Legal framework

The Sixth Form College, Colchester is registered under the Data Protection Act 2018. This means that the purposes for which the College collects and processes personal data is notified to and registered with the Information Commissioner’s Office (ICO).

The Sixth form College, Colchester is the Data Controller as defined by the Data Protection Act 2018.

The General Data Protection Regulations (GDPR), which came into effect on 25 May 2018, strengthened the rights individuals have over their personal data which organisations collect and process

Why your personal information is collected

The Corporation, (also referred to below as ‘we’) collect the following information from you, which we need in order to carry out the functions of the college company and comply with company law.  We will not share your personal information with anyone without your consent unless we are required to do so in order to comply with the law. The information collected is stored in a secure, protected environment and will not transmitted outside the EU.

Information required for statutory registers

Your name, title, role, date of appointment, your date of birth (which will appear as month and year on the company house register), the number of directorships you hold, your address (which will be the company’s registered office address), occupation, and your country of residence.

This information will be included in the statutory register of directors and secretaries and shared with Companies House and published on the Companies House website.

Lawful basis for processing

The Corporation processes this personal data and provides access to it on request because we are under a legal obligation to do so. The legal obligation is prescribed in Companies Act 2006


The College will retain data for the period of time required by the Companies Act 2006 or successor legislation.

The company register of directors and annual reports of the company, which contain summary information about the College’s subsidiary companies and its directors, will be retained for the duration of the College’s existence as a statutory corporation.

Retention and Disposal


The Corporation’s full retention schedule specifies the way that data is categorised, the security applied to the data and the maximum period data should be kept for business and statutory purposes.

A copy of the schedule is available by contacting the Clerk to the Corporation 


Corporation’s disposal schedule details the date when documentation will be (or has been) destroyed and the chosen method of disposal.Personal data will be securely disposed of in accordance with the disposal schedule.

A copy of the schedule is available to view by contacting the Clerk to the Corporation 

Accuracy of data

Directors are responsible for updating the Clerk about changes to their data to ensure it is up to date and accurate.

We aim to notify directors within 7 working days if any revisions or additions are made to this notice.

Your legal rights

Our use of your data is subject to your legal rights of Inform, Access, Rectify, Erase, & Restrict.

  • be informed about the collection and use of your personal data (which is covered by this Privacy Notice)
  • request access to information about you that we hold
  • request that  inaccurate personal data is rectified,  if it is incorrect; or completed if it is incomplete. This may not always be possible if it relates to an official record
  • request that have personal data erased (‘the right to be forgotten’). This is not an absolute right and only applies in certain circumstances
  • to request the restriction or suppression of your personal data, When processing is restricted, you are permitted to store the personal data, but not use it. This is not an absolute right and only applies in certain circumstances.
  • withdraw consent (see below)
  • complain to the Information Commissioner’s Office (see below)

In addition you have a right to request

  • data portability i.e. to obtain and reuse your personal data for your own purposes across different services. This only applies when consent is the basis for processing and when the data involves technology
  • intervention in respect of automated decision making i.e. a decision solely by automated means without any human involvement 

It should be noted that these two rights are unlikely to be relevant to colleges

Subject access request

If you wish to make a request for your personal information, please contact the Clerk to the Corporation or the College’s Data Protection Officer using the contact details below. 

Withdrawing consent

If you have given your consent and you wish to withdraw it please contact the Clerk to the Corporation or the College’s DPO using the contact details below.


Illustrative data flow documentation is available on request by contacting the Clerk to the Corporation [for contact details please refer to pg.3]. The illustrations aim to show in an elementary manner how each data type is processed, used, stored, transferred and where applicable retained.

Should you require a copy of this Privacy Notice or an extract thereof in an alternative format please contact the Clerk to the Corporation.

Queries and Concerns

If you have a query or concern regarding the way that we are asking for or processing your personal data, please contact the  Clerk to the Corporation or the College’s Data Protection Officer

Clerk to the Corporation


Postal address: The Sixth Form College, North Hill, Colchester, CO1 1SN

Telephone: 01206 500532

Data Protection Officer


Postal address: The Sixth Form College, North Hill, Colchester, CO1 1SN

Telephone: 01206 500700

Information Commissioner

If you still have concerns following the DPOs response you have the right to contact the Information Commissioner’s Office


Postal address: Information Commissioners Office, Wycliffe House, Water Lane,

Wilmslow, Cheshire, SK9 5AF

Telephone: 0303123113