As a student of Plymouth College of Art your privacy is important to us. This privacy notice explains how the College collects, uses and shares your personal data and your rights in relation to the personal data we hold. This privacy notice concerns our processing of personal data of past, present and prospective students of Plymouth College of Art.
This privacy notice explains why we are asking you for particular data, how we will use it and how long we will keep it for.
Plymouth College of Art is the data controller of your personal data and is subject to the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act 2018. The College is registered with the Information Commissioner's Office (ICO) with the registration number Z677722X.
How do we collect your data?
We collect data to operate effectively and provide you the best experience at Plymouth College of Art. We may collect your personal data in a number of ways, for example:
- from the information you provide when you interact with us before joining - for example, when you express an interest in studying at Plymouth College of Art (e.g signing up to one of our Open Days)
- when you apply to study via the Universities and Colleges Admissions Service (UCAS) and when you complete other admissions processes
- when you communicate with us by telephone, email or via our website
- in various other ways as you interact with us during your time as a student
- from third parties, for example from your previous or current school, sixth form college, other college or employers who may provide a reference about you.
What data do we hold?
We collect a range of data from you at various stages of your journey with Plymouth College of Art, which under the GDPR are defined as personal data and sensitive personal data.
Personal data is data relating to a living individual who can be identified from that information or from that data and other information in the College’s possession (for example: name, address, telephone number, student number). It can also include expressions of opinions about an individual.
Sensitive data relates to racial or ethnic origin, religious beliefs, trade union membership, health, criminal convictions. Personal data concerning disability is sensitive data.
How long do we retain data?
We may retain your personal data for a period of six years after your association with us has come to an end. However, information such as your name and date of birth, course/programme studied and final grade will be retained indefinitely by us in order to maintain your academic record for archiving purposes.
How do we use your data?
The purposes for which we may use personal data (including sensitive personal data) we collect during your time with us include (but is not limited to):
- Progress on your course/programme, including:
- Providing IT, equipment resource and library services
- Providing student support services, including:
- Student wellbeing
- Additional learning support
- Careers and employability
- Monitoring equality and diversity
- Administering finance (e.g. fees, bursaries)
- Other administrative purposes, including:
- maintaining student records
- carrying out statistical analysis
- carrying out audits (e.g. to ensure compliance with our regulatory and legal obligations)
- promoting our services
- preventing and detecting crime
- dealing with grievances and disciplinary actions
- dealing with complaints and enquiries
The basis for processing your data
The College relies on several different legal basis depending on the processing being performed:
- Necessary for the progress of your studies - on many occasions the College will process your data to enable it to meet its commitments to you e.g. those relating to education and assessment.
- Necessary to comply with a legal obligation - the College may have legal obligations to provide your personal data to others e.g. the Office for Students (OFS), HESA and others.
- For the purpose of protecting the vital interest of yourself or another - sometimes in extreme circumstances the College will have to release information to protect your interests or the interests of others e.g. in medical emergencies.
Processing is necessary for the purposes of legitimate interest of the College or a third party subject to overridden interests of the data subject - the College (and sometimes third parties) has a broad legitimate interest in activities that connect to the activities and education of students. Subject to those interests not being overridden by the interests of fundamental rights and freedom of students, it will pursue those interests. A good example of this legitimate interest would be its Alumni activities.
- Consent - on specific occasions the College will only process certain data if you give consent.
How we share your data
For the purposes referred to in this privacy notice and relying on the bases for processing as set out above, we may share your personal data with certain third parties.
This list is not intended to be exhaustive but to give you an idea of the various kinds of processing of information which the College may need to undertake:
- our employees, agents and contractors where there is a legitimate reason for their receiving the information
- awarding bodies such as the Open University, University of the Arts London and Pearson
- those with an interest in tracking student progress and attendance, including:
- student sponsors (e.g. the Student Loans Company)
- current or potential education providers (for example, where you take part in an exchange programme as part of your course)
- current or potential employers (to provide references)
- government departments and agencies where we have a statutory obligation to provide information:
- the Office for Students (OfS)
- the Higher Education Statistics Agency (HESA)
- the Home Office (in connection with UK visas and immigration)
- solicitors/debt recovery agents/Courts (should you fall into arrears of payment to the College)
- council tax and electoral registration officers at Plymouth City Council (for the purpose of Council Tax and for electoral registration purposes)
- crime prevention or detection agencies (e.g. the police)
- parents, guardians, and next-of-kin (where there is a legitimate reason for disclosure)
- third parties conducting surveys, for example, the National Student Survey.
The College does not currently undertake any profiling activities or make automated decisions about you.
The College does not usually transfer your data to other countries. Where this situation may arise (e.g if you take part in an Erasmus or international exchange, or are involved in European or international project) we will contact you directly to seek consent to do this.
You have the following rights:
- To ask for a copy of the data we hold on you. This is known as the right of subject access.
- Rights to rectification and erasure. You have the right to correct any inaccurate personal data held by the College. Once information the College has collected is no longer necessary for the purpose for which it was collected and processed, you sometimes have the right to have your data erased.
- To ask us to stop processing your data temporarily if you think it is wrong until we work out what is correct
- To ask us to let you take a copy of your data in a portable format to another organisation
Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.
If you have given your consent and you wish to withdraw it, please contact our Data Protection Officer using the contact details set out below. Please note that where our processing of your personal data relies on your consent and where you then withdraw that consent, we may not be able to provide all or some aspects of our services to you and/or it may affect the provision of those services.
If you have any queries about this privacy notice or how we process your personal data, or to request access to the personal data that we hold about you, you can contact our Data Protection Officer at: Plymouth College of Art, Tavistock Place, Plymouth, PL4 8AT or email firstname.lastname@example.org.
If you are unsatisfied with the way in which we process your personal data, we ask that you let us know so that we can try and put things right. If we cannot resolve it you can make a complaint to the Information Commissioner.
You can find out more about your rights under data protection legislation from the Information Commissioner's Office website available at: www.ico.org.uk.