Who we are

This service is run by the Education and Skills Funding Agency (ESFA), which is a part of the Department for Education (DfE). For the purpose of data protection legislation, the DfE is the data controller for the personal data processed as part of this service.

How we will use your information

When you register on the service, the personal information you give us will be used:

  • so you can sign ESFA contracts, agreements and funding claims
  • to view who signed ESFA documents on behalf of your organisation
  • for administration and research purposes

If you have any questions or concerns about the handling or use of data in this application please contact

More information on how the ESFA uses your data is available from

The nature of your personal data we will be using

The categories of your personal data that we will be using for this service are: your name and your work email address.

Why our use of your personal data is lawful

In order for our use of your personal data to be lawful, we need to meet one (or more) conditions in the data protection legislation. For the purpose of this service the processing is necessary for the performance of a task carried out in the public interest. In this case it is necessary for the department to process your data to assess your eligibility for funding.

Who we will make your personal data available to

We sometimes need to make personal data available to other organisations. These might include contracted partners (who we have employed to process your personal data on our behalf) and/or other organisations (with whom we need to share your personal data for specific purposes).

Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. We share the names of contract signatories and users who have reviewed contract documents with other members of your organisation who are also users of the service.

How long we will keep your personal data

We will only keep your personal data for as long as we need it for the purpose(s) of this service, after which point it will be securely destroyed. This will usually be 7 years after the end of each contract.

If you haven’t signed in for 366 days, we’ll delete your account and remove your personal details. You’ll need to register again to use the service.

Please note that, under Data Protection Legislation and in compliance with the relevant data processing conditions, we can lawfully keep personal data processed purely for research and statistical purposes indefinitely.

Your data protection rights

You have the right:

  • to ask us for access to information about you that we hold
  • to have your personal data rectified, if it is inaccurate or incomplete
  • to request the deletion or removal of personal data where there is no compelling reason for its continued processing
  • to restrict our processing of your personal data (i.e. permitting its storage but no further processing)
  • to object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
  • not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you

If you need to contact us regarding any of the above, please do so via the DfE site at

Further information about your data protection rights appears on the Information Commissioner’s website at

The right to lodge a complaint

If you are unhappy with our use of your personal data, you have the right to raise any concerns with the Information Commissioner’s Office (ICO) via their website at

Last updated

We may need to update this privacy notice periodically so we recommend that you revisit this information from time to time. This version was last updated in May 2018.

Further information

Further information about the ESFA can be found at


This service puts small files (known as ‘cookies’) on to your computer. Most websites do this. These cookies are used to:

  • help us understand how you use the service, so we can improve it
  • remember what notifications you’ve seen so you’re not shown them again
  • temporarily store the information you enter (eg, your postcode)

The cookies aren’t used to identify you personally. They’re put on to your computer to make the service work better for you. You can edit or delete the cookies.

Find out how to edit and delete cookies.

Session cookies

We store session cookies on your computer to help keep your information secure while you use the service.

Name Purpose Expires
User.Auth Stores encrypted information that is used by the server to identify the signed in user. 2 hours
User.Context Stores the email address and full name of a signed in user. Session
__RequestVerificationToken This is an anti-forgery token and is used to prevent cross-site request forgery (CSRF) attacks. It prevents others from forging your website links. Session

Our introductory message

You may see a pop-up welcome message when you first visit GOV.UK. We’ll store a cookie so that your computer knows you’ve seen it and knows not to show it again.

Name Purpose Expires
seen_cookie_message Saves a message to let us know that you’ve seen our cookie message 1 month

Google Analytics

We use Google Analytics software to collect information about how you use ESFA sites. We do this to help make sure our sites are meeting the needs of their users and to help us make improvements.

Google Analytics stores information about:

  • how you got to our sites
  • the pages you visit on ESFA sites
  • how long you spend on each ESFA page
  • what you click on while you’re visiting our sites

We don’t collect or store your personal information (for example your name or address) so this information can’t be used to identify who you are.

We don’t allow Google to use or share our analytics data.

You can opt out of Google Analytics cookies.

Universal Analytics

Name Purpose Expires
_ga This helps us count how many people visit ESFA sites by tracking if you’ve visited before 2 years
_gat Used to manage the rate at which page view requests are made 10 minutes