Privacy Policy

St Brendans Sixth Form Privacy Notice:  Students

This privacy notice is issued by St Brendan’s Sixth Form College.  The protection of personal privacy is important to St Brendan’s and any personal data you provide will be treated in accordance with current data protection legislation.

 In order to study at the College, St Brendan’s will ask you to provide us with certain types of personal information about yourself. This notice explains what it is going to be used for including any third parties with whom your information will be shared.

We collect and use personal information about students in order to carry out our responsibilities as a further education provider and to meet our legal obligations. 

It is important to us that you understand how your personal information will be used by the College from when you register and attend open events, apply to join us, during your time here as a student and beyond completion of your study once you have left the College.

The information we collect

• Personal information (such as name, addresses, gender, date of birth, national insurance number, car registration number, Unique Learner Number, Candidate number)
• Contact information (telephone, mobile and email address)
• Characteristics (such as ethnicity, nationality/residency, learning difficulties, disabilities, care status, medical information, learning needs, religion)
• Information about bursary eligibility and financial support.
• Attendance and behavioural information, along with educational progress including (and not limited to) assessment outcomes (formal and informal)
• Previous education and qualification records
• Photographs (for identification purposes)
• Family or personal circumstances where this information is important to support your student experience and onward progression.
• Destination data after leaving the College
• Special circumstances where applicable (such as Education Health and Care Plans, caring responsibilities, right of abode, child protection information) 
• Images taken whilst on campus (signage will be displayed) or whilst out on trips.  Students can request that images of them be removed from digital platforms (such as our internal website or social media), and we will make reasonable efforts to do so. However, it may not be possible to remove images already published in print or by third parties
• Images / Videos taken on CCTV to maintain the security of the premises and for preventing and investigating suspected crime. This includes the use of  Automatic Number Plate Recognition (ANPR) at the college entrance gates inside the perimeter of the College. 

We collect personal data from various sources, including:

• Yourself (during application and enrolment),
• Whilst you are a student here, via communication with us (e.g. emails, phone calls etc.)
• Previous schools or colleges
• Personal Learning Records service
• Local authorities and government agencies
• Other organisation involved in your education or support

Where information is transferred from another education provider, this may include safeguarding records.  These are treated confidentially and only key information shared with those who may need to know in order to provide the relevant safeguarding support.

Why we collect and use this information

We use your information to: 

• Provide you with relevant information linked to applying to the college, to process and assess your application and for your enrolment.
• Promote relevant activities and events linked to your desired, or enrolled, programme of study
• Provide and support your learning, your examinations and onward progression
• Monitor and report on your attainment and progress
• Provide appropriate pastoral care and safeguarding
• Assess eligibility for financial support
• Manage behaviour and ensure safety
• Provide access to college systems, facilities and services
• Some information we process (including health, ethnicity, religion, safeguarding and disability information) is classified as special category personal data. We process this where necessary for reasons of substantial public interest, safeguarding, provision of education, health and social care support, and to meet our legal obligations
• Comply with the law regarding safeguarding, data sharing and entitlement to study
• Deal with grievances, complaints and disciplinary action
• Collect information from other agencies (such as Personal Learning Record) to create or capture the unique learner number, download prior attainment , to collect information from prior schools
• In order to provide these services effectively, College staff have access to our records of your personal information. This access is bound by strict guidance to staff about confidentiality and limited to proper professional use. 

With whom do we share information?

Some of your personal data may be shared with the following:

• Department for Education and the Learner Registration Service (St Brendan’s has a statutory duty to pass details of learners and learners’ programmes to these funding agencies).  Their previous notices are included and linked in the annex below this document.
• Examination organisations and the Joint Council for Qualifications.
• Local Authorities
• Parents / Carers (Information may be shared with parents/carers where permitted by law, where the student has consented, or where there are safeguarding, welfare or legitimate educational reasons for doing so)
• UCAS and other appropriate progression platforms to promote and support onward progression
• Your previous school (information such as confirmation of enrolment, final examinations results, destination and progression information).
• Providers of statistical data analysis, such as and not limited to ALPS, Six Dimensions, to enable the college to assess and improve educational teaching and performance.
• Audit / inspection bodies, such as and not limited to OFSTED, Validera
• Pay My Student and other financial management providers (such as Cunninghams).
• Evolve – online system for managing visits/trips.
• Online learning platforms assessed to enhance your learning experience whilst at St Brendan’s Sixth Form College.
• Employers / work placements that you attend whilst at College. 
• Information management systems such as My Concern and external agencies relating to safeguarding.
• Agencies involved in supporting the organisation of trips that you opt to attend.
• Safeguarding and support agencies where deemed appropriate and necessary.  Where this is not a legal requirement, we will seek your consent before doing so.
• A comprehensive list of platforms / systems with which personal data is shared will be collated and maintained with a brief summarisation of purpose.  Wherever possible, and appropriate, personal information shared will be limited to student identifier, college email addresses and name.  Where protected characteristics are shred specification justification will be recorded. 

The College does not process your data through automated decision-making or profiling.

When we share your information with these partners/organisations, we share only the minimum information necessary for the purposes outlined. We ensure any data passed in done so through a secure method to protect any data containing your personal information so that if a communication is intercepted in transmission your data will remain secure.  We only share your personal data where the law allows us to do so.  Any systems implemented for use are assessed for adherence to GDPR and UK Data Protection principles.  Where personal data is transferred outside the UK, appropriate safeguards will be in place in accordance with UK GDPR

Why we share student data

We are required to share certain information with the Department for Education on a statutory basis. This supports:

• College funding
• Monitoring of educational progress
• National education policy

 Security

The College uses CCTV to assist with providing you with a safe and secure work/study environment. CCTV images will be used only when required to investigate an incident, unacceptable behaviour, crime prevention and damage etc.

A comprehensive CCTV policy is viewable on our college website.

How long will we keep your Personal Information?

All data that we collect and process on behalf of the Department for Education (DfE) – our funding agency – is kept for as long as we are required to do so.  Other data, including electronic records, will be held as long as necessary in order to fulfil our responsibilities as an education provider.  We keep your personal data in line with our retention policy:

• Most student records are retained for 7 years after leaving
• Safeguarding records may be retained until age 25 or older

Full details are available in the St Brendans Records Retention Schedule.

Your responsibilities for your Personal Information

Loss of personal data and identity theft can have potentially harmful consequences.

 It is important that you take responsibility for the following:

• Report any inaccuracies in your personal information viewable on Student ProPortal by submitting a change request or emailing the required changes through to mis-team@stbrn.ac.uk
• Never share your network log-in details with anyone else
• Log out before you leave the computer you have been working on – you don’t want the next person passing by to access your details
• Be aware of who might be looking over your shoulder to read what is on your screen
• If you print personal information, take it from the printer straight away and keep it safe and confidential

 Your rights to access your Personal Data

You have the right to:

• Request access to your personal data.  Being specific about the information required will enable us to limit searches and reply in a more timely manner.
• Ask for incorrect data to be corrected
• Request deletion of your data. This right is limited where we are legally required to retain information
• Object to or restrict how your data is used
• Request transfer of your data

To exercise your rights, contact dpo@stbrn.ac.uk

Our legal basis for processing data:

St Brendan’s process personal data under one or more of the following UK GDPR lawful bases:

Article 6(1)(c) Legal Obligation

Article 6(1)(e) Public Task

Article 6(1)(a) Consent (where applicable)

Article 6(1)(f) Legitimate Interests (where appropriate)

For special category data:

Article 9(2)(g)

Article 9(2)(h)

Schedule 1 Data Protection Act 2018 conditions

Data Breach:

 If we become aware of a data breach that is likely to result in a high risk to your rights or freedom, and as required by data protection legislation, we will notify the ICO and affected individuals of personal data breaches.

 For the purposes of relevant data protection legislation, the College is the Data Controller.

Details of the Data Controller are:

Data Protection Officer
St Brendans Sixth Form College
Broomhill Road
Bristol

BS4 5RQ

dpo@stbrn.ac.uk 

Contact and Complaints

If you have any questions, contact our Data Protection Officer at dpo@stbrn.ac.uk or via our Complaints Policy.

If you are not satisfied through these channels, you can contact the Information Commissioner’s Office:  https://ico.org.uk/concerns/

This Privacy Notice has been prepared in accordance with the UK GDPR and the Data Protection Act 2018..

Privacy Notice:  DfE

This privacy notice is issued on behalf of the Secretary of State for the Department of Education (DfE) to inform learners about the Individualised Learner Record (ILR) and how their personal information is used in the ILR. Your personal information is used by the DfE to exercise our functions under article 6(1)(e) of the UK GDPR and to meet our statutory responsibilities, including under the Apprenticeships, Skills, Children and Learning Act 2009. Our lawful basis for using your special category personal data is covered under Substantial Public Interest based in law (Article 9(2)(g)) of UK GDPR legislation. This processing is under Section 54 of the Further and Higher Education Act (1992).

The ILR collects data about learners and learning undertaken. Publicly funded colleges, training organisations, local authorities, and employers (FE providers) must collect and return the data each year under the terms of a funding agreement, contract or grant agreement. It helps ensure that public money is being spent in line with government targets. It is also used for education, training, employment, and well-being purposes, including research.

We retain your ILR learner data for 20 years for operational purposes (e.g. to fund your learning and to publish official statistics). Your personal data is then retained in our research databases until you are aged 80 years so that it can be used for long-term research purposes. For more information about the ILR and the data collected, please see the ILR specification at https://www.gov.uk/government/collections/individualised-learner-record-ilr

ILR data is shared with third parties where it complies with DfE data sharing procedures and where the law allows it. The DfE and the English European Social Fund (ESF) Managing Authority (or agents acting on their behalf) may contact learners to carry out research and evaluation to inform the effectiveness of training.

For more information about how your personal data is used and your individual rights, please see the DfE Personal Information Charter ( https://www.gov.uk/government/organisations/department-for-education/about/personal-information-charter ) and the DfE Privacy Notice ( https://www.gov.uk/government/publications/privacy-notice-for-key-stage-5-and-adult-education )

If you would like to get in touch with us or request a copy of the personal information DfE holds about you, you can contact the DfE in the following ways:

Using our online contact form https://form.education.gov.uk/service/Contact_the_Department_for_Education

By telephoning the DfE Helpline on 0370 000 2288

Or in writing to: Data Protection Officer Department for Education 4th floor 2 St Paul’s Place 125 Norfolk Street Sheffield S1 2FJ

If you are unhappy with how we have used your personal data, you can complain to the Information Commissioner’s Office (ICO) at:

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You can also call their helpline on 0303 123 1113 or visit https://www.ico.org.uk

Privacy Notice :  LRS

The information you supply is used by the Learning Records Service (LRS). The LRS issues Unique Learner Numbers (ULN) and creates Personal Learning Records across England, Wales, and Northern Ireland, and is operated by the Department for Education (DfE) in England. This privacy notice explains how we use your personal information. For the purposes of relevant data protection legislation, the DfE is the data controller for personal information processed.

The LRS supports the DfE by collecting learner information from training providers and awarding organisations. For the purposes of relevant data protection legislations, the DfE is the data controller for personal information we process.

We receive your personal data from: schools, colleges, local authorities, and training/learning providers and accredited achievement data supplied by awarding organisations

 The aims of LRS are to: create a trusted and verified record of learning for citizen across England, Wales, and Northern Ireland, enable education organisations to access these records when required to support individuals with enrolment to education and careers advice, ensuring they get access to the correct education and government funding, issue you with a Unique Learner Number (ULN), create your Personal Learning Record (PLR) and collect entries and results data that is used to create national statistical publications.  The PLR is a lifetime record of achievement for all learners.

All data in LRS will be retained until a learner is 80 years old and has not engaged with a learning provider for 7 years.

The full privacy notice can be found here: 
https://www.gov.uk/government/publications/lrs-privacy-notices/lrs-privacy-notice

St Brendans Sixth Form Privacy Notice:  Parent / Carer / Guardian

This privacy notice is issued by St Brendan’s Sixth Form College.  The protection of personal privacy is important to St Brendan’s and any personal data you provide will be treated in accordance with current data protection legislation. 

Throughout this guidance “child” refers to those you have parental responsibility for. "Parent” refers to parent / carer / guardian. 

When you, or your child, engages with St Brendan’s Sixth Form College in registering for an open event, when applying to join and / or subsequently enrolling key parental contact information is captured.  This notice explains what it is going to be used for, including any third parties with whom your information will be shared.  The notice contains details of when the data may be captured within the joining journey. 

We collect and use personal information about parents in order to carry out our responsibilities as a further education provider and to meet our legal obligations.

A separate comprehensive Privacy Notice is available for Students.

We collect personal data from various sources, including:

• yourself (during open event registration, engagement in communications with college staff),
• your child (during open event registration, application, enrolment and updating data)
• Local authorities and government agencies

Where information is transferred from another education provider, this may include

safeguarding records.  These are treated confidentially and only key information shared with those who may need to know in order to provide the relevant safeguarding support.

Why we collect and use this information

We use your information to: 

• provide you with relevant information linked to applying to the college, to process and assess your child’s application and for your child’s enrolment.
• promote relevant activities and events linked to yours child’s programme of study
• provide information and progress updates on your child’s learning and examinations
• keep you informed of college events (such as parents evenings) and other opportunities
• contact you in the event of an emergency
• assess eligibility for financial support
• comply with the law regarding safeguarding, data sharing and entitlement to study
• deal with grievances, complaints and disciplinary action
• In order to provide these services effectively, College staff have access to our records of your personal information. This access is bound by strict guidance to staff about confidentiality and limited to proper professional use.
• By registering for an open event, you consent to us providing updates and conducting experience surveys without further explicit consent.
• Where special category information is processed, this is undertaken in accordance with Article 9 UK GDPR and Schedule 1 of the Data Protection Act 2018, including safeguarding, substantial public interest and educational support purposes where applicable

Where automated processes are used, they are subject to human oversight. 

With whom do we share information?

Some of your personal data may be shared with the following:

• Local Authorities
• Parent evening booking systems in order for the college to manage meetings between parents and teachers. 
• Email systems (such as DotMailer) in order to provide email communications
• Audit / inspection bodies, such as and not limited to Validera
• Pay My Student.
• Evolve – online system for managing visits/trips.
• Information management systems such as My Concern and external agencies relating to safeguarding.
• Agencies involved in supporting the organisation of trips that your child opts to attend.
• Safeguarding and support agencies where deemed appropriate and necessary. 
• A comprehensive list of platforms / systems with which personal data is shared will be collated and maintained with a brief summarisation of purpose. 

When we share your information with these partners/organisations, we share only the minimum information necessary for the purposes outlined. We ensure any data shared is transferred securely to protect any data containing your personal information so that if a communication is intercepted in transmission your data will remain secure.  We only share your personal data where the law allows us to do so.  Any systems implemented for use are assessed for adherence to GDPR and UK Data Protection principles.  Where personal data is transferred outside the UK, appropriate safeguards will be in place in accordance with UK GDPR 

Why we share parent data

We are required to share certain information with external agencies within our legal responsibility for safeguarding students. 

Security

The College uses CCTV to assist with providing a safe and secure work / study environment. CCTV images will be used only when required to investigate an incident, unacceptable behaviour, crime prevention and damage etc.

A comprehensive CCTV policy is viewable on our college website.

How long will we keep your Personal Information?

Data, including electronic records, will be held as long as necessary in order to fulfil our responsibilities as an education provider.  

• Registration information provided at Open Events:  15 months.  After this, only statiscal information will be retained.
• Parental Information provided through the application process – where the student does not enrol at any time with St Brendans:  2 years
• Parental information for enrolled students:  Most student records are retained for 7 years after leaving
• Safeguarding records may be retained until age 25 or older

Full details are available in the St Brendans Records Retention Schedule.

Your responsibilities for your Personal Information

Loss of personal data and identity theft can have potentially harmful consequences.

It is important that you take responsibility for the following:

• Report any inaccuracies in the personal information viewable on Student ProPortal by submitting a change request or emailing the required changes through to mis-team@stbrn.ac.uk
• Never share your network log-in details with anyone else

Your rights to access your Personal Data

You have the right to:

• Request for your details to be removed from our records.  Where a student continues to be in enrolled we will need a minimum of one emergency contact.
• Request access to your personal data.  Being specific about the information required will enable us to limit searches and reply in a more timely manner.
• Ask for incorrect data to be corrected
• Request deletion of your data. This right is limited where we are legally required to retain information
• Object to or restrict how your data is used
• Request transfer of your data

To exercise your rights, contact dpo@stbrn.ac.uk

Our legal basis for processing data:

St Brendan’s process personal data under one or more of the following UK GDPR lawful bases:

Article 6(1)(c) Legal Obligation

Article 6(1)(e) Public Task

Article 6(1)(a) Consent (where applicable)

Article 6(1)(f) Legitimate Interests (where appropriate)

Data Breach:

If we become aware of a data breach that is likely to result in a high risk to your rights or freedom, and as required by data protection legislation, we will notify the ICO and affected individuals of personal data breaches.

For the purposes of relevant data protection legislation, the College is the Data Controller.

Details of the Data Controller are:

Data Protection Officer
St Brendans Sixth Form College
Broomhill Road
Bristol

BS4 5RQ

dpo@stbrn.ac.uk

Contact and Complaints

If you have any questions, contact our Data Protection Officer at dpo@stbrn.ac.uk or via our Complaints Policy.

If you are not satisfied through those channels, you can contact the Information Commissioner’s Office:  https://ico.org.uk/concerns/

This Privacy Notice has been prepared in accordance with the UK GDPR and the Data Protection Act 2018.