PRIVACY NOTICE - STUDENTS

Transcription

1 Page: 1 f 8 1. Scpe All student data subjects whse persnal data is cllected, in line with the requirements f the GDPR. 2. Respnsibilities 2.1 The Data Prtectin Officer / GDPR Owner is respnsible fr ensuring that this ntice is made available t data subjects prir t Leeds City Cllege cllecting/prcessing their persnal data. 2.2 Leeds City Cllege wh interact with data subjects are respnsible fr ensuring that this ntice is drawn t the data subject s attentin and their cnsent t the prcessing f their data is secured. 3. Privacy ntice 3.1 Wh are we? Leeds City Cllege is the largest Further educatin establishment in the City f Leeds, West Yrkshire, England, with arund 33,000 students, 1,300 staff. Leeds City Cllege ffer a wide range f FE and HE Curses. Our Data Prtectin Officer / GDPR Owner and data prtectin representatives can be cntacted directly here: (graham.eland@leedscitycllege.ac.uk) ( ) The persnal data we wuld like t cllect frm yu is: Persnal data type: Surce (where Leeds City Cllege btained the persnal data frm if it has nt been cllected directly frm yu, the data subject. Nte if the persnal data has been accessed frm publicly accessible surces): persnal details (Name, address, date f birth) family details lifestyle and scial circumstances financial details

2 Page: 2 f 8 educatin and emplyment details student recrds visual images (CCTV, Phtgraphs) physical r mental health details racial r ethnic rigin religius r ther beliefs trade unin membership ffences and alleged ffences criminal prceedings, utcmes and sentences The persnal data we cllect will be used fr the fllwing purpses: Student Recrds Management Examinatins and Achievement Safeguarding Funding Claims Student Supprt Student Learning IT Systems ( , strage, e-learning) Marketing and Publicity We smetimes need t share the persnal infrmatin we prcess with the individual themself and als with ther rganisatins. Where this is necessary we are required t cmply with all aspects f the GDPR. What fllws is a descriptin f the types f rganisatins we may need t share sme f the persnal infrmatin we prcess with fr ne r mre reasns. Where necessary r required we share infrmatin with: family, assciates and representatives f the persn whse persnal data we are prcessing prfessinal advisers current, past r prspective emplyers educatrs and examining bdies trade, emplyer and prfessinal rganisatins UCAS trade unins and staff assciatins vluntary and charitable rganisatins healthcare, scial and welfare rganisatins suppliers

3 Page: 3 f 8 financial rganisatins survey and research rganisatins persns making an enquiry r cmplaint careers service press and the media lcal and central gvernment security rganisatins plice frces, prisn and prbatin services, curts and tribunals suppliers and service prviders Our legal basis fr prcessing the persnal data: Leeds City Cllege prcesses data in rder t fulfil cntractual bligatins such as Educatin and Skills Funding Agency (ESFA) Higher Educatin Funding Cuncil Fr England (HEFCE) West Yrkshire Cmbined Authrity (WYCA) Exam Bards (OCR, AQA, City and Guilds, Pearsn, Edexcel, AAT, Certa, NCFE, CIPS) Healthcare, scial and welfare rganisatins Plice frces, curts and tribunals Lcal and central gvernment Privacy ntice fr this persnal data prcessing is recrded n Leeds City Cllege Website (GDPR REC 4.1) 3.2 Cnsent By cnsenting t this privacy ntice yu are giving us permissin t prcess yur persnal data specifically fr the purpses identified. Cnsent is required fr Leeds City Cllege t prcess bth types f persnal data, but it must be explicitly given. Where we are asking yu fr sensitive persnal data we will always tell yu why and hw the infrmatin will be used. Yu may withdraw cnsent at any time by cmpleting the Data Subject Cnsent Withdrawal Frm available frm the Cllege Website GDPR DOC 2.7A.

4 Page: 4 f Disclsure Leeds City Cllege will nt pass n yur persnal data t third parties withut first btaining yur cnsent. The fllwing third parties will receive yur persnal data fr the fllwing purpse(s) as part f the prcessing activities: Third cuntry (nn- EU)/internatinal rganisatin Ggle Safeguards in place t prtect yur persnal data Certificatin t ISO/IEC Infrmatin Security standard. Retrieve a cpy f the safeguards in place here: Retentin perid Leeds City Cllege will prcess persnal data fr whilst yu are a student and will stre the persnal data fr a number f years. The retentin perid fr different classificatins f persnal data has been established in line with infrmatin management guidelines. Please refer t view GDPR DOC 2.3 data retentin perids. 3.5 Yur rights as a data subject At any pint while we are in pssessin f r prcessing yur persnal data, yu, the data subject, have the fllwing rights: Right f access yu have the right t request a cpy f the infrmatin that we hld abut yu. Right f rectificatin yu have a right t crrect data that we hld abut yu that is inaccurate r incmplete. Right t be frgtten in certain circumstances yu can ask fr the data we hld abut yu t be erased frm ur recrds. Right t restrictin f prcessing where certain cnditins apply t have a right t restrict the prcessing. Right f prtability yu have the right t have the data we hld abut yu transferred t anther rganisatin. Right t bject yu have the right t bject t certain types f prcessing such as direct marketing. Right t bject t autmated prcessing, including prfiling yu als have the right t be subject t the legal effects f autmated prcessing r prfiling. Right t judicial review: in the event that Organisatin Name refuses yur request under rights f access, we will prvide yu with a reasn as t why. Yu have the right t cmplain as utlined in clause 3.6 belw.

5 Page: 5 f 8 All f the abve requests will be frwarded n shuld there be a third party invlved (as stated in 3.4 abve) in the prcessing f yur persnal data. 3.6 Cmplaints In the event that yu wish t make a cmplaint abut hw yur persnal data is being prcessed by Leeds City Cllege (r third parties as described in 3.4 abve), r hw yur cmplaint has been handled, yu have the right t ldge a cmplaint directly with the supervisry authrity and Leeds City Cllege data prtectin representatives Data Prtectin Officer / GDPR Owner. The details fr each f these cntacts are: Cntact Name: Address line 1: Address line 2: Address line 3: Address line 4: Address line 5: Telephne: Supervisry authrity cntact details [Data Prtectin Officer (DPO)] / [GDPR Owner] cntact details Graham Eland Leeds City Cllege Park Lane Campus Leeds West Yrkshire LS3 1AA Graham.eland@leedscitycllege.ac.uk 3.7 Privacy statement Read mre abut hw and why we use yur data here 4. Online privacy statement Persnal data Under the EU s General Data Prtectin Regulatin (GDPR) persnal data is defined as: any infrmatin relating t an identified r identifiable natural persn ('data subject'); an identifiable natural persn is ne wh can be identified, directly r indirectly, in particular by reference t an identifier such as a name, an

6 Page: 6 f 8 identificatin number, lcatin data, an nline identifier r t ne r mre factrs specific t the physical, physilgical, genetic, mental, ecnmic, cultural r scial identity f that natural persn. Hw we use yur infrmatin This privacy ntice tells yu hw we, Leeds City Cllege, will cllect and use yur persnal data. Why des Organisatin Leeds City Cllege need t cllect and stre persnal data? In rder fr us t prvide yu with a service we need t cllect persnal data yur emplyment, curse studies and examinatins. In any event, we are cmmitted t ensuring that the infrmatin we cllect and use is apprpriate fr this purpse, and des nt cnstitute an invasin f yur privacy. In terms f being cntacted fr marketing purpses Leeds City Cllege wuld cntact yu fr additinal cnsent. Will Leeds City Cllege share my persnal data with anyne else? We may pass yur persnal data n t third-party service prviders cntracted t Leeds City Cllege in the curse f dealing with yu. Any third parties that we may share yur data with are bliged t keep yur details securely, and t use them nly t fulfil the service they prvide yu n ur behalf. When they n lnger need yur data t fulfil this service, they will dispse f the details in line with their prcedures. If we wish t pass yur sensitive persnal data nt a third party we will nly d s nce we have btained yur cnsent, unless we are legally required t d therwise. Hw will Leeds City Cllege use the persnal data it cllects abut me? Leeds City Cllege will prcess (cllect, stre and use) the infrmatin yu prvide in a manner cmpatible with the EU s General Data Prtectin Regulatin (GDPR). We will endeavur t keep yur infrmatin accurate and up t date, and nt keep it fr lnger than is necessary. Leeds City Cllege is required t retain infrmatin in accrdance with the law, such as infrmatin needed fr incme tax and audit purpses. Hw lng certain kinds f persnal data shuld be kept may als be gverned by specific educatinal requirements and agreed practices. Persnal data may be held in additin t these perids depending n individual business needs. Under what circumstances will Leeds City Cllege cntact me? Our aim is nt t be intrusive, and we undertake nt t ask irrelevant r unnecessary questins. Mrever, the infrmatin yu prvide will be subject t rigrus measures and prcedures t minimise the risk f unauthrised access r disclsure.

7 Page: 7 f 8 Can I find ut the persnal data that Leeds City Cllege hlds abut me? Leeds City Cllege at yur request, can cnfirm what infrmatin we hld abut yu and hw it is prcessed. If Leeds City Cllege des hld persnal data abut yu, yu can request the fllwing infrmatin: Identity and the cntact details f the persn r rganisatin that has determined hw and why t prcess yur data. In sme cases, this will be a representative in the EU. The purpse f the prcessing as well as the legal basis fr prcessing. If the prcessing is based n the legitimate interests f Leeds City Cllege r a third party, infrmatin abut thse interests. The categries f persnal data cllected, stred and prcessed. Recipient(s) r categries f recipients that the data is/will be disclsed t. If we intend t transfer the persnal data t a third cuntry r internatinal rganisatin, infrmatin abut hw we ensure this is dne securely. The EU has apprved sending persnal data t sme cuntries because they meet a minimum standard f data prtectin. In ther cases, we will ensure there are specific measures in place t secure yur infrmatin. Hw lng the data will be stred. Details f yur rights t crrect, erase, restrict r bject t such prcessing. Infrmatin abut yur right t withdraw cnsent at any time. Hw t ldge a cmplaint with the supervisry authrity. Whether the prvisin f persnal data is a statutry r cntractual requirement, r a requirement necessary t enter int a cntract, as well as whether yu are bliged t prvide the persnal data and the pssible cnsequences f failing t prvide such data. The surce f persnal data if it wasn t cllected directly frm yu. Any details and infrmatin f autmated decisin making, such as prfiling, and any meaningful infrmatin abut the lgic invlved, as well as the significance and expected cnsequences f such prcessing. What frms f ID will I need t prvide in rder t access this? Leeds City Cllege accepts the fllwing frms f ID when infrmatin n yur persnal data is requested: Passprt, driving licence, birth certificate, utility bill (frm last 3 mnths), etc.

8 Page: 8 f 8 Cntact details f the Data Prtectin Officer / GDPR Owner: Cntact Name: Address line 1: Address line 2: Address line 3: Address line 4: Address line 5: Telephne: Data Prtectin Officer / GDPR Owner cntact details Graham Eland Leeds City Cllege Park Lane Campus Leeds West Yrkshire LS3 1AA graham.eland@leedscitycllege.ac.uk Dcument Owner and Apprval The Leeds City Cllege Data Prtectin Officer is the wner f this dcument and is respnsible fr ensuring that this prcedure is reviewed in line with the review requirements f the GDPR. A current versin f this dcument is available t all members f staff and students n the Leeds City Cllege Staff and Student Intranets. This prcedure is issued n a versin cntrlled basis. Change Histry Recrd Issue Descriptin f Change Date f Plicy 1.0 Initial issue 14/11/