Dudley College of Technology - Protecting your privacy and personal data
Dudley College of Technology (the "College") is committed to protecting your privacy and personal data. This Privacy Notice informs you of what data we collect, why we collect it and what we do with it, so you can be confident that your personal data is in safe hands. It will also let you know the rights you have, and the choices that you can make to ensure control over your personal data. The College is the data controller and/or processor for personal data relating to you.
Information that we collect
Applicants and members of the public
- We collect your personal information when you enquire about or apply for a course at Dudley College using either our website, a paper application form, or through an external website such as UCAS or Mailchimp. This will include your name, title, birth date, age and gender (both legal gender and what gender you identify as) as well as contact details including address, email address and phone number and also information relevant to the course you have applied for.
- If you are required to attend an interview for a course we will take notes of any relevant information such as your interests, prior qualifications and working hours.
- Visitors to the college will be asked to register their name and car registration at reception.
- We will also collect your Unique Learner Number from the Learner Record Service (LRS)
Learners
- When you enrol at the college we will create a record in our student records system based on the information you provide, allocate you a unique student number that will be used in all of our systems to identify you, and take a photograph to be stored and used on your ID badge. We capture information including:
- Personal details including name, date of birth, contact details, National Insurance number, your legal gender/gender identity and ethnicity.
- Details of next of kin.
- Details of parent/guardian for learners aged between 16 to 19.
- Details of previous qualifications.
- Details of any health or medical conditions, including whether you have a disability or learning difficulty.
- Details about criminal convictions.
- If you attend the Black Country & Marches Institute of Technology and you are not registered as a Dudley College student, we will collect your name, email address and contact number.
- When you are studying at college, we will capture personal information such as:
- Your progress, attendance and any support needs identified.
- Logs of your use of IT systems such as email, internet access, virtual learning, door access.
- Logs of certain words and images when using college computers, or cloud-based college services such as Microsoft Teams, that may trigger IT filters or Artificial Intelligence threat detection, such as swear words or inappropriate images.
- Recordings of lessons as part of an online or blended learning package
- Information about your personal circumstances, such as household income, bank details, evidence of benefits, payslips, birth certificates to assess your suitability for a bursary.
- We use your information to lookup or create a Unique Learner Number (ULN) on a government database called Learning Records Service (LRS).
- International learners will be required to give us additional information such as passports and financial information in accordance with UK Visa and Immigration guidelines.
Parent / Guardian for a student
We will collect two parent(s) / guardian(s) contact details if you are aged between 16 to 19, we will collect their name, phone number and email address. They will be contacted regarding your progress, attendance / safeguarding issues and they will be contacted during emergencies.
Employees
We will collect personal information from you when you apply for a job with us. This will include:
- personal details such as your name, date of birth, contact details, gender, next of kin and national insurance number (or other tax identification number);
- information relating to your education and employment history;
- information relating to your employment history at the College and your ongoing performance at the College (e.g. annual professional development review information, disciplinary and grievance information, attendance record)
- your photograph/ image;
- immigration information (e.g. passport details and nationality);
- where relevant, health information (including any disabilities) and other equality-monitoring data you provide to us;
- trade union membership;
- criminal conviction information;
- Your bank and pay details; and
- Pensions and benefits information.
Employers
- We will store contact information including name, email and telephone for employers in our Customer Relationship Management and finance databases.
Website users
We capture information from our website using cookies that can be placed on your computer to enable us to offer a better experience for web users, and to track visitor numbers to our website. This information tells us how many times you visit a page, how long you viewed it and the search engine and search terms used, as well as the geographical location. In some instances Dudley College website pages use third party services or software, such as embedded apprenticeship vacancies, maps, social networking features, job application software or online videos. Many of these services may set cookies on your device. For instance videos embedded on our pages that are hosted on You Tube will lay down Google tracking cookies, in most instances our sites allow you to customise your permissions with regard to tracking, but in some instances such as this one, permissions are implied by the host provider. If you wish to know more about the way we use cookies visit dudleysixth.co.uk/Cookies
CCTV
CCTV recordings are used and retained for a limited period to ensure the safety of our learners, staff and visitors to our college. Signage is used to make sure that individuals are aware that CCTV is being recorded. Access to view these recordings are limited to the appropriate staff. CCTV images may be passed on to the police in for the purposes of crime detection or prevention. Dudley College will also disclose CCTV footage when requested by insurance companies. CCTV may be used to assure the integrity of our examination arrangements, with footage shared with Awarding Organisations for audit and fraud prevention purposes.
Full details can be found in our CCTV Policy found at www.dudleycol.ac.uk/About-Us/Policies-Procedures
Body-worn video
Members of our Security Team may be wearing body-worn video equipment that will capture video images and audio of learners, staff, and members of the public. All recordings will be incident specific and will not indiscriminately record all security activity. The Security Team will, wherever possible, inform individuals that video recordings are being taken. Recordings will be held securely on a HDD within the device, and retained in line with our data retention policy and Information Asset Register.
How we use information that we collect
Applicants
When you enquire or apply for a course, we will store the information to contact you with appropriate course information, events or news, in some cases to arrange for an interview and to send you joining instructions.
If you consent, we may send you information relating to other courses and events happening at the college.
Learners
We use your information to create a student record, and in the following ways
- Teaching and learning
- Creating timetables and registers to plan your learning and record attendance.
- Providing a virtual learning environment, e-learning portfolio, and e-ILP.
- To assign you into different Microsoft Teams groups for the purposes of your course
- To facilitate assessment, diagnostics, examinations.
- To inform you of lessons, examinations and attendance issues via email and SMS.
- To support student discipline in line with our Student Code of Conduct and Learning Agreement, and deal with grievances.
- Recordings may be taken of classes to supplement face-to-face delivery, or for online delivery. These may be saved and used throughout the year as a learning resource and for staff training.
- To provide IT, library and information services, including booking student computers and monitoring their use in accordance with our IT Acceptable Usage Policy.
- Support services
- To support students with additional learning support needs, including assessment planning and recording activity.
- To support applications to our bursary funds where there is financial hardship for low income learners.
- To provide confidential counselling services for students.
- To support student safeguarding activity.
- For the safety and security of learners, for example using CCTV.
- We may use bank details you provide to make bursary and refund payments to you.
- To maintain student records
- Make data returns to the Education and Skills Funding Agency (ESFA) for funding and monitoring purposes in line with our regulatory and legal obligations.
- Make data returns to the Office for Students (OfS) for our HE learners for funding and monitoring purposes.
- Produce management information including monitoring of equal opportunities and disadvantage learner participation.
- Administering finance, taking fees giving refunds.
- Making payments to delivery partners under franchise arrangements.
- Using images in our publications and marketing materials with consent.
- Promoting our services, such as courses or events that may be of interest.
- To contact you in relation to your course or to complete destination surveys.
- International learner data may be shared with UK Visas and Immigration in accordance with their guidelines.
- To provide learner alumni services
- Research projects
Personal data received from third parties
Where necessary, we may receive personal data about you from third parties. Examples include the following:
| Data | Source |
|---|---|
| Name, date of birth and contact details | UCAS |
| Qualifications achieved, date when qualification was awarded, grade achieved and the awarding body | Learner Record Service (LRS) |
| Medical, mental health, accessibility-related details and Educational Health Care Plan (if applicable) only in relation to your enrolment at the college | Medical practitioners and/or family members, local authorities and schools |
| Details relating to student loan application if applicable | Student Loans Company |
| Details as to how you are performing in your apprenticeship | Your employer and Smart Assessor |
| Learner and enrolment details including ethnicity, contact information. If you are not a registered Dudley College student but attend the IOT, we will collect your name, email address and contact number. | Black Country and Marches Institute of Technology (IOT) |
Employees
We will use your personal information as follows:
- For the recruitment process and for carrying our pre-employment checks.
- For the safeguarding and welfare of both staff and students, preventing and detecting criminal acts.
- For checking your identity and right to work in the UK.
- For checking your qualifications.
- To keep an audit trail of the checks we have made and our relationship with you in case of employment claims.
- To set up payroll and pension and to reimburse expenses.
- For dealing with HMRC.
- For communicating with you, including for marketing purposes.
- For carrying out our role as your employer or potential employer.
- For using images in our publications and marketing materials and for staff ID cards.
- For research purposes e.g. surveys.
- For IT services, acceptable usage policy and telephone directory information.
- To provide confidential counselling services for staff.
Personal data received from third parties
Where necessary, we may receive personal data about you from third parties. Examples include the following:
| Data | Source |
|---|---|
| Your previous employment record | Former employers |
| Personal and contact details, your application and CV | Employment Agencies |
| Your immigration status | Home Office (UKVI) |
| Information about criminal convictions (where appropriate) | Disclosure & Barring Service |
| Medical, mental health, accessibility-related and similar information(we only obtain this information from third parties if you give us consent to do so) | Medical practitioners/ occupational health |
Employers
We use contact information in our Customer Relationship Management and finance databases in order to:
- Carrying out day-to-day customer relationship activity.
- Promoting our services, such as courses or events that may be of interest.
- Contact you in relation to work undertaken for you or to complete surveys.
- Contact you to discuss employee progress on training programmes.
- Carry out finance and credit management tasks.
- Direct employer and employees to appropriate learning opportunities at Black Country & Marches Institute of Technology.
- Include the employer’s data on Smart Assessor, this is an E-Portfolio platform for apprentices and work-based learners. The company name, address, contact details and name of company’s key contact is included on the platform.
- Have access to Digital Apprenticeship Service (DAS) and view information on apprentice’s who have enrolled with the college as their training provider and their employer. The Digital Apprenticeship Service’s privacy information is stated below, Education and Skills Funding Agency (ESFA) Privacy Notice
The purposes for which we process your personal data and the legal basis
Full details on the lawful basis for processing of your data can be found in the college’s Information Asset Register, details of which are available from the Data Protection Officer.
Learners and applicants
The college acts as a controller and a processor for student data. Most of the data we hold on learners will be sent to the Education and Skills Funding Agency (ESFA) acting on behalf of the Department for Education (DfE) in accordance with our legal duties, and our contractual obligations with the ESFA. The college will also make use of this data to perform our primary public task, which is providing education and training.
We only process data for specified purposes and if it is justified in accordance with data-protection law. The table below lists the various purposes for which we process personal data and the corresponding justification for it. Some processing of your personal data is justified on the basis of contractual necessity. In general this applies to personal data you provide to us to process your application and if enrolled, to monitor academic performance. Without that information, we would be unable to provide you with your chosen course and related support services. Some personal data is also required to fulfil our legal obligations, for example regarding immigration.
| Purpose | Legal basis/justification |
|---|---|
| Provision of ESFA or WMCA funded courses, HE courses and any information collected throughout your learner journey. | Necessary as part of our public interest task to provide education and training (“public interest”). |
| Provision of other courses and related services | Necessary for performing a contract i.e. to provide your learning agreement for your chosen academic programme i.e. (“contractual necessity”). |
| Assessing eligibility to undertake our courses. This is assessed before the learner is enrolled, this could include checking where the learner is located, funding eligibility or prior qualifications. | Consent and/or:- processing is necessary for the purposes of taking steps prior to entering into a contract with us; or- public interest. |
| Administration of complaints, grievances and appeals | Public interest or contractual necessity. |
| Immigration matters | Necessary for us to comply with our legal obligations in relation to students who hold visas. Such processing may also be in the public interest and your consent may be required in some cases. |
| Making reasonable adjustments for disabilities and providing relevant support to students with ill health. | Legitimate Interest |
| Criminal convictions | DPA Section 10 (5) Schedule 1, Part 3 Paragraph 29. Consent |
| Regulating the College’s community (including dealing with misconduct under our procedures for academic and other misconduct) | Public interest and legitimate interest in maintaining academic standards. |
| Obtaining payment of fees (if applicable) | Contractual necessity and our legitimate interest in obtaining payment for the services we provide. |
| Protecting our property and assets (e.g. by dealing with misconduct) | Necessary for our legitimate interest in safeguarding our property and assets. |
| Providing appropriate I.T. and other infrastructure facilities | Public interest or contractual necessity and our legitimate interest in providing a proper infrastructure to support the provision of academic programmes and related student services |
| Communicating with students and Alumni relations | Public interest and any legitimate interest in marketing the College and maintaining an alumni network. |
| CCTV | Necessary for our legitimate interest in ensuring the safety of the College community and our property and assets www.dudleycol.ac.uk/About-Us/Policies-Procedures |
| Marketing | Where you have previously applied to, or studied at the College or indicated to us in any other way that you give your permission, we may send you information about our courses on the basis of our legitimate interests in advertising the services of the College. In doing so, we will offer you an opportunity to refuse marketing when your details are first collected and in subsequent communications to you.Any other marketing will only be carried out with your consent. |
| Research | Consent or processing is necessary in the public interest (where the research is scientific, historical or for statistical purposes). |
| Parental communications | This is to engage and create a communication channel between the College and the parents/guardians. It is also necessary for us to comply with our legal obligations and on a public interest basis for the parents of learners aged between 16 to 19 |
| Provision of courses delivered by the Black Country and Marches Institute of Technology and delivery partners. | Consent and/or: - processing is necessary for the purposes of taking steps prior to entering into a contract with us; or - public interest. |
| Enable Dudley Public Health to monitor the number of positive COVID-19 cases in all settings and provide appropriate support, activating the local outbreak management plan if necessary. | Public Interest |
Employees
We collect and use your personal information on the basis that it is necessary for performing our employment contract with you, or it is necessary to take steps before entering into the contract with you. We also collect and use your personal information on the basis that we need to do so in order to comply with our legal obligation.
Where we collect your special category personal information, we do this on the basis that it is necessary for the purposes of carrying out our obligations in the field of employment law. Special categories of personal data are personal data that reveal a person’s racial or ethnic origin, political opinions, religions or philosophical beliefs, trade union membership, physical or mental health, sexual life or sexual orientation and criminal records.
We will not keep your personal information for longer than we need it for the purposes we have explained above.
When you apply for a job with us, but your application is unsuccessful, we will keep your personal information for 12 months.
When you are an employee, we will keep your personal information for as long as you work with us and then after you leave, we will keep your personal information for 7 years.
The table below lists the various purposes for which we process personal data and the corresponding justification for it. Some processing of your personal data is justified on the basis of contractual necessity. In general, this applies to personal data you provide to us at the commencement and throughout the duration of your employment with the College to manage the employment relationship and to monitor performance. Some personal data is also required to fulfil our legal obligations (e.g. immigration, HMRC). Without that information we would be unable to employ you and comply with our legal obligations.
| Purpose | Legal basis/justification |
|---|---|
| To make a decision about your recruitment or appointment. | Necessary prior to entering into an employment contract and to comply with Employment Law |
| To enter into and perform our obligations under our employment contract with you and exercise our rights. | Necessary for the performance of the employment contract and to comply with Employment Law. |
| To provide references on request | Necessary for the performance of the employment contract or where consent has been given |
| To monitor equality, diversity and inclusion | Necessary in our legitimate interest to promote an inclusive work environment and to comply with Employment Law and our other legal obligations |
| Immigration matters | Necessary for us to comply with our legal obligations. Such processing may also be in the public interest and your consent may be required in some cases. |
| CCTV | Necessary for our legitimate interest in ensuring the safety of the College community and our property and assets www.dudleycol.ac.uk/About-Us/Policies-Procedures |
| Research | Consent or processing is necessary in the public interest (where the research is scientific, historical or for statistical purposes). |
How we use particularly sensitive personal information of employees
| Purpose | Legal basis/justification |
|---|---|
| We use information relating to your health to make decisions regarding reasonable adjustments. | Processing of health-related data is necessary so that we can meet our obligations in the field of employment law. |
| We use information about your race or ethnicity, religious beliefs, sexual orientation and political opinions to conduct equal opportunities monitoring. | Processing is necessary in the public interest and so that we can meet our obligations in the field of employment law (public sector equality duty). |
| We use trade union membership information to pay trade union premiums, register that status of a protected employee and to comply with employment law obligations. | Processing is necessary so that we can meet our obligations in the field of employment law. |
| We use information about your criminal convictions where the law allows us to do so and if it is appropriate given the nature of the role to assess your suitability to carry out the work for which you are being engaged. | Processing is necessary in the public interest and substantial public interest. |
Transferring data to third parties
Learners
The college submits learner and enrolment data to a number of third parties:
- the Education and Skills Funding Agency (ESFA) on a monthly basis.
- Office for Students (OfS).
- RCU Market Intelligence Data Exchange (MiDES) to provide statistical analysis and benchmarking of our performance against other providers.
- external verifiers.
- delivery partners under franchising arrangements.
- Awarding Organisations (who may contact you for quality assurance purposes).
- schools who checking for destinations of leavers.
- organisations requesting references.
- the Police for crime prevention or detection.
- End-Point Assessment Organisations for Apprentices.
- the Local Authority
- placement providers
- your parents / guardians if aged between 16 to 19. If you turn 18 after 31st August in the academic year you are studying with us and you do not want us to share information with your parents/guardians, please email [email protected] to request this change
- Student Loans Company
- Home Office
- co-curricular and/or extra-curricular excursion providers
- your employer if you are an apprentice
- software suppliers
- external security
- Mailchimp secure email marketing
- Prospective learner enquiry data to Black Country and Marches Institute of Technology delivery partners for specific courses
- Purlos – a supplier of Artificial Intelligence based chat using WhatsApp to communicate to prospective learners during the application process
- Dudley Council Public Health via the new Infectious Disease Notification and Management System – hosted on the School Life Platform
- If applying for an Apprenticeship through Dudley College, your COVID vaccine status may be passed onto Employers, if Employers request this information.
- Cognassist – A tool which identifies learner needs through assessment and helps personalise learner support
- Century – A website which supports learners with their English and Maths
- Learner Records Service – a tool which identifies your Unique Learner Number and your previous qualifications
- BKSB - A learning platform which assess your English and Maths skills
Employees
- To the college pension scheme providers to enable them to administer your pension.
- To organisations requesting references.
- To HMRC to enable them to administer your tax.
- The Department for Education
- To external verifiers and awarding bodies for them to confirm your qualifications and CPD requirements
- To Office of National Statistics (ONS) to provide statistical analysis.
- To Association of College to provide statistical analysis and benchmarking against other providers.
- To the college’s recognised Trade Unions to provide details of your membership payments and statistical analysis.
- our auditors
- UK Home Office
- Local Authority
- Dudley Council Public Health via the new Infectious Disease Notification and Management System – hosted on the School Life Platform
Retention of data
The College will only retain your personal data for as long as is necessary for the relevant activity for which we collected it (as described above).
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Usually employment related personal data will be kept for the duration of the period that your work for us and then for approximately seven years after you leave. This retention period is linked to contract law dispute legislation. However, personal data held in connection with health and safety may be retained indefinitely in view of the potential for personal injury claims to be submitted against the College at a later date.
Information relating to criminal convictions shall be retained for no longer than is necessary and for a maximum of six months following your provision of a criminal conviction certificate to the College.
Personal data held in connection with our alumni office with you will be retained indefinitely in support of your lifelong relationship with the College or until there is no longer a legal basis for holding it, for example if you withdraw your consent.
Use of personal images
Images of specific individuals and groups are considered to be personal data and as such consent is required to use it. Generally you will be asked to complete a written consent form, which will clearly explain how the images will be used and for how long. It may not always be practicable to obtain written consent, especially for larger group photos, or at live college events, however the college photographer will make it clear that your images will be stored and could be used online or for marketing purposes.
Images of large crowds or where an individual appears inadvertently in the background are unlikely to be considered as personal data.
You can withdraw consent for the college to use your images at any time, this should be made in writing to the Data Protection Officer. Once your consent is withdrawn we will not use your images in any new material or publications, however it may not always be possible to recall publications or materials where your image has already appeared.
Education and Skills Funding Agency (ESFA) Privacy Notice
The ESFA is responsible for funding education and skills in England for children, young people and adults. It is also responsible for delivery of key services in the education and skills sector in England including the apprenticeship service, the provision of information, advice and guidance through the National Careers Service, and the Learning Records Service. We may use your personal information in our delivery of this work.
Further information about how the ESFA access to your personal data, details of organisations with whom the ESFA regularly share data, information about how long the ESFA retain your data, and how to change your consent to being contacted, please visit: www.gov.uk/government/publications/esfa-privacy-notice
Office for Students (OfS) Privacy Notice
Information on how OfS use the personal data we submit for our Higher Education learners can be found here: www.officeforstudents.org.uk/ofs-privacy/privacy-notice/
Learning Records Service (LRS) Privacy Notice
The information you supply is used by the Learning Records Service (LRS). The LRS issues Unique Learner Numbers (ULN) and creates Personal Learning records across England, Wales and Northern Ireland, and is operated by the Education and Skills Funding Agency, an executive agency of the Department for Education (DfE).For more information about how your information is processed, and to access your Personal Learning Record, please refer to: www.gov.uk/government/publications/lrs-privacy-notices
West Midlands Combined Authority (WMCA) Privacy Notice
Adult Education Budget Privacy Notice for the Purpose of Data Collection
The West Midlands Combined Authority (WMCA) is responsible for commissioning and funding adult education budget provision for learners within the West Midlands. The WMCA may use your personal information in the delivery of this work. For more information on how the WMCA use your data please visit: 2022-2023_privacy-notice.pdf (wmca.org.uk)
You are in control of your information
Your rights under data protection law
As a data subject, you have the following rights in relation to your personal data processed by us:
- To gain access to your personal data;
- To rectify inaccuracies or where appropriate, given the purposes for which your data is processed, the right to have incomplete data completed;
- To have your personal data erased. This is a limited right which applies, among other circumstances, when the data is no longer required, consent has been withdrawn and/or the processing has no legal justification. There are also exceptions to this right, such as when the processing is required by law or in the public interest;
- To object to the processing of your personal data for marketing purposes.
- To object when the processing of your personal data is based on the public interest or other legitimate interests, unless we have compelling legitimate grounds to continue with the processing.
- To restrict the processing of your personal data. This is a limited right which will apply in specific circumstances and for a limited period.
- To obtain a copy of your data in a commonly used electronic form if the data is processed by automated means and the processing is based on your consent or contractual necessity.
Access your information (make a Subject Access Request)
You have the right to request a copy of the information that we hold on you. If you would like a copy of your information please email [email protected] or write to:
Data Protection Officer
Dudley College
The Broadway
Dudley DY1 4AS
01384 363000
The college will respond to your request as quickly as possible, no longer than 1 month.
Updating your records
It is important that your details are accurate and up to date. Please visit one of our sites with your ID badge to make changes to your details. Alternatively, you can email [email protected].
Consent
Where we use your data on the basis of consent, for example to send you details of courses that you may be interested in, or to use your image on our website or brochures we will always ask for clear affirmative consent. You can withdraw consent just as easily as it is given, by contacting the college by email: [email protected].
Freedom of Information
Freedom of Information requests can be made to the Data Protection Officer, email: [email protected]
Or write to:
Data Protection Officer
Dudley College
The Broadway
Dudley DY1 4AS
01384 363000
The College has a separate policy setting out its obligations under the Freedom of Information Act 2000 and the Environmental Information Regulations 2004. This is available on our website under 'Policies and Procedures' and can be found at: www.dudleycol.ac.uk/About-Us/Policies-Procedures/
Complain
Dudley College aims for the highest standards when collecting and using your personal data. If you would like to complain to the college, please access the form called “How Are We Performing?” using the following link:
www.dudleycol.ac.uk/About-Us/Policies-Procedures/Complaints-Compliments
The form is also available from any of our college campus receptions, Learner Services or from the Standards and Performance Department.
Once the form is completed it should be returned to the Standards Assurance Co-ordinator at [email protected] or by post to Sharon Hayward, Dudley College of Technology, The Broadway, Dudley, West Midlands, DY1 4AS who will ensure the complaint is investigated and responded to in accordance with the procedure on "How Are We Performing?". You can also contact her by telephone on Dudley (01384) 363287.
Complain to the Information Commissioner (ICO)
If you believe that we have not complied with data protection law you can complain to the Information Commissioner: ico.org.uk
Data Protection Officer
To contact the Data Protection Officer for Dudley College email: [email protected]
Or write to:
Data Protection Officer
Dudley College
The Broadway
Dudley DY1 4AS
01384 363000