CATS is GDPR compliant.

This Privacy Notice is to let you know how CATS generally uses and looks after your personal information.  This includes what you tell us about yourself and what we learn during our relationship with you.  It does not provide exhaustive detail of all aspects of our collection and use of personal information, but our online service portals and individual applications will.  However, we are happy to provide any additional information or explanation needed.

Please email FOI@catsexams.com or write to the address below for further information.

Why we process your personal information

We process personal information to enable us to carry out our regulatory duties which may include:

• consideration and investigation of complaints and policy issues,
  • providing advice and information,
  • maintaining our own accounts and records,
  • supporting and managing our employees,
  • sending promotional communications about the services we provide,
  • undertaking research,
  • administration of licences,  
  • internal support functions,
  • corporate administration and all activities we are required to carry out as a data controller.

The type of personal information we process

We process information relevant to the above reasons/purposes which may include:

• personal details 
  • family details
  • lifestyle and social circumstances
  • goods and services
  • financial details
  • employment and education details
  • details of complaints, incidents and grievances
  • visual images, personal appearance and behaviour
  • responses to surveys

We also process special category personal information that may include:

• racial or ethnic origin
  • religious or other beliefs
  • offences (including alleged offences)

Who information is processed about

We process personal information about:

• customers
  • employees
  • students
  • suppliers
  • complainants or their representatives
  • subject of a complaint or their representatives
  • individuals who we may contact when carrying out a complaint or enquiry
  • services providers
  • applicants for a licence or registration
  • authors, publishers and other creators
  • consultants and advisers
  • survey respondents
  • journalists and the media
  • enquirers (e.g. FOI requesters)
  • workers (in addition to employees)
  • those seeking different types of approvals from CATS (e.g. applicants for declarations, certificates etc.)
  • applicants for National Security Vetting who work for the aviation industry

Who the information may be shared with

Other organisations

We sometimes need to share information with other organisations. Where this is necessary, we are required to comply with all aspects of the GDPR.  What follows is a description of the types of organisations we may need to share some of the personal information we process with for one or more reasons.

Where necessary or required we share information with:

• data subjects listed above
  • family, associates and representatives of the person whose personal data we are processing
  • professional advisers and consultants
  • services providers (see below)
  • credit reference agencies
  • debt collection and tracing agencies
  • police forces
  • private investigators
  • current, past or prospective employers and examining bodies
  • financial organisations
  • central government
  • other companies within our group
  • suppliers
  • financial organisations
  • debt collection and tracing agencies
  • persons making an enquiry or complaint
  • organisation subject to a complaint or assessment,
  • prosecuting authorities, courts
  • other ombudsman and regulatory authorities
  • security organisations including vetting organisations

Our service providers

Unless we are automatically required to share your information by law, or have in place an agreement/contract with a third-party service provider to process information on our behalf or assist CATS in providing services, we will normally let you know if we need to share or release your information.

Information is only disclosed by CATS for specified purposes to third parties.  This may include, but is not limited to, administrative workers and IT professionals who, during their professional duties, are assisting CATS with its regulatory functions. CATS takes the security of your personal information very seriously. Information is only disclosed to third party service providers under a contract and who are subject to a duty of confidentiality and have sufficient security measures in place to protect personal data. If you do not consent to the disclosure of information to third parties as described in this Notice, you may make representations to FOI.catsexams.com.

In many circumstances, we will not disclose personal data without consent. However, when we investigate a complaint, for example, we may need to share personal information with the organisation concerned and with other relevant bodies. There are many factors to consider when CATS decides whether information should be disclosed.

You can email FOI.catsexams.com for further information about:

• agreements we have with other organisations for collecting/sharing information;
  • circumstances where we can pass on personal data without consent, for example, to prevent and detect crime and to produce anonymised statistics; 
  • how we comply with the GDPR and other applicable legislation.

Transfers

It may sometimes be necessary to transfer personal information overseas. When this is needed information may be transferred to countries or territories around the world. Any transfers made will be in full compliance with all aspects of the data protection act.

Visitors to our website

The CATSEXAMS website has areas where we capture the details of our users to enable the website service to operate. 

For example:

On-line forms

We have on-line systems or forms which capture the personal information of applicants according to the service they are applying for. More information on this is available under ‘People who apply to us for a service’. 

When you contact us

People who call us

When you call us, we may ask for personal details for verification purposes. We use this information to make sure that we are talking to the right person and to help us locate your information. If you are making a general enquiry we may collect personal details to return your call or to pass on information related to your case/application.

People who email us

Any email sent to us, including any attachments, may be monitored by CATS for reasons of security and/or monitoring compliance with CATS policies. Email monitoring or blocking software may also be used. Please be aware that it is your responsibility to ensure that any email you send to us is not in breach of any law or regulation. 

To make an enquiry, please contact the relevant department or use our enquiry form.

People who make a complaint or report to us

When we receive a complaint or report from a person we may create a record containing the identity of the complainant and any other individuals involved.

We will use the personal information we collect to process the complaint or report and to check on the level of service we provide. We do compile reports for internal management oversight, but minimal information is used. We will also publish, in our Annual Report, statistics showing information such as the number of complaints we receive, but not in a form which identifies anyone.

We usually disclose the identity of the complainant to the CATS manager in the area related to the complaint or report. This is necessary where, for example, the accuracy of a person’s record is in dispute or a report directly relates to the complainant and an investigation is required. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in files in line with our retention policies. This means that information will be retained for varied amounts of time from closure depending on the type of complaint or report. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.
Similarly, where enquiries are submitted to us, we will use the information supplied to us to deal with the enquiry, compile internal reports and to check on the level of service we provide.

People who apply to us for a service

We must hold the personal details of the people who requested a service to provide the service. We keep records of the services provided for the duration of the licence holder’s aviation career and / or in accordance with applicable regulations.

CATS offers various services to the aviation industry and we sometimes use third parties to assist us in providing those services. However, these third parties are only permitted to use information from applicants to complete those services.

How long we keep your personal information

We keep your personal information for as long as you have a relationship with us and, thereafter, for specified purposes in line with our legal duties or our public functions, to respond to any questions or complaints, or to maintain records according to European or National aviation rules that apply to us.

Your individual rights

The General Data Protection Regulation (GDPR) provides you with a number of rights in relation to the processing of your personal data, including the right of access to a copy of the personal data we hold about you, known as a Subject Access Request.

How to get a copy of your personal information

For details on how to access the personal information that we hold about you write to us at this address: 

CATS Innovation Centre
110 Butterfield
Greatr Marlings
Luton
LU2 8DL
U.K.

Letting us know if your personal information is incorrect

You have the right to question any information we have about you that you think is wrong or incomplete. Please contact us at foi@catsexams.com if you want to do this.  If you do, we will take reasonable steps to check its accuracy and correct it.

You can ask us to stop using your personal information

You have the right to object to our use of your personal information, or to ask us to delete, remove, or stop using your personal information if there is no need for us to keep it. This is known as the ‘right to object’ and ‘right to erasure’, or the ‘right to be forgotten’.

There may be legal or other official reasons why we need to keep or use your data. But please tell us if you think that we should not be using it at foi@catsexams.com.

You can ask us to restrict the use of your personal information

We may sometimes be able to restrict the use of your data such as if:

• It is not accurate.
  • It has been used unlawfully but you don’t want us to delete it.
  • It is not relevant any more, but you want us to keep it for use in legal claims.
  • You have already asked us to stop using your data but you are waiting for us to tell you if we can keep on using it.

This means that it can only be used for certain things, such as legal claims or to exercise legal rights. In this situation, we would not use or share your information in other ways while it is restricted.

If you want to object to how we use your data, or ask us to delete it or restrict how we use it or, please contact us at foi@catsexams.com.

How to withdraw your consent

Where we have relied on your consent to process your personal information, you can withdraw your consent at any time. Please contact us if you want to do so.

If you withdraw your consent, we may not be able to provide certain products or services to you. If this is so, we will tell you.

Complaints or queries about using your information

CATS applies the highest standards when collecting and using personal information. We therefore take any complaints we receive about the processing of personal information very seriously. We encourage people to bring issues to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our information management procedures.

CATS Data Protection Officer (DPO)

CATS DPO is:

Dr Stuart E. Smith
To contact our DPO, please email foi@catsexams.com. This will ensure that in his absence your enquiry can be dealt with in the most efficient way.

Complain to the Information Commissioner

If you are not satisfied with how CATS has handled your personal data, please let us know and we will try and resolve the problem. However, you have a right to complain directly to the ICO.

Changes to this Privacy Notice

We keep our Privacy Notice under regular review. This Privacy Notice was last updated on 27/12/19.