This Privacy Notice will be reviewed on a regular basis or when a change in legislation and/or practices dictates and any changes will be notified to you by posting an updated version on our websites and/or by contacting you via email.
We recommend that you regularly check for changes and review this policy when visiting our website(s).
This Privacy Notice aims to explain the types of personal data we may collect about you when you interact with us and use our website, Impact Student Partners, including any data you may provide when you purchase products, goods and services or sign up to our newsletters.
It also explains how we will store and handle your data and keep it safe.
When you are using the Impact Student Partners website, Commercial Services Trading Ltd (company registration No: 05858178 (England and Wales)) is the data controller.
We understand that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all our customers and their employees and other people with whom we interact in the course of undertaking our services. This Privacy Notice offers both our customers and their employees with meaningful and accessible guidance on our approach to handling personal data.
Impact Student Partners is a trading style of Commercial Services Trading Ltd, company registration No: 05858178 (registered in England and Wales), and part of Commercial Services Group (CSG).
CSG is the umbrella for all its trading brands, with its ultimate parent organisation being Kent County Council. It provides the support, dependability, and security to allow all brands to thrive independently. CSG are committed to providing an excellent customer and user experience underpinned by social value and a committed and empowered workforce.
Impact Student Partners collects, uses and processes personal information about you. When we do we are regulated under the UK Data Protection Act 2018 (DPA 2018), the UK General Data Protection Regulation (UK GDPR) and the Data (Use and Access) Act 2025.
If you have any questions, suggestions or complaints about the processing of your personal information please contact our Data Protection Officer (DPO) via email at DPO@csltd.org.uk, or in writing by using the address below;
Data Protection Officer
Commercial Services Group
1 Abbey Wood Road
Kings Hill
West Malling
ME19 4YT.
We collect your personal information in order to provide you with advice, service and support, including:
- Confirming support arrangements.
- Recruitment, onboarding, payroll, compliance and management of support staff.
- Communication regarding events, training, complaints or service updates.
- Customer service and administrative support relating to our student services.
In providing these services, it will be necessary for Impact Student Partners to gather, obtain, record and hold your personal information.
The table below summarises the information we collect, use and retain for our services, how and why we do so, how we use it and with whom it may be shared.
We seek to ensure that our information collection and processing is always proportionate. We will notify you of any changes to information we collect or to the purposes for which we collect and process it.
| The information collected | How the information is collected | Why the information is collected | How the information is used and may be shared |
|---|---|---|---|
| Candidate Personal Details: such as name, contact information, and location |
Directly from individuals when they apply for a role, submit a CV, complete online forms, or contact us by phone or email. Through interviews or consultations conducted by our consultants. From publicly available professional sources such as LinkedIn, job boards, or company websites. Via our cloud-based CRM, which may use AI to assist with transcribing calls, generating summaries, or improving data quality. |
Match candidates to suitable support assignments and manage the recruitment process. Communicate effectively with candidates and clients throughout assignments. Maintain accurate business records and provide high-quality customer service. Carry out limited, consent-based marketing to inform individuals about relevant opportunities or services. Analyse service performance and improve our recruitment processes using insights generated through AI tools (under human review). |
To register you as a candidate or client within our CRM. Used to match support workers with students based on support needs. To contact you regarding support requirements or other relevant updates. To produce anonymised reports and insights that help improve service quality. To comply with legal or regulatory requirements where necessary. |
| Candidate Financial details: such as bank/building society account details, student loan status, National Insurance and tax information, your age, date of birth and court orders / attachment of earnings order | Candidate Financial details: such as bank/building society account details, student loan status, National Insurance and tax information, your age, date of birth and court orders / attachment of earnings order |
To perform the employment contract including payment of salary and benefits. Legitimate interests: to maintain employment records and to comply with legal, regulatory and corporate governance obligations and good employment practice. |
To ensure you receive the correct pay and benefits and deducting tax and NI contributions. Information shared with the payroll department and with HMRC and the Cabinet Office's National Fraud Initiative. |
| Candidate Employment History: including CVs, qualifications, references, and career preferences | Through interviews or consultations conducted by our consultants. From publicly available professional sources such as LinkedIn, job boards, or company websites. |
Match support workers with suitable student assignment opportunities and manage the recruitment process. Maintain accurate business records and provide high-quality customer service. Carry out limited, consent-based marketing to inform individuals about relevant opportunities or services. |
To register you as a candidate or client within our CRM. To contact you regarding roles, student assignments, interviews, or other relevant updates. To comply with legal or regulatory requirements |
| Candidates Nationality and Immigration: Your nationality and immigration status and information from related documents, such as your passport or other identification and immigration information | From you and, where necessary, the Home Office | To enter into/perform the employment contract. | Nationality and Immigration: Your nationality and immigration status and information from related documents, such as your passport or other identification and immigration information |
| Candidate Sensitive Information (Special category data): Your racial or ethnic origin, sex and sexual orientation, religious or similar beliefs, political opinions, data concerning your health, genetic and biometric data. | From you |
To perform the employment contract and to comply with legal obligations (including exercising employment law rights or obligations) and for reasons of substantial public interest (equality of opportunity or treatment, racial and ethnic diversity at senior levels of organisations). (Less commonly: where necessary for legal claims to protect your vital interests). |
To comply with equal opportunities monitoring obligations and to follow policies. To comply with employment and other laws. To assess your fitness for work and ensure your health and safety in the workplace or to provide appropriate workplace adjustments. To bring or respond to any complaints or legal claims brought against you. |
| Candidate Criminal Records: information, including the results of Disclosure and Barring Service (DBS) checks | From you and the DBS |
To perform the employment contract. To comply with legal obligations necessary for the purposes of performing or exercising obligations or rights in connection with employment. For reasons of substantial public interest (preventing or detecting unlawful acts, safeguarding, suspicion of terrorist financing or money laundering in the regulated sector and protecting the public against dishonesty). |
To carry out basis and/or statutory checks, including the DBS. Information shared with DBS and other regulatory authorities as required. For security vetting and investigating complaints and allegations of criminal offences. For further information, see * below |
| Candidate References: Details in references about you that we may give to others to support employment opportunities | From your CV or Referees |
To perform the employment contract. To comply with legal obligations. Legitimate interests: to maintain employment records and to comply with legal, regulatory and corporate governance obligations and good employment practice. |
To provide you with the relevant reference. To comply with legal / regulatory obligations. Information shared with client hiring managers and the recipient(s) of the reference. |
| Client Organisations: To register you as a new customer | From a representative of your company | To enter into/performance of a contract. |
For the performance of a contract to fulfil services or enquires. Information may be shared with trusted third-party service providers who support our CRM, email, payroll, or reference-checking functions, under strict data-processing agreements. Regulatory bodies or legal authorities if required by law |
| Client Financial details | From client/customer organisations. |
To enter into/performance of a contract. Legitimate interest: to maintain financial records and to comply with our legal obligations for tax/VAT. |
To ensure you receive the contract invoices for orders placed with us. Information may be shared with the HMRC for taxation purposes. |
Other than stated above, we may share personal information with law enforcement, our regulators or other authorities if required by applicable law. As there is a statutory and contractual basis for collecting your personal data if you do not provide some or all of the details specified in the ‘The personal information we collect and use’ section, we may be unable to enter into a contract with your organisation.
On some occasions, we may collect or process your personal information using automated decision-making systems (a decision made by automated means and without any human intervention). This enables us to make sure our decisions are quick, fair, efficient and correct, based on what we know. We do this because we want to provide us with communication patterns or summarised calls to improve record accuracy. Automated decision-making is not used without human review. AI is used to support processes not to make independent decisions about candidates. Human oversight is maintained.
We may utilise machine learning technology to match candidates profiles information and experiences to various support/assignment opportunities based on the selection criteria outlined in job descriptions/specifications, as provided by the client, to create shortlists for reviewing against client vacancies.
Or used to create a candidate profile using publicly accessible information from other online sources (e.g. job boards, LinkedIn etc.). Where profiles are created, we will contact you and gain your consent to further process and retain your personal data for job seeking opportunities and recruitment services.
If you consent to receive Job and Blog alerts, we will use automated profiling based on your requirements, we do this because we want to provide you with information, products and services that are of interest and are most relevant to you.
The use of this type of technology helps us to make quicker and more consistent decisions, particularly in cases where large volume of data needs to be analysed and decisions made efficiently and effectively. These automated decisions can affect the services we may offer you now or in the future.
Automated decision making is allowed in the following circumstances:
1. Where we have notified you of the decision and given you 21 days to request a reconsideration.
2. Where it is necessary to fulfil our contractual obligations and requirements and appropriate measures are in place to safeguard your rights.
3. In limited circumstances, with your explicit consent and where appropriate measures are in place to safeguard your rights.
If an automated decision is made, based on any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must put in place appropriate measures to safeguard your rights.
We will not keep your information for longer than is necessary, for either:
• the purpose of administering your individual record;
• or as is necessary in providing a service to our customer;
• or as required by law.
Upon expiry, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning.
For certain data sets, we have the following specific retention periods:
For example:
• personal information processed under contractual obligations will be retained for 7 years beyond the date of your temporary last assignment or last permanent placement
• the personal information of temporary workers will be retained for 7 years to fulfil our HMRC obligations
• jobseeker personal information (e.g. CV) will only be retained for 24 months unless you have exercised your right for your personal information to be erased or you have objected to your information being processed
• we will hold your personal information for marketing purposes unless you have opted out or unsubscribed from receiving marketing information
We may share your personal data with the following organisations:
• With students that require support in relation to the overall support provision.
• With potential clients (universities or colleges) in relation to specific jobs if we deem your profile suitable, we will inform you of the organisation and with your consent share your personal data with the hiring client.
• With umbrella companies to enable payment for contractual work.
• With the Cabinet Office National Fraud Initiative, for the purposes of assisting the prevention and detection of fraud under a legal obligation and the HM Revenue and Customs (HMRC) for the purposes of legal compliance with tax and HRMC regulations.
• With relevant Government funding bodies regarding Disabled Student Allowances (DSAs) for audit and compliance purposes.
We may also share your personal information with trusted third parties that are under contract with us and where it is necessary to administer our working relationship with you or where we have another legitimate interest in doing so (providing this is not overridden by your interests).
Our trusted third parties may include service providers who supply us with processing services or functions, including our contracted IT suppliers, access to data and systems is only granted where authorised and specifically required in line with our contracts with them.
Management information may be shared within Commercial Services Group, under a Data Sharing Agreement held by its operating company Global Commercial Services Group Ltd, a company registered in England and Wales (Reg No. 11735631). This Agreement reflects the requirements of the UK GDPR, DPA2018 and DUAA2025.We may also need to share some of the categories of personal information with other parties where a transfer of the business takes place. Usually, information will be anonymised or pseudonymised, but this may not always be possible. The recipient of the information will be bound by confidentiality obligations and legally binding data sharing agreements.
Information may be retained at our offices and those of our service providers, representatives and agents as described above.
Some of the personal information you provide to us may be transferred to countries outside of the UK, or the EU/EEA. Where this occurs, we will make restricted transfer under UK “adequacy regulations” to protect individuals rights and freedoms for their personal data.
Where the UK has no “adequacy regulations” then the restricted transfer will be subject to appropriate safeguards whereby standard contractual clauses have been entered into with the organisation receiving the data.
Under the UK GDPR you have a number of rights which allow you to:
Your right of access - You have the right to ask us for copies of your personal data, however there are some exemptions which means you may not receive all the information you ask for.
Your right to rectification - You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure - You have the right to ask us to erase your personal data in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal data in certain circumstances.
Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.
Your right to data portability - You have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent.
If you make a request, we have one calendar month to respond to you. If a request is deemed to be complex or a number of requests have been received from an individual, the response time may be extended by up to 2 months.
We will always seek to comply with your request however we may be required to hold or use your information to comply with legal duties.
You can also withdraw your consent and opt-out from direct marketing by using the unsubscribe link at the bottom of our marketing emails.
Suppression lists will be maintained to screen against direct marketing information being sent to people who have already exercised their right to object to direct marketing. These lists will be held for compliance purposes only, and this does not affect your rights to be erased.
Please note: your request may delay or prevent us delivering a service to you.
For further information about your rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioners Office (ICO) on individuals’ rights under the UK General Data Protection Regulation https://ico.org.uk/
If you would like to exercise a right or make a complaint about how your personal data is handled by Impact Student Partners, please contact our DPO via email at dpo@csltd.org.uk or write to Data Protection Officer, Commercial Services Group, 1 Abbey Wood Road, Kings Hill, West Malling, ME19 4YT.
We have appropriate security measures in place to prevent personal information from being accidentally lost, used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and the ICO as regulator of any suspected data security breach where we are legally required to do so.
If you have any questions, suggestions or complaints about the processing of your personal information, or you wish to exercise any of your rights please contact our Data Protection Officer (DPO) via email at DPO@csltd.org.uk or in writing by using the address below;
Data Protection Officer
Commercial Services Group
1 Abbey Wood Road
Kings Hill
West Malling
ME19 4YT.
The UK General Data Protection Regulation also gives you right to lodge a complaint with a supervisory authority. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk or telephone 0303 123 1113.
We reserve the right to update this Privacy Notice at any time, and we will provide you with a new Privacy Notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.