Legal framework
The Sixth Form College, Colchester is registered under the Data Protection Act 2018. This means that the purposes for which the College collects and processes personal data is notified to and registered with the Information Commissioner’s Office (ICO).
The Sixth form College, Colchester is the Data Controller as defined by the Data Protection Act 2018.
The UK General Data Protection Regulations (UK GDPR), which came into effect on 01 January 2021, sets out the key principles and rights individuals have over their personal data which organisations collect and process.
Collecting personal information
The Corporation, (also referred to below as ‘we’) will collect information from you, which we need in order to carry out our functions, manage and develop the Corporation. We will not share your personal information with anyone without your consent unless we are required to do so in order to comply with the law. The information collected is stored in a secure, protected environment and will not transmitted outside the European Economic Area
We will only collect personal information from you, which is needed in order to carry out the statutory duties of the Corporation. This information will be held securely and unless explicitly stated below it will not be made public.
The lawful basis for processing this information is outlined under each section of the following and where your consent is required we will give you the opportunity to opt in.
All personal information is retained in accordance with the Corporation‘s retention schedules, which are also available on request by contacting the Clerk to the Corporation [for contact details please refer to the end of this document].
How and why your personal information is processed
Subjective information
Your home address, home and mobile telephone numbers (and workplace alternatives where provided).
This information is required in order that we can contact you regarding meetings and other relevant events and send relevant correspondence to you. This information will be held securely, shared only with staff who need to use the data for their duties and will not be made public.
Your personal email address
This information will be used in the event that you notify us that you are unable to access your college email address or you agree for us to retain the email address as a means of contacting you after your term of office has ended. This information will be held securely, shared only with staff who need to use the data for their duties and will not be made public.
Your full name (including title), the body which appointed you, the date of your appointment and the date on which your term of office ends.
This information is required for the statutory registers for governors/trustees and will be shared with the Department for Education (DfE) on request and made publically available on the College’s website in order to increase transparency and more quickly and easily identify individuals who have a role in the governance of the College.
The information will also be shared with college staff for use in relevant media for example, the student handbook.
Lawful basis for processing
The legal grounds for the Corporation processing contact information for governors is that the Corporation is under a legal obligation, under the Further and Higher Education Act 1992, to maintain a Governing Body as it senior decision-making body. The Corporation’s Instrument and Articles, defined by that statute require the Corporation to maintain contact with governors to conduct the College’s business and the information above is necessary for these purposes.
Retention
The Corporation maintains governor contact information for up to 2 years after a person has ceased to be a governor. This is in order that we may complete year-end processes for any financial years in which a governor was appointed and should any legal queries arise. Statutory registers are kept in accordance with the Corporation’s retention schedule.
Information required for safeguarding and insolvency checks
Your full name, address and date of birth.
We will share this information with the College’s HR department in order that they can commence the Government’s Disclosure and Barring Service (DBS) so that they can check whether you have any previous convictions which would make you unsuitable for working with children and young people.
In addition, this information will also be used to check the registers of disqualified directors, trustees removed by the Charity Commission or courts and the insolvency registers. This information will be held securely, shared only with staff who need to use the data for their duties and will not be made public.
The College will retain information resulting from these checks to confirm that they have been completed.
Your name and date of birth will also be shared with the College’s bankers to enable them to fulfil their responsibilities under the proceeds of Crime Act, the Prevention of Terrorism Act, Money Laundering Regulations or any other relevant legislation.
Lawful basis for processing
The legal grounds for the Corporation processing this personal data is that the Corporation operates a College of Further Education, and under the Children Act 2004 has a statutory duty to safeguard and promote the welfare of its learners. In addition, the Corporation, as an exempt charity under the Charities Act 2011, as amended, has a statutory duty to ensure that its governors are eligible to act as trustees and therefore we collect declarations and conduct safeguarding checks to satisfy this requirement.
Retention
The Corporation retains data on its central register to confirm that the process was completed and the outcome, for up to six years after a governor has left the College. Should any governor be involved in a safeguarding matter this may result in data being retained for an additional length of time in line with statutory requirements.
Information required for the Register of Interests
Your name, current employment; appointments (voluntary or otherwise); membership of professional bodies, groups or organisations; companies in which you hold an interest and any other interests not covered by the above.
We collect this information so that we can identify possible conflicts of interest, i.e. situations where your interests may (or may appear to) influence your decision making. For current Corporation governors this information will be published on the College’s external website and made available to the public on request.
We also collect data on third party payments to governors and payment of expenses.
Relevant information about payment of expenses to governors or related third parties is published in the Corporation’s annual reports and financial statements.
Lawful basis for processing
The Corporation processes this personal data and provides access to it on request because we are under a legal obligation to do so. The legal obligation was originally prescribed in regulations made by the Secretary of State under powers established by the Further and Higher Education Act 1992 and is contained in section 10 of the Corporation’s Instrument of Government. Furthermore the Corporation has a contractual requirement to publish related party payments and expenses under our funding agreement with the Education and Skills Funding Agency.
Retention
Personal data provided to the Corporation for the Register of Interests is retained for six complete financial years after the year in which a person has ceased to be a governor, to cover the normal period for any legal claims arising. This information also includes your contact details at the time when each declaration was made or updated.
Images
Images of you (photos or videos) may be used to promote the role and identity of governors inside the College and externally in publicity material, such as newsletters, press releases or on the internet (websites), to raise awareness of the work of the Corporation.
A photographic image with your name will be used to create your personal identification badge and as part of the governor’s information board located in the College. These images will be stored in a secure electronic database and may be used for publication (as described above) and may be viewed by the public.
Lawful basis for processing
The Corporation relies on your consent for processing your personal image. Consent must be freely given and can be withdrawn at any time by contacting the Clerk to the Corporation. If consent is withdrawn
Retention
Should you give consent, you should be aware that the College may continue to retain your images in printed media for up to 12 months after your appointment has termination or you have withdrawn your consent. This is because prospectuses and paper-based media are updated on an annual basis. Electronic copies will be securely disposed of in accordance with the Corporations disposal schedule.
The Chair of the Corporation
Your personal email address
This will be made available to the Education Skills Funding Agency (ESFA) and Further Education and Sixth Form College Commissioner on request, where they need direct contact with the Chair. We will always request that out of date data is deleted when we provide data about a new appointment. This information will be held securely and will not be made public.
Lawful basis for processing.
The Corporation has a contractual requirement to provide this information when a new Chair of the Corporation is appointed.
Retention
The Corporation maintains contact information for up to 2 years after a person has ceased to be the Chair of the Corporation.
Equal Opportunities Monitoring - special category data
The Corporation is committed to equal opportunities. This includes not discriminating under the Equality Act 2010, and building an accurate picture of the make-up of the Corporation in order to assist with governor succession planning and contributing to the achievement of the College’s equality objectives.
In order to monitor diversity effectively, it is necessary to collect personal information across all nine of the protected characteristics under the Equality Act 2010: age, sex, marital status, colour, nationality, ethnic origins, religion, sexual orientation or disability. This information will be held securely and will not be made public. The information will only be seen by the Clerk to the Corporation to aid with monitoring the diversity of the Corporation. Anonymised summary reports will be created to assist with governor succession planning.
Lawful basis for processing
The Corporation relies on your consent for processing this information. Consent must be freely given and can be withdrawn at any time by contacting the Clerk to the Corporation.
Retention
Individual returns will be securely held until a summary report has been created; this will normally mean that the information will be securely destroyed on the date of receipt.
Retention and Disposal
Retention
The Corporation’s full retention schedule specifies the way that data is categorised, the security applied to the data and the maximum period data should be kept for business and statutory purposes.
A copy of the schedule is available by contacting the Clerk to the Corporation
Disposal
Corporation’s disposal schedule details the date when documentation will be (or has been) destroyed and the chosen method of disposal. Personal data will be securely disposed of in accordance with the disposal schedule.
A copy of the schedule is available to view by contacting the Clerk to the Corporation.
Accuracy of data
Governors are responsible for updating the Clerk about changes to their data to ensure it is up to date and accurate.
We aim to notify governors within 7 working days if any revisions or additions are made to this notice.
Your legal rights
Our use of your data is subject to your legal rights of Inform, Access, Rectify, Erase, & Restrict. The GDPR includes a right for individuals to:
- be informed about the collection and use of your personal data (which is covered by this Privacy Notice)
- request access to information about you that we hold
- request that inaccurate personal data is rectified, if it is incorrect; or completed if it is incomplete. This may not always be possible if it relates to an official record.
- request that have personal data erased (‘the right to be forgotten’). This is not an absolute right and only applies in certain circumstances
- to request the restriction or suppression of your personal data, When processing is restricted, you are permitted to store the personal data, but not use it. This is not an absolute right and only applies in certain circumstances.
- withdraw consent (see below)
- complain to the Information Commissioner’s Office (see below)
In addition you have a right to request
- data portability i.e. to obtain and reuse your personal data for your own purposes. This only applies when consent is the basis for processing and when the data involves technology
- intervention in respect of automated decision making i.e. a decision solely by automated means without any human involvement
It should be noted that these two rights are unlikely to be relevant to colleges.
Subject access request
If you wish to make a request for your personal information, please contact the Clerk to the Corporation or the College’s Data Protection Officer using the contact details below.
Withdrawing consent
If you have given your consent and you wish to withdraw it please contact the Clerk to the Corporation or the College’s DPO using the contact details below.
Accessibility
Illustrative data flow documentation is available on request by contacting the Clerk to the Corporation [for contact details please refer to pg.6]. The illustrations aim to show in an elementary manner how each data type is processed, used, stored, transferred and where applicable retained.
Should you require a copy of this Privacy Notice or an extract thereof in an alternative format please contact the Clerk to the Corporation.
Queries and Concerns
If you have a query or concern regarding the way that we are asking for or processing your personal data, please contact the Clerk to the Corporation or the College’s Data Protection Officer
Clerk to the Corporation
Email: johnsont@colchsfc.ac.uk
Postal address: The Sixth Form College, North Hill, Colchester, CO1 1SN
Telephone: 01206 500532
Data Protection Officer
Email: dpo@colchsfc.ac.uk
Postal address: The Sixth Form College, North Hill, Colchester, CO1 1SN
Telephone: 01206 500700
Information Commissioner
If you still have concerns following the Data Protection Officer's response you have the right to contact the Information Commissioner’s Office
Online:
Telephone: 03031231113