Reaseheath College Privacy Notice for Students
How we use Personal Information
Reaseheath College is committed to data security and the fair and transparent processing of personal data. This privacy notice sets out how we will treat the personal data which you provide to us in compliance with applicable data protection law, in particular the General Data Protection Regulation (EU) 2016/679 (GDPR).
Please read this Privacy Notice carefully as it contains important information on who we are, how and why we collect, store, use and share personal information, your rights in relation to your personal information, how to contact us and supervisory authorities in the event that you would like to report a concern about the way in which we process your data.
This page provides information about the use of personal information provided by students of Reaseheath College (http://www.reaseheath.ac.uk/) and the University Centre Reaseheath (https://www.ucreaseheath.ac.uk) whilst they are enrolled students.
During this process you will be asked to tell us personal information about yourself (e.g. name and email address etc) in order to maintain our students records, for you to use College systems and services and so on. At the point of collecting the information we aim to clearly explain what it is going to be used for and who we may share it with. Unless required or permitted by law, we will always ask you before we use it for any other reason.
Who are we?
Reaseheath College is one of the leading specialist land-based colleges in the UK. The Corporation was established under the Further and Higher Education Act 1992 and is an exempt charity for the purposes of the Charities Act 2011. We are registered with Ofsted, with our registered address being: Reaseheath College, Reaseheath, Nantwich, CW5 6DF
In relation to our processing of data and for the purposes of the GDPR, Reaseheath College is the ‘Data controller’ of the personal information you provide us in relation to your employment and performance as a member of staff at Reaseheath College
Reaseheath College is the Data Controller for all information collected and is registered with the ICO, Registration Number: Z7450714.
What is ‘personal information’?
‘Personal information’ means any information which relates to or identifies you as an individual.
What personal information will be processed?
The College will keep a record of the details you provided on your application form, any supporting documents requested as part of your admission and additional details provided by any referees and recorded following any interview process.
We will also maintain records about your studies at Reaseheath College, University Centre Reaseheath or DART Apprenticeships, and about your use of the academic and non-academic facilities and services that we offer.
This personal information will include data such as your name, home address, date of birth, photograph, course studied, fee payments, and information about your examinations, assessments and results.
Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats.
Access to your personal information is limited to Reaseheath College, University Centre Reaseheath, or DART staff who have a legitimate interest in it for the purpose of carrying out their contractual duties, and our use of your personal information will not be excessive.
In addition to this, we may process some information about you that is classed as ‘sensitive’ or ‘special category’ personal data, and which requires additional protections. This includes information concerning your ethnicity, sexual orientation, religious beliefs or health/disability that we use for planning and monitoring purposes, or in order to provide care, help or suitable adjustments.
Access to, and the sharing of, your ‘sensitive’ personal data are controlled very carefully. You will normally be given further details about our use of any such data when we collect it from you.
What is the purpose and legal basis of the processing?
The College, University Centre and DART will process your personal information for a range of contractual, statutory or public interest purpose, including the following
- To deliver and administer your education, record the details of your studies (including any placements with external organisations), and determine/confirm your academic achievements. This will include keeping records of your image/photograph on our internal college records system and as part of your course management, putting together class lists, putting together reports and registers and to be able to tell other colleges your attendance dates if you leave.
- To administer exams and assessments, to allocate you to the correct classes for assessments, to make arrangements for exams or visits, to consider whether special provision or assistance is required for exams and visits.
- To administer the admissions/applications process – for sending event invitations, to check entrance exam results, to arrange interviews, for communicating with you to consider whether to offer places.
- Where relevant, to monitor, evaluate and support your research activity.
- To administer the financial aspects of your relationship with us and any funders.
- To deliver facilities to you (e.g. IT, sport, libraries, accommodation, careers).
- To enable your participation at events (e.g. functions, graduation).
- To communicate effectively with you by post, email and phone, including the distribution of relevant newsletters and circulars.
- To operate security (including CCTV), governance, disciplinary (including plagiarism and academic misconduct), complaint, audit and quality assurance processes and arrangements.
- To support your training, medical, safety, welfare and religious requirements.
- To compile statistics and conduct research for internal and statutory reporting purposes.
- To fulfil and monitor our responsibilities under equalities, immigration and public safety legislation.
- To enable us to contact others in the event of an emergency (we will assume that you have checked with the individuals before you supply their contact details to us).
- To help us to make reasonable adjustments for any disability, as requested by you.
- To provide statutory returns required by applicable legislation.
You may be contacted and asked to complete one or more surveys into the outcomes of your education and your activities after your course has finished. These surveys are used to create statistics to meet the public interest in the outcomes of education. . The surveys may be undertaken by us or by an organisation contracted for that purpose. We will hold your contact details after you leave us in order for you to be contacted to complete an outcomes survey
We consider the processing of your personal information for the above purposes to be either necessary for us to take steps with a view to creating a contractual relationship with you (e.g. to assess your application to study with us) and as part of or necessary for compliance with a legal obligation (e.g. equal opportunities monitoring), or necessary for the performance of tasks we carry out in the public interest task of providing education to you.
Where that information is special category personal information (e.g. medical information) we will process it because there is a substantial public interest for us to do so.
If we require your consent for any specific use of your personal information, we will collect it at the appropriate time and you can withdraw this at any time.
Whilst you are studying at the College, University Centre or DART then we may send you information about the other courses we provide that you may wish to progress onto, this is on the basis of our legitimate business interests. In doing so, we will comply with the requirements of the “soft opt in” and offer you an opportunity to refuse marketing when your details are first collected and in subsequent messages (by way of own unsubscribe).
Any other marketing we carry out will be on the basis of consent.
Who will my personal information be shared with?
As described above, your personal information is shared with relevant College, University Centre or DART staff as required.
In addition, it is shared as permitted or required by law, on a considered and confidential basis, with a range of external organisations, including the following:
- Educational Government Bodies including the Education and Skills Funding Agency and the Department for Education. The ESFA is responsible for funding education and skills in England for children, young people and adults. It is also responsible for delivery of key services in the education and skills sector in England including the apprenticeship service, the provision of information, advice and guidance through the National Careers Service, and the Learning Records Service. This information is used by these government departments to meet their statutory responsibilities and to create and maintain the unique learner number (ULN) and personal learning record (PLR). You can find the ESFA’s Privacy notice at ESFA privacy notice – GOV.UK (www.gov.uk)
- Office for Students (See OFS’s statement about the uses made by them of your personal information published at https://www.officeforstudents.org.uk/ofs-privacy/privacy-notice
- The information you provide may also be shared with other organisations for education, training, employment and well-being related purposes, including for research.
- Where relevant and as required and/or notified to you, your school/college, training organisation or employer.
- Where relevant and as required and/or notified to you, your parent/guardian.
- Your examination boards or awarding bodies.
- Your student support assessment body.
- Your funders and/or potential funders. (Student Loans etc).
- The providers of any external/collaborative learning and training placements or fieldwork opportunities.
- In the case of international applicants, the British Council or appropriate agencies.
- Where relevant and as required, UK Visas and Immigration in order to act as your sponsor for visa purposes.
- Where relevant and as required, governmental bodies including local authorities, the Home Office, and the Department for Work and Pensions and its agencies.
- Other Further and Higher Education organisations, in order to assist with tracking and research into access to Further Education and Higher Education. (e.g. Higher Education Funding Council for England, Office for Students, UK Research and Innovation, Universities and Colleges Admissions Service, Office for Fair Access, Office of the Independent Adjudicator, the organisation(s) running the National Student Survey and other student and leaver surveys).
- In relation to EDEN students, relevant third parties including NSAFD, End Point Assessment Organisations or End Point Assessors.
- Your contact and core personal details are passed to the Development and Alumni Relations office while you are still a student so that you can be added to the alumni database. You will receive more details about Alumni activities at the appropriate time.
- Companies or organisations providing specific services to, or on behalf of, the University and/or one or more Colleges.
- For the purpose of managing student surveys, SurveyMonkey.
- The Student Association and student clubs and societies, in order to facilitate your membership of those bodies.
- On occasion and where necessary, the police and other law enforcement agencies.
Service Providers: For security, service operation and management purposes, Reaseheath College also uses third-party services for its managed IT Services. We ensure that these providers provide the same level of protection as Reaseheath College. Third-party vendors and providers supply the necessary software, networking and storage to the IT Systems. These third parties have access to your Personal Information only for purposes of performing these tasks on our behalf.
We ensure there is a contract in place with the categories of recipients listed above which include obligations in relation to the confidentiality, security, and lawful processing of any personal data shared with them.
No sensitive personal information will be supplied to anyone outside the College without first obtaining your consent, unless required or permitted by law.
How we transfer your personal Information outside Europe
On occasion, the above types of sharing may involve the transfer of your personal information outside the European Economic Area (e.g. to facilitate your participation in an exchange visit or to report to an overseas funding provider). Such transfers usually are necessary in order to meet our contractual obligations with you, and are carried out with appropriate safeguards in place to ensure the confidentiality and security of your personal information.
Other than as set out above, we will not normally publish or disclose any personal information about you to other external enquirers or organisations unless you have requested it or consented to it, or unless it is in your vital interests to do so (e.g. in an emergency situation).
The College uses SurveyMonkey to complete some surveys and this can potentially transfer your Data out of the EU to storage areas in the United States. Survey Monkey are members of the Privacy Shield Framework which has been approved for Data Transfers by the EU.
You can find out more about Privacy Shield here https://www.privacyshield.gov/welcome
How long is my information kept?
We will always retain your personal information in accordance with law and regulation and never retain your information for longer than is necessary.
We store your personal information as part of your student record for the duration of your studies (and it may be used as part of our assessment of any future application you make for further studies at Reaseheath, University Centre Reaseheath or DART). It is then kept for a further 6 years after graduation or departure.
Your Data Processing Rights
These rights apply to all data subjects, including our clients, suppliers and any third-party individual we may collect data about.
Where we process data, we understand that you have certain rights listed as follows:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
- Right to be informed
Where you provide your personal data directly to us, we will communicate our Privacy Notice to you at the earliest opportunity or as soon as is reasonably practicable. We will usually do this at the first point we correspond with each other.
- Right of access
If you wish to receive a copy of personally identifiable data we store about you, this can be made available on request. To do this, please email firstname.lastname@example.org and title your email ‘Data Subject Access Request’, including your name and contact details and your reason for requesting a copy of the data we store about you.
To ensure we are sending your personal data to you, we may need to contact you to verify your identity. Once we have verified your identity, we will supply you with a digital record of all your personal data as soon as we can, but in any event, it will be within thirty days.
We will not charge you for supplying copies of your personal data in the first instance. However, in the event we find data subject access requests to be manifestly unfounded or excessive, particularly where repetitive, we will need to consider the effort required to handle such requests and charge a reasonable administrative fee.
- Right to rectification
Where you feel the personal data, we hold about you is inaccurate or incomplete, you have the right to advise us, and we will rectify such data following your instructions. Please email email@example.com and title your email ‘Data Rectification Request’. We will endeavour to action your request as soon as is reasonably practicable after that.
- Right to erasure
If you no longer want us to process your personal data, we can remove your personally identifiable data from our databases on request. To do this, please email firstname.lastname@example.org and title your email ‘Data Erasure Request’, including your name, telephone number and the reason why you no longer want us to process your data.
For security reasons, we may need to contact you to verify your identity. Once we have verified your identity, we will aim to erase all related personal identifiable data as soon as we can. We will aim to action your request within two working days, though we will contact you to let you know once completed.
Please note we will need to store some basic information including your full name and basic contact details which may include your email address or your telephone number. This is to ensure we do not duplicate process and we have a sufficient record to ensure we do not unnecessarily contact you or further process your personal data. Should you change your mind or require our services at a later date, simply let us know.
- Right to restrict processing
If at any point you object to us using your data in a particular way you have the right to suppress or block us processing your data.
This may be due to you having some concerns over the accuracy of the data or our use of it, or where it is no longer needed for its original purpose but it may be needed to create, exercise or defend legal claims.
You can exercise this right at any time, please email email@example.com and title your email ‘Data Restriction Request’, including your name and contact details, the reason for your request and how you want us to restrict the processing of your data. We will attempt to action your request as soon as is reasonably practicable.
- Right to data portability
Where you have provided your data directly to us, and it is processed by automated means, you have the right to receive personal data back from us in a structured, machine-readable format, and where you request (and if possible), we will transmit your personal data to another data controller. We will always try to facilitate such request where it is technically feasible to do so.
Please note this right is only applicable where the processing is based on the individual’s consent or for the performance of a contract.
Should you wish to exercise this right at any time, please email firstname.lastname@example.org and title your email ‘Data Portability Request’, including your name and contact details, and the reason for your request. Where possible, we will attempt to action your request as soon as is reasonably practicable to do so.
- Right to object
In the event, you object to our processing of your data where we have identified that such processing is based upon legitimate interest and you believe there are no grounds for us to continue to process your data, then you have the right to object.
Should you wish to exercise this right at any time, please email email@example.com and title your email ‘Data Objection Request’, including your name and contact details, and the reason for your request. We will attempt to action your request as soon as is reasonably practicable to do so.
- Rights in relation to automated decision making and profiling
We do not make automated decisions using this personal data.
If you have any questions about how your personal information is used please consult the College’s data protection webpages at www.reaseheath.ac.uk/data-protection.
The Data Protection Officer is the Chief Financial Officer and Director of Resources: Graeme Lavery
The Data Protection Officer
If you are not happy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF (https://ico.org.uk/).