Privacy and cookies

Student Privacy Notice

1 Student Privacy Notice (How we use student information)   

This privacy notice explains how The Sixth Form College, Colchester collects, uses and shares and processes your personal data, including special categories of personal data, and your rights in relation to the personal data we hold. 

This privacy notice concerns our processing of personal data, including special categories of personal data, of past, present and prospective students of The College.   

The Sixth Form Colleges Trust is the data controller of your personal data and is subject to current UK Data Protection Legislation.

2 How we collect your information

We collect your personal and special category personal data in a number of ways. For example:

• From the information you provide to us when you interact with us before joining, for example, when you express your interest in studying at The College and apply for a place;
• When you enrol to study at the College and complete enrolment forms and other documentation related to our other admissions processes and procedures, including the provision of a photograph;
• When you communicate with us by telephone, email or via our website, for example, in order to make enquiries or raise concerns;
• In various other ways as you interact with us during your time as a student of The College, for the various purposes set out below;
• From third parties, for example from your previous or current school/ college, who provide a reference about you 
• From your previous school/college, who are required to pass on any safeguarding information about you

3 The types of information we collect

Whilst the majority of student information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with UK Data Protection Legislation, we will inform you whether you are required to provide certain student information to us or if you have a choice in this. We collect the following types of personal data about you:

• Your name, and contact information such as address, email address and telephone number, as well as your date of birth, country of domicile and your nationality. We will also allocate you a unique College student number;
• Information relating to your education /employment history (where applicable), the school(s), and other colleges you have attended and places where you have worked, the courses you have completed, dates of study and examination results (including your Unique Candidate Identifier number - UCI, Unique Learner Number - ULN). We will also keep records relating to assessments of your work, details of examinations taken, your predicted and actual examination grades and other information in your student record;
• Data from government agencies i.e. POLAR scores, value added projected grades etc;
• Your photo for use on college ID lanyards and for identification purposes.
• Attendance information (such as sessions/ lessons attended, number of absences and absence reasons)
• Data on the use of email and access to the internet
• Information about your family or personal circumstances, and both academic and extracurricular interests, for example, where this is relevant to the assessment of your suitability to receive a bursary and ‘free school meal eligibility’, or in order to provide you with appropriate pastoral care;
• Special categories of personal data, include:
  • Information concerning your health and medical conditions (e.g. disability and dietary needs);
  • Special Educational Needs (examination arrangements and other learning support requirements)  
  • Information about criminal convictions and offences;
  • Information about your racial or ethnic origin; native languages; religion or similar beliefs.
  • Characteristics such as disability, gender and sexual orientation.
  • Safeguarding information

 

4 How we use information about our students

The purposes for which we use and collect personal data (including special categories of personal data) during a student's association with us include:

• Recruitment and admissions;
• Enrolment;
• Academic matters, including:

• The provision of our core teaching, learning services (e.g. registration, assessment, attendance, managing and monitoring progress (including communication with parents/careers), student behaviour, examination entries and publication of results).
• Maintaining student records;
• Assessing yur eligibility for bursaries and access to other sources of financial support.

• Providing library, IT and information services, student ID purposes;
• Non-academic matters in support of our core services, including:

• Providing student support services (e.g. through pastoral support and personal development, disability and additional learning support, careers and employability support)
• Equality and diversity monitoring
• Safeguarding and promoting the welfare of students;
• Ensuring students' safety and security i.e. photo ID/wearing of lanyards;
• Managing the use f social media;

• Administering finance (e.g. fees, scholarships and bursaries);
• Other administrative purposes, including:

• Carrying ut research and statistical analysis;
• Carrying ut audits (e.g. to ensure compliance with our regulatory and legal obligations);
• Providing operational information (e.g. providing IT support, information about building closures or access restrictions on campus, or safety advice);
• Promoting our services (e.g. providing information and publicity about events happening on and off college premises);
• Preventing and detecting crime;
• Dealing with grievances and disciplinary actions;
• Dealing with complaints and enquiries.
• Assessing the quality f our services
• To comply with the law regarding data sharing

Personal data (including subjects achieved and first destinations) will be published in the College Student Reunion and Awards booklet. This information will also be passed to third parties involved in the ceremonies (including schools and award sponsors). All published details will be available on our website following the relevant events.

(You can withhold your consent to your name being published for the Reunion and Awards booklet when you register online to attend the award ceremony).

Photographs of students play a significant role in college marketing and publications, both online and in print. Any student enrolled at college does so on the understanding that their image may be used in such a fashion. The College does, however, wish to respect student wishes in such matters, and college staff will, wherever reasonably practical, ask permission before taking student photographs - students are welcome to refuse such permission.  It is the case that, in other contexts (for example, when students appear in the background or crowd at a large event) it will be less easy for individual permission to be sought; such situations are governed by the student learning agreement, which gives the college permission to make use of such images.

Students may also request that photographs be removed (for example, from our website or social media) and, wherever possible, the college will make efforts to do so. Photos published in other contexts (e.g. the prospectus and other print publications, online newspapers etc). may, however, be impossible to remove.

5 The lawful basis for processing and using your information.

Personal Data

Depending on the processing activity, we rely on the following lawful basis for processing your personal data under UK GDPR  

We process your personal data on the basis of legitimate interest because it is necessary for the delivery of your education or in order to take steps at your request prior to joining the College. We also process your personal data on the basis of a contract, as when you apply to, and enrol at, college you enter into a contract of mutual obligation with the College.

In this respect, we rely on Article 6(1)(b) which relates to processing necessary for the performance of a contract for the following data activities:

• Interact with you before you are enrolled as a student, as part of the admissions process (e.g. to provide you with a prospectus or answer enquiries about our courses);
• To enrol you at the college
• Once you have enrolled, to provide you with the services as set out in your Learning Agreement;
• To deal with any concerns or feedback you have;
• For any other purpose for which you provide us with your personal data.
• To deal with concerns we have regarding attendance/fitness to study/wellbeing or health related issues.

We also process your personal data because it is necessary for the performance of tasks carried out in the public interest (Article 6(1)(e) or because it is necessary for our or a third party's legitimate interests (Article 6(1)(f) (e.g. compliance with the terms of the 1996 Education Act). In this respect, we use your personal data for the following:

• Returns to the Learning Records Service (LRS) to obtain or update Unique Learner Number (ULN) and Personal Learning Records (PLR).  Details can be found at  this government site.
• Returns to the ESFA (an executive agency of the Department for Education – DfE) for funding (ILR funding returns) and other statistical purposes. (See data available here - updated August 2024)
• To provide you with educational services which are not be set out in your Learning Agreement but which are nevertheless a part of our academic and educational mission;
• To monitor and evaluate the performance and effectiveness of the College, including by training our staff or monitoring their performance;
• To maintain and improve the academic, corporate, financial, estate and human resource management of the college;
• To promote equality and diversity throughout the college;
• To seek advice on our rights and obligations, such as where we require our own legal advice;
• Recovering money, you owe us

            Further, we process your personal data on the basis of vital interest (Article (1)(d) in order to protect your vital interests or those of another person, in order:;

• To meet our compliance and regulatory obligations, such as compliance with safeguarding requirements;
• In order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities.

And where:

• It is necessary for medical purposes (e.g. medical diagnosis, provision of health or social care or treatment, or a contract with a health professional);
• It is necessary to protect your or another person’s vital interests; or
• We have your specific or, where necessary, explicit consent to do so.

6 Special Categories of Personal Data 

The College collects personally sensitive data on all students e.g. your legal gender, special educational and learning needs, health records (including safeguarding) and ethnic origin, criminal convictions.

The College takes care in processing this data and only shares this data when there is an explicit or legal basis for doing so.  In processing the data, the College adheres to the principle of ‘Data Minimisation’, ensuring that what is shared is accurate, relevant and limited to what is necessary.

We process this data for reasons of substantial public interest, including: regulatory requirement, equality of opportunity or treatment, support for individuals with a particular disability or medical condition, counselling, safeguarding of children and individuals at risk, Safeguarding of economic wellbeing of certain individual and insurance.

We also collect and process special categories of personal data on the basis of legitimate interest because it is necessary for the delivery of your education (public task) or in order to take steps at your request.  

The additional legal basis for processing special categories of personal data that we rely on are:

• Article 9(2)(a) your explicit consent.
• Article 9(2)(b) which relates to carrying out our obligations and exercising our rights in the safeguarding of your fundamental rights.
• Article 9(2)(c) to protect your vital interests or those of another person where you are incapable of giving your consent.
• Article 9(2)(f) for the establishment, exercise or defence of legal claims
• Article 9(2)(g) – where processing is necessary for reasons of substantial public interest
• Article 9(2)(j) for archiving purposes in the public interest.

7 Storing student data

In line with the College retention policy and subject to any other notices that we provide to you, we retain your personal data, including special categories of personal data, for a period of six years after a student’s association with the College has come to an end.  For safeguarding information there is a requirement to keep relevant data until the person is 25 years of age or older, for instances where detailed information about activities in school and/or college may form an important part of safeguarding for that individual.  

Some information is retained indefinitely in order to maintain your academic record for archiving purposes.

8 Sharing information with others 

For the purposes referred to in this privacy notice and relying on the bases for processing as set out above, we share your personal data, including special categories of data, with certain third parties, including:

• Agents where there is a legitimate reason for their receiving the information, including:

• Third parties wh work with us to provide student support services (e.g. counselling, mental health and Safeguarding agencies);
• Internal and external auditors.
• Those with an interest in tracking student progress and attendance, including:
• Current r potential employers (to provide references)

• Government departments and agencies where we have a statutory obligation to provide information (e.g. the ESFA, the Home Office (in connection with UK visas and immigration), Council Tax and Electoral Registration Officers at relevant local authorities (for the purpose of assessing liability for Council Tax and for electoral registration purposes));
• Crime prevention or detection agencies (e.g. the police, the Department for Work and Pensions and Trading Standards);
• Parents and carers (where there is a legitimate reason for disclosure);
• Third parties conducting surveys, e.g. QDP Services – Learner Satisfaction Survey, Alps and Six Dimensions;
• Microsoft for cloud data storage and authentication;
• CEDAR for reporting purposes.
• If we hold safeguarding information about you and you leave College and enrol with a different education provider before the age of 18, we will transfer the safeguarding file to the new setting, as required by law.

We routinely share student information with:

• The current school from which applicants are applying 
• Previous schools that students attended and universities, schools or colleges after leaving us
• Essex Local Education Authority (Essex LEA) 
• The Department for Education (DfE) 

9 Why we share student information

We do not share information about our students with anyone without their consent unless the law and our policies allow us to do so.

We share student’s data with the Department for Education (DfE) on a statutory basis (public task basis). This data sharing underpins college funding and educational attainment policy and monitoring.  

See link below for further details:

DFE Privacy Notice for Key stage 5 and Adult Education

We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE) using their powers under section 14 Education Act 2002, through the Education and Skills Funding Agency (ESFA).

Data collection requirements:

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the college ILR returns) see these government guidelines.

(For information regarding ILR please see appendix A)

10 Youth support services -Students aged 16+ 

We will also share certain information about students aged 16+ with our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996 (public task).

This enables them to provide services as follows: 

• Post-16 education and training providers
• Youth support services
• Careers advisers

11 The National Pupil Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies. 

We are required by law (public task), to provide information about our students to the DfE as part of statutory data collections such as the Individualised Learner Record (ILR). Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the NPD, see this NPD publication.

The department shares information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

• Conducting research or analysis
• Producing statistics
• Providing information, advice or guidance

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

• Who is requesting the data
• The purpose for which it is required
• The level and sensitivity of data requested: and 
• The arrangements in place to store and handle the data 

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

The following links may be useful:

More information about the Department for Education’s data sharing process.

Information about which organisations the department has provided pupil information, (and for which project)   

Contact DfE:

12 Requesting access to your personal data

Under the DPA you have the following rights:

• To obtain access to, and copies of, the personal data that we hold about you;
• To require that we cease processing your personal data if the processing is causing you damage or distress;
• To require us not to send you marketing communications.
• To require us to correct the personal data we hold about you if it is incorrect;
• To require us to erase your personal data;
• To require us to restrict our data processing activities (and, where our processing is based on your consent, you can withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal);
• To receive from us the personal data we hold about you which you have provided to us in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller;
• To object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights.

Please note that the above rights are not absolute, and we are entitled to refuse requests where exceptions apply.

If you have given your consent and you wish to withdraw it, please contact our Data Protection Officer using the contact details set out below. Please note that where our processing of your personal data relies on your consent and where you then withdraw that consent, we may not be able to provide all or some aspects of our services to you and/or it may affect the provision of those services.

Under data protection legislation, you have the right to request access to information about you that we hold. To make a request for your personal information, contact the College’s Data Protection Officer (DPO) via email:  dpo@colchsfc.ac.uk

13 Changes to your personal data

Please tell us promptly about any changes to the information we hold about you. This is particularly important for your contact details. You can do this via your personal or senior tutor. 

14 Contact

If you would like to discuss anything in this privacy notice, please contact our Data Protection Officer by email: dpo@colchsfc.ac.uk

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office.

Appendix A – ILR Privacy Notice 2024 to 2025 version 1 January 2024

How We Use Your Personal Information

This privacy notice is issued by the Education and Skills Funding Agency (ESFA) on behalf of the Secretary of State for the Department of Education (DfE) to inform learners about the Individualised Learner Record (ILR) and how their personal information is used in the ILR. Your personal information is used by the DfE to exercise our functions under article 6(1)(e) of the UK GDPR and to meet our statutory responsibilities, including under the Apprenticeships, Skills, Children and Learning Act 2009. Our lawful basis for using your special category personal data is covered under Substantial Public Interest based in law (Article 9(2)(g)) of GDPR legislation. This processing is under Section 54 of the Further and Higher Education Act (1992).

The ILR collects data about learners and learning undertaken. Publicly funded colleges, training organisations, local authorities, and employers (FE providers) must collect and return the data to the ESFA each year under the terms of a funding agreement, contract or grant agreement. It helps ensure that public money distributed through the ESFA is being spent in line with government targets. It is also used for education, training, employment, and well-being purposes, including research.

We retain your ILR learner data for 20 years for operational purposes (e.g. to fund your learning and to publish official statistics). Your personal data is then retained in our research databases until you are aged 80 years so that it can be used for long-term research purposes. For more information about the ILR and the data collected, please see the ILR specification.

ILR data is shared with third parties where it complies with DfE data sharing procedures and where the law allows it. The DfE and the English European Social Fund (ESF) Managing Authority (or agents acting on their behalf) may contact learners to carry out research and evaluation to inform the effectiveness of training.

For more information about how your personal data is used and your individual rights, please see the DfE Personal Information Charter and the DfE Privacy Notice.

If you would like to get in touch with us or request a copy of the personal information DfE holds about you, you can contact the DfE in the following ways:

• Using our online contact form 
• By telephoning the DfE Helpline on 0370 000 2288
• Or in writing to: Data Protection Officer, Department for Education (B2.28), 7 & 8 Wellington Place, Wellington Street, Leeds, LS1 4AW

If you are unhappy with how we have used your personal data, you can complain to the Information Commissioner’s Office (ICO) at:
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You can also call their helpline on 0303 123 1113 or visit the ICO website

Date last updated: 31 Jan 2024