Reaseheath College Privacy Notice for Student Applicants
How we use Personal Information
Reaseheath College is committed to data security and the fair and transparent processing of personal data. This privacy notice sets out how we will treat the personal data which you provide to us in compliance with applicable data protection law, in particular the Data Protection Act 2018 and the UK General Data Protection Regulation (the “GDPR”), together with other UK data protection laws
Please read this Privacy Notice carefully as it contains important information on who we are, how and why we collect, store, use and share personal information, your rights in relation to your personal information, how to contact us and supervisory authorities in the event that you would like to report a concern about the way in which we process your data.
This page provides information about the use of personal information provided by prospective students of Reaseheath College (http://www.reaseheath.ac.uk/) and the University Centre Reaseheath (https://www.ucreaseheath.ac.uk) during the Application and Enquiries process.
During this process you will be asked to tell us personal information about yourself (e.g. name and email address etc) in order to become a student or a client, to use College systems and services and so on. At the point of collecting the information we aim to clearly explain what it is going to be used for and who we may share it with. Unless required or permitted by law, we will always ask you before we use it for any other reason.
Who are we?
Reaseheath College is one of the leading specialist land-based colleges in the UK. The Corporation was established under the Further and Higher Education Act 1992 and is an exempt charity for the purposes of the Charities Act 2011. We are registered with Ofsted, with our registered address being: Reaseheath College, Reaseheath, Nantwich, CW5 6DF.
In relation to our processing of data and for the purposes of this document, Reaseheath College is the ‘Data controller’ of the personal information you provide us in relation to the recruitment process at Reaseheath College. However, in some instance’s other authorities/agents/regulatory bodies (such as the local authorities and the Education and Skills Funding Agency) will act as data controllers in their own right, for your personal information. Whether we are acting as a data controller, processor or joint controller, we are responsible for ensuring your data is handled in a secure way, and we have included in this document all of the privacy information that you should be aware of.
Reaseheath College is registered with the ICO, Registration Number: Z7450714.
What is ‘personal information’?
‘Personal information’ means any information which relates to or identifies you as an individual.
There are special categories of more sensitive personal data which require a higher level of protection, such as, race, ethnicity, religious or philosophical beliefs, health, sexual orientation, etc.
What personal information will be processed?
The College will keep a record of the details you provided on any enquiry and application forms, UCAS forms, any supporting documents and forms (Bursary, Accommodation forms etc) and additional details provided by any external sources, such as schools and other supporting agencies and any records following any interview process.
Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats, including some databases. Access to your personal information is limited to staff who have a legitimate interest in it for the purpose of carrying out their contractual duties, and our use of your personal information will not be excessive.
In addition to this, the College may process some information about you that is classed as ‘sensitive’ or ‘special category’ personal data, and which requires additional protections. This includes information concerning your ethnicity, sexual orientation, religious beliefs or health/disability for planning and monitoring purposes, or in order to provide care, help or suitable adjustments.
What is the purpose and legal basis of the processing?
The College and University Centre will process the personal information provided on your enquiry and application forms and the other information referred to above for the purposes of identifying you, inviting you to events, processing your application, verifying the information provided, deciding whether to offer you a place for the course you have applied for, and communicating that outcome (together with any feedback).
We may also use or disclose the information provided for the following statutory or public interest purposes:
- To prevent or detect fraud.
- For equal opportunities monitoring.
- To help us to make reasonable adjustments for any disability, as requested by you.
- To allow us to consider any future accommodation requirements.
- To provide statutory returns required by applicable legislation.
- For research and statistical purposes, but no information which could identify you will be published.
We consider the processing of your personal information for the above purposes to be either necessary for us to take steps with a view to creating a contractual relationship with you (e.g. to assess your application to study with us, to deliver and administer your education), or necessary for compliance with a legal obligation (e.g. equal opportunities monitoring), or necessary for the performance of tasks we carry out in the public interest task of providing education to you.
Where details of parents, guardians and next of kin are processed, this is to enable us to contact you in relation to your child’s participation in our courses. Our lawful basis for these activities is that the processing is necessary for the performance of a task (education) carried out in the public interest.
Where that information is special category personal information (e.g. medical information) we will process it because there is a substantial public interest for us to do so. This is to provide relevant supports and safeguarding during your time as a student.
We require you to provide us with the information we ask for during the application process in order to assess your application properly except where its supply is marked as optional.
If you fail to provide certain information when requested, we may not be able to provide you access to our programmes, or we may be prevented from complying with our legal obligations (such as equal opportunities monitoring).
Where you have previously studied at the College or commenced an application process with us before, then we will send you information about the courses we provide on the basis of our legitimate business interests. In doing so, we will comply with the requirements of the “soft opt in” and offer you an opportunity to refuse marketing when your details are first collected and in subsequent messages (by way of own unsubscribe).
Any other marketing we carry out would normally be on the basis of consent.
Who will my personal information be shared with?
As well as circulating your application and related materials to the appropriate staff, we will share your personal information for the above purposes as relevant and necessary with:
- Educational Government Bodies including the Education and Skills Funding Agency and the Department for Education. The ESFA is responsible for funding education and skills in England for children, young people and adults. It is also responsible for delivery of key services in the education and skills sector in England including the apprenticeship service, the provision of information, advice and guidance through the National Careers Service, and the Learning Records Service. This information is used by these government departments to meet their statutory responsibilities and to create and maintain the unique learner number (ULN) and personal learning record (PLR). You can find the ESFA’s Privacy notice at ESFA privacy notice – GOV.UK (www.gov.uk)
- The information you provide may also be shared with other organisations for education, training, employment and well-being related purposes, including for research.
- Your referees.
- Where relevant and as required and/or notified to you, your school/college, training organisation or employer.
- Where relevant and as required and/or notified to you, your parent/guardian.
- Your examination boards or awarding bodies.
- Your student support assessment body.
- Your funders and/or potential funders.
- In the case of international applicants, the British Council or appropriate agencies.
- Where relevant and as required, UK Visas and Immigration in order to act as your sponsor for visa purposes.
- Where relevant and as required, governmental bodies including local authorities, the Home Office, and the Department for Work and Pensions and its agencies.
- Other Further and Higher Education organisations, in order to assist with tracking and research into access to Further Education and Higher Education.
- Companies or organisations providing specific services to, or on behalf of, the University and/or one or more Colleges.
- For the purposes of event management, Eventbrite
- For the purpose of managing student enquiries and applications SalesForce, SurveyMonkey and MailChimp.
Service Providers: For security, service operation and management purposes, Reaseheath College also uses third-party services for its managed IT Services. We ensure that these providers provide the same level of protection as Reaseheath College. Third-party vendors and providers supply the necessary software, networking and storage to the IT Systems. These third parties have access to your Personal Information only for purposes of performing these tasks on our behalf.
We ensure there is a contract in place with the categories of recipients listed above which include obligations in relation to the confidentiality, security, and lawful processing of any personal data shared with them.
All parties who we share data with are required to take appropriate security measures to protect your personal information, in line with our policies. We do not allow our third-party partners / service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
We may sometimes be obliged to disclose your personal information by law, such as by a regulator with appropriate power, or to otherwise comply with the law. In addition, information held by or for public bodies can be subject to freedom of information requests, however any information disclosed would not breach your privacy rights.
Where we potentially transfer data outside of the UK, these transfers will be covered either by an appropriate Adequacy Decision or a Data Processing Addendum with appropriate Standard Contractual Clauses (SCC’s).
How long is my information kept?
We will always retain your personal information in accordance with law and regulation and never retain your information for longer than is necessary.
If you are unsuccessful, your information will be normally kept for one year after the completion of the application process.
Your Data Processing Rights
These rights apply to all data subjects, including our clients, suppliers and any third-party individual we may collect data about.
Where we process data, we understand that you have certain rights listed as follows:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
- Right to be informed
Where you provide your personal data directly to us, we will communicate our Privacy Notice to you at the earliest opportunity or as soon as is reasonably practicable. We will usually do this at the first point we correspond with each other.
- Right of access
If you wish to receive a copy of personally identifiable data we store about you, this can be made available on request. To do this, please email firstname.lastname@example.org and title your email ‘Data Subject Access Request’, including your name and contact details and your reason for requesting a copy of the data we store about you. To ensure we are sending your personal data to you, we may need to contact you to verify your identity. Once we have verified your identity, we will supply you with a digital record of all your personal data as soon as we can, but in any event, it will be within thirty days.
We will not charge you for supplying copies of your personal data in the first instance. However, in the event we find data subject access requests to be manifestly unfounded or excessive, particularly where repetitive, we will need to consider the effort required to handle such requests and charge a reasonable administrative fee.
- Right to rectification
Where you feel the personal data, we hold about you is inaccurate or incomplete, you have the right to advise us, and we will rectify such data following your instructions. Please email email@example.com and title your email ‘Data Rectification Request’. We will endeavour to action your request as soon as is reasonably practicable after that.
- Right to erasure
If you no longer want us to process your personal data, we can remove your personally identifiable data from our databases on request. To do this, please email firstname.lastname@example.org and title your email ‘Data Erasure Request’, including your name, telephone number and the reason why you no longer want us to process your data. For security reasons, we may need to contact you to verify your identity. Once we have verified your identity, we will aim to erase all related personal identifiable data as soon as we can. We will aim to action your request within two working days, though we will contact you to let you know once completed.
Please note we will need to store some basic information including your full name and basic contact details which may include your email address or your telephone number. This is to ensure we do not duplicate process and we have a sufficient record to ensure we do not unnecessarily contact you or further process your personal data. Should you change your mind or require our services at a later date, simply let us know.
- Right to restrict processing
If at any point you object to us using your data in a particular way you have the right to suppress or block us processing your data.
For example, if you do not want us to use your data for marketing purposes simply let us know, or please ensure (where applicable) the form you submit to us does not have the ‘marketing’ sign-up option checked.
Please note we will not check the box on your behalf unless you ask us to do so. Please ensure you provide your express permission and check the relevant box manually if you wish to sign up to our marketing lists. If you wish to change your email marketing preference once you have signed up, you can simply unsubscribe where you will have the option to do so in related emails, or if you contact us, we can do this for you.
You can exercise this right at any time, please email email@example.com and title your email ‘Data Restriction Request’, including your name and contact details, the reason for your request and how you want us to restrict the processing of your data. We will attempt to action your request as soon as is reasonably practicable.
- Right to data portability
Where you have provided your data directly to us, and it is processed by automated means, you have the right to receive personal data back from us in a structured, machine-readable format, and where you request (and if possible), we will transmit your personal data to another data controller. We will always try to facilitate such request where it is technically feasible to do so.
Please note this right is only applicable where the processing is based on the individual’s consent or for the performance of a contract.
Should you wish to exercise this right at any time, please email firstname.lastname@example.org and title your email ‘Data Portability Request’, including your name and contact details, and the reason for your request. Where possible, we will attempt to action your request as soon as is reasonably practicable to do so.
- Right to object
In the event, you object to our processing of your data where we have identified that such processing is based upon legitimate interest and you believe there are no grounds for us to continue to process your data, then you have the right to object.
Should you wish to exercise this right at any time, please email email@example.com and title your email ‘Data Objection Request’, including your name and contact details, and the reason for your request. We will attempt to action your request as soon as is reasonably practicable to do so.
- Rights in relation to automated decision making and profiling
We do not make automated decisions using this personal data.
Please be aware that these rights are subject to certain conditions and exceptions, as set out in UK data protection law.
- Photography and Videography
From time to time, photographs and videos are taken on and off campus as part of college life and for marketing, educational and promotional purposes. These images could be used in print and digital media formats including, print publications, websites, e-marketing, poster banners, advertising, film, social media, and for teaching and research purposes, etc. We do this to help showcase the work we do as an education provider and to support what our students are achieving.
When using images or recordings of people where individuals feature prominently and are clearly identifiable, a Consent Declaration must be signed. The consent form will be stored alongside the images for as long as the image/recording is retained.
We will not keep images/recordings for longer than necessary and they will not be used other than for their original purpose. You may withdraw your consent at any time and all images will be removed from the College drive immediately, however, withdrawal of consent will only affect further processing and any published material will not be recalled.
Please note, any images used on websites can be viewed throughout the world and not just in the United Kingdom, and some overseas countries may not provide the same level of protection to the rights of individuals as the EU/UK legislation provides.
When is a consent form not necessary?
A consent form is not necessary when there is a large group of people with no one standing out e.g. at an event. We will notify those in attendance that photography or filming will be taking place either verbally, or with clear and visible signage, and those who do not wish to be in a photograph or recording can opt out by contacting any member of college staff.
More information on how we use your images can be obtained from the marketing department (add email link is possible)
Our CCTV system is owned and managed by the College. Under the Data Protection Act, we are the ‘data controller’ for the images produced by the CCTV system. The CCTV systems are compliant with the requirements of the Data Protection Act. Signs are placed around campuses in order to inform staff, students, visitors, and members of the public that CCTV is in operation.
The principal purposes of the College’s CCTV system are as follows: crime prevention, campus security, health and safety – to assist in the investigation of suspected breaches of College regulations by staff, students or the general public. The College seeks to operate its CCTV system in a manner that is consistent with respect for the individual’s privacy.
Cameras are not monitored, unless responding to an incident identified on campus, and all recorded materials are kept in secure areas. The cameras installed provide images that may be of suitable quality for the specified purposes for which they are installed, the images are retained for no longer than 7-31 days from the date of recording. All images recorded by the CCTV System remain the property of the College. The monitoring, viewing of, recording of staff/student activities will be carried out in accordance with our CCTV Policy.
The Reaseheath Group CCTV Policy is available on request.
If you have any questions about how your personal information is used please consult the College’s data protection webpages at www.reaseheath.ac.uk/data-protection.
The Data Protection Officer is the Chief Financial Officer and Director of Resources: Graeme Lavery
The Data Protection Officer
If you are not happy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF (https://ico.org.uk/).