Student Funding (Bursary, EMA, Childcare) Privacy Notice

Who is collecting the information?

Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

Why are we collecting it, and what are we doing with it (Purpose)?

We collect and process your data for assessing eligibility for funding assistance and for management planning purposes. The following details this further explaining each purpose and how they relate to the different types of courses etc.

To assess and process your application for student funding assistance

Further Education (FE) courses:

When you accept an offer of a place on a Further Education (FE) course at Edinburgh College you will have the opportunity to apply for student funding on the EMA/Bursary and Childcare funding sections of the application website. If you choose to apply for funding you will receive an email asking you for documentary evidence to support your application. This email will give you instructions on how to supply this and about what will happen next. (Please note childcare funding can only be awarded for registered childcare costs whilst you are attending classes).

Higher Education (HE) courses:

If you accept a place on a Higher Education (HE) course you will have the opportunity to apply for childcare funding on the funding application website. If you choose to apply for funding you will receive an email asking you for documentary evidence to support your application. This email will give you instructions on how to supply this and about what will happen next. (Please note childcare funding can only be awarded for registered childcare costs whilst you are attending classes).

The assessment process:

The assessment process will include reviewing your application and supporting documents to verify that you meet the eligibility criteria for funding; assessing your application for the correct level of funding in accordance with Scottish Funding Council policies, and issuing an award decision notice.

In order to assess your eligibility and level of award the Student Funding Team will use the information you have provided about your education, location and personal circumstances to consider whether you are eligible for support. The Student Funding Team will also review the information you have provided on your course application, should it be necessary to do so.

For Childcare Funding applications the assessment process may also include contacting your childcare provider to confirm or clarify details of the childcare cost information they have provided in the Childcare Costing Document submitted with your application.

To analyse student funding applications for planning purposes

The college analyses student funding applications by award level and type for budget planning and to ensure the college is meeting Scottish Funding Council recommendations regarding priority groups (lone parents, young carers and care-experienced students).

What personal data do we collect?

Personal data

Name, primary & term address, telephone number, email address
Date of birth
Course information (course choice, mode and level)
Previous education (including Scottish Candidate Number), qualifications and employment history
Previous funding history
Employment status (e.g. jobseeker) and history
UK Visa status; Home Office status; EU residency (as required)
Household composition and tax-year annual income of both student and relevant household members as applicable (also includes estrangement)
Bank details
If you are a carer or have caring responsibilities
Care experienced/looked after background status (if applicable)
Details of siblings/dependants/adult dependants where applicable and relevant
Details of registered childcare provider and childcare provision required
Your IP Address (your unique online identifier when browsing the internet)

Special category data

Gender (and gender identity)
Disability and health data (including mental health) when relevant to the award
Marital/civil partnership status
Special interest group status (e.g. asylum seeker; refugee; stateless person; person with profound or complex needs)
Nationality
Residency information/date, duration and reason of entry to the UK/EU

How are we collecting this information? What is the source?

We collect this information directly from you through the college’s funding application form or directly from you, after you have submitted your application.

Student Funding

If you apply for student funding, we will use information from your course application (name, date of birth, gender, address, email address, phone number, and course details), and we will collect additional information from you through the Student Funding application form. You will be sent an email on submission of your online application form that will tell you about the supporting evidence you will need to provide to complete your application.

Childcare Funding

When we need further information about registered childcare costs, or need to verify the details of those costs (costs are verified three times a year in November, January and April), the college will contact your childcare provider directly. The information we will request is limited to: provider address and contact details; Care Commission registration number; start and end dates of provision; days, start and end time and daily cost of provision; details of Local Authority Partnership Funding being claimed by the provider (if any), contractual information (number of weeks of contract, holiday billing); bank details for payment of award.

Change of circumstances

Where you advise us of a change of address or a change in circumstances, and we need further information about this to assess any change in eligibility, we will collect this information from you separately.

The lawful basis for the processing

For processing of your personal data to process your application, the lawful basis is GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The specific law authorising this is the Post-16 Education (Scotland) Act 2013, and the underpinning legislation is described in further detail below.

Where your special category personal data are processed, the lawful basis is GDPR Article 9(2)(g) “processing is necessary for reasons of substantial public interest, based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”.

Student Funding Legislation

College governing bodies have power under section 12(2)(c) of the Further and Higher Education (Scotland) Act 1992 to provide students of the college with such assistance of a financial or other nature as it considers appropriate.

It is a condition of the Education (Access Funds) (Scotland) Direction 2017, that SFC shall administer student support funds, in conjunction with the Post 16 education bodies, in accordance with the requirements of section 73ZA of the Education (Scotland) Act 1980, the Education (Access Funds) (Scotland) Regulations 1990, the Education (Access Funds) (Scotland) Determination 2013.

Who we share the information with

The college shares your information with the:

Scottish Funding Council (SFC): if you are awarded EMA, bursary or childcare funding, the college is required to provide the following information to the Scottish Funding Council via secure data hub: your name, address, date of birth, course identifier, student matriculation number, total household income and details about the amount and type of funding you receive. This sharing is carried out securely, and an appropriate data sharing agreement is in place between SFC and the College.

The college uses the following data processors to process your personal information:

Unit-E, TeQuios and CAMS systems are provided by third party suppliers (e.g. Capita Further and Higher Education), to process student applications and student funding applications. Edinburgh College hosts these and sits within the college’s technical controls. The college also has appropriate contracts in place with these third-party suppliers. Microsoft (Reporting functions) is used to report on the supplied data.

How long do we hold the personal data?

Paper and electronic records are destroyed after seven years; personal and award data will remain on the college’s Student Funding system in line with the college’s retention schedule.

Individuals’ rights in relation to this processing

Under data protection law, you have a number of rights; some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing, and the College would be required to process your request within one month.

The rights that apply to this particular processing are:

Right to be Informed – i.e. a privacy notice.
Right of Access – this means you have the right to access your personal information.
Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request that your personal data be deleted.
Right to Data Portability – this means you have the right to request your information in a machine-readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
Right to Restriction – this means you can restrict the processing of your information and links with some of the other rights.
Right to Object – this means you can object to how your data is used.
Right to be informed of automated individual decision-making (including profiling) – we do not use this for OH purposes, and therefore this does not apply.

Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time, and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

Complaints to the UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance, please contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome, then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO guides on the ICO website.

You can email them at casework@ico.org.uk, call them on 0303-123-113, or you can send a letter to them at the following address:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF