Hairdressing, Barbering and Beauty Applicant Selection Privacy Notice

Why are we collecting it, and what are we doing with it (Purpose)?

We are collecting your information to process your application to do a course in the Hairdressing and Beauty department. The application and interview process requires certain written tasks to ensure you are at the correct level for your chosen course, whether this is Hairdressing, Barbering, Beauty/or Complementary Therapies. Following the College receiving these written tasks, you will be invited to an interview with the Hairdressing and/or Beauty staff to assess your suitability for the course.

What personal data do we collect?

Personal data is information that identifies you and relates to your life (whether that’s your home life, education, business, or job). Some of your personal data (like your health information, religion, or ethnicity) is more sensitive – this is called “special category data”. 

Personal data

• Name
• Course applied for
• Written Tasks
• Questions in the interview

How are we collecting this information? What is the source?

We collect this directly from you, via your application form, and, where applicable, on the day of your interview.

The lawful basis for the processing

Under data protection law the legal basis for the College in processing your personal data is GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” The Post-16 Education (Scotland) Act 2013 and the Further and Higher Education (Scotland) Acts 1992 and 2005 require the College to provide quality fundable courses and this is one of the College’s core public tasks.

Who we share the information with

The College does not share your application, written tasks and interview information with anyone external to the College. The College does use third-party software providers, for example, Microsoft Teams. In those instances, appropriate contractual agreements are in place to protect your information.

Details of data transfers to any third countries or international organisations

Depending on the course you have applied for, the College requests that you provide a written task to upload with your application.

How long do we hold the personal data? 

The College will not hold your data for longer than necessary for the purpose of interviews for your chosen course. Following the completion of interviews for the academic year, the department will hold the tasks and interviews for six months. After that period has passed, the College will securely destroy the records in accordance with College procedures.

Individuals’ rights in relation to this processing

Under data protection law, you have a number of rights; some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing, and the College would be required to process your request within one month.

The rights that apply to this particular processing are:

• Right to be Informed – i.e. a privacy notice.
• Right of Access – this means you have the right to access your personal information.
• Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
• Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request that your personal data be deleted.
• Right to Data Portability – this means you have the right to request your information in a machine-readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
• Right to Restriction – this means you can restrict the processing of your information and links with some of the other rights.
• Right to Object – this means you can object to how your data is used.
• Right to be informed of automated individual decision-making (including profiling) – we do not use this for OH purposes, and therefore this does not apply.

Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time, and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

Complaints to the UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance, please contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome, then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO guides on the ICO website.

You can email them at casework@ico.org.uk, call them on 0303-123-113, or you can send a letter to them at the following address: