Student privacy notice

Contents

  1. Introduction
  2. Who is processing personal data
  3. What personal data do we process
  4. The legal basis for processing your personal and special category data
  5. What we use personal and sensitive data for
  6. Automated decision making
  7. Who we share your personal data with
  8. Changes to your personal data
  9. Will your data be sent or stored abroad?
  10. How long do we keep your personal data?
  11. How to access personal data the college holds about you and other rights you have
  12. Contact us

A. Introduction

The purpose of this notice is to inform students about how the college collects, uses and shares their personal data, and their rights in relation to the personal data we hold.

B. Who is processing personal data

CCCG determines why and how your personal data is used and is considered to be the data controller of the personal data. This places legal obligations on the college.

CCCG is registered under its licence name of The WKCIC Group with the Information Commissioner’s Office as a data controller under the reference A8187792.

Our address is Longford Street, London NW1 3HB

The college’s Data Protection Officer can be contacted by email at: dataprotection@capitalccg.ac.uk

C. What personal data do we process

CCCG processes personal data that is necessary for us to administer and deliver education services to you. This includes:

  • information about you and your study and your communications with us including details of your education, qualifications and publications
  • financial information gathered for the purposes of administering fees and charges, loans, grants, bursaries etc
  • copies of passports, visas, and other documents required to ensure compliance with Home Office and other conditions
  • photographs and other identification information for student ID cards
  • information about your participation and progression in learning and assessment activities and
  • information about your use of learning materials.

Special category data

We may also process “special category data” which includes information about your racial or ethnic origin, religious beliefs or other beliefs, physical or mental health. We may also process information concerning any criminal offences or criminal proceedings.

D. The legal basis for processing your personal and special category data

  • Contract

We may process your personal data and special category data because it is necessary for us to do so in order to fulfil the contract you enter into with the college when registering as a student or in order to take steps at your request prior to entering into a contract.

The college collects and processes personal information that is necessary to provide the required services to you for the contract and also to meet its legal and statutory obligations in delivering the contract.

  • Legitimate interests 

We may use and process your personal information where it is necessary for us to pursue our legitimate interests or a third party’s legitimate interests. Such legitimate interests can include:

  • monitoring attendance at lectures and other learning activities
  • the recording of educational activities including lecture capture
  • monitoring and investigating the use of IT services to maintain network and information security
  • testing our systems to ensure optimum performance
  • providing a safe environment involving the prevention and investigation of inappropriate activity
  • verifying the accuracy of data that we hold
  • improving our services via staff training
  • promoting equality and diversity throughout the college
  • recovering money that is owed to us
  • tracking your progress into further learning or employment
  • staying in touch with you after you graduate including fundraising

 

  • Legal obligation

We may also process your personal data for our compliance with legal obligations. This can include:

  • compliance with regulatory obligations such as anti-money laundering laws and safeguarding requirements
  • assisting with investigations (including criminal investigations) carried out by the police and other competent authorities
  • complying with court or other competent authority orders

 

  • Vital interests

The college will only rely on vital interests as a lawful basis for processing your personal data where it is necessary to protect someone’s life.

  • Consent

The college will use consent as a lawful basis for some processing. Where we do so we always provide you with the choice as to whether or not to opt in to such processing.

  • We will provide academic references and confirmation of study to prospective employers and to your local authority or council, with your consent.
  • We will provide information to the with your consent
  • We may process personal data provided by you for a specific purpose or purposes (for example, disability, catering preferences or lifestyle status for event management)

E. What we use personal and sensitive data for

CCCG processes your personal and special category data for the following reasons:

  • the provision of teaching and associated services (e.g. registration, assessment, graduation)
  • maintaining student records
  • promoting the welfare of students
  • to communicate with you for all matters relevant to your study at the college
  • providing library, IT and information services
  • administering student finances
  • managing college accommodation
  • managing the use of college services (e.g. student support services, careers service)
  • equal opportunities monitoring
  • evaluating the performance and effectiveness of the college including research and statistical analysis
  • to meet our compliance and regulatory obligations
  • the prevention and detection of crime and assisting investigations carried out by relevant authorities
  • dealing with disciplinary matters
  • dealing with complaints

F. Automated decision making

The college does not make any automated decisions about you using your personal data.

G. Who we share your personal data with

Your data will be shared internally within the college with staff and departments that require the use of the data in order to administer your study and provide college services to you.

Data including your personal and sensitive data will be shared externally where the college has a legitimate need to do so in fulfilling the contract the college has with you or has a legal obligation to provide data. The following list provides examples of the most common occasions on which it is necessary to share your data.

  • We will share some personal data (including your name, date of birth, email address, programme and level of study, start and end date and gender) with the college Students’ Union if you have provided your consent at registration for your first year of study of your current programme. The Union use this information to communicate with you to provide services to you as a member of the Union. The sharing of data between the college and the Union is covered by a data sharing agreement. You can opt out at any time from the Student Union holding your data through our online student system.
  • Other regulatory bodies that the college is legally required to provide data to including (HESA), Office for Students (OfS), Education and Skills Funding Agency (ESFA), National college for Teaching and Learning (NCTL), Student Loans Company, Quality Assurance Agency for Higher Education (QAA), Office for Standards in Education (OFSTED) and subject specific accreditation organisations. This may also include providing details to organisations representing those bodies e.g. OfS use Ipsos Mori to conduct the National Students’ Survey for which the college is required to provide the contact details of its students.
  • Other third party organisations, covered by a data sharing agreement, where the college has a legitimate need to do so in fulfilling the contract it has with you.
  • We will provide information to the police and other enforcement agencies in the event of an emergency or where required to assist the prevention or detection of crime.
  • The college may also pass information about a student to an appropriate third party where there is concern about the welfare of a student to safeguard the interests of the student.
  • We will provide information to UK Visas and Immigration (UKVI) where required in relation to students holding tier 4 visas.
  • Employers and organisations with whom placements are arranged as part of your programme of study in order to facilitate the placement.
  • Employers of students studying on Apprenticeships programme.
  • Other institutions when delivering provision in collaboration with CCCG.
  • References to potential employers and other education institutions where the student has named the college or a staff member as a referee.
  • Professional bodies where appropriate for the programme of study to validate and accredit qualifications.
  • We will share some personal data with our external supplier for the purpose of providing graduation gowns required for attendance at graduation ceremonies.

HESA Student Collection Notices can be found at: https://www.hesa.ac.uk/about/regulation/data-protection/notices

H. Changes to your personal data

It is the responsibility of the student to notify the college as soon as possible if any of the data held about them needs to be updated or is incorrect. The college provides an opportunity annually for you as a student to check your details through the registration process and also requires students to notify changes more promptly directly to student services.

I. Will your data be sent or stored abroad?

Some of the personal data we process about you may be transferred to, and stored at, a destination outside the European Economic Area (EEA), for example where personal data is processed by one of our software suppliers who is based outside the EEA or who uses data storage facilities outside the EEA.

In these circumstances, your personal data will only be transferred where the transfer is subject to one or more of the appropriate safeguards for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission);a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of protection.

J. How long do we keep your personal data?

The college will retain personal data for no longer than is necessary to fulfil its contractual and regulatory obligations in line with our retention schedule available HERE.

K. How you can access personal information the college holds about you and other rights you have

  1. The right to be informed

You have the right to be informed about the collection and use of your personal data and this privacy notice is part of the transparency requirements of data protection legislation.

  1. Right of access

You have a right of access to your own personal data held by the college. Most data held about you is available for you to view online through our online student system whilst a student of the college. Furthermore, a request to see the personal data held by the college can be made through a Subject Access Request.

  1. The right to rectification

You have the right to have inaccurate personal data held by the college rectified or completed if it is incomplete. This can be done through our online student system or by contacting the Student Administration team at: Student.Helpdesk@capitalccg.ac.uk

  1. The right to erasure

Once personal data collected by the college is no longer necessary for the purpose for which it was collected and processed, you may have the right to have the data erased. The college manages the retention period of data held through its retention schedule.

  1. The rights to restrict processing and to object to processing

In certain circumstances you have the right to restrict the processing of your personal data. This is likely to arise when there is an issue concerning the accuracy or the legitimate grounds for processing of the personal data.

  1. The right to object to processing

You have the right to object to:

  • processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
  • direct marketing (including profiling); and
  • processing for purposes of scientific/historical research and statistics.

The college will stop processing the personal data unless there are compelling legitimate grounds for the processing, which override your interests, rights and freedoms.

  1. Rights to data portability

You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format. The college will respond to any Subject Access Requests in compliance with this. You have the right to obtain information which the college holds about you by making a subject access request – by completing appendix 2 of the data protection policy which can be found HERE.

In line with its policy the Group aims to comply with requests for access without undue delay and at the latest within one month of receipt unless there is a good reason for delay. In such cases, the reason for delay should be explained, in writing, to the data subject making the request.

Note:

Detailed guidance on all of the rights you have with regard to the personal data that we hold and process about you is available on the ICO website here – https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.

L. Contact us

If you have any queries about this privacy notice or how we process your personal data you can contact us at: Student.Helpdesk@capitalccg.ac.uk

If you are not satisfied with how we are processing your personal data, please in the first instance contact our Data Protection Officer by email at: dataprotection@capitalccg.ac.uk. You can also report a concern about how your information has been handled to the Information Commissioner – https://ico.org.uk/concerns/handling/.

Date 24/05/2018