Introduction
Reaseheath College is committed to data security and the fair and transparent processing of personal data. This privacy notice sets out how we will treat the personal data which you provide to us in compliance with applicable data protection law, in particular the Data Protection Act 2018 and the UK General Data Protection Regulation (the “GDPR”), together with other UK data protection laws
Please read this Privacy Notice carefully as it contains important information on who we are, how and why we collect, store, use and share personal information, your rights in relation to your personal information, how to contact us and supervisory authorities in the event that you would like to report a concern about the way in which we process your data.
This page provides information about the use of personal information provided by prospective students of Reaseheath College (http://www.reaseheath.ac.uk/) and the University Centre Reaseheath (https://www.ucreaseheath.ac.uk) during the Application and Enquiries process.
During this process you will be asked to tell us personal information about yourself (e.g. name and email address etc) in order to become a student or a client, to use College systems and services and so on. At the point of collecting the information we aim to clearly explain what it is going to be used for and who we may share it with. Unless required or permitted by law, we will always ask you before we use it for any other reason.
Who are we?
Reaseheath College is one of the leading specialist land-based colleges in the UK. The Corporation was established under the Further and Higher Education Act 1992 and is an exempt charity for the purposes of the Charities Act 2011. We are registered with Ofsted, with our registered address being: Reaseheath College, Reaseheath, Nantwich, CW5 6DF.
In relation to our processing of data and for the purposes of this document, Reaseheath College is the ‘Data controller’ of the personal information you provide us in relation to the recruitment process at Reaseheath College. However, in some instance’s other authorities/agents/regulatory bodies (such as the local authorities and the Education and Skills Funding Agency) will act as data controllers in their own right, for your personal information. Whether we are acting as a data controller, processor or joint controller, we are responsible for ensuring your data is handled in a secure way, and we have included in this document all of the privacy information that you should be aware of.
Reaseheath College is registered with the ICO, Registration Number: Z7450714.
What is ‘personal information’?
‘Personal information’ means any information which relates to or identifies you as an individual.
There are special categories of more sensitive personal data which require a higher level of protection, such as, race, ethnicity, religious or philosophical beliefs, health, sexual orientation, etc.
What personal information will be processed?
The College will keep a record of the details you provided on any enquiry and application forms, UCAS forms, any supporting documents and forms (Bursary, Accommodation forms etc) and additional details provided by any external sources, such as schools and other supporting agencies and any records following any interview process.
We will also maintain records about your studies at Reaseheath College and University Centre Reaseheath, and about your use of the academic and non-academic facilities and services that we offer.
This personal information will include data such as your name, home address, date of birth, photograph, course studied, fee payments, and information about your examinations, assessments and results.
Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats, including some databases. Access to your personal information is limited to staff who have a legitimate interest in it for the purpose of carrying out their contractual duties, and our use of your personal information will not be excessive.
In addition to this, the College may process some information about you that is classed as ‘sensitive’ or ‘special category’ personal data, and which requires additional protections. This includes information concerning your ethnicity, sexual orientation, religious beliefs or health/disability for planning and monitoring purposes, or in order to provide care, help or suitable adjustments.
Access to, and the sharing of, your ‘sensitive’ personal data are controlled very carefully. You will normally be given further details about our use of any such data when we collect it from you.
What is the purpose and legal basis of the processing?
The College and University Centre will process your personal information for a range of contractual, statutory or public interest purpose, including the following:
- To deliver and administer your education, record the details of your studies (including any placements with external organisations), and determine/confirm your academic achievements. This will include keeping records of your image/photograph on our internal college records system and as part of your course management, putting together class lists, putting together reports and registers and to be able to tell other colleges your attendance dates if you leave.
- To administer exams and assessments, to allocate you to the correct classes for assessments, to make arrangements for exams or visits, to consider whether special provision or assistance is required for exams and visits.
- To administer the admissions/applications process – for sending event invitations, to check entrance exam results, to arrange interviews, for communicating with you to consider whether to offer places.
- Where relevant, to monitor, evaluate and support your research activity.
- To administer the financial aspects of your relationship with us and any funders.
- To deliver facilities to you (e.g. IT, sport, libraries, accommodation, careers).
- To enable your participation at events (e.g. functions, graduation).
- To communicate effectively with you by post, email and phone, including the distribution of relevant newsletters and circulars.
- To operate security (including CCTV), governance, disciplinary (including plagiarism and academic misconduct), complaint, audit and quality assurance processes and arrangements.
- To support your training, medical, safety, welfare and religious requirements.
- To compile statistics and conduct research for internal and statutory reporting purposes.
- To fulfil and monitor our responsibilities under equalities, immigration and public safety legislation. To enable us to contact others in the event of an emergency (we will assume that you have checked with the individuals before you supply their contact details to us).
- To help us to make reasonable adjustments for any disability, as requested by you.
- To provide statutory returns required by applicable legislation.
You may be contacted and asked to complete one or more surveys into the outcomes of your education and your activities after your course has finished. These surveys are used to create statistics to meet the public interest in the outcomes of education. The surveys may be undertaken by us or by an organisation contracted for that purpose. We will hold your contact details after you leave us in order for you to be contacted to complete an outcomes survey.
We consider the processing of your personal information for the above purposes to be either necessary for us to take steps with a view to creating a contractual relationship with you (e.g. to assess your application to study with us, to deliver and administer your education), or necessary for compliance with a legal obligation (e.g. equal opportunities monitoring), or necessary for the performance of tasks we carry out in the public interest task of providing education to you.
Where details of parents, guardians and next of kin are processed, this is to enable us to contact you in relation to your child’s participation in our courses. Our lawful basis for these activities is that the processing is necessary for the performance of a task (education) carried out in the public interest.
Where that information is special category personal information (e.g. medical information) we will process it because there is a substantial public interest for us to do so. This is to provide relevant supports and safeguarding during your time as a student.
If we require your consent for any specific use of your personal information, we will collect it at the appropriate time and you can withdraw this at any time.
Marketing
Whilst you are studying at the College or University Centre then we may send you information about the other courses we provide that you may wish to progress onto, this is on the basis of our legitimate business interests. In doing so, we will comply with the requirements of the “soft opt in” and offer you an opportunity to refuse marketing when your details are first collected and in subsequent messages (by way of own unsubscribe).
From time to time, we will take photos/videos on and off campus as part of college life, for marketing and promotional purposes. We rely on your consent to process this kind of data. More information on how we handle these images/videos is available below in the section Photography and Videography
Any other marketing we carry out would normally be on the basis of consent.
Emergencies
We may also use your personal information, typically in an emergency, where this is necessary to protect your vital interests, or someone else’s vital interests.
Who will my personal information be shared with?
As well as circulating your application and related materials to the appropriate staff, we will share your personal information for the above purposes as relevant and necessary with:
- Educational Government Bodies including the Education and Skills Funding Agency and the Department for Education. The ESFA is responsible for funding education and skills in England for children, young people and adults. It is also responsible for delivery of key services in the education and skills sector in England including the apprenticeship service, the provision of information, advice and guidance through the National Careers Service, and the Learning Records Service. This information is used by these government departments to meet their statutory responsibilities and to create and maintain the unique learner number (ULN) and personal learning record (PLR). You can find the ESFA’s Privacy notice at ESFA privacy notice – GOV.UK (www.gov.uk)
- The information you provide may also be shared with other organisations for education, training, employment and well-being related purposes, including for research.
- Your referees.
- Where relevant and as required and/or notified to you, your school/college, training organisation or employer.
- Where relevant and as required and/or notified to you, your parent/guardian.
- Your examination boards or awarding bodies.
- Your student support assessment body.
- Your funders and/or potential funders.
- In the case of international applicants, the British Council or appropriate agencies.
- Where relevant and as required, UK Visas and Immigration in order to act as your sponsor for visa purposes.
- Where relevant and as required, governmental bodies including local authorities, the Home Office, and the Department for Work and Pensions and its agencies.
- Other Further and Higher Education organisations, in order to assist with tracking and research into access to Further Education and Higher Education.
- Companies or organisations providing specific services to, or on behalf of, the University and/or one or more Colleges.
- For the purposes of event management, Eventbrite
- For the purpose of managing student enquiries and applications SalesForce, SurveyMonkey and MailChimp.
Service Providers: For security, service operation and management purposes, Reaseheath College also uses third-party services for its managed IT Services. We ensure that these providers provide the same level of protection as Reaseheath College. Third-party vendors and providers supply the necessary software, networking and storage to the IT Systems. These third parties have access to your Personal Information only for purposes of performing these tasks on our behalf.
We ensure there is a contract in place with the categories of recipients listed above which include obligations in relation to the confidentiality, security, and lawful processing of any personal data shared with them.
All parties who we share data with are required to take appropriate security measures to protect your personal information, in line with our policies. We do not allow our third-party partners / service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
We may sometimes be obliged to disclose your personal information by law, such as by a regulator with appropriate power, or to otherwise comply with the law. In addition, information held by or for public bodies can be subject to freedom of information requests, however any information disclosed would not breach your privacy rights.
Where we potentially transfer data outside of the UK, these transfers will be covered either by an appropriate Adequacy Decision or a Data Processing Addendum with appropriate Standard Contractual Clauses (SCC’s).
Social Media Platforms for sharing Personal data.
Reaseheath College and University Centre do not endorse the use of third-party communication tools, such as WhatsApp, Facebook Messenger, etc. for data sharing. As a data controller, we are unable to ensure the security of such platforms and therefore, all staff and students are advised not to use these platforms as a means of communication for college-related matters.
All colleagues and students are provided with a Microsoft 365 account, where the recommended platform, Microsoft Teams, can be used for instant messaging between all students and staff.
How long is my information kept?
We will always retain your personal information in accordance with law and regulation and never retain your information for longer than is necessary.
We store your personal information as part of your student record for the duration of your studies (and it may be used as part of our assessment of any future application you make for further studies at Reaseheath College or University Centre Reaseheath). It is then kept for a further 6 years after graduation or departure.
Your Data Processing Rights
These rights apply to all data subjects, including our clients, suppliers and any third-party individual we may collect data about.
Where we process data, we understand that you have certain rights listed as follows:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
- Right to be informed
Where you provide your personal data directly to us, we will communicate our Privacy Notice to you at the earliest opportunity or as soon as is reasonably practicable. We will usually do this at the first point we correspond with each other.
- Right of access
If you wish to receive a copy of personally identifiable data we store about you, this can be made available on request. To do this, please email dpo@reaseheath.ac.uk and title your email ‘Data Subject Access Request’, including your name and contact details and your reason for requesting a copy of the data we store about you. To ensure we are sending your personal data to you, we may need to contact you to verify your identity. Once we have verified your identity, we will supply you with a digital record of all your personal data as soon as we can, but in any event, it will be within thirty days.
We will not charge you for supplying copies of your personal data in the first instance. However, in the event we find data subject access requests to be manifestly unfounded or excessive, particularly where repetitive, we will need to consider the effort required to handle such requests and charge a reasonable administrative fee.
- Right to rectification
Where you feel the personal data, we hold about you is inaccurate or incomplete, you have the right to advise us, and we will rectify such data following your instructions. Please email dpo@reaseheath.ac.uk and title your email ‘Data Rectification Request’. We will endeavour to action your request as soon as is reasonably practicable after that.
- Right to erasure
If you no longer want us to process your personal data, we can remove your personally identifiable data from our databases on request. To do this, please email dpo@reaseheath.ac.uk and title your email ‘Data Erasure Request’, including your name, telephone number and the reason why you no longer want us to process your data. For security reasons, we may need to contact you to verify your identity. Once we have verified your identity, we will aim to erase all related personal identifiable data as soon as we can. We will aim to action your request within two working days, though we will contact you to let you know once completed.
Please note we will need to store some basic information including your full name and basic contact details which may include your email address or your telephone number. This is to ensure we do not duplicate process and we have a sufficient record to ensure we do not unnecessarily contact you or further process your personal data. Should you change your mind or require our services at a later date, simply let us know.
- Right to restrict processing
If at any point you object to us using your data in a particular way you have the right to suppress or block us processing your data.
For example, if you do not want us to use your data for marketing purposes simply let us know, or please ensure (where applicable) the form you submit to us does not have the ‘marketing’ sign-up option checked.
Please note we will not check the box on your behalf unless you ask us to do so. Please ensure you provide your express permission and check the relevant box manually if you wish to sign up to our marketing lists. If you wish to change your email marketing preference once you have signed up, you can simply unsubscribe where you will have the option to do so in related emails, or if you contact us, we can do this for you.
You can exercise this right at any time, please email dpo@reaseheath.ac.uk and title your email ‘Data Restriction Request’, including your name and contact details, the reason for your request and how you want us to restrict the processing of your data. We will attempt to action your request as soon as is reasonably practicable.
- Right to data portability
Where you have provided your data directly to us, and it is processed by automated means, you have the right to receive personal data back from us in a structured, machine-readable format, and where you request (and if possible), we will transmit your personal data to another data controller. We will always try to facilitate such request where it is technically feasible to do so.
Please note this right is only applicable where the processing is based on the individual’s consent or for the performance of a contract.
Should you wish to exercise this right at any time, please email dpo@reaseheath.ac.uk and title your email ‘Data Portability Request’, including your name and contact details, and the reason for your request. Where possible, we will attempt to action your request as soon as is reasonably practicable to do so.
- Right to object
In the event, you object to our processing of your data where we have identified that such processing is based upon legitimate interest and you believe there are no grounds for us to continue to process your data, then you have the right to object.
Should you wish to exercise this right at any time, please email dpo@reaseheath.ac.uk and title your email ‘Data Objection Request’, including your name and contact details, and the reason for your request. We will attempt to action your request as soon as is reasonably practicable to do so.
- Rights in relation to automated decision making and profiling
We do not make automated decisions using this personal data.
Please be aware that these rights are subject to certain conditions and exceptions, as set out in UK data protection law.
Photography and Videography
From time to time, photographs and videos are taken on and off campus as part of college life and for marketing, educational and promotional purposes. These images could be used in print and digital media formats including, print publications, websites, e-marketing, poster banners, advertising, film, social media, and for teaching and research purposes, etc. We do this to help showcase the work we do as an education provider and to support what our students are achieving.
When using images or recordings of people where individuals feature prominently and are clearly identifiable, a Consent Declaration must be signed. The consent form will be stored alongside the images for as long as the image/recording is retained.
We will not keep images/recordings for longer than necessary and they will not be used other than for their original purpose. You may withdraw your consent at any time and all images will be removed from the College drive immediately, however, withdrawal of consent will only affect further processing and any published material will not be recalled.
Please note, any images used on websites can be viewed throughout the world and not just in the United Kingdom, and some overseas countries may not provide the same level of protection to the rights of individuals as the EU/UK legislation provides.
When is a consent form not necessary?
A consent form is not necessary when there is a large group of people with no one standing out e.g. at an event. We will notify those in attendance that photography or filming will be taking place either verbally, or with clear and visible signage, and those who do not wish to be in a photograph or recording can opt out by contacting any member of college staff.
More information on how we use your images can be obtained from the marketing department (add email link is possible)
CCTV
Our CCTV system is owned and managed by the College. Under the Data Protection Act, we are the ‘data controller’ for the images produced by the CCTV system. The CCTV systems are compliant with the requirements of the Data Protection Act. Signs are placed around campuses in order to inform staff, students, visitors, and members of the public that CCTV is in operation.
The principal purposes of the College’s CCTV system are as follows: crime prevention, campus security, health and safety – to assist in the investigation of suspected breaches of College regulations by staff, students or the general public. The College seeks to operate its CCTV system in a manner that is consistent with respect for the individual’s privacy.
Cameras are not monitored, unless responding to an incident identified on campus, and all recorded materials are kept in secure areas. The cameras installed provide images that may be of suitable quality for the specified purposes for which they are installed, the images are retained for no longer than 7-31 days from the date of recording. All images recorded by the CCTV System remain the property of the College. The monitoring, viewing of, recording of staff/student activities will be carried out in accordance with our CCTV Policy.
The Reaseheath Group CCTV Policy is available on request.
Further Information
If you have any questions about how your personal information is used please consult the College’s data protection webpages at www.reaseheath.ac.uk/data-protection.
If you need further assistance, please contact the College’s data protection team (data.protection@reaseheath.ac.uk) or its Data Protection Officer (dpo@reaseheath.ac.uk).
The Data Protection Officer is the Chief Financial Officer and Director of Resources: Graeme Lavery
The Data Protection Officer
Reaseheath College
Reaseheath
Nantwich
Cheshire
CW5 6DF
Complaints?
If you are not happy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF (https://ico.org.uk/).