GDPR Privacy Notice for Work Placements & Work Experience Students
1 INTRODUCTION
Heavy Haul Rail Limited (“Heavy Haul Rail”, “we”, “our” or “us”) is committed to protecting the privacy and personal information of students participating in work experience placements, workplace learning programmes, internships, apprenticeships, site visits and related educational activities.
This Privacy Notice explains how we collect, use, store, share and protect your personal data and outlines your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. DATA CONTROLLER
Heavy Haul Rail Limited is the data controller responsible for the processing of your personal data.
Contact Details
Heavy Haul Rail Limited
data.protection@heavyhaulrail.co.uk
If you have any questions about this Privacy Notice or how your personal data is handled, please contact us using the details above.
3. WHAT PERSONAL DATA WE COLLECT
Depending on the placement or programme, we may collect:
Personal Identification Information
- Name
- Date of birth
- Home address
- Email address
- Telephone number
- Emergency contact details
Educational Information
- School, college or university attended
- Course of study
- Placement details
- Learning objectives
- Attendance records
Health and Safety Information
- Medical conditions relevant to health and safety
- Accessibility requirements
- Dietary requirements for events
- Accident or incident records
Safeguarding Information
- Details required to ensure student welfare and safeguarding
- Parental or guardian contact information where applicable
IT and Security Information
- User account details
- Building access records
- Network access logs
- CCTV footage where applicable
Photographs and Images
- Individual photographs
- Group photographs
- Video recordings
- Images taken during placements, events, educational activities or corporate communications
4. WHY WE USE PERSONAL DATA
We process personal data for the following purposes:
Placement Administration
- Arranging and managing placements
- Communicating with students, educational establishments and parents/guardians where appropriate
- Monitoring attendance and participation
Health, Safety and Safeguarding
- Ensuring the health, safety and welfare of students
- Managing risks in operational environments
- Responding to emergencies or incidents
- Meeting safeguarding obligations
Security
- Managing access to company premises and systems
- Preventing unauthorised access
- Investigating security incidents
Business Administration
- Maintaining placement records
- Auditing and compliance activities
- Responding to requests and complaints
Promotion and Communications
Producing recruitment, promotional and internal communications materials
Showcasing educational programmes and careers opportunities
Publishing news stories, case studies and success stories
5. OUR LAWFUL BASES FOR PROCESSING
Under UK GDPR, we rely on one or more of the following lawful bases:
| Purpose | Lawful Basis |
| Managing placements and educational programmes | Legitimate Interests |
| Health and safety management | Legal Obligation and Legitimate Interests |
| Safeguarding activities | Legal Obligation and Legitimate Interests |
| Security, access control and CCTV | Legitimate Interests |
| Maintaining records and compliance | Legal Obligation |
| Use of photographs for marketing and publicity | Consent |
Where we rely on legitimate interests as our lawful basis, our legitimate interests are: managing safe, effective and legally compliant work placements and educational programmes; protecting the security and integrity of our premises, systems and staff; and maintaining appropriate business records. We have assessed that these interests are not overridden by the rights and freedoms of the individuals concerned.
Where we process special category personal data, such as health information, we will rely on an appropriate additional condition under UK data protection law. For health and safety data we rely on Article 9(2)(b) of UK GDPR (processing necessary for the purposes of carrying out obligations in the field of employment and social security law). For safeguarding records we rely on Article 9(2)(g) (processing necessary for reasons of substantial public interest) in accordance with Schedule 1 of the Data Protection Act 2018.
6. STUDENT PHOTOGRAPHS, VIDEOS AND IMAGES
Heavy Haul Rail may take photographs or video recordings during placements, educational visits, career events and workplace activities.
How Images May Be Used
Images may be used for:
- Internal newsletters and communications
- Company intranet content
- Recruitment campaigns
- Educational partnership materials
- Company websites
- Social media channels
- Press releases and external publications
Consent
Where photographs or videos are intended for promotional, marketing or public-facing purposes, Heavy Haul Rail will obtain appropriate consent from:
- The student, where legally able to provide consent; or
- A parent or guardian where the student is under 18 and consent is required.
Participation in photographs is generally voluntary, and students may decline to be photographed or filmed.
Withdrawal of Consent
Where processing is based on consent, consent may be withdrawn at any time. Withdrawal will not affect processing carried out before consent was withdrawn.
Storage and Retention of Images
Images will be kept only for as long as necessary for the purpose for which they were collected and in accordance with our records retention schedule. Images used in historical corporate records may be retained for longer where there is a legitimate business need.
7. WHO WE SHARE INFORMATION WITH
We may share personal data with:
- Schools, colleges and universities
- Parents or guardians where appropriate
- Regulatory authorities
- Health and safety advisers
- Emergency services
- IT and systems providers
- Professional advisers
- Insurers
- Auditors and regulators where legally required
We will only share information where there is a lawful basis to do so. We do not sell personal data.
8. INTERNATIONAL TRANSFERS
Personal data is normally processed within the UK.
If personal data is transferred outside the UK, Heavy Haul Rail will ensure that appropriate safeguards are in place in accordance with UK data protection law.
9. HOW LONG WE KEEP PERSONAL DATA
Heavy Haul Rail follows the UK GDPR storage limitation principle and retains personal data only for as long as necessary for the purposes for which it was collected.
Unless a longer period is required by law or legitimate business need:
| Record Type | Retention Period |
| Student placement records | 3 years after the placement ends |
| Health and safety records relating to placements | Up to 6 years, or longer if required by law |
| Safeguarding records | In accordance with safeguarding obligations and legal requirements |
| CCTV footage | Typically up to 30 days unless required for an investigation |
| Marketing consent records | For the duration of consent and up to 3 years afterwards |
| Promotional images and media | Up to 5 years after creation, unless retained for historical or archival purposes |
At the end of the applicable retention period, information will be securely deleted, destroyed or anonymised.
If we make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights.
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.
10. DATA SECURITY
We may have to share your data with third parties, including third-party service providers and other associated companies.
We require third parties to respect the security of your data and to treat it in accordance with the law.
We may transfer your personal information outside the EU.
If we do, you can expect
10. DATA SECURITY
We have put in place measures to protect the security of your information.
Heavy Haul Rail takes appropriate technical and organisational measures to protect personal data against:
- Unauthorised access
- Loss
- Misuse
- Alteration
- Accidental destruction
Access is restricted to those who need it for legitimate business purposes.
11. YOUR RIGHTS
Under UK GDPR, you have the right to:
- Be informed about how your information is used
- Request access to your personal data
- Request correction of inaccurate information
- Request erasure of personal data in certain circumstances
- Request restriction of processing
- Object to processing where applicable
- Request transfer of your data to another organisation where applicable
- Withdraw consent where processing is based on consent
- Challenge decisions based solely on automated processing where applicable.
Requests can be made using the contact details provided in this notice.
12. COMPLAINTS
If you are unhappy with how Heavy Haul Rail has handled your personal data, please contact us first so that we can try to resolve your concerns.
You also have the right to complain to the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: https://www.ico.org.uk
13. CHANGES TO THIS PRIVACY NOTICE
Heavy Haul Rail may update this Privacy Notice from time to time to reflect changes in legal requirements or our processing activities. The latest version will always be made available to students and educational partners.
Heavy Haul Rail Limited is committed to processing personal data fairly, lawfully, transparently and securely in accordance with UK GDPR and the Data Protection Act 2018.
14. DATA PROTECTION OFFICER
We have appointed a team of Data Privacy Champions to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact Data.Protection@heavyhaulrail.co.uk. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.