Data Protection Policy

To Know Our Data Protection Policy

(Last reviewed: May 2021)

About This Policy:

Eynsford College holds and processes information about employees, learners, and other data subjects for academic, administrative and commercial purposes. When handling such information, Eynsford College, and all staff or others who process or use any personal information, must comply with the Data Protection Policy Principles which are set out in the Data Protection Act 1998 and from 25 May 2018 the General Data Protection Regulation (collectively, the Data Protection Legislation).

Data Protection Principles:

Anyone processing data must comply with the data protection principles, personal data must:

• be processed fairly and lawfully,
• be obtained for a specified and lawful purpose and shall not be processed in any manner incompatible with the purpose,
• be adequate, relevant and not excessive for the purpose
• be accurate and up-to-date,
• not be kept for longer than necessary for the purpose,
• be processed in accordance with the data subject’s rights,
• be kept safe from unauthorised processing, and accidental loss, damage or destruction
• not be transferred to a country outside the European Economic Area, unless that country has equivalent levels of protection for personal data, except in specified circumstances.

Collecting personal information:

GDPR Legislation ensures that personal data processing is done fairly and without adversely affecting the rights of the data subject.

Personal data should be processed on the basis of one of the legal ground set out in Data protection Legislation. This includes

• Consent must be given by data subject
• The processing is necessary for the fulfilment of a contract with data subject
• Compliance with a legal obligation to which the data controller is subject
• For the legitimate interest of the data controller or the party to whom the data is disclosed.

Whenever special categories of personal data or information about criminal offences (such as a DBS checks) are being processed, additional conditions must be met.

Personal data is sometimes collected with prior consent from persons visiting or phoning the College or electronically through visits to our website for the purposes.

Processing for Limited Purposes:

In order to provide services, we may collect and process personal data for a variety of purposes, including: enrolment of our students, administration of our courses, provision of suitable homestay accommodation, recruitment of staff and staff administration, and compliance with our legal obligations.

Personal data may include information we receive directly from a data subject (for example, by completing forms or by corresponding with us by mail, phone, email or otherwise) and information we receive from other sources (including, for example, business partners, subcontractors in technical, payment and delivery services, the Disclosure and Barring Service and others)

We will only process personal data for the specific purposes set out in this policy or for any other purpose permitted by the Data Protection Legislation. We will notify those purposes to the data subject when we first collect the data or as soon as possible thereafter.

Further information about how we process personal data relating to our staff is contained in our Staff Handbooks.

Notifying data subjects:

If we collect personal data directly from data subjects, we inform the data subject of the purpose(s) for which we intend to process that personal data,

If we receive personal data about a data subject from other sources, we will provide the data subject with this information as soon as possible thereafter.

We will inform data subjects whose personal data we process that we are the data controller with regard to that data.

Adequate, relevant and non-excessive processing:

We will only collect personal data that is required for the purpose.

Accurate data:

We will ensure that personal data we hold is accurate and kept up to date. Accuracy of any personal data is ensured at the point of collection and at regular intervals afterwards. We will take all reasonable steps to destroy or amend inaccurate or out-of-date data.

Timely processing:

We will not keep personal data longer than is necessary for the purpose or purposes for which they were collected. We will take all reasonable steps to destroy, or erase from our systems, all data which is no longer required.

Processing in line with data subject’s rights

We will process all personal data in line with data subjects’ rights as:

A subject may request access to any data held about them by a data controller. The Data Protection Act 1998 (the “Act”) gives data subjects the right to access information held about them. This is subject to a fee of £10 to meet our costs for providing this.

A subject may prevent the processing of their data for direct-marketing purposes and request that any inaccurate personal data about them is corrected.

They may request that we stop using their personal information for certain purposes.

Personal data must be provided in a portable format and deleted on request by the data subject.

Decisions about them should not be made by wholly automated means

Some of the rights listed above are limited to certain defined circumstances and we may not be able to comply with requests.

If a data subject is unhappy with the way we are processing or have processed their personal data, they have a right to complain to the Information Commissioner’s Office. More information about this can be found at: https://ico.org.uk/concerns/

Security of data

Eynsford College will take appropriate security measures against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data.

• We will maintain data security by protecting the confidentiality, integrity and availability of the personal data, defined as follows:

Confidentiality: means that only people who are authorised to use the data can access it.

Integrity: means that personal data should be accurate and suitable for the purpose for which it is processed

• Only authorised users will be able to access the data if they need it for authorised purposes. Personal data should therefore be stored on our central computer system instead of individual PCs.
• Security procedures include: Access to data by authorised persons only
• Secure lockable desks and cupboards to be kept locked if they hold confidential information of any kind. (Personal information is always considered confidential.)
• Paper documents should be shredded.
• Digital storage devices should be physically destroyed when they are no longer required.
• All computer users must ensure that monitors do not show confidential information to passers-by and that they log off from their PC when it is left unattended

How we use your personal information:

The personal information we collect from you is used by the College to help us provide a service which is suited to your needs and preferences.

The College will:

• Create a profile for you
• Present the information in the most suitable way to suit your needs and the technology you use

The College may also:

• Use the information collected for data analysis, tests and research so that we can ensure that the content is presented in the most effective manner for you and for your computer as part of our efforts to keep our site safe and secure.
• Disclose your information if required to do so by law.

The College will not:

• Share your personal information for direct marketing purposes.

Opting Out and Deletion of Data

Personal Information:

Your personal information provided for contact purposes (name, address, telephone number, email) may be removed from our database at any point on request.

Intellectual Property Rights

Unless otherwise stated, we are the owner or the licensee of all intellectual property rights in our site, and in the material published on it. Those works are protected by copyright laws. All such rights are reserved.

All materials on this site, including but not limited to images, text, audio clips, artwork, and video clips, are, unless otherwise stated, owned and controlled by us and may not be copied, reproduced, republished, uploaded, posted, transmitted or distributed in any way. Modification of the materials or unauthorized use of the materials for any purpose is a violation of our legal rights.

Acceptable Use

You may only use our site for lawful purposes. You may not use our site:

• In any way that breaches any local, national or international law or regulation.
• For unlawful or fraudulent purposes.
• To knowingly transmit any harmful programs that adversely affects the operation of any computer software or hardware.
• Not to reproduce, duplicate, or copy any part of our site without our express permission.
• To transmit any unsolicited or unauthorised advertising or promotional material or any other form of similar solicitation (spam).

External Links

College website may contain links to and from websites operated by individuals and companies over which we have no control. If you follow a link to any of these websites, please note that these websites have their own privacy and terms of use policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Changes to our Privacy Policy

Any amendments to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy policy. Contact, questions, comments and requests regarding this privacy policy are welcomed and should be addressed to asker@eynsfordcollege.co.uk

Definitions :

Data subjects: A person whose data is collected

Data controller: is the organisation which determines the purposes for which, and the manner in which, any personal data is processed.

Data: is information which is stored electronically or in certain paper-based filing systems.

Data processor: is an employee who processes personal data on behalf of the College.

Third parties: may include contractors, suppliers, contacts, referees, friends, or family members.

Processing refers to any action involving personal information, including obtaining, viewing, copying, amending, adding, deleting, storing, disclosing or destroying information.

—- —- —- —– —-

Staff Responsibilities

All staff shall:

• ensure that all personal information which they provide to Eynsford College in connection with their employment is accurate and up-to-date;
• inform Eynsford College of any changes to information, for example, changes of address;
• check the information which Eynsford College shall make available from time to time, in written or automated form, and inform Eynsford College of any errors or, where appropriate, follow procedures for up-dating entries on computer forms. Eynsford College shall not be held responsible for errors of which it has not been informed.

When staff hold or process information about students, colleagues or other data subjects (for example, students’ course work, references to other academic institutions, or details of personal circumstances), they should comply with the Data Protection Policy Guidelines for Staff.

Staff shall ensure that

• all personal information is kept securely;
• personal information is not disclosed either orally or in writing, accidentally or otherwise to any unauthorised third party.

Unauthorised disclosure may be a disciplinary matter, and may be considered gross misconduct in some cases.

 Student Responsibilities

All learners shall

• ensure that all personal information which they provide to Eynsford College is accurate and up-to-date;
• inform Eynsford College of any changes to that information, for example, changes of address;
• check the information which Eynsford College shall make available from time to time, in written or automated form, and inform Eynsford College of any errors or, where appropriate, follow procedures for up-dating entries on computer forms. Eynsford College shall not be held responsible for errors of which it has not been informed.

Students who use Eynsford College computer facilities may, from time to time, process personal information (for example, in course work or research). In those circumstances, they must notify the tutor or Director, who will provide further information about this requirement.

Rights to Access Information

Staff, students and other data subjects in Eynsford College have the right to access any personal data that is being kept about them either on computer or in structured and accessible manual files. Any person may exercise this right by submitting a request in writing to the Managing Director.

Eynsford College aims to comply with requests for access to personal information as quickly as possible, but will ensure that it is provided within 5 days unless there is good reason for delay. In such cases, the reason for the delay will be explained in writing by the Managing Director to the data subject making the request.

Subject Consent

In some cases, such as the handling of sensitive information or the processing of research data, Eynsford College is entitled to process personal data only with the consent of the individual. Agreement to Eynsford College processing some specified classes of personal data is a condition of acceptance of a student on to any course, and a condition of employment for staff.

Sensitive Information

Eynsford College may process sensitive information about a person’s health, disabilities, criminal convictions, race or ethnic origin. For example, some jobs or courses will bring the applicants into contact with children, including young people between the ages of 16 and 18, and Eynsford College has a duty under the Children Act 1989 and other enactments to ensure that staff are suitable for the job, and learners for the courses offered. Eynsford College may also require such information for the administration of the sick pay policy, the absence policy or the equal opportunities policy, or for academic assessment.

Eynsford College also asks for information about particular health needs, such as allergies to particular forms of medication, or conditions such as asthma or diabetes. Eynsford College will only use such information to protect the health and safety of the individual, for example, in the event of a medical emergency.

Assessment Marks

Students shall be entitled to information about their marks for assessments, however this may take longer than other information to provide. Eynsford College may withhold enrolment, awards, certificates, accreditation or references in the event that monies are due to Eynsford College.

Retention of Data

Eynsford College will keep different types of information for differing lengths of time, depending on legal, academic and operational requirements.

 Compliance: