Print
Edinburgh College Privacy Notice
  • Student Enrolment Privacy Policy

    Who are we?

    We are Edinburgh College, and we’re respo​nsible for looking after the information you giv​e us when you enrol at Edinburgh College (under data protection law we are the Data Controller). Our address is: Milton Road Campus, 24 Milton Road East, Edinburgh EH15 2PP. Our designated Data Protection Officer (DPO) is Alice Wilson, who can be contacted by email at: DataProtection@edinburghcollege.ac.uk

    What is our commitment to you, and your personal data?

    ​​

    Edinburgh College is committed to protecting the privacy and security of your personal information.

    This privacy notice explains how we collect, use and share your personal data, and your rights in relation to the personal data we hold. (You can read more about these in “Your Rights” below).

    We will comply with the data protection principles of data protection law.

    We will:

    • Use your data in a lawful, fair and transparent way (lawfulness, fairness and transparency)
    • Collect it only for valid purposes, that we have clearly explained to you, and not use it for any purpose incompatible with the original purpose (purpose limitation)
    • Ensure it’s adequate and relevant to (and just enough to achieve) these purposes (data minimisation)
    • Ensure your data are accurate and up-to-date (accuracy)
    • Keep your data only as long as necessary for the purposes we collected it for (storage limitation)
    • Keep your personal data secure (security)

    What is "personal data"?

    Personal data is information which identifies you specifically, and also relates to your life (whether that’s your home life, education, business or job). We tell you about the specific items of personal data we collect from you below. When we completely anonymise your data (so that individuals cannot be identified) it stops being personal data.

    What is “special category data”?

    Some of your personal data (like your health information, religion, criminal convictions or ethnicity) is more sensitive – this is called “special category data” (we tell you which special category data we collect from you below). In most circumstances you do not have to provide this information (unless you are completing a PVG application, where you must supply this information).

    When you apply for certain specific special categories of Additional Support Funding (for example, because you’re eligible for additional help to travel to college due to a pre-existing health condition), the college must ask you to give us certain health details to process your application.

    Where you’ve agreed special college attendance arrangements with your Learning Development Tutor (under the college’s Flexible Attendance Policy) you will need to provide certain health information to your Learning Development Tutor (where this is the reason for the putting the special attendance arrangement in place). If you receive discretionary funding your Learning Development Tutor will inform the college’s Student Funding Team that you have agreed flexible attendance, but will not pass on details of your health condition.

    What information do we collect about you?

    Personal dataSpecial category data (only where you provide this; or it is required by law*)
    Name, address, telephone number, email addressGender (and gender identity)
    Date of birthSexual orientation
    NationalityReligion or religious denomination
    Next of kin and emergency contact detailsEthnicity
    Employer detailsDisability & health data (including mental health)
    National Insurance Number (Modern Apprentices only)Marital/civil partnership status
    Bank account detailsSpecial interest group status (e.g. asylum seeker; refugee; care-experienced; stateless person; veteran; person with profound or complex needs).
    Previous education, qualifications and employment history*Offences and alleged offences (for the purposes of PVG checks)
    Employment status (e.g. jobseeker) and history*Criminal proceedings, outcomes and sentences (for the purposes of PVG checks)
    Course and units of study (including previous courses of study)
    Assessment information related to your course, including assessment and exam dates and results
    Disciplinary information
    Appeals and complaints information
    Attendance data
    Financial information
    Personal financial circumstances (including family)
    Photographic footage
    Passport number and country of domicile
    Your IP Address (your unique online identifier when browsing the internet).
    Your unique student ID
    If you are a carer or have caring responsibilities
    First/preferred language
    Pregnancy and maternity information

    How do we collect your personal data?

    • When you first apply for a place on an Edinburgh College course, we will collect data about you on our application form (we explain this in our Application Privacy Notice).
    • When you formally enrol on a course by completing our self-enrolment form, we give you the chance to check some of the personal information you provided at application stage; and we also ask you for new items of personal information.
    • If you’re a private individual (or company) purchasing a course.
    • When you apply for discretionary funding (including bursaries, Educational Maintenance Allowance, childcare or discretionary funding); we will use information you have already provided at application and enrolment stage; together with information we’ll ask you to provide on our discretionary funding application forms.

    Why do we need the information we’re asking for?

    For Academic purposes

    For academic purposes: to provide you with teaching, learning and support services; to assess your work; record your progress and ensure you receive certificates from awarding bodies like SQA and BTEC.

    We collect and use your information to:

    • Enrol you as a student
    • Administer our programmes of study, including funding and fee arrangements
    • Monitor your performance and attendance, supervise, conduct assessments and examinations, confer Edinburgh College awards; and provide awarding bodies with assessment results to enable them to confer awards.
    • To give you access to Student Support, IT, library, careers, and other college services.
    • To give you access to learning and teaching tools (including online tools) used as part of your course (e.g. Moodle, Mahara, Turnitin)
    • Deal with appeals, complaints and disciplinary matters promptly and fairly
    • Provide academic guidance and enable you to communicate with staff, your student representatives and fellow students on your programme of study
    • Invite you to college graduation ceremonies
    • Seek your feedback on our courses
    • Communicate with you about learning, teaching, student support, graduation (and FE awards events)

    What’s our legal basis for using your personal information?

    We’re collecting your personal information for the academic purposes above, as part of our Public Task (this is called a “condition for processing” and we need one of these under data protection law to allow us to process your information lawfully). The Post-16 Education (Scotland) Act 2013 allows Edinburgh College to run educational courses, and to provide support services, for students.

    The Data Protection Act 2018 allows us to process your health and other special category data, when we’re specifically providing student support services or making adjustments during your course in relation to any disabilities, because this is set out in statute (law) (the Post-16 Education (Scotland) Act 2013) .

    We also use your health and other special category data (e.g. ethnicity, sexual orientation, race) to carry out statistical analysis (where you provide this information) to ensure we’re advancing equality of opportunity and treatment for all student groups; the Data Protection Act 2018 allows us to process your information for this purpose (but only where you’ve chosen to provide this data).

    For administrative and financial management services

    For administrative and financial management services: to administer fees due and paid for by you and to process payment made for other college related services (for example accommodation); to provide eligible students with childcare and other discretionary funding.

    We collect and use your information to:

    • Administer and collect payment of course fees from you, or an employer
    • Process payments for additional college services like accommodation; graphics and printing services; and library fines
    • Assess your entitlement to student support payments (like Education Maintenance Allowances (EMAs), Childcare Fund payments, bursaries and discretionary funds) and make arrangements for the payment of these to you in the event you are successful.
    • Communicate with you in connection with administrative and financial services.

    What’s our legal basis for using your personal information?

    Where we are collecting your data to ensure payment of course fees, to provide accommodation, graphics and printing services, or library fines we need to process your data to fulfil a contract you have entered into with us.

    Where we’re using your personal information to provide you with a bursary, an EMA, childcare funding or discretionary funding we’re doing this as part of our Public Task. This comes from the Education Student Loans Scotland Regulations (2002); the Education (Access Funds) Scotland Determination (2014); and the Education Maintenance Allowances (Scotland) Regulations 2007.

    To meet our duty of care to you and other legal obligations

    To meet our duty of care to you and other legal obligations: to comply with a legal obligation; protect your vital interests in an emergency; exercise or defend legal claims or comply with court judgements; and protect public health.

    We collect and use your information to:

    • Meet our legal duty of care to you under health and safety and safeguarding laws;
    • Protect your vital interests or someone else’s e.g. in a medical emergency;
    • Provide health and counselling services
    • Comply with a statutory obligation (e.g. under tax or immigration law; as part of the Protection of Vulnerable Groups (PVG) Act 2007).
    • Meet our obligations under equality law. Under the UK Equality Act 2010 we need to collect special category personal data about our students to assist with monitoring equality of opportunity and eliminating unlawful discrimination. We hold this information in strictest confidence and disclose it to bodies with a statutory duty to collect it (i.e the Scottish Funding Council). You can choose whether you want to provide information for this purpose.
    • If a student or applicant declares they have a disability, we have a duty to disclose this information on a need-to-know basis to staff to ensure that reasonable adjustments are made, enabling disabled students to meet their full academic potential.

    What’s our legal basis for using your personal information?

    To:

    • Comply with a legal obligation (e.g. providing your personal data, including equality and health information, to the Scottish Funding Council for funding and equalities monitoring purposes).
    • Protect vital interests in an emergency (e.g. if you are unwell and an ambulance is required; or if we have a safeguarding concern about a student)
    • Exercise or defend legal claims or comply with court judgements

    For public safety and the prevention and detection of crime

    For public safety and the prevention and detection of crime: where this is necessary for the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against and the prevention of threats to public security.

    Processing your personal data for these purposes includes:

    • Use of CCTV to monitor and collect visual images
    • Monitor use of IT facilities
    • Apply security and welfare measures for the safety and security of students and the wider College community under health and safety and other relevant laws

    What’s our legal basis for using your personal information?

    Where this is necessary for the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against and the prevention of threats to public security

    To promote the college

    To promote the college: we may take photographs, and other images and recordings of students for possible use in our publicity and promotional material in print and online on our websites and social media. We would also like to inform you of other college services (including the gym and college restaurants); and college events; for direct marketing purposes.

    Processing your personal data for these purposes includes:

    • We will take photographs of students at events including Graduation, Open Days, and our FE Awards ceremony. Where you are the subject of the photo we will ask for your consent before using your image in our publicity and promotional material (which will include print and online material - both on our website and on social media).
    • Where you are not the subject of a photograph or film, but are included in a group setting (e.g. as part of the crowd at graduation) we will make you aware of the filming and photography and give you the chance to object/not be filmed/photographed.
    • We will keep copies of promotional material in our archives as a record of the College’s activities.
    • We will keep you informed of additional college services (like the gym, and our restaurants) and college events which may be of interest to you (but only where you have given your consent to receive direct marketing).

    What’s our legal basis for using your personal information?

    Where we have your consent (where you are the subject of the image/footage; or where we’ve asked you if you’re interested in receiving direct marketing); or because it is in the legitimate interest of the college to use your image in the promotion of its services (group photos and footage at graduation and college events. Where you object to being filmed or photographed as part of a record of college events, please inform a member of staff or following instructions on signage at events).

    How do I withdraw consent to a photograph, once I’ve given it?

    If you’ve completed a photographic consent form, but have changed your mind and want to withdraw your consent, please email: marketingteam@edinburghcollege.ac.uk

    How do I withdraw consent to direct marketing from Edinburgh College?

    If you’ve given your consent to receive direct marketing from Edinburgh College, please email: marketingteam@edinburghcollege.ac.uk

    For research

    For research: where this is necessary for statistical purposes and also research in the public interest.

    Processing your personal data for these purposes includes:

    • Surveying graduates from our full time programmes of study to find out if they entered work, further study, or are doing something else.
    • Producing management and statistical information to monitor and improve our performance and our services to you and inform strategic planning (e.g. for recruitment).

    What’s our legal basis for using your personal information?

    Where this is necessary for statistical and research purposes. The Scottish Funding Council require the College to survey its full time graduates to find out their destination after finishing their studies at Edinburgh College.

    Who your information will be shared with and why:

    We will share your personal data only where we must do so to comply with a legal obligation; or where sharing your personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Edinburgh College. Where sharing is not on the basis of one of the two reasons above, we will share your personal information only when we have your consent (for example, for direct marketing about college goods and additional services)

    Please be aware that we will appoint people and organisations to work for us, and contract them to act as data processors on our behalf. Examples of when we do this include: Moodle, plagiarism detection systems (Turnitin); and BePersonnel (to enable them to provide one to one tailored support where this has been identified as a requirement of your Personal Learning Support Plan).

    We will also share limited personal data where this is necessary for the following purpose:

    For academic purposes

    For academic purposes: such as providing the results of assessments to awarding bodies to enable them to confer you with academic awards (e.g. a HNC, SVQ, BTEC qualification); arranging an industry placement for you as part of your studies, to allow you to join the Edinburgh College Students’ Association (ECSA) or verifying your attendance and progress to your sponsor.

    Processing your personal data for these purposes includes:

    • Sharing your personal details and assessment results with awarding bodies (e.g. SQA, BTEC, City and Guilds) to enable them to confer awards upon you (e.g. HNC, HND certificate)
    • To deliver a programme collaboratively or jointly between the College and the partner institution, for example, a University.
    • To check that our assessment of your work is fair we will share information with external examiners.
    • To undertake official independent assessment of our programmes e.g. by the SQA, BTEC
    • To confirm your attendance, progress and assessment marks to your sponsor (e.g. your employer) or the institution through which you are studying.
    • To arrange a suitable industry placement if this is part of your course.
    • To publicise your award in our graduation programme and in the list of awards we provide in press releases to news media. (We will ask you for your consent for this).
    • To enable you to participate in the National Student Survey or other official surveys that give us your feedback on our academic quality and your student experience.

    Where we have a legal obligation

    Where we have a legal obligation: this will include sharing with emergency services in a medical emergency, or to assist police investigating a crime, or to provide local councils with information on your choice of course, attendance and progress, and whether you are facing any barriers to education (if you are a school leaver, or school-college partnership student).

    Processing your personal data for these purposes includes:

    • To help the emergency services (fire, police, ambulance) or a health professional to protect your vital interests or someone else’s e.g. in a medical emergency.
    • To administer your right to be a member of the Edinburgh College Student Association and vote in its elections.
    • Submitting statistical returns to the government or its agencies, including the Scottish Funding Council (SFC), Skills Development Scotland (SDS), and other official bodies. This will include sharing your special category data (where you’ve provided it) with the Scottish Funding Council for equality monitoring purposes; we will also share the destinations of full time graduates with the Scottish Funding Council, where graduates have agreed to take part in our survey.
    • To meet a statutory or regulatory obligation, (e.g. providing details on your course choice, progress, and any barriers to your local authority).
    • Confirming your eligibility for tuition fee funding with agencies including the Student Awards Agency for Scotland (SAAS), the Student Loans Company or your sponsor.
    • To comply with immigration laws. This involves disclosure and data sharing with UK Visas and Immigration authorities about applicants and students who are subject to immigration law.
    • To provide limited information necessary to an organisation with a statutory function, such as the police, where this is necessary for law enforcement.

    To enable you to access the services of Edinburgh College Development Trust

    To enable you to access the services of Edinburgh College Development Trust: including financial hardship and extra-curricular grants.

    Processing your personal data for these purposes includes:

    • Where you indicate you wish to receive direct marketing from Edinburgh College Development Trust, about their activities, we will share you contact preferences with them.
    • Where you are applying to the Edinburgh College Development Trust through the Green Project Fund we will share your forename, surname, contact details, and programme of study. Where you are applying to the Edinburgh College Development Trust through the McLeod Memorial Fund, we will also share your health and socio-economic circumstances, as part of the process of evaluating your application.
    • We will share you information with the Edinburgh College Development Trust either where this it required in order for you to enter into a contract with them (to access funding) or where we have your consent (to inform them of your direct marketing preferences).

    International Data Transfers

    As a global organisation we may process your personal information in a country outside the European Economic Area (EEA), when this is necessary to provide you with academic and support services, or fufil a contract with you.

    When doing so we will:

    • Make sure that appropriate safeguards are in place to protect your information and your rights under privacy law;
    • Apply the same high standards of privacy and security wherever we process your data.

    Your rights

    Because this is your personal information, you have rights under data protection law. You have the right to:

    • Be told what personal information Edinburgh College is keeping about you (this privacy notice)
    • Obtain a copy of the data, free of charge within one month of your request (known as a Subject Access Request)
    • Make Edinburgh College change any personal information that’s wrong, out of date or incomplete.
    • If it’s wrong or out of date, to stop us using your personal information until we’ve put it right.

    If you think we are acting unfairly or unlawfully you can:

    • Object to the way we are using your data, by contacting Edinburgh College’s Information Management team by emailing DataProtection@edinburghcollege.ac.uk or you can speak to the team on 0131 297 8663. The team will be happy to help; but we also have an independent Data Protection Officer (Alice Wilson) you can speak to if you’d prefer – we’ve included her details in a separate section below.
    • Complain to the UK Information Commissioner’s Office by calling their helpline on 0303 123 1113. (The Information Commissioner’s Office is the regulator and makes sure organisations across the UK treat your personal information properly).

    Under certain conditions you also have the right to ask:

    • To restrict the use of your data (e.g. if you have raised issues about the accuracy or use of your personal data, until we have investigated and responded to your concerns);
    • Erase your information, known as the ‘Right to be Forgotten’
    • Tell us to stop using your personal data to make decisions about you;
    • Tell us to comply with your wishes where you have previously consented to us processing your data for a particular purpose and have withdrawn your consent to further processing;
    • Provide you with a portable electronic copy of the data you’ve given us (data portability).

    Data Protection Officer and contact details

    Edinburgh College has an independent Data Protection Officer (Alice Wilson) you can speak to – she can be contacted via DataProtection@Edinburghcollege.ac.uk or 0131 297 8663.

    How long will we keep your data?

    We will keep information about you only for as long as needed to provide you with academic and support services and meet our legal obligations and rights.

  • Student Application Privacy Policy

    Edinburgh College is providing you with this information, as an applicant to one of our programmes of study, to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your personal data for the following purposes:

    To process your application to study one of our courses

    This will include reviewing your application to see if you have met the entry criteria for a course; and offering a place on an Edinburgh College course where appropriate (some courses will require you to attend an interview).

    Where you accept an offer of a place on an Edinburgh College course we will use your information to provide you with a timetable; provide you with other essential information required to begin your studies, and to invite you to a registration event.

    If your course requires you to have a Protecting Vulnerable Groups (PVG) check we will use the information you have supplied to arrange this with you directly.

    To review your student funding and childcare funding eligibility

    When you have been offered a place on an Edinburgh College course, if you choose to apply for funding, the college’s Student Funding Team will review your course and funding applications, and use the information provided about your education, location and personal circumstances to consider whether you are eligible for student funding support.

    When you accept an offer of a place on a Further Education (FE) course at Edinburgh College you will have the opportunity to apply for student funding on the EMA/Bursary and Childcare funding sections of the application website. If you choose to apply for funding you will receive an email asking you for documentary evidence to support your application. This email will give you instructions on how to supply this and about what will happen next. (Please note childcare funding can only be awarded for registered childcare costs whilst you are attending classes).

    If you accept a place on a Higher Education (HE) course you will have the opportunity to apply for childcare funding on the funding application website. If you choose to apply for funding you will receive an email asking you for documentary evidence to support your application. This email will give you instructions on how to supply this and about what will happen next. (Please note childcare funding can only be awarded for registered childcare costs whilst you are attending classes).

    To arrange payment of course fees

    If you or your employer are paying for your course of study, the college will contact you separately to request further information, including bank details (for example).

    If you are eligible for a fee waiver, and have been offered a place on an Edinburgh College course, the college will collect further information and evidence from you separately – this will either be through the course application system, or directly from you.

    If you have applied for an Individual Training Account to part pay your course fees you will be asked to provide the college with proof of income in the form of a P60 or your last three months’ payslips.

    To review any additional support needs you may have

    This application form gives you the opportunity to tell the college about any additional support need(s) you may have. The Learning Support Team contacts applicants who indicate an additional support need to provide them with information about learning support at college. This information is not used in any selection or allocation process.

    To analyse student applications for business, planning and equal opportunities purposes

    The college analyses student applications, including by key protected characteristic groups (including age; disability; gender reassignment; marriage and civil partnership; pregnancy and maternity; race; religion or belief; gender; and sexual orientation) to plan and improve its services and curriculum offering. Analysing applications by key protected characteristic groups forms part of the college’s responsibilities under the Public Sector Equality Duty, part of the Equality Act 2010. This information (where you choose to supply it) will not be used in any selecting or allocating process.

    To keep in touch with you about wider college activities (for marketing purposes)

    The college will inform you about the essential information you will need to begin your course. However, the college would also like to keep in touch with you, before you start your course, about wider events and activities across the college beyond your course of study – we will always ask for your consent to send you this additional information, and if you consent, you can withdraw this at any time by emailing Marketing@edinburghcollege.ac.uk

    To meet our responsibilities in relation to your school, local authority, and Skills Development Scotland

    If you are a “school leaver” (you are due to leave school and are applying for a college place whilst still at school) we will share basic information about the status of your application with Skills Development Scotland and in certain cases with school guidance teachers. This will be limited to the status/progress of your application.

    If you have been referred to the college by a local authority or local authority support service we will share basic information about the status of your application with that local authority/local authority support service. This will be limited to the status/progress of your application.

    We will share your personal data with other third parties (for example a parent or guardian if you are 16 or over) only where we have your consent.

    The college is required to provide certain information on “young people” (individuals aged 15 to 25) to Skills Development Scotland (SDS), to enable SDS to a). monitor that young person’s involvement in education or training; b) provide advice or support with regard to that young person’s training. This is explained in our information sharing section below.

    What personal data do we collect?

    Personal dataSpecial category data (only where you provide this; or it is required by law*)
    Name, primary & term address, telephone number, email addressGender (and gender identity)
    Date of birthSexual orientation
    NationalityReligion or religious denomination
    Next of kin and emergency contact detailsEthnicity
    Method of course payment (if applicable)Disability & health data (including mental health)
    National Insurance Number (Modern Apprentices; ESF-funded students; ITA-funded students only)Marital/civil partnership status
    Previous education (including Scottish Candidate Number), qualifications and employment historyPregnancy and maternity information
    Employment status (e.g. jobseeker) and historySpecial interest group status (e.g. asylum seeker; refugee; stateless person; person with profound or complex needs).
    Skills & experience (personal statement)*Offences and alleged offences (for the purposes of PVG checks where required)
    UK Visa status*Criminal proceedings, outcomes and sentences (for the purposes of PVG checks where required)
    Your IP Address (your unique online identifier when browsing the internet)
    Method of payment
    If you are a carer or have caring responsibilities
    Care experienced/looked after background status (if applicable)
    First/preferred language
    Residency information/date & reason of entry to UK/EU
    Veteran status

    How are we collecting this information? What is the source?

    We collect this information directly from you through the college’s application form (or directly from you, after you have submitted your application, in the circumstances explained below):

    If your course of study requires you to be subject to a PVG check we will collect further details directly from you, following submission of your application.

    If you apply for student funding we will use information from your application (name; date of birth; gender; address and course details) and collect additional information from you through the Student Funding Application Form – we will explain how we use that information in a separate privacy notice provided to you at that time.

    Where we need further information around the payment of your course fees, or your exemption from paying course fees, we will collect this information from you separately. (Please note, fee-waiver evidence will be collected through the college’s application form for certain courses).

    If you enrol on an Edinburgh College course we will confirm the information you have provided via our self-enrolment form (you will be provided with a link to our enrolled students’ privacy notice at that point).

    The lawful basis for the processing

    For processing of your personal data in order to process your application, the lawful basis is GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The specific law authorising this is the Post-16 Education (Scotland) Act 2013.

    Where your special category personal data are processed, the lawful basis is GDPR Article 9(2)(g) “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”.

    Where the college processes your special category data specifically to provide learning support, the specific law authorising this is the Post-16 Education (Scotland) Act 2013.

    Where applicants’ special category demographic information (gender identity, sexual orientation, race, ethnicity) are processed for the purposes of analysis in order to advance equality of opportunity and treatment for all student groups, the specific law authorising this is the Equalities Act 2010 (but only where you’ve chosen to supply this information).

    Where your personal data are shared with your school or local authority for the purposes of updating them on your application status, the specific law authorising this is the Education (Scotland) Act 1980.

    Where your personal data are shared with Skills Development Scotland, the specific law authorising this is the Post-16 Education (Scotland) Act 2013 and specifically the Young People's Involvement in Education and Training (Provision of Information) (Scotland) Order 2014.

    Who we share the information with:

    The college shares your information with the following data controllers:

    Your local authorities and/or school (where you are a school leaver, or have been referred to the college via a local authority department or support service)

    Skills Development Scotland: if you are aged 15-25 the college is required to provide the following information to Skills Development Scotland via a secure data hub: your name, address, telephone number, date of birth, Scottish Candidate Number; course information (including start and end date); application/enrolment status; course withdrawal or completion information.

    Data processors:

    The college uses the following data processors to process your personal information:

    Unit-E and CAMS are provided by third party suppliers, to process student applications and student funding applications. These are hosted by Edinburgh College and sit within the college’s technical controls.

    How long do we hold the personal data?

    Paper application forms deleted after seven years; personal data will remain on the college’s Student Record System in line with the college’s retention schedule.

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice); right of access; right of rectification; right of erasure (commonly known as the right to be forgotten); right to restrict processing; right to object; right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing and the College would be required to process your request in one month.

    The rights that apply for this particular processing are:

    • Right to be informed – this privacy notice addresses this.
    • Right of access – you can request access and copies of your personal data held by the college. To do this, please email the DataProtection@edinburghcollege.ac.uk and your request will be processed accordingly.
    • Right to rectification – you can request that inaccurate or incomplete personal data is rectified.
    • Right to Erasure (this right is not absolute and is subject to specifics of the request).
    • Right to object (including to direct marketing). The right to object to direct marketing is absolute and will be responded to accordingly.
    • Right to data portability (this right is not absolute and is subject to specifics of the request).

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • Progressing and Continuing Student Application Privacy Notice

    Privacy Notice for Progressing Students

    Edinburgh College is providing you with this information to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your personal data for the following purposes:

    To process your application to study one of our courses

    This will include reviewing your application to see if you have met the entry criteria for a course; and offering a place on an Edinburgh College course where appropriate (some courses will require you to attend an interview).

    Where you accept an offer of a place on an Edinburgh College course we will use your information to provide you with a timetable; provide you with other essential information required to begin your studies, and to invite you to a registration event.

    If your course requires you to have a Protecting Vulnerable Groups (PVG) check we will use the information you have supplied to arrange this with you directly.

    To review your student funding and childcare funding eligibility

    When you have been offered a place on an Edinburgh College course, if you choose to apply for funding, the college’s Student Funding Team will review your course and funding applications, and use the information provided about your education, location and personal circumstances to consider whether you are eligible for student funding support.

    When you accept an offer of a place on a Further Education (FE) course at Edinburgh College you will have the opportunity to apply for student funding on the EMA/Bursary and Childcare funding sections of the application website. If you choose to apply for funding you will receive an email asking you for documentary evidence to support your application. This email will give you instructions on how to supply this and about what will happen next. (Please note childcare funding can only be awarded for registered childcare costs whilst you are attending classes).

    If you accept a place on a Higher Education (HE) course you will have the opportunity to apply for childcare funding on the funding application website. If you choose to apply for funding you will receive an email asking you for documentary evidence to support your application. This email will give you instructions on how to supply this and about what will happen next. (Please note childcare funding can only be awarded for registered childcare costs whilst you are attending classes).

    To arrange payment of course fees

    If you or your employer are paying for your course of study, the college will contact you separately to request further information, including bank details (for example).

    If you are eligible for a fee waiver, and have been offered a place on an Edinburgh College course, the college will collect further information and evidence from you separately – this will either be through the course application system, or directly from you.

    If you have applied for an Individual Training Account to part pay your course fees you will be asked to provide the college with proof of income in the form of a P60 or your last three months’ payslips.

    To analyse student applications for business, planning and equal opportunities purposes

    The college analyses student applications, including by key protected characteristic groups (including age; disability; gender reassignment; marriage and civil partnership; pregnancy and maternity; race; religion or belief; gender; and sexual orientation) to plan and improve its services and curriculum offering. Analysing applications by key protected characteristic groups forms part of the college’s responsibilities under the Public Sector Equality Duty, part of the Equality Act 2010. This information (where you choose to supply it) will not be used in any selecting or allocating process.

    To keep in touch with you about wider college activities (for marketing purposes)

    The college will inform you about the essential information you will need to begin your course. However, the college would also like to keep in touch with you, before you start your course, about wider events and activities across the college beyond your course of study – we will always ask for your consent to send you this additional information, and if you consent, you can withdraw this at any time by emailing Marketing@edinburghcollege.ac.uk

    To meet our responsibilities in relation to your school, local authority, and Skills Development Scotland

    If you have been referred to the college by a local authority or local authority support service we will share basic information about the status of your application with that local authority/local authority support service. This will be limited to the status/progress of your application.

    We will share your personal data with other third parties (for example a parent or guardian if you are 16 or over) only where we have your consent.

    The college is required to provide certain information on “young people” (individuals aged 15 to 25) to Skills Development Scotland (SDS), to enable SDS to a). monitor that young person’s involvement in education or training; b) provide advice or support with regard to that young person’s training. This is explained in our information sharing section below.

    What personal data do we collect?

    Personal dataSpecial category data (only where you provide this; or it is required by law*)
    Name, primary & term address, telephone number, email addressGender (and gender identity)
    Date of birthSexual orientation
    NationalityReligion or religious denomination
    Next of kin and emergency contact detailsEthnicity
    Method of course payment (if applicable)Disability & health data (including mental health)
    National Insurance Number (Modern Apprentices; ESF-funded students; ITA-funded students only)Marital/civil partnership status
    Previous education (including Scottish Candidate Number), qualifications and employment historyPregnancy and maternity information
    Employment status (e.g. jobseeker) and historySpecial interest group status (e.g. asylum seeker; refugee; stateless person; person with profound or complex needs).
    Skills & experience (personal statement)*Offences and alleged offences (for the purposes of PVG checks where required)
    UK Visa status*Criminal proceedings, outcomes and sentences (for the purposes of PVG checks where required)
    Your IP Address (your unique online identifier when browsing the internet)
    Method of payment
    If you are a carer or have caring responsibilities
    Care experienced/looked after background status (if applicable)
    First/preferred language
    Residency information/date & reason of entry to UK/EU
    Veteran status

    How are we collecting this information? What is the source?

    We collect this information directly from you through the college’s application form (or directly from you, after you have submitted your application, in the circumstances explained below):

    If your course of study requires you to be subject to a PVG check we will collect further details directly from you, following submission of your application.

    If you apply for student funding we will use information from your application (name; date of birth; gender; address and course details) and collect additional information from you through the Student Funding Application Form – we will explain how we use that information in a separate privacy notice provided to you at that time.

    Where we need further information around the payment of your course fees, or your exemption from paying course fees, we will collect this information from you separately. (Please note, fee-waiver evidence will be collected through the college’s application form for certain courses).

    If you enrol on an Edinburgh College course we will confirm the information you have provided via our self-enrolment form (you will be provided with a link to our 'enrolled students' privacy notice at that point).

    The lawful basis for the processing

    For processing of your personal data in order to process your application, the lawful basis is GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The specific law authorising this is the Post-16 Education (Scotland) Act 2013.

    Where your special category personal data are processed, the lawful basis is GDPR Article 9(2)(g) “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”.

    Where the college processes your special category data specifically to provide learning support, the specific law authorising this is the Post-16 Education (Scotland) Act 2013.

    Where applicants’ special category demographic information (gender identity, sexual orientation, race, ethnicity) are processed for the purposes of analysis in order to advance equality of opportunity and treatment for all student groups, the specific law authorising this is the Equalities Act 2010 (but only where you’ve chosen to supply this information).

    Where your personal data are shared with your school or local authority for the purposes of updating them on your application status, the specific law authorising this is the Education (Scotland) Act 1980.

    Where your personal data are shared with Skills Development Scotland, the specific law authorising this is the Post-16 Education (Scotland) Act 2013 and specifically the Young People's Involvement in Education and Training (Provision of Information) (Scotland) Order 2014.

    Who we share the information with:

    The college shares your information with the following data controllers:

    Your local authorities and/or school (where you are a school leaver, or have been referred to the college via a local authority department or support service)

    Skills Development Scotland: if you are aged 15-25 the college is required to provide the following information to Skills Development Scotland via a secure data hub: your name, address, telephone number, date of birth, Scottish Candidate Number; course information (including start and end date); application/enrolment status; course withdrawal or completion information.

    Data processors:

    The college uses the following data processors to process your personal information:

    Unit-E and CAMS are provided by third party suppliers, to process student applications and student funding applications. These are hosted by Edinburgh College and sit within the college’s technical controls.

    How long do we hold the personal data?

    Paper application forms deleted after seven years; personal data will remain on the college’s Student Record System in line with the college’s retention schedule.

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice); right of access; right of rectification; right of erasure (commonly known as the right to be forgotten); right to restrict processing; right to object; right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing and the College would be required to process your request in one month.

    The rights that apply for this particular processing are:

    • Right to be informed – this privacy notice addresses this.
    • Right of access – you can request access and copies of your personal data held by the college. To do this, please email the DataProtection@edinburghcollege.ac.uk and your request will be processed accordingly.
    • Right to rectification – you can request that inaccurate or incomplete personal data is rectified.
    • Right to Erasure (this right is not absolute and is subject to specifics of the request).
    • Right to object (including to direct marketing). The right to object to direct marketing is absolute and will be responded to accordingly.
    • Right to data portability (this right is not absolute and is subject to specifics of the request).

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • Student Funding (Bursary, EMA, Childcare) Privacy Notice

    Edinburgh College is providing you with this information to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect and process your data for assessing eligibility for funding assistance and for management planning purposes. The following details this further explaining each purpose and how they relate to the different types of courses etc.

    To assess and process your application for student funding assistance

    Further Education (FE) courses:

    When you accept an offer of a place on a Further Education (FE) course at Edinburgh College you will have the opportunity to apply for student funding on the EMA/Bursary and Childcare funding sections of the application website. If you choose to apply for funding you will receive an email asking you for documentary evidence to support your application. This email will give you instructions on how to supply this and about what will happen next. (Please note childcare funding can only be awarded for registered childcare costs whilst you are attending classes).

    Higher Education (HE) courses:

    If you accept a place on a Higher Education (HE) course you will have the opportunity to apply for childcare funding on the funding application website. If you choose to apply for funding you will receive an email asking you for documentary evidence to support your application. This email will give you instructions on how to supply this and about what will happen next. (Please note childcare funding can only be awarded for registered childcare costs whilst you are attending classes).

    The assessment process:

    The assessment process will include reviewing your application and supporting documents to verify that you meet the eligibility criteria for funding; assessing your application for the correct level of funding in accordance with Scottish Funding Council policies, and issuing an award decision notice.

    In order to assess your eligibility and level of award the Student Funding Team will use the information you have provided about your education, location and personal circumstances to consider whether you are eligible for support. The Student Funding Team will also review the information you have provided on your course application, should it be necessary to do so. 

    For Childcare Funding applications the assessment process may also include contacting your childcare provider to confirm or clarify details of the childcare cost information they have provided in the Childcare Costing Document submitted with your application.

    To analyse student funding applications for planning purposes

    The college analyses student funding applications by award level and type for the purposes of budget planning, and to ensure the college is meeting Scottish Funding Council recommendations regarding priority groups (lone parents, young carers and care experienced students).

    What personal data do we collect?

    Personal data

    Special category data

    Name, primary & term address, telephone number, email address

    Gender (and gender identity)

    Date of birth

    Disability & health data (including mental health) when relevant to award

    Course information (course choice, mode and level)

    Marital/civil partnership status

    Previous education (including Scottish Candidate Number), qualifications and employment history

    Special interest group status (e.g. asylum seeker; refugee; stateless person; person with profound or complex needs).

    Previous funding history

    Nationality

    Employment status (e.g. jobseeker) and history

    Residency information/date, duration & reason of entry to UK/EU

    UK Visa status; Home Office status; EU residency (as required)

    Household composition and tax-year annual income of both student and relevant household members as applicable (also includes estrangement)

    Bank details

    If you are a carer or have caring responsibilities

    Care experienced/looked after background status (if applicable)

    Details of siblings/dependants/adult dependants where applicable and relevant

    Details of registered childcare provider and childcare provision required

    Your IP Address (your unique online identifier when browsing the internet).

    How are we collecting this information? What is the source?

    We collect this information directly from you through the college’s funding application form

    (or directly from you, after you have submitted your application, in the circumstances explained below):

    Student Funding

    If you apply for student funding we will use information from your course application (name; date of birth; gender; address; email address, phone number and course details) and collect additional information from you through the Student Funding application form.  You will be sent an email on submission of your online application form that will tell you about the supporting evidence you will need to provide in order to complete your application.

    Childcare Funding

    When we need further information about registered childcare costs, or need to verify the details of those costs (costs are verified three times a year in November, January and April), the college will contact your childcare provider directly. The information we will request is limited to: provider address and contact details; Care Commission registration number; start and end dates of provision; days, start and end time and daily cost of provision; details of Local Authority Partnership Funding being claimed by the provider (if any), contractual information (number of weeks of contract, holiday billing); bank details for payment of award.

    Change of circumstances

    Where you advise us of a change of address or change in circumstances, and we need further information about this to assess any change in eligibility, we will collect this information from you separately.

    The lawful basis for the processing

    For processing of your personal data in order to process your application, the lawful basis is GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The specific law authorising this is the Post-16 Education (Scotland) Act 2013 and underpinning legislation is described in further detail below.

    Where your special category personal data are processed, the lawful basis is GDPR Article 9(2)(g) “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”.

    Student funding legislation

    College governing bodies have power under section 12(2)(c) of the Further and Higher Education (Scotland) Act 1992 to provide students of the college such assistance of a financial or other nature as it considers appropriate. 

    It is a condition of the Education (Access Funds) (Scotland) Direction 2017, that SFC shall administer student support funds, in conjunction with the Post 16 education bodies, in accordance with the requirements of section 73ZA of the Education (Scotland) Act 1980, the Education (Access Funds) (Scotland) Regulations 1990, the Education (Access Funds) (Scotland) Determination 2013. 

    Who we share the information with

    The college shares your information with the:

    Scottish Funding Council (SFC): if you are awarded EMA, bursary or childcare funding the college is required to provide the following information to the Scottish Funding Council via secure data hub: your name, address, date of birth, course identifier, student matriculation number, total household income and details about the amount and type of funding you are in receipt of. This sharing is carried out securely and an appropriate data sharing agreement is in place between SFC and the College.

    The college uses the following data processors to process your personal information:

    Unit-E, TeQuios and CAMS systems are provided by third party suppliers (e.g. Capita Further and Higher Education), to process student applications and student funding applications. These are hosted by Edinburgh College and sit within the college’s technical controls. The college also has appropriate contracts in place with these third party suppliers

    How long do we hold the personal data?

    Paper and electronic records are destroyed after seven years; personal and award data will remain on the college’s Student Funding system in line with the college’s retention schedule.

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice); right of access; right of rectification; right of erasure (commonly known as the right to be forgotten); right to restrict processing; right to object; right to data portability and the right to know of any automated individual decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing and the College would be required to process your request in one month.

    The rights that apply for this particular processing are:

    • Right to be informed – this privacy notice addresses this.
    • Right of access – you can request access and copies of your personal data held by the college. To do this, please email the DataProtection@edinburghcollege.ac.uk and your request will be processed accordingly.
    • Right to rectification – you can request that inaccurate or incomplete personal data is rectified.
    • Right to Erasure (this right is not absolute and is subject to specifics of the request).
    • Right to object (including to direct marketing). The right to object to direct marketing is absolute and will be responded to accordingly.
    • Right to data portability (this right is not absolute and is subject to specifics of the request).

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:

    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • Student School-College Partnership (S4-S6) Privacy Notice

    Edinburgh College is providing you with this information, as one of our school-college partnership S4-S6 students, to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your personal data for the following purposes:

    To process your application to study one of our courses

    This will include reviewing your application and personal statement in order to offer you a place on an appropriate Edinburgh College course.

    To review any additional support needs you may have

    This application form gives you the opportunity to tell the college about any additional support need(s) you may have. This information is not used in any selection or allocation process.

    To analyse student applications for business, planning and equal opportunities purposes

    The college analyses student applications, including by key protected characteristic groups (including age; disability; gender reassignment; marriage and civil partnership; pregnancy and maternity; race; religion or belief; gender; and sexual orientation) to plan and improve its services and curriculum offering. Analysing applications by key protected characteristic groups forms part of the college’s responsibilities under the Public Sector Equality Duty, part of the Equality Act 2010. This information (where you choose to supply it) will not be used in any selecting or allocating process.

    To meet our responsibilities in relation to your school, local authority, and Skills Development Scotland

    We will share basic information about the status of your application with your local authority (for example City of Edinburgh Council; Midlothian and East Lothian councils) and your school. This will be limited to the status/progress of your application.

    We will share your personal data with other third parties (for example a parent or guardian if you are 16 or over) only where we have your consent.

    The college is also required to provide certain information on “young people” (individuals aged 15 to 25) to Skills Development Scotland (SDS), to enable SDS to a). monitor that young person’s involvement in education or training; b) provide advice or support with regard to that young person’s training. This is explained in our information sharing section below.

    What personal data do we collect?

    Personal dataSpecial category data (only where you provide this; or it is required by law*)
    Name, primary & term address, telephone number, email addressGender (and gender identity)
    Date of birthSexual orientation
    NationalityReligion or religious denomination
    Next of kin and emergency contact detailsEthnicity
    Previous education (including Scottish Candidate Number), qualifications and employment historyDisability & health data (including mental health); additional support need information
    School year at start of next academic session (i.e. S4, S5 or S6)Medical information and medication administration information
    Skills & experience (personal statement)Special interest group status (e.g. asylum seeker; refugee; stateless person; person with profound or complex needs).
    If you are a carer or have caring responsibilities
    Care experienced/looked after background status (if applicable)
    First/preferred language
    Additional learning support provided in class (e.g. scribe; 1-2-1; and Alternative Assessment Arrangements information (e.g. read or scribe in examinations)
    Evidence to support Alternative Assessment Arrangements (including examinations).
    Travel/transport to and from college arrangements

    How are we collecting this information? What is the source?

    We collect the majority of information directly from you through the college’s application form.

    However, information on any learning support provided at school and/or alternative assessment arrangements; and any medication you need to carry with you during your studies at college, will be supplied by your guidance teacher in a separate section of your application form.

    The lawful basis for the processing

    For processing of your personal data in order to process your application, the lawful basis is GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The specific law authorising this is the Post-16 Education (Scotland) Act 2013.

    Where your special category personal data are processed, the lawful basis is GDPR Article 9(2)(g) “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”.

    Where the college processes your special category data specifically to provide learning support, the specific law authorising this is the Post-16 Education (Scotland) Act 2013.

    Where applicants’ special category demographic information (gender identity, sexual orientation, race, ethnicity) are processed for the purposes of analysis in order to advance equality of opportunity and treatment for all student groups, the specific law authorising this is the Equalities Act 2010 (but only where you’ve chosen to supply this information).

    Where your personal data are shared with your school or local authority for the purposes of updating them on your application status, the specific law authorising this is the Education (Scotland) Act 1980.

    Where your personal data are shared with Skills Development Scotland, the specific law authorising this is the Post-16 Education (Scotland) Act 2013 and specifically the Young People's Involvement in Education and Training (Provision of Information) (Scotland) Order 2014.

    Who we share the information with

    The college shares your information with the following data controllers:

    Your local authority and/or school (for example: City of Edinburgh Council; Midlothian Council; East Lothian Council). This is provided through a secure ‘schools tracker’.

    Skills Development Scotland: the college is required to provide the following information to Skills Development Scotland via a secure data hub: your name, address, date of birth, Scottish Candidate Number; course information (including start and end date); application/enrolment status; course withdrawal or completion information.

    Data processors

    The college uses the following data processer to process your personal information:

    Unit-E is provided by a third party supplier, to process student applications. This software is hosted by Edinburgh College and sits within the college’s technical controls.

    How long do we hold the personal data?

    Personal data will remain on the college’s Student Record System in line with the college’s retention schedule.

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice); right of access; right of rectification; right of erasure (commonly known as the right to be forgotten); right to restrict processing; right to object; right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing and the College would be required to process your request in one month.

    The rights that apply for this particular processing are:

    • Right to be informed – this privacy notice addresses this.
    • Right of access – you can request access and copies of your personal data held by the college. To do this, please email the DataProtection@edinburghcollege.ac.uk and your request will be processed accordingly.
    • Right to rectification – you can request that inaccurate or incomplete personal data is rectified.
    • Right to Erasure (this right is not absolute and is subject to specifics of the request).
    • Right to object (including to direct marketing). The right to object to direct marketing is absolute and will be responded to accordingly.
    • Right to data portability (this right is not absolute and is subject to specifics of the request).

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • Privacy Notice for STEM Inspiration Experience (P7 & S1)

    Edinburgh College is providing you with this information, as one of our international students, to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your personal data for the following purposes:

    To enrol your child on Edinburgh College’s STEM Inspiration Experience day

    This will include enrolling your child on Edinburgh College’s Student Record System to enable them to participate in the STEM Inspiration Experience day. The college is also required to keep a record that your child attended the STEM Inspiration Experience Day, as required by the Scottish Funding Council for funding and audit purposes.

    To maintain a register of pupils who attended on the day (for health and safety purposes)

    This is to ensure the college has an accurate list of pupils who are physically on campus during a STEM Inspiration Experience day (for health and safety purposes).

    To maintain a register of school staff who are on campus during the day

    Teaching staff and pupil support assistants who are accompanying pupils during the day will be asked to enter their details on to the college’s visitors’ book.

    To analyse student participation in the STEM Inspiration Experience for business, planning and equal opportunities purposes

    The college analyses student enrolments to plan and improve its services and curriculum offering. Analysing STEM enrolments by gender (to consider any gender imbalance in STEM participation) forms part of the college’s responsibilities under the Public Sector Equality Duty, part of the Equality Act 2010. The college will also analyse enrolments to establish if pupils who participate in a STEM Experience Inspiration day ultimately choose to enrol at Edinburgh College upon leaving secondary education.

    To publicise and promote the STEM Inspiration Experience (but only where we have your consent to do so)

    The college will also ask for your consent to use photographic and video footage of your child during their participation in the STEM Inspiration Experience. The college will not gather this footage unless we have your consent to do so in advance. We explain how we ask for your consent (and how you can withdraw consent if you later wish to do so) below.

    What personal data do we collect?

    Personal data
    Personal data
    Name
    Date of birth
    Gender
    School postcode
    Image & video footage (only with consent – see below)

    How are we collecting this information? What is the source?

    Once you give your permission for your child to participate in a STEM Inspiration Experience day we will automatically collect their name, date of birth and gender, directly from your school, who will supply it to the college via email in a password-protected spreadsheet.

    We will separately ask for your consent to take and use photographs and footage of your child via a specific consent form provided to you via your child’s school. This form also includes a privacy notice explaining how the images/footage will be used in the event that you provide consent.

    The lawful basis for the processing

    Enrolment on STEM Inspiration Experience

    For the processing of your personal data in order to enrol your child on a STEM Inspiration Experience day and enable their participation in this educational experience, the lawful basis is GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The specific law authorising this is the Post-16 Education (Scotland) Act 2013.

    Sharing of required enrolment data by your child’s school

    Where your child’s data are shared with Edinburgh College, by their school, the lawful basis is GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The specific law authorising this is the Education (Scotland) Act 1980.

    Photography and filmed footage for Edinburgh College promotional purposes

    Where the college uses photographic images or video footage of your child participating in a STEM Inspiration Experience day, this will only be where you have provided consent. The lawful basis is GDPR Article 6(1)(a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”. If you have given consent to photography/filming, and wish to withdraw that consent, please email: communications@edinburghcollege.ac.uk

    Who we share the information with

    Data Controllers:

    The college shares your information with the following data controller:

    Scottish Funding Council: the college is required to provide your child’s name; date of birth; gender; and the postcode of their school to the Scottish Funding Council in line with their requirements for all pupils/students taking part in activities/programmes at Scottish colleges.

    Data processors:

    The college uses the following data processors to process your personal information:

    Unit-E (Edinburgh College’s Student Record System) is provided by a third party. The student record system is hosted by Edinburgh College and sits within the college’s technical controls.

    How long do we hold the personal data?

    Paper attendance registers, and personal data held on the college’s Student Record System will be deleted six years after the end of the current academic year (2019/2020).

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice); right of access; right of rectification; right of erasure (commonly known as the right to be forgotten); right to restrict processing; right to object; right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing and the College would be required to process your request in one month.

    The rights that apply for this particular processing are:

    • Right to be informed – this privacy notice addresses this.
    • Right of access – you can request access and copies of your personal data held by the college. To do this, please email the DataProtection@edinburghcollege.ac.uk and your request will be processed accordingly.
    • Right to rectification – you can request that inaccurate or incomplete personal data is rectified.
    • Right to Erasure (this right is not absolute and is subject to specifics of the request).
    • Right to object (including to direct marketing).

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk . If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:

    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • Student Personal Learning Support Plan Privacy Notice

    Edinburgh College is providing you with this information to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect this information to enable us to assess your learning support needs. The Learning Support Advisers (LSA) can then make recommendations to teaching staff and LDTs for reasonable adjustments that could be made in the classroom/learning environment and alternative arrangements for assessments. The LSA will also make notes in the PLSP of any future support meetings with you.

    What personal data do we collect?

    Personal dataSpecial Category Personal Data
    Name (first name, surname)Disabilities/Learning Support needs
    Date of BirthEvidence of disability
    Student Number
    Address
    Telephone number
    Email address
    Parent/Key worker (if applicable)
    Third Party Contact (if applicable)
    Course title
    Scottish Candidate Number
    Campus
    Carer
    Care experienced
    Education and qualifications history

    How are we collecting this information? What is the source?

    Most of the information is collected directly from the student but we also generate information by screening the student if they discloses dyslexia.

    The lawful basis for the processing

    Under data protection law, the lawful basis for processing your data is Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject” and Article 6(1)(e) “Processing is necessary for the performance of a task carried ut in the public interest or in the exercise of official authority vested in the controller” The College is required to provide support an make reasonable adjustments under the Equalities Act 2010. The Post 16 Education (Scotland) Act 2013 requires the College to provide quality fundable course and provide the appropriate support for students. For special category personal data, the lawful basis is Article 9(2)(g) “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.” Where you have authorised that your progress at college is communicated to a parent or guardian or another organisation, then the legal basis is consent (Article 6(1)(a)). It’s important to note that consent can be withdrawn at any time. Please communicate to your Learning Support Adviser (LSA) if you wish to withdraw your consent.

    Who we share the information with:

    We use the information on the PLSP to make recommendations to teaching staff and Learning Development Tutors (LDTs) for reasonable adjustments that could be made in the classroom/learning environment and alternative arrangements for assessments.

    We may share personal data with dyslexia assessors and support suppliers (third party suppliers). All data is shared in order to support the students disclosed need.

    If you are a student within the school-college partnership, we ask your Guidance Teacher for information about and evidence of your learning support needs. We also share information with Local Authorities, e.g. social work.

    Where you have requested that an individual or organisation is kept up to date with your progress at college we do this but only with your written permission.

    All sharing is carried out securely, and with appropriate documentation in place.

    How long do we hold the personal data?

    We hold the data in your PLSP for 5 years after which the information will be destroyed securely following college procedures.

    Individuals’ rights in relation to this processing

    Under data protection law, individuals have a number of rights. These rights are as follows:

    • Right to be informed – this privacy notice
    • Right of access – this means you can request a copy of the personal data an organisation holds on you
    • Right to rectification – this means you can request inaccurate or incomplete information is corrected
    • Right to erasure (commonly known as the Right to be Forgotten) – this means you can request that your personal data is deleted and the organisation no longer processes your personal data
    • Right to restriction – this means you can request an organisation restricts how your data is processed. This right links with some of the other rights, for example when you request data is corrected, until the data is corrected you could request the processing is restricted.
    • Right to data portability – this means you have the right to request your data in a machine readable format (e.g. csv file) and transfer it to you or another organisation
    • Right to object – this means you can object to your personal data being processed. This right is absolute in relation to direct marketing.
    • Rights in relation to automated individual decision-making including profiling – you have the right not to be subject to automated individual-decision making.

    Not all of these rights are absolute, some have caveats and depend on the legal basis. If you wish to exercise your rights please contact the Data Protection team who will process your request and respond within one month of receipt of your request.

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • Student Health and Wellbeing Service Privacy Notice

    Edinburgh College is providing you with this information to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College’s Wellbeing Adviser/s and the Learning Support Assistants will be the only people involved in the collection of your data. Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    The Wellbeing Service collects different types of information for the purpose of providing wellbeing support to the students of Edinburgh College:

    • We collect basic information that helps us get to know you
    • We collect campus, course, and email address, phone number: this is so we can contact you, and make appropriate arrangements to meet with you. It will also help the college to identify trends in access to the service
    • We collect presenting issues related to mental health: this is to help us guide you to the best self-management approaches and resources, and this will be done in consultation with you
    • We keep a record of meetings: this will be a basic record of what has been recommended for your support and to help with reviewing at future meetings.

    What personal data do we collect?

    Personal

    Special Category (Sensitive)

    Forename and surname

    Health (including mental health)

    Email address and phone number

    Any other sensitive information* that you decide you want to share in connection with using our service (we will not ask for this). (For example: religion, gender identity, sexual orientation, racial or ethnic origin).

    Course and campus of study

     

    How are we collecting this information? What is the source?

    We collect this information directly from you when you use our service (only where you choose to supply it).

    The lawful basis for the processing

    The college’s lawful basis for processing your personal data is GDPR Article 6 (1) (e) and “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. It is the Post-16 Education (Scotland) Act 2013 Act that provides the legal framework for the provision of wellbeing support to students.

    Where special category personal data is collected, then the GDPR Article 9(2)(g) condition for processing is “processing is necessary for reasons of substantial public interest, on the basis of Union or member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.”

    Who we share the information with

    Your data will be shared only as necessary with colleagues in the college such as counsellors, lecturers, LDTs, Curriculum Managers and Learning Support Advisers on a need-to-know basis.

    We may have to share your personal information if you, or anyone you tell us about, is at harm or immediate risk of harm - or if we believe there is a risk of terrorism involved. 

    How long do we hold the personal data?

    Your data will be kept for two academic years after you complete you finish your studies at Edinburgh College, it will then be securely disposed of.

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: Right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten),right to restrict, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing.

     

    The rights that apply for this particular processing is:

    • Right to be informed – this privacy notice addresses this.
    • Right of access – you can request access and copies of your personal data held by the College. To do this, please email the DataProtection@edinburghcollege.ac.uk and your request will be processed accordingly.

     

    You have the right to object to the processing of your personal data for this purpose. Where the processing is for public task, there are certain caveats for organisations to continue to process your personal data where it is justified. However, the right to object to direct marketing is absolute and will be responded to accordingly.  As with right of access, if you wish to object please email the data protection mailbox and your request will be processed accordingly.

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk . If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:

    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • International Student Privacy Notice

    Edinburgh College is providing you with this information, as one of our international students, to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your information for the purpose of processing your application and enrolling you on an Edinburgh College programme of study; and to facilitate your studies at the college (we explain this in more detail below).

    We use your information to provide you with accommodation services, cultural activities (e.g. to arrange visits to local attraction), arrange school visits and transport services (e.g. collecting you from the airport).

    We specifically need your information:

    To process your application to study one of our courses

    This will include reviewing your application to see if you have met the entry criteria for a course; evaluating whether the college is able to offer you a place on a course/fulfil a contract of study; and offering a place on an Edinburgh College course where appropriate.

    To review any additional support needs you may have

    This application form gives you the opportunity to tell the college about any additional support need(s) (including health needs) you may have.

    For academic purposes (once you enrol)

    To provide you with teaching, learning and support services; to assess your work; record your progress and ensure you receive certificates from awarding bodies like SQA and BTEC. To give you access to learning and teaching tools, Student Support, IT, library, careers, and other college services. To seek your feedback on our courses.

    For administrative and financial management services

    To administer fees due and paid for by you and to process payment made for other college-related services (for example if you are staying in college accommodation).

    For immigration purposes

    To support you with your application for a visa to study in the UK, and to comply with our Tier 4 Sponsor obligations to support immigration control.

    To analyse student applications and enrolments for business, planning and equal opportunities purposes

    The college analyses student applications and enrolments, including by key protected characteristic groups (including age; disability; gender reassignment; marriage and civil partnership; pregnancy and maternity; race; religion or belief; gender; and sexual orientation) to plan and improve its services and curriculum offering. Analysing applications and enrolments by key protected characteristic groups forms part of the college’s responsibilities under the Public Sector Equality Duty, part of the Equality Act (2010).

    What personal data do we collect?

    Personal dataSpecial category data (only where you provide this; or it is required by law*)
    Name, address, telephone number, email addressDisability & health data (including mental health)
    Date of birthSpecial interest group status (e.g. asylum seeker; refugee)
    NationalityPassport number and country of domicile
    Next of kin and emergency contact detailsVisa information
    Employer detailsImmigration history
    Previous education, qualifications and employment historyAttendance data
    Bank account details
    Financial information (including family)
    Course and units of study (including previous courses of study)
    Assessment information related to your course, including assessment and exam dates and results
    Disciplinary information
    Appeals and complaints information
    Photographic image and footage (CCTV)
    Your IP Address (your unique online identifier when browsing the internet).
    Your unique student ID
    First/preferred language
    Gender (M/F)
    Marital/civil partnership status (*if your visa status is dependent on your partner)

    How are we collecting this information? What is the source?

    When you first apply for a place on an Edinburgh College course, we will collect data about you from your completed application form.

    When you formally enrol on a course, we will also ask you for new items of personal information as identified on the list above.

    If you are referred by an agent representative, or are being sponsored on your course, we will receive some or all of your personal information directly from your agent or sponsor.

    The lawful basis for the processing

    Under GDPR Article 6(1)(b) “Processing is necessary for the performance of a contract to which the data subject is party to in order to take steps at the request of the data subject prior to entering into a contract.” Is legal basis for processing your personal data (to enrol you as a student at Edinburgh College and deliver the educational experience detailed to you).

    For special category (sensitive) personal data, the legal basis is Article 9(2)(b) “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.” The specific social protection law which authorises processing of special category personal data is The Equality Act (2010).

    Who we share the information with

    For immigration purposes

    As a Tier 4 Sponsor Edinburgh College has a responsibility to comply with all aspects of the Immigration Rules and sponsor guidance, and support immigration control, including taking steps to ensure that every student at our institution has permission to study in the UK throughout the whole period of their study. We must co-operate with the Home Office (UK Visas and Immigration) by complying with requests for information, including in connection with the prevention or detection of crime, the administration of illegal working civil penalties and/or the apprehension or prosecution of immigration offenders.

    For sponsored programmes

    We may be required to provide reports to your financial sponsors to update them about your attendance, progress and welfare.

    For students under 18

    We may contact your parents or guardians if we have any concerns about your attendance, progress or welfare.

    For academic purposes

    such as providing the results of assessments to awarding bodies to enable them to confer you with academic awards (e.g. a HNC, SVQ, BTEC qualification); arranging an industry placement for you as part of your studies.

    For democratic purposes

    To enable you to vote in Edinburgh College Students’ Association (ECSA) elections, as per your legal right to elected student representation.

    Where we place you in accommodation (e.g. halls of residence with a home stay host)

    We will share your personal information (name, age, gender; contact details and special category information dietary requirements, allergies, medical requirements) to facilitate your stay.

    Where we arrange transport (e.g. bus passes or taxi transfers)

    We will share your name and (homestay) address in Edinburgh with the transport provider.

    Where we arrange a school visit

    we will share you name with the school you are visiting.

    Where we have a legal obligation to do so

    Edinburgh College is obliged to share limited information on international students with the Scottish Funding Council – the regulatory body for Scottish colleges. This information is limited to your: gender; name; date of birth; postcode; Scottish Candidate Number; how your place on an Edinburgh College course is being funded.

    Details of data transfers to any third countries or international organisations

    For sponsored programmes: we may be required to provide reports to your financial sponsors to update them about your attendance, progress and welfare – subject to where your sponsor is located this may be outside the EU. Where a sponsor is outside the EU the college ensures appropriate organisational and technical security measures are in place to safeguard your data and that a clear agreement is in place around the security of your information.

    How long do we hold the personal data?

    We will keep paper records in relation to you studies for three years after the end of the academic year in which you are studying. Digital information will be held on the college’s systems and student records database in line with college retention and disposal schedules.

    Individuals’ rights in relation to this processing

    Under data protection law you have a number of rights regarding how an organisation processes your personal data. You have various rights including:

    • Right to be informed (provided by this Privacy Notice)
    • Right of access to the personal information Edinburgh College holds about you.
    • Right to rectification - To change any personal information that’s wrong, incomplete or out of date.
    • The right to restrict processing – this links with the other rights and if there is an issue you can request that the processing restricted until the issues are resolved
    • The right to to object (including to direct marketing – which is an absolute right)
    • The right to erasure (commonly known as the ‘right to be forgotten’) – this means you have the right to request all you data is destroyed
    • The right to data portability – this means you have the right to have your personal data in a machine-readable format (e.g. .csv file) provided to you (or if you request transferred to another organisation).

    If you want to know more about your rights, or if you want to contact Edinburgh College to make use one or more of your rights, please email DataProtection@edinburghcollege.ac.uk or phone 0131 297 8663. Please note some of these rights are not absolute and require certain conditions to be met.

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • Summer School Privacy Notice

    Edinburgh College is providing you with this information to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your information for the purpose of processing your application and enrolling you on Edinburgh College Summer School; to provide any additional services you have requested; and to facilitate your studies at the college (we explain this in more detail below).

    We use your information to provide you with accommodation services, cultural activities (e.g. to arrange visits to local attraction), and transport services (e.g. collecting you from the airport).

    We specifically need your information:

    To process your application to study at Summer School.

    This will include evaluating whether the college is able to offer you a place on a course and on what terms; contacting you about any gaps in your application or queries you have; and offering a place on an Edinburgh College Summer School course where appropriate.

    To review any additional support needs you may have

    This application form gives you the opportunity to tell the college about any additional support need(s) (including health needs) you may have.

    For academic purposes (once you enrol)

    to provide you with teaching, learning and support services; to place you in a class of the appropriate level; to assess your work, record your progress and provide you with a course completion certificate; to give you access to learning and teaching tools, IT, library, and other college services; to provide you with additional services you have requested such as accommodation, cultural activities or transport services; to seek your feedback on our courses.

    For administrative and financial management services

    to administer fees due and paid for by you and to process payment made for other college-related services (for example if you are staying in college accommodation or have purchased an additional service such as airport transfers, catering, or social programme).

    For immigration purposes

    to support you with your application for a visa to study in the UK, and to comply with our Tier 4 Sponsor obligations to support immigration control.

    For communication purposes:

    to communicate with you about the provision of the course you have applied for or enrolled on, and to inform you of future courses you may be interested in.

    To analyse student applications and enrolments for business, planning and equal opportunities purposes

    The college analyses student applications and enrolments, including by key protected characteristic groups (including age; disability; marriage and civil partnership; and gender) to plan and improve its services and curriculum offering. Analysing applications and enrolments by key protected characteristic groups forms part of the college’s responsibilities under the Public Sector Equality Duty, part of the Equality Act (2010).

    To provide you with further information on courses relevant to your studies

    But only where you provide consent to receive direct marketing.

    What personal data do we collect?

    Personal dataSpecial category data (only where you provide this; or it is required by law*)
    Name, address, telephone number, email addressDisability & health data (including mental health)
    Date of birthSpecial interest group status (e.g. asylum seeker; refugee)
    NationalityAttendance data (including sickness absence)
    Next of kin and emergency contact detailsGender identity
    Parent/Guardian details (if under 18)
    Local address and personal details of responsible adult in Edinburgh (if under 18
    Bank account details
    Desired course and level of study at Edinburgh College Summer School
    Financial information (including family) (only where this information required for visa purposes)
    Disciplinary information
    Appeals and complaints information
    Photographic image and footage (CCTV)
    Your unique student ID
    First/preferred language
    English level
    Gender
    Marital/civil partnership status (*if your visa status is dependent on your partner)
    Passport number and country of domicile
    Visa information (including details of relevant person if in possession of a dependent visa)

    How are we collecting this information? What is the source?

    When you first apply for a place on an Edinburgh College course, we will collect data about you from your completed application form. We may contact you for further information as detailed on the list above, especially if you require a visa to study in the UK or you are under 18 years old.

    When you formally enrol on a course, we will also ask you for new items of personal information as identified on the list above.

    If you are referred by an agent representative, or are being sponsored on your course, we will receive some or all of your personal information directly from your agent or sponsor.

    The lawful basis for the processing

    Under GDPR Article 6(1)(b) “Processing is necessary for the performance of a contract to which the data subject is party to in order to take steps at the request of the data subject prior to entering into a contract.” Is legal basis for processing your personal data (to enrol you as a student at Edinburgh College and deliver the educational experience detailed to you).

    For special category (sensitive) personal data, the legal basis is Article 9(2)(b) “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.” The specific social protection law which authorises processing of special category personal data is The Equality Act (2010).

    Where the college provides you with further information on other courses relevant to your studies (for marketing purposes) the condition for processing your personal data is Article 6(1)(a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.

    If you wish to withdraw your consent to receive direct marketing from Edinburgh College (at any time) please email: summerschool@edinburghcollege.ac.uk

    Who we share the information with

    For immigration purposes

    As a Tier 4 Sponsor Edinburgh College has a responsibility to comply with all aspects of the Immigration Rules and sponsor guidance, and support immigration control, including taking steps to ensure that every student at our institution has permission to study in the UK throughout the whole period of their study. We must co-operate with the Home Office (UK Visas and Immigration) by complying with requests for information, including in connection with the prevention or detection of crime, the administration of illegal working civil penalties and/or the apprehension or prosecution of immigration offenders.

    For sponsored programmes

    We may be required to provide reports to your financial sponsors to update them about your attendance, progress and welfare.

    For students under 18

    We may contact your parents or guardians if we have any concerns about your attendance, progress or welfare.

    Where we place you in accommodation (e.g. halls of residence with a homestay host):

    We will share your personal information (name, age, gender; contact details and special category information; dietary requirements, allergies, medical requirements) to facilitate your stay.

    Where we arrange transport

    (e.g. taxi transfers) we will share your name and (homestay) address in Edinburgh with the transport provider.

    Where we arrange bus passes

    We will share your name, date of birth and ID photo with the transport provider.

    Where we have a legal obligation to do so

    Edinburgh College is obliged to share limited information on international students with the Scottish Funding Council – the regulatory body for Scottish colleges. This information is limited to your: gender; name; date of birth; postcode; Scottish Candidate Number; how your place on an Edinburgh College course is being funded.

    Data Processors:

    The college uses the following data processer to process your personal information:

    Unit-E is provided by a third-party supplier, to process student applications. This software is hosted by Edinburgh College and sits within the college’s technical controls.

    Details of data transfers to any third countries or international organisations

    For sponsored programmes: we may be required to provide reports to your financial sponsors to update them about your attendance, progress and welfare – subject to where your sponsor is located this may be outside the EU. Where a sponsor is outside the EU the college ensures appropriate organisational and technical security measures are in place to safeguard your data and that a clear agreement is in place around the security of your information.

    How long do we hold the personal data?

    We will keep paper records in relation to your studies for three years after the end of the academic year in which you are studying. Digital information will be held on the college’s systems and student records database to satisfy audit requirements: for example SFC require Edinburgh College to retain your data for 6 years for audit purposes.

    Individuals’ rights in relation to this processing

    Under data protection law you have a number of rights regarding how an organisation processes your personal data. You have various rights including:

    • Right to be informed (provided by this Privacy Notice)
    • Right of access to the personal information Edinburgh College holds about you.
    • Right to rectification - To change any personal information that’s wrong, incomplete or out of date.
    • The right to restrict processing – this links with the other rights and if there is an issue you can request that the processing restricted until the issues are resolved
    • The right to to object (including to direct marketing – which is an absolute right)
    • The right to erasure (commonly known as the ‘right to be forgotten’) – this means you have the right to request all you data is destroyed
    • The right to data portability – this means you have the right to have your personal data in a machine-readable format (e.g. .csv file) provided to you (or if you request transferred to another organisation).

    If you want to know more about your rights, or if you want to contact Edinburgh College to make use one or more of your rights, please email DataProtection@edinburghcollege.ac.uk or phone 0131 297 8663. Please note some of these rights are not absolute and require certain conditions to be met.

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • Cookie Policy

    Cookie Privacy Notice

    A cookie is a small text file which is placed on your computer or mobile device by your web browser when you access a website. Cookies store information such as user preferences, to allow web applications to offer you a personalised experience and allow us to monitor which pages users find useful so we can improve your website experience.

    This statement aims to provide you with information on what cookies are how we use them and how to accept or reject them.

    About Cookies

    There are two different types of cookies:

    Session Cookies: These are created temporarily when a user visits a website. Once the user closes the browser the cookie is deleted.

    Persistent Cookies: This type of cookie remains on the user’s device for a certain period of time. The cookie is re-activated when the user returns to the website that set that particular cookie. These cookies can be removed manually.

    The UK International Chamber of Commerce categorises cookies as:

    • Strictly necessary cookies: These cookies are essential in order to enable you to move around a website and use its features, such as accessing secure areas of the website.
    • Performance cookies: These cookies collect information about how visitors use a website to help improve the performance of the site, for instance, which pages visitors go to most often. These cookies are anonymous and do not collect personal data that could identify a visitor.
    • Functionality cookies: These cookies provide an enhanced, more personalised experience by storing your preferences such as username or region you are in.
    • Targeting/advertising cookies: These cookies are used to deliver targeted adverts more relevant to you and your interests.
    • No information from cookies can be traced to an individual person, and the cookie only relates to activity on our website.

    The information cannot be used for marketing on an individual basis and does not compromise the security of your device.

    Please visit www.allaboutcookies.org for further information about cookies.

    Edinburgh College Cookies

    Google Analytics

    Edinburgh College uses Google Analytics to track how our website is being used. This enables us to improve the website to better meet the needs of users.

    Cookie Names: _utma, _utmb, _utmc, _utmv _utmz

    Google Analytics cookies are present on every page on the website and store information such as the location of the user, how they found the site (search engine, direct link etc,), what pages they have visited and how long they have spent on the site.

    This information is anonymous and cannot be traced to an individual.

    Share This Content

    Users can share information on our website the various social media through the “Share this Content” toolbar.

    Cookie Name: _atuvc

    The __atuvc cookie is created and read by the AddThis social sharing site JavaScript on the client side in order to make sure the user sees the updated count if they share a page and return to it before our share count cache is updated. No data from that cookie is sent back to AddThis and removing it when disabling cookies would cause unexpected behaviour for users.

    Website Accessibility

    Users can use the website accessibility features to change the font size, background colour and text colour of pages on the website. This allows for better readability of the website.

    Cookie Names: _ecad , _ecbgc , _ectc , _ecfs

    These cookies are used to ensure that any changes made are present on all pages on the website. As such, these cookies are present on all pages, but only if the user has specified a custom setting.

    Previously Viewed Courses

    Users can see their previously visited courses on the right-hand side of any course pages.

    Cookie Name: _ecrv

    This provides the user with the ability to quickly navigate to one of up to the last three courses that they have viewed on the website. This cookie is only used on Course Pages.

    Managing Cookies

    If you would prefer cookies not to store data or would like to manage individual cookies, you can do this through your web browser.

    Click on the links below for more information on the most popular browsers:

    • Google Chrome
    • Microsoft Internet Explorer
    • Mozilla Firefox
    • Apple Safari
    • Opera
    • iOS
    • Android
    • Blackberry®​
  • National Fraud Initiative Privacy Notice

    Edinburgh College is providing you with this information to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it (Purpose)?

    Sharing Data with Audit Scotland: National Fraud Initiative

    This College is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud.

    On behalf of the Auditor General for Scotland, Audit Scotland appoints the auditor to audit the accounts of the College. It is also responsible for carrying out data matching exercises under the National Fraud Initiative.

    Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This will include personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified but the inclusion of personal data within a data matching exercise does not mean that any specific individual is under suspicion. Where a match is found it indicates that there may be an inconsistency that requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out. The exercise can also help bodies to ensure that their records are up to date.

    Audit Scotland currently requires Edinburgh College to participate in a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to Audit Scotland for matching. The exact nature of the data supplied is set out in Audit Scotland’s instructions, which can be found at: http://www.audit-scotland.gov.uk/our-work/national-fraud-initiative

    The use of data by Audit Scotland in a data matching exercise is carried out under their statutory authority, normally under its powers in Part 2A of the Public Finance and Accountability (Scotland) Act 2000. It does not require the consent of the individuals concerned under the Data Protection Act 2018. Data matching by Audit Scotland is subject to a Code of Practice. This may also be found at: http://www.audit-scotland.gov.uk/our-work/national-fraud-initiative

    For further information on Audit Scotland’s legal powers and the reasons why it matches particular information, see the full text privacy notice at: http://www.audit-scotland.gov.uk/our-work/nationalfraud-initiative

    The lawful basis for the processing

    Our legal reason for processing the data is that use is necessary for the performance of a task in the public interest. Article 6, (1), (e)

    Special category (sensitive) data: Processing is necessary for reasons of substantial public interest and is authorised by domestic law proportionate to the aim pursued. The legal basis for processing your special category and criminal convictions data is Article 9 (2) (g) substantial public interest, and sections 6, 10, 11, and 12 of schedule 1 to the Data Protection Act 2018.

    Individuals’ rights in relation to this processing:

    • The right to access your personal data
    • The right to rectification if the personal data we hold about you is incorrect
    • The right to restrict processing of your personal data

    The following rights apply only in certain circumstances:

    • The right to withdraw consent at any time if consent is our lawful basis for processing your data
    • The right to object to our processing of your personal data
    • The right to request erasure (deletion) of your personal data
    • The right to data portability

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • College Employee Privacy Notice

    Edinburgh College is providing you with this information, as one of our employees, to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your personal data for the following purposes:

    Recruitment and retention of staff:

    • Making a decision about your recruitment/appointment;
    • Determining the terms on which you work for us;
    • Checking that you are legally entitled to work in the UK;
    • Checking your criminal history, including PVG Disclosure Scotland checks;
    • Assessing qualifications, including decisions about promotions;
    • Making decisions about your continued employment;
    • Undertaking/implementing salary reviews and calculating compensation e.g. voluntary severance;
    • When outsourcing particular business areas of the college we are required to provide information to your new employer in adherence with TUPE regulations.

    Payroll and pensions administration (including National Insurance and Tax Administration):

    • Paying you and deducting tax and national insurance contributions;
    • Providing employee benefits to you;
    • Liaising with your pension provider and the Department of Work & Pensions

    Supporting your Continuing Professional Development and career progression:

    • Identifying education, training and development requirements (e.g. Training Needs Analysis);
    • Conducting appraisal/development reviews.

    For occupational health and managing sickness absence purposes:

    • Ascertaining your fitness to work when managing sickness absence;
    • Referring you to Occupational Health to assess your fitness for work (this may be an internal or external practitioner); a separate Occupational Health privacy notice will be provided at that time.

    For disciplinary and conduct purposes:

    • Gathering evidence during the course of investigations for possible disciplinary, grievance or capability hearings;
    • To monitor your use and ensure security of our information and communication systems, in partnership with IT, to ensure compliance with our IT Policies;
    • Dealing with legal disputes involving you, or other employees.

    For health and safety purposes:

    • Complying with health and safety obligations (e.g. monitoring compulsory training).
    • Dealing with legal disputes arising from accidents at work.

    For Equality and Diversity monitoring purposes:

    • Equal opportunities monitoring, in line with legal obligations, to promote inclusion.

    For management planning purposes:

    • Business management and planning, including accounting and auditing;
    • Producing quarterly and annual statistical HR Dashboards for senior management and the Policy & Resources Committee to inform business planning which includes headcount (and full-time equivalents), establishment, turnover, absence, recruitment, training and workforce demographics such as age, disability, part-time status.

    For collective bargaining purposes:

    • Providing information and data to Colleges Scotland under the Trade Union and Labour Relations (Consolidation) Act 1992 which enables agreements to be reached under National Bargaining with recognised Trade Unions i.e. pay agreements, job evaluation etc.

    What personal data do we collect?

    • Name/Title
    • Address(es)
    • Telephone number(s) – home & mobile
    • Personal email address
    • Date of birth
    • Gender
    • Marital status
    • Dependants
    • Next of kin
    • Emergency contact information
    • National Insurance number
    • Bank account details
    • Payroll number & tax code
    • Salary
    • Pension scheme details
    • Benefit information e.g. childcare voucher membership
    • Application form (or if via agency CV & covering letter)
    • Proof of Right to work
    • References
    • Qualification certificates
    • PVG Membership Number

    We also process special category personal data:

    • Race
    • Ethnicity
    • Religious beliefs
    • Sexual orientation
    • Disability
    • Gender identity
    • Criminal convictions information
    • Medical questionnaire
    • Absence records and reasons as this may contain health data or other special category data
    • Occupational Health reports
    • Trade Union membership

    How are we collecting this information? What is the source?

    We will collect the majority of your personal information from you during our recruitment and selection process. If you applied for a post through myjobscotland.gov.uk we will have received your information from myjobscotland: they will be a separate controller of your personal data – for further information on how they process your data please see their privacy notice.

    We will ask you to keep your personal information current throughout your time with us by updating our self-service HR system. However, in certain circumstances we will collect information from third parties including:

    • Former employers
    • Employment agencies
    • Disclosure Scotland
    • GPs/Consultants/Occupational Health professionals
    • HMRC
    • Department of Work & Pensions

    The lawful basis for the processing

    For processing of your personal data, the lawful basis is GDPR Article 6(1)(b) “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.

    Where your special category personal data are processed, the lawful basis is GDPR Article 9(2)(b) “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject”.

    • Where employees’ health data are processed, there are several laws which require this. They are as follows: Health and Safety at Work etc. Act 1974; The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013; and Employment Rights Act 1996.
    • Where employees special category demographic information (gender identity, sexual orientation, race, ethnicity) the specific law authorising this is the Equalities Act 2010.
    • Where employees’ criminal conviction data are processed, the specific law authorising this is the Protection of Vulnerable Groups (Scotland) Act 2007.
    • Where employees’ data are processed for the purposes of collective bargaining, involving Colleges Scotland, the specific law authorising this is the Trade Union and Labour Relations (Consolidation) Act 1992.

    Exceptionally, we may also use your personal information:

    • Where we need to protect your vital interests (or someone else’s interests);

    Who we share the information with:

    We share your personal information with the following third party data controllers:

    • Disclosure Scotland
    • Audit Scotland (as part of the National Fraud Initiative)
    • Pension providers (e.g. Lothian Pension Fund, STSS & Prudential for AVCs);
    • HMRC;
    • Colleges Scotland (e.g. national initiatives such as National Bargaining);
    • GPs/Consultants/Occupational Health practitioners (a separate privacy notice will be provided at that time);

    We share your personal information with the following data processor:

    • Midland HR (providers of iTrent) only for the purposes of maintaining and upgrading the HR system and resolving technical queries. Edinburgh College hosts the iTrent application and database internally.

    How long do we hold the personal data?

    We will retain personal data about employees for a maximum of six years after their employment has ceased, with certain exceptions:

    The college will retain documents relating to pre-employment health screenings of individuals exposed to hazardous substances through their employment; and records relating to major injuries arising from accidents in the workplace; for 40 years after an employee’s employment has ceased.

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice); right of access; right of rectification; right of erasure (commonly known as the right to be forgotten); right to restrict processing; right to object; right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing and the College would be required to process your request in one month.

    The rights that apply for this particular processing are:

    • Right to be informed – this privacy notice addresses this.
    • Right of access – you can request access and copies of your personal data held by the college. To do this, please email the DataProtection@edinburghcollege.ac.uk and your request will be processed accordingly.
    • Right to rectification – you can request that inaccurate or incomplete personal data is rectified.
    • Right to Erasure (this right is not absolute and is subject to specifics of the request).
    • Right to object (including to direct marketing). The right to object to direct marketing is absolute and will be responded to accordingly.
    • Right to data portability (this right is not absolute and is subject to specifics of the request).

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • College Job Applicant Privacy Notice

    Edinburgh College is providing you with this information, as someone who applied for a post/job role at Edinburgh College, to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your personal data in order to effectively manage our recruitment process and in order to assist us in:

    • Making a decision about your recruitment/appointment
    • Determining the terms on which you work for us
    • Checking that you are legally entitled to work in the UK
    • Checking your criminal history, including PVG Disclosure Scotland checks
    • Assessing qualifications
    • Checking whether you are eligible for guaranteed offer of interview under Disability Confident Scheme
    • Monitoring and advancing equality of opportunity and eliminating unlawful discrimination, as per the college’s legal duty under the Equality Act 2010 (the Scottish Public Sector Equality Duty requires the college to analyse and produce anonymised reports on the recruitment of persons from specific protected characteristic groups)

    What personal data do we collect?

    We process the following personal data for all applicants:

    • Name/Title
    • Address(es)
    • Telephone number(s) – home & mobile
    • Personal email address
    • Date of birth
    • Salary
    • Application form (or, if via agency, CV & covering letter)
    • Proof of Right to work in the UK
    • Caring responsibilities
    • Gender
    • Marital Status

    And for applicants who are offered a role with Edinburgh College we also process:

    • References
    • Qualification certificates
    • Bank details
    • Next of kin/emergency contact details
    • Pension details

    We also process special category personal data for all applicants:

    • Race
    • Ethnicity
    • Religious beliefs
    • Sexual orientation
    • Disability
    • Gender identity
    • Criminal convictions information

    And for applicants who are offered a role at Edinburgh College, we will also process the following special category data (further information on how we use this information is provided in the college’s employee privacy notice):

    • PVG Membership Number
    • Medical questionnaire

    How are we collecting this information? What is the source?

    We will collect the majority of your personal and sensitive information from you during the application stage of our recruitment process. Further information will be requested directly from you if you are offered a role with Edinburgh College (bank details, medical questionnaire, PVG application information (e.g. previous addresses); next of kin details; pension details; occupational health information questionnaire).

    If you applied for a post directly through our Edinburgh College website (or link to our website) from January 14th, 2019 onwards, we will store your personal and sensitive information securely on our recruitment module within our HR system (currently iTrent).

    If you previously applied for a post through myjobscotland.gov.uk we will have received your information from myjobscotland: they will be a separate controller of your personal data – for further information on how they process your data please see their privacy notice.

    The lawful basis for the processing

    For processing of your personal data, the lawful basis is GDPR Article 6(1)(b) “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.

    To meet our Public Sector Equality Duties under the Equality Act 2010, we collect additional personal and special category data about our applicants, via our Equalities Monitoring form, to assist the college in monitoring and advancing equality of opportunity and eliminating unlawful discrimination.

    Where your special category personal data (e.g. gender identity, sexual orientation, race, ethnicity) are processed for this purpose the lawful basis is GDPR Article 9(2)(g) “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject”.

    Where applicants’ special category demographic information (gender identity, sexual orientation, race, ethnicity) are processed for the purposes of monitoring and advancing equality of opportunity and eliminating unlawful discrimination the specific law authorising this is the Equality Act 2010.

    Where applicants’ criminal convictions information are processed the specific law authorising this is the Rehabilitation of Offenders Act 1974 (Exclusions and Exceptions) (Scotland) Amendment Order 2016.

    Where applicants’ asylum status/right to work in the UK information are processed the specific law authorising this is the Immigration, Asylum and Nationality Act 2006.

    Who we share the information with:

    We share personal information with the following data processor:

    • Midland HR (providers of iTrent) only for the purposes of maintaining and upgrading the HR system and resolving technical queries. Edinburgh College hosts the iTrent application and database internally.

    If you are offered a role at Edinburgh College we will share your personal information with the following third party data controllers as part of our new starter process and in order to enter into an employment contract with you (further information on how we use this information is provided in the college’s employee privacy notice):

    • Disclosure Scotland
    • Pension providers (e.g. Lothian Pension Fund, STSS & Prudential for AVCs)
    • HMRC
    • Department of Work & Pensions
    • GPs/Consultants/Occupational Health practitioners (a separate privacy notice will be provided at that time)

    How long do we hold the personal data?

    If you are unsuccessful in our recruitment process (i.e. you are not offered a role with Edinburgh College) your information will be deleted 6 months after the closure of the recruitment campaign for which you applied.

    If you are successful in being appointed to a role at Edinburgh College, we will transfer your personal and sensitive information into our iTrent employee module (please see Privacy Notice for Employees of Edinburgh College (November 2018)).

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing and the College would be required to process your request in one month.


    The rights that apply for this particular processing are:

    • Right to be informed – this privacy notice addresses this.
    • Right of access – you can request access and copies of your personal data held by the college. To do this, please email the DataProtection@edinburghcollege.ac.uk and your request will be processed accordingly.
    • Right to rectification – you can request that inaccurate or incomplete personal data is rectified.
    • Right to erasure (this right is not absolute and is subject to specifics of the request).
    • Right to object (including to direct marketing). The right to object to direct marketing is absolute and will be responded to accordingly.
    • Right to data portability (this right is not absolute and is subject to specifics of the request).

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • College Employee Occupational Health Privacy Notice

    Edinburgh College is providing you with this information to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

    Why are we collecting it and what are we doing with it (Purpose)?

    As your employer we have a duty of care to all of our staff and we collect personal data for the purposes of occupational health (OH) and for the assessment of the working capacity of the employee. We also process employee personal data to ensure the health and safety of the employees at work and to allow consideration of any reasonable adjustments that may be required to support their ability to work.

    What personal data do we collect?

    Personal dataSpecial Category/Sensitive Personal Data
    NameAttendance/Sickness Record (if applicable)
    Date of birthHealth conditions.
    AddressMedical Reports (if you choose to bring them to an OH meeting)
    Telephone Number
    Email
    Job Role
    Your GP contact information & (if applicable) any hospital contact information if you have a specific health condition.

    How are we collecting this information? What is the source?

    We collect your information in a number of ways, depending on the circumstances. The following details are the main ways that data is collected.

    Management Referral

    When making a referral, managers/HR are asked to confirm that the employee has been informed of the details of the referral before submitting. The referral will not be able to go ahead if this is not confirmed with the employee. The OH Referral Form requires confirmation that the employee has been fully informed of the referral, informed of their rights and, if applicable, their consent under the Access to Medical Reports Act 1988 (AMRA) must be received prior to an OH assessment and report is carried out.

    Under AMRA employees have the right to see the report before it is sent to their line manager and HR. Under Section 3 of AMRA requires that medical reports and applications for them are not processed unless the individual has consented. This is consent under AMRA and not under data protection law. Under Section 4 and 5 of AMRA employees have rights and can request inaccurate information is corrected. If the medical professional considers this is accurate a note on the report will be added to accurately reflect this. At the time of receiving the report to review, employees are given a time frame for contacting Occupational Health with consent under AMRA to release the report.

    New Employment Health Questionnaires

    As referenced earlier, as an employer, the College has a duty of care to all employees to ensure their health and safety at work and, when applicable, identify and implement any reasonable adjustments required to enable the employee to work. Therefore, the College requires new employees to complete a health screening in order to determine if the individual is fit for the tasks that they will be performing and identify any reasonable adjustments that may be required.

    The questionnaire is used solely for the purposes of assessing fitness to work and if necessary implementing reasonable adjustments to ensure the employee is able to work.

    Health Surveillance

    For some roles, health surveillance will need to be undertaken where risk assessment indicates that an individual might be exposed to certain hazards within the work place i.e. noise The employer will be sent a fitness to work certificate following the health surveillance appointment.

    The lawful basis for the processing

    The lawful basis for processing for these purposes are GDPR Article 6(1)(b) “Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”. For the processing of special category personal data (i.e. health data), the lawful basis is GDPR Article 9(2)(h) “Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3”. GDPR Article 9(3) states that processing is permitted “when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy.”

    All health professionals will adhere to their governing body of professional standards with regards to confidentiality.

    Please note any reference to consent is not consent to process personal data under data protection law. Consent is in relation to the Access to Medical Reports Act 1988 (AMRA) only and provides an employee with opportunity to view and correct an OH report prior to it being provided to the employer.

    Who we share the information with:

    For the purposes of Management Referrals, your OH Report is shared with your line manager and the HR department. However, this is only shared if you have provided your consent under AMRA. For the purposes of New Employment Questionnaires and Health Surveillance this is shared, if necessary, to the College’s HR department to ensure that reasonable adjustments are made and the College is meeting its duty of care and ensuring the health and safety of the workforce.

    How long do we hold the personal data?

    The Occupational Health records will be kept for the length of employment and for 7 years after leaving employment (this applies to Management Referrals and New Employment Health Questionnaires). Once this retention period has passed, these records will be destroyed securely following College procedures.

    For the health surveillance records these are required under The Control of Substances Hazardous to Health Regulations (COSHH) 2002 and the related Health and Safety at Work etc Act 1974 which require that records are kept for 40 years. Following this time period, the records will be destroyed securely in line with College procedures.

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing and the College would be required to process your request in one month.


    The rights that apply for this particular processing are:

    • Right to be Informed – i.e. a privacy notice.
    • Right of Access – this means you have the right to access your personal information.
    • Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
    • Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request your personal data is deleted.
    • Right to Data Portability – this means you have the right to request your information in a machine readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
    • Right to Restriction – this means you can restrict the processing of your information and links with some of the other rights.
    • Right to Object – this means you can object to how your data is used.
    • Right to be informed of automated individual decision making (including profiling) – we do not do this for OH purposes and this therefore does not apply.

    Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • Compliments, Cause for Consideration & Complaints Privacy Notice

    Edinburgh College is providing you with this information to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

    Why are we collecting it and what are we doing with it (Purpose)?

    Your personal information is collected to record and process your compliment, cause for consideration or complaint. The Complaints Handing Co-ordinator/Investigating Officer will use this personal information to contact you with regards to your compliment, cause for consideration or complaint.

    What personal data do we collect?

    Personal dataSpecial Category Personal Data (Please note this is only collected if you have provided this detail in your complaint)
    Name (Forename and Surname)Racial or ethnic origin
    Name of individual acting on your behalf (if applicable)Political opinions
    AddressReligious or philosophical beliefs
    Email addressTrade Union membership
    Mobile numberHealth information
    Course (if applicable)Sex life or sexual orientation
    Campus (if applicable)
    Opinions and other relevant information in relation to investigation

    How are we collecting this information? What is the source?

    The information is collected when you complete the 3Cs form to record a compliment, cause for consideration or complaint about the College. When your cause for consideration or complaint is being investigated and resolved, the investigating officer may need to collect further information, including opinions of individuals etc. The outcome of this will be detailed in your investigation outcome.

    The lawful basis for the processing

    The legal basis for processing your personal data is GDPR Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” In this instance as the College is a public body it is required under the Scottish Public Services Ombudsman Act 2002 to investigate and resolve complaints received from members of the public.

    If you have provided any special category/sensitive personal data within your compliment, cause for consideration or complaint, the legal basis for processing is GDPR Article 9(2)(a) “the data subject has given explicit consent to the processing of those personal data for one or more specified purposes.”

    Who we share the information with:

    Your data will be shared with the investigating officer to process your cause for consideration or complaint. If you have authorised another individual or organisation to act on your behalf, then we would only share information with them on receipt of a completed Data Subject Authorisation Disclosure form. This form is necessary to ensure that you have given the individual/organisation authority to represent you and act on your behalf.

    How long do we hold the personal data?

    Your information is held for three years from the date of receipt of your compliment and three years after closure of your cause for consideration or complaint. After that your information will be destroyed securely and in line with College procedures.

    Individuals’ rights in relation to this processing

    Under data protection law, individuals have the following rights:

    • The right to be informed – i.e. a privacy notice
    • The right of access – this means you can access your personal data and receive copies of all your data held by the College
    • The right to rectification – this means that you can update/correct inaccurate or incomplete data
    • The right to erasure (commonly known as the Right to be Forgotten (RTBF) – this means you can request your personal data is destroyed, and the College no longer holds your personal data.
    • The right to restriction – this means you can request that the processing of your personal data is restricted. This links with some of the other rights and means that if there is an issue the processing activity can be paused until the issue is resolved.
    • The right to restriction – this means you can request that the processing of your personal data is restricted. This links with some of the other rights and means that if there is an issue the processing activity can be paused until the issue is resolved.
    • The right to data portability – this means you can request all your data in a machine readable format (e.g. a .csv file) to transfer to another organisation.
    • Right to know of any automated decision-making, including profiling – this means you have the right to know of any automated decision-making and not be subject to a decision made solely on automated processing.

    Some of these rights are not absolute and require certain conditions. All requests made to the College must be responded to within a month of receipt of the request.

    Please note where you have consented to processing of your personal data (specifically the special category data contained in a complaint), you have the right to withdraw your consent at any time.

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF

Your Data Protection Rights at Edinburgh College

The Data Protection Act 2018 and the EU General Data Protection Regulation (GDPR) provide certain rights for individuals in relation to their personal data and what organisations may do with their data.

Please read the document below for more information on your rights under data protection law.

To make a request in relation to any of your rights, please email DataProtection@edinburghcollege.ac.uk

  • Your Rights Under Data Protection Law

    The Data Protection Act 2018 and the EU General Data Protection Regulation (GDPR) provide certain rights for individuals in relation to their personal data and what organisations may do with their data. Under data protection law you have the following rights:

    1. The right to be informed
    2. The right of access
    3. The right to rectification
    4. The right to erasure
    5. The right to restrict processing
    6. The right to data portability
    7. The right to object
    8. Rights in relation to automated decision making and profiling

    All of these rights require organisations to respond to a request in one month. There is no fee, although if a request is considered manifestly unfounded or excessive a reasonable fee can be charged for the administrative costs associated with the request.

    The UK Information Commissioner’s Office (ICO) is the regulator of data protection and has further information and guidance regarding your rights here: https://ico.org.uk/your-data-matters.

    Your rights – contacting the college

    If you have any queries regarding how Edinburgh College processes your personal data, or wish to make a request under data protection law, please contact the Data Protection Officer (DPO) by emailing DataProtection@edinburghcollege.ac.uk

    The right to be informed

    The right to be informed is known as a “privacy notice” and organisations must communicate to you who they are, the name and contact information of their Data Protection Officer (DPO); why they collect your data; for what purpose; if they share it; and how long the information is held for.

    This page contains Edinburgh College’s principle privacy notices.

    ICO Guidance: https://ico.org.uk/your-data-matters/your-right-to-be-informed-if-your-personal-data-is-being-used/

    The right of access

    The right of access means you can request access to view, or get copies of, the personal data that an organisation holds on you. You can make such a request for all information held about you, or you can be specific, e.g. asking for copies of application and enrolment forms.

    ICO guidance: https://ico.org.uk/your-data-matters/your-right-of-access/

    The right to rectification

    The right to rectification means that you can request that inaccurate information held about you is corrected or deleted. If your information is incomplete, you can ask the organisation to complete it by adding further information.

    ICO guidance: https://ico.org.uk/your-data-matters/your-right-to-get-your-data-corrected/

    The right to erasure

    The right to erasure is commonly known as the ‘Right to be Forgotten’ (RTBF). This means you can request that an organisation deletes the personal data they hold about you. This right only applies in certain circumstances including:

    • The organisation doesn’t need your information anymore
    • If you had provided your consent but now withdraw it
    • You object to the use of your data, and your interests outweigh the organisation’s
    • If the data was collected or used unlawfully
    • If there is a legal obligation to erase your data.
    • Or if your data was collected from you as a child for an online service (e.g. Facebook).

    ICO’s guidance: https://ico.org.uk/your-data-matters/your-right-to-get-your-data-deleted/

    The right to restrict processing

    The right to restrict processing means that if you are concerned about the accuracy of your personal data, or how it is being used, you can limit how the organisation uses your data. You can also stop an organisation deleting your data. This right also links closely with the right to rectification and right to object.

    ICO Guidance: https://ico.org.uk/your-data-matters/your-right-to-limit-how-organisations-use-your-data/

    The right to data portability

    The right to data portability means you have the right to request that an organisation provide you with your personal data in an accessible, machine-readable format, e.g. a csv file. You can also request that the organisation transfers your data to another organisation. They must do this if the transfer is technically feasible.

    This right only applies in specific circumstances and is not absolute.

    ICO Guidance: https://ico.org.uk/your-data-matters/your-right-to-data-portability/

    The right to object

    The right to object means you can request that an organisation stops using (processing) your data for specific purposes. There are limits to this right, you can only object if the organisation is using your data:

    • For a “task carried out in the public interest”
    • For “legitimate interests”
    • For “scientific or historical research or statistical purposes”
    • For direct marketing

    If an organisation agrees to your objection it must stop processing unless it can provide strong legitimate reasons for continuing to use your data. However, when the objection relates to direct marketing the right to object is absolute and an organisation must stop using your data.

    ICO Guidance: https://ico.org.uk/your-data-matters/the-right-to-object-to-the-use-of-your-data/

    Rights in relation to automated decision making and profiling

    Rights in relation to automated decision making and profiling relates decisions made about you using computer algorithms etc. and without human intervention.

    This can include profiling - when your personal data is used to analyse or predict aspects of your life, including personal preferences and interest.

    An example of this is when a company sends you information regarding particular books which are similar to ones that you already purchased from them. It can be a useful process for organisations and individuals in many sectors, including education and marketing.

    When automated processing including profiling is carried out with your personal data you have the right:

    • Not to be subject to a decisions that is based solely on automated processing if the decision affects your legal rights
    • To understand the reasons behind decision made and the potential consequences of the decisions
    • To object to profiling in certain situations, including direct marketing.

    ICO Guidance: https://ico.org.uk/your-data-matters/your-rights-relating-to-decisions-being-made-about-you-without-human-involvement/


Edinburgh College Data Protection Policy
Edinburgh College is committed to a policy of protecting data, and to protecting the rights and freedoms of individuals with respect to the processing of their personal data. 

Our Data Protection Policy sets out the legal framework and risks which govern the college’s use of data; the college’s commitment to protecting its data; and the obligations of users to protect all data (with particular reference to personal and special (previously called sensitive) categories of personal data).

Download PDF Data Protection Policy ​
​​​​​​​​​​​​​

Edinburgh College Data Breach Reporting Procedure
For information on how to report a suspected data breach, involving personal data, please read our Data Breach Reporting Procedure.


​​




InfoGraphic
Name Email Phone Message
Please leave this field blank
For further information please contact the College t: 0131 669 4400 | Terms of use and disclaimer
Text Size + - Background Colour Text Colour
Inverted Grey Simple Soft Red Blue Green Yellow Violet Default
Black Grey White Soft Red Blue Green Yellow Violet Default
×