Student School-College Partnership (S4-S6) Privacy Notice

Who is collecting the information?

Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

Why are we collecting it, and what are we doing with it (Purpose)?

We collect your personal data for the following purposes:

To process your application to study one of our courses

This will include reviewing your application and personal statement to offer you a place on an appropriate Edinburgh College course.

To review any additional support needs you may have

This application form allows you to tell the college about any additional support needs you may have. This information is not used in any selection or allocation process.

To analyse student applications for business, planning and equal opportunities purposes

The college analyses student applications, including by key protected characteristic groups (age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, gender, and sexual orientation), to plan and improve its services and curriculum offering. Analysing applications by key protected characteristic groups is part of the college’s responsibilities under the Public Sector Equality Duty, as set out in the Equality Act 2010. This information (where you choose to supply it) will not be used in any selection or allocation process.

To meet our responsibilities in relation to your school, local authority, and Skills Development Scotland

We will share basic information about the status of your application with your local authority (for example, the City of Edinburgh Council, Midlothian, and East Lothian councils) and your school. This will be limited to the status/progress of your application.

We will share your personal data with other third parties (for example, a parent or guardian if you are 16 or over) only with your consent.

The college is also required to provide certain information on “young people” (individuals aged 15 to 25) to Skills Development Scotland (SDS), to enable SDS to a). monitor that young person’s involvement in education or training; b) provide advice or support concerning that young person’s training. This is explained in our information-sharing section below.

What personal data do we collect?

Personal data

Name, primary and term address, telephone number, email address
Date of birth
Nationality
Next of kin and emergency contact details
Previous education (including Scottish Candidate Number), qualifications and employment history
School year at start of next academic session (i.e. S4, S5 or S6)
Skills and experience (personal statement)
If you are a carer or have caring responsibilities
Care experienced/looked after background status (if applicable)
First/preferred language
Additional learning support provided in class (e.g. scribe, 1-2-1, and Alternative Assessment Arrangements information (e.g. read or scribe in examinations)
Evidence to support Alternative Assessment Arrangements (including examinations)
Travel/transport to and from college arrangements

Special category data (only where you provide this, or it is required by law*)

Gender (and gender identity)
Sexual orientation
Religion or religious denomination
Ethnicity
Disability and health data (including mental health); additional support needs information
Medical information and medication administration information
Special interest group status (e.g. asylum seeker; refugee; stateless person; person with profound or complex needs)

How are we collecting this information? What is the source?

We collect most of the information directly from you through the college’s application form.

However, information on any learning support provided at school and/or alternative assessment arrangements, and any medication you need to carry with you during your studies at college, will be supplied by your guidance teacher in a separate section of your application form.

The lawful basis for the processing

For processing of your personal data to process your application, the lawful basis is GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The specific law authorising this is the Post-16 Education (Scotland) Act 2013.

Where your special category personal data are processed, the lawful basis is GDPR Article 9(2)(g) “processing is necessary for reasons of substantial public interest, based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”.

Where the college processes your special category data specifically to provide learning support, the relevant law is the Post-16 Education (Scotland) Act 2013.

Where applicants’ special category demographic information (gender identity, sexual orientation, race, ethnicity) is processed for analysis to advance equality of opportunity and treatment for all student groups, the specific law authorising this is the Equality Act 2010 (but only where you’ve chosen to supply this information).

Where your personal data is shared with your school or local authority for the purposes of updating them on your application status, the specific law authorising this is the Education (Scotland) Act 1980.

Where your personal data is shared with Skills Development Scotland, the specific law authorising this is the Post-16 Education (Scotland) Act 2013 and specifically the Young People's Involvement in Education and Training (Provision of Information) (Scotland) Order 2014.

Who we share the information with

The college shares your information with the following data controllers:

Your local authority and/or school (for example: City of Edinburgh Council, Midlothian Council, East Lothian Council). This is provided through a secure ‘schools tracker’.

Skills Development Scotland: the college is required to provide the following information to Skills Development Scotland via a secure data hub: your name, address, date of birth, Scottish Candidate Number; course information (including start and end date); application/enrolment status; and course withdrawal or completion information.

Data processors: The college uses the following data processors to process your personal information:

Unit-E is provided by a third-party supplier to process student applications. Edinburgh College hosts this software and sits within the college’s technical controls. Microsoft (Reporting functions) is used to report on the supplied data.

How long do we hold the personal data?

Personal data will remain on the college’s Student Record System in line with the college’s retention schedule.

Individuals’ rights in relation to this processing

Under data protection law, you have a number of rights; some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing, and the College would be required to process your request within one month.

The rights that apply to this particular processing are:

Right to be Informed – i.e. a privacy notice.
Right of Access – this means you have the right to access your personal information.
Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request that your personal data be deleted.
Right to Data Portability – this means you have the right to request your information in a machine-readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
Right to Restriction – this means you can restrict the processing of your information and link it to some of the other rights.
Right to Object – this means you can object to how your data is used.
Right to be informed of automated individual decision-making (including profiling) – we do not use this for OH purposes, and therefore this does not apply.

Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time, and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

Complaints to the UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance, please contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome, then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO guides on the ICO website.

You can email them at casework@ico.org.uk, call them on 0303-123-113, or you can send a letter to them at the following address:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF