Data Privacy at Varndean
Data Protection
This privacy notice below (and the policies and documents referred to in it) sets out the basis on which the College will collect and use personal data, either where the College collects it from individuals itself, or where it is provided to the College by third parties. It also sets out rules on how the College handles uses, transfers and stores personal data. Please also refer to the College’s Data Protection Policy.
Privacy Notice for Students
Varndean College is committed to protecting your privacy and helping you feel confident about how your personal information is handled. This privacy notice explains how we collect and use your personal information, why we collect it, and what rights you have in relation to the data we hold about you.
Under the Data Protection Act (DPA) and the UK General Data Protection Regulation (UK GDPR), a data controller is the organisation that decides how and why personal data is processed. Varndean College acts as a data controller, meaning we are responsible for determining how your personal information is used and protected. We are required by data protection law to provide you with the information set out in this notice.
This legislation says that personal information we hold about you must be:
- Used lawfully, fairly and in a clear and transparent way
- Collected only for specific, valid purposes that we have explained to you, and not for anything incompatible with those purposes
- Relevant and limited to what is necessary for those purposes
- Accurate and kept up-to-date
- Kept only as long as necessary
- Stored securely
What information do we collect about you?
We collect persona, information from you when you apply to study at Varndean College and it is updated where necessary during the enrolment process. This information includes:
- Personal details such as name, address, date of birth, email address
- Characteristics such as gender, ethnicity, first and second language
- Health information such as doctor’s details, special needs, medical conditions
- Dates of attendance
- Exam results
- Behaviour record
If your application is successful and you enrol as a student at the College the personal data we process includes:
- Personal details such as name, address, date of birth, email address
- Characteristics such as gender, ethnicity, first and second language
- Health information such as doctor’s details, special needs, medical conditions
- Attendance information
- Assessment information/exam results
- Details of any support received
- Behaviour record
- Funding information
- Careers advice
- Busary information
- Trips and enrichment information
- Safeguarding information
- Photographs
- CCTV images captured on the College campus
Why we collect and use your information and the lawful basis for doing so
The purposes for which we use your information and the legal basis on which we rely are as follows:
- Most of the information we hold about you is required for the performance of your contract with us, which is to provide you with your education, supporting you during your time at college, and helping you gain the skills, knowledge and qualifications you need to progress to your intended destination.
- Some information we collect is used to meet our legal obligations, for example:
- Ensuring your safety whilst at College
- Maintaining accounts and related records to ensure compliance with financial regulations
- Monitoring our performance and meeting OFSTED requirements
- We also use your data when necessary to support our legitimate interests, such as:
- Monitoring IT systems to maintain security, availability and enhance the services we provide
- Protecting or enforcing our contractual or other legal rights, including taking or defending legal action
- Recording CCTV and monitoring access to ensure the security and safety of the College campus and its community
- Promoting College services and opportunities through marketing
- We also collect information on behalf of the Department of Education, which funds your education. For details on how they handle your personal data, please see their Privacy Notice.
Some of the information we collect is classed as sensitive under data protection law, and we need your consent to process it. This includes details such as your ethnic origin, gender, and medical information. We use medical information to support you during your time at College and, where appropriate, to apply for Exam Access Arrangements. Your consent is collected when you provide this information on your application form.
How long will we keep your personal information?
How will we share your personal information?
We do not share information about our students with anyone without consent unless the law and our policies allow us to do so. Where it is legally required or necessary and in line with data protection law, we may share personal information about students with:
- Our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns and exclusions
- The Department for Education – their privacy notice can be viewed here.
- Students’ parents and representatives
- Educators and examining bodies
- Our regulator, Ofsted
- Suppliers and service providers – to to deliver contracted services
- Central and local government
- Health and social welfare organisations
- Professional advisers and consultants
- Police forces, courts, tribunals
- UCAS
Transferring your data outside of the European Economic Area (EEA)
The majority of your information is stored and processed within the European Economic Area (EEA). We will not transfer your personal data outside Europe unless you specifically ask us to do so. Where we do transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law, and will endeavour to ensure appropriate safeguards are in place.
Your rights over your personal information
Under data protection law individuals have certain rights regarding how their personal data is used and kept safe, including the right to:
- Request access to your personal information (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. We will provide you with copies of your personal information along with details such as the source of the information and who it has been shared with.
- Request correction of the personal information we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact our Data Protection Officer dpo@varndean.ac.uk.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To do this please contact us in writing. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purposes you originally agreed to, unless we have another legitimate basis for doing so in the law.
Questions or complaints
If you have any questions or concerns about this privacy notice or how we handle your personal information, or if you wish to exercise any of the rights it refers to contact the Data Protection Officer at dpo@varndean.ac.uk, who has been appointed to oversee compliance with this privacy notice.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO). The ICO’s contact details can be found on their website at www.ico.org.uk.
Changes to our privacy notice
We keep our privacy notices under regular review. Any changes we make to this Privacy Notice for Students will be published on our website.