EH15 and The Apprentice customers Patron Comment Cards

Who is collecting the information?

Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

Why are we collecting it, and what are we doing with it (Purpose)?

The information collected is used solely for marketing and promotional purposes related to EH15 and the Apprenticeship Restaurant. We will use your information to contact you via email (where you request this) to advise you of restaurant offers and special promotions relating to Edinburgh College’s EH15 and Apprentice restaurants.

Your feedback scores and any comments you provide will be used by the college’s learning and teaching staff to provide feedback to students and will form part of their assessment material. Please note that comment cards are completely anonymised for this purpose.

What personal data do we collect?

The personal information we collect includes your

• Forename
• Surname
• Email address
• Postal address
• Feedback on your dining experience
• Any comments you provide. 

We will also keep a record of your consent to receive promotional information via email, provided you have given this consent.

How are we collecting this information? What is the source?

The data is collected from EH15 and the Apprentice Restaurant patron comment cards.

The lawful basis for the processing

The condition for processing personal data for this purpose is Article 6(1)(a): “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”

If you wish to withdraw consent to receive direct marketing, please email: Communications@Edinburghcollege.ac.uk.

Who we share the information with

Data Processors

We use a third-party provider, Mailchimp (Data Processor), to communicate our promotional offers with you. We also gather statistics on email opens and clicks using MailChimp (a sub-processor) to help us monitor and improve our communication. For more information, please see Mailchimp’s Privacy Policy.

Details of data transfers to any third countries or international organisations

Mailchimp (Data Processor) is a US-based company, and your information may be transferred to, stored, or processed in the United States. Mailchimp participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework.

How long do we hold the personal data?

We will retain your information for 5 years from the date of your consent. After this time, we will re-contact subscribers to confirm they wish to remain on our mailing lists.

Individuals’ rights in relation to this processing

Under data protection law, you have a number of rights; some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing, and the College would be required to process your request within one month.

The rights that apply to this particular processing are:

• Right to be Informed – i.e. a privacy notice.
• Right of Access – this means you have the right to access your personal information.
• Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
• Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request that your personal data be deleted.
• Right to Data Portability – this means you have the right to request your information in a machine-readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
• Right to Restriction – this means you can restrict the processing of your information and links with some of the other rights.
• Right to Object – this means you can object to how your data is used.
• Right to be informed of automated individual decision-making (including profiling) – we do not use this for OH purposes, and therefore this does not apply.

Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time, and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

Complaints to the UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance, please contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome, then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO guides on the ICO website.

You can email them at casework@ico.org.uk, call them on 0303-123-113, or you can send a letter to them at the following address:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF