0 Shortlist Search
Enter your keyword, course, subject or interest
EC Default Banner

Compliments and Complaints Privacy Notice

Who is collecting the information?

Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

Why are we collecting it, and what are we doing with it (Purpose)?

Your personal information is collected to record and process your compliment or complaint. The Complaints Handling Co-Ordinator/Investigating Officer may use this personal information to contact you concerning an objection or complaint.

What personal data do we collect?

Personal data

  • Forename and surname
  • Name of individual acting on your behalf (if applicable)
  • Address
  • Email address
  • Mobile number
  • Course (if applicable)
  • Campus (if applicable)
  • Opinions and other relevant information in relation to the investigation

Special Category Personal Data

  • Racial or ethnic origin
  • Political opinions
  • Religious or philosophical beliefs
  • Trade Union membership
  • Health information
  • Sex life or sexual orientation

How are we collecting this information? What is the source?

This information is collected when you complete the compliments and complaints form to record a compliment or complaint about the college. When your complaint is being investigated, the Complaints Handling Coordinator or Investigating Officer may need to collect further information via email or telephone.

The lawful basis for the processing

The legal basis for processing your personal data is GDPR Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” In this instance, as the College is a public body, it is required under the Scottish Public Services Ombudsman Act 2002 to investigate and resolve complaints received from members of the public.

Suppose you have provided any special category/sensitive personal data within your compliment or complaint. In that case, the legal basis for processing is GDPR Article 9(2)(a): “the data subject has given explicit consent to the processing of those personal data for one or more specified purposes.”

Who we share the information with

Your data will be shared with the investigating officer to facilitate the processing of your complaint. If you have authorised another individual or organisation to act on your behalf, then we would only share information with them on receipt of a completed Data Subject Authorisation Disclosure form. This form is necessary to ensure that you have given the individual/organisation authority to represent you and act on your behalf.

How long do we hold the personal data?

Your information is held for three years from the date of receipt of your compliment and three years after closure of your complaint. After that, your data will be securely destroyed in accordance with College procedures.

Individuals’ rights in relation to this processing

Under data protection law, you have a number of rights; some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing, and the College would be required to process your request within one month.

The rights that apply to this particular processing are:

  • Right to be Informed – i.e. a privacy notice.
  • Right of Access – this means you have the right to access your personal information.
  • Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
  • Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request that your personal data be deleted.
  • Right to Data Portability – this means you have the right to request your information in a machine-readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
  • Right to Restriction – this means you can restrict the processing of your information and links with some of the other rights.
  • Right to Object – this means you can object to how your data is used.
  • Right to be informed of automated individual decision-making (including profiling) – we do not use this for OH purposes, and therefore this does not apply.

Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time, and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

Complaints to the UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance, please contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome, then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO guides on the ICO website.

You can email them at casework@ico.org.uk, call them on 0303-123-113, or you can send a letter to them at the following address:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF