International Student Privacy Notice

Who is collecting the information?

Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

Why are we collecting it, and what are we doing with it (Purpose)?

We collect your information to process your application and enrol you on an Edinburgh College programme of study, and to facilitate your studies at the college (we explain this in more detail below).

We use your information to provide you with accommodation services, cultural activities (e.g., arranging visits to local attractions), school visits, and transport services (e.g., collecting you from the airport).

We specifically need your information:

To process your application to study one of our courses

This will include reviewing your application to see if you have met the entry criteria for a course; evaluating whether the college can offer you a place on a course/fulfil a contract of study; and offering a place on an Edinburgh College course where appropriate.

To review any additional support needs you may have

This application form allows you to tell the college about any additional support needs (including health needs) you may have.

For academic purposes (once you enrol)

To provide you with teaching, learning and support services; to assess your work; record your progress and ensure you receive certificates from awarding bodies like SQA and BTEC. To give you access to learning and teaching tools, Student Support, IT, library, careers, and other college services. To seek your feedback on our courses.

For administrative and financial management services

To administer fees due and paid for by you and to process payments made for other college-related services (for example, if you are staying in college accommodation). Edinburgh College works with Western Union to facilitate student payments. When you make your payment via Western Union, Western Union will inform the College of your name and the amount you have paid.

For immigration purposes

To support you with your application for a visa to study in the UK, and to comply with our Tier 4 Sponsor obligations to support immigration control.

To analyse student applications and enrolments for business, planning and equal opportunities purposes

The college analyses student applications and enrolments, including by key protected characteristic groups (age; disability; gender reassignment; marriage and civil partnership; pregnancy and maternity; race; religion or belief; gender; and sexual orientation), to plan and improve its services and curriculum offering. Analysing applications and enrolments by key protected characteristic groups forms part of the college’s responsibilities under the Public Sector Equality Duty, part of the Equality Act (2010).

What personal data do we collect?

Personal data

Name, address, telephone number, email address
Date of birth
Nationality
Next of kin and emergency contact details
Employer details
Previous education, qualifications and employment history
Bank account details
Financial information (including family)
Course and units of study (including previous courses of study)
Assessment information related to your course, including assessment and exam dates and results
Disciplinary information
Appeals and complaints information
Photographic image and footage (CCTV)
Your IP Address (your unique online identifier when browsing the internet).
Your unique student ID
First/preferred language
Gender
Marital/civil partnership status (*if your visa status is dependent on your partner)

Special Category Personal Data

Disability and health data (including mental health)
Special interest group status (e.g. asylum seeker; refugee)
Passport number and country of domicile
Visa information
Immigration history
Attendance data

How are we collecting this information? What is the source?

When you first apply for a place on an Edinburgh College course, we will collect data about you from your completed application form.

When you formally enrol on a course, we will also ask you for additional personal information.

If an agent or sponsor refers or sponsors you for your course, we will receive some or all of your personal information directly from your agent or sponsor.

The lawful basis for the processing

Under GDPR Article 6(1)(b), “Processing is necessary for the performance of a contract to which the data subject is a party to take steps at the request of the data subject before entering into a contract.” It is the legal basis for processing your personal data (to enrol you as a student at Edinburgh College and deliver the educational experience detailed to you).

For special category (sensitive) personal data, the legal basis is Article 9(2)(b) “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.” The specific social protection law which authorises the processing of special category personal data is the Equality Act (2010).

Who we share the information with

For immigration purposes

As a Tier 4 Sponsor, Edinburgh College has a responsibility to comply with all aspects of the Immigration Rules and sponsor guidance, and support immigration control, including taking steps to ensure that every student at our institution has permission to study in the UK throughout the whole period of their study. We must co-operate with the Home Office (UK Visas and Immigration) by complying with requests for information, including in connection with the prevention or detection of crime, the administration of civil penalties for illegal working, and/or the apprehension or prosecution of immigration offenders.

For sponsored programmes

We may be required to provide reports to your financial sponsors to update them about your attendance, progress and welfare.

For students under 18

We may contact your parents or guardians if we have any concerns about your attendance, progress or welfare.

For academic purposes

Such as providing the results of assessments to awarding bodies to enable them to confer academic awards (e.g., an HNC, SVQ, or BTEC qualification); and arranging an industry placement for you as part of your studies.

For democratic purposes

To enable you to vote in Edinburgh College Students’ Association (ECSA) elections, as per your legal right to elected student representation.

Where we place you in accommodation (e.g. halls of residence with a home stay host)

e.g. halls of residence with a home stay host)We will share your personal information (name, age, gender, contact details, special category information, dietary requirements, allergies, and medical requirements) to facilitate your stay.

Where we arrange transport (e.g. bus passes or taxi transfers)

(e.g. bus passes or taxi transfers) We will share your name and (homestay) address in Edinburgh with the transport provider.

Where we arrange a school visit

We will share your name with the school you are visiting.

Where you are due a refund of fees

If you have paid your fees through Western Union and are due a refund under our refund policy, we will share your name, reference number, email address, and the amount to be refunded with Western Union.

Where we have a legal obligation to do so

Edinburgh College is obliged to share limited information on international students with the Scottish Funding Council – the regulatory body for Scottish colleges. This information is limited to your: gender; name; date of birth; postcode; Scottish Candidate Number; and how your place on an Edinburgh College course is being funded.

Details of data transfers to any third countries or international organisations

For sponsored programmes

We may be required to provide reports to your financial sponsors to update them about your attendance, progress and welfare – subject to where your sponsor is located, this may be outside the EU. Where a sponsor is outside the EU, the college ensures appropriate organisational and technical security measures are in place to safeguard your data and that an explicit agreement is in place around the security of your information.

Where you pay your fee via Western Union

Edinburgh College works with Western Union to facilitate student payments. When you make your payment via Western Union, Western Union will inform the College of your name, your student reference number (from the offer letter sent to you by the College) and the amount you have paid. Western Union processes your data in the United States. Where Edinburgh College shares your data with Western Union (for the purposes of processing a refund), your personal data will be processed in the United States.

How long do we hold the personal data?

We will keep paper records in relation to your studies for three years after the end of the academic year in which you are studying. Digital information will be stored on the college’s systems and the student records database in line with the college's retention and disposal schedules.

Individuals’ rights in relation to this processing

Under data protection law, you have a number of rights; some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing, and the College would be required to process your request within one month.

The rights that apply to this particular processing are:

Right to be Informed – i.e. a privacy notice.
Right of Access – this means you have the right to access your personal information.
Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request that your personal data be deleted.
Right to Data Portability – this means you have the right to request your information in a machine-readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
Right to Restriction – this means you can restrict the processing of your information and links with some of the other rights.
Right to Object – this means you can object to how your data is used.
Right to be informed of automated individual decision-making (including profiling) – we do not use this for OH purposes, and therefore this does not apply.

Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time, and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

Complaints to the UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance, please contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome, then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO guides on the ICO website.

You can email them at casework@ico.org.uk, call them on 0303-123-113, or you can send a letter to them at the following address:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF