in a secure server managed by the Engineering Council.  

Changes to this Privacy Notice

We reserve the right to update this privacy notice at any time, and we will notify you if there is a substantial change in the way we process your data. We may also notify you in other ways from time to time about the processing of your personal data.