Enterprise and Business Start-up Support

Who is collecting the information?

This notice relates to data which will be collected by third-party partners working with Edinburgh College to offer services and support to students and staff.

Edinburgh College is the Data Controller for the personal data received. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

If you have any questions about the research or your participation, please contact research@edinburghcollege.ac.uk.

Why are we collecting it, and what are we doing with it (Purpose)?

Edinburgh College students will be signposted to Business Start-up support offered by a range of external partners, including Bridge to Business, The Merchant Company of Edinburgh, Business Gateway Edinburgh, Business Gateway Midlothian, Codebase and the RBS Accelerator. This support could include mentorship programmes, funding opportunities, networking events, workshops and 1:1 support.

These partners will collect your personal data directly to help individuals register for activities and stay engaged. They will share some of this personal data with the College to inform engagement with and uptake of the support, and to allow for programme evaluation.

What personal data do we collect?

We will receive:

• name
• age or date of birth,
• course studying
• details of the specific support you have engaged with

The lawful basis for the processing

Under data protection legislation, the lawful basis for the College to process the information we receive is UK GDPR Article 6(1)(e) ‘performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’.

Who we share the information with

After receiving information from the Business Start-up Support organisation, we do not share it outside the college.

How long do we hold the personal data?

Data will be held for one academic year to support programme evaluation.

Individuals’ rights in relation to this processing

Under data protection law, you have a number of rights; some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing, and the College would be required to process your request within one month.

The rights that apply to this particular processing are:

• Right to be Informed – i.e. a privacy notice.
• Right of Access – this means you have the right to access your personal information.
• Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
• Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request that your personal data be deleted.
• Right to Data Portability – this means you have the right to request your information in a machine-readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
• Right to Restriction – this means you can restrict the processing of your information and links with some of the other rights.
• Right to Object – this means you can object to how your data is used.
• Right to be informed of automated individual decision-making (including profiling) – we do not use this for OH purposes, and therefore this does not apply.

Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time, and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

Complaints to the UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance, please contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome, then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO guides on the ICO website.

You can email them at casework@ico.org.uk, call them on 0303-123-113, or you can send a letter to them at the following address:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF