Cambridge Regional College (‘the College’) processes personal information about students, employees, partners, suppliers and service users in order to provide quality education and training. The College processes personal information so that staff can be recruited and paid, courses planned and delivered, students and their parents/carers/guardian/host family and employers kept informed of progress, examination registrations completed, and to comply with legal obligations to funding bodies and government, including monitoring performance and achievements.
This privacy notice has been prepared in accordance with the UK General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act 2018.
The College takes the protection of personal information very seriously. We aim to explain clearly what it is going to be used for and who we may share it with. Unless required or permitted by law, we will always ask you before we use it for any other reason. We will only use your information for marketing with your prior consent.
Personal data will never be supplied to anyone outside the College without first obtaining your consent, unless required or permitted by law.
We keep the personal data we process to the minimum required to carry out each task, remove your personal information from our systems when it is no longer required, and ensure that all personal information supplied is held securely. We keep our privacy notices under regular review.
Whenever you provide us with personal information, we will treat that information in accordance with this statement, our Data Protection Policy, current legislation and our Data Protection Registration (Registration Number: Z7264155)
Click the following links to find out more about the data we collect and why, how long we keep it, and who we share it with.
Student
The information that you give us
As part of your admission to the College we will collect your personal details including: name, address, date of birth, National Insurance number, residency information, email address, your photographic image, first and second language, dates of attendance, exam/test results, ethnicity, health information, doctor’s details, next-of-kin/emergency contact details, information about support needs, behaviour record, sex-related information, gender, your employer, academic references, criminal conviction information.
In order to manage the financial affairs of the College we collect and hold the following information about you: funding information including supporting evidence for fee remission, employment status, free meal eligibility, fees paid, bank details and household situation.
Additionally, if you are taking part in International programmes; we will also collect copies of your biometric residence card, your passport and police registration form and bank details.
If you are a prospective student at the College we will collect your personal details including name, address, phone number, email address, age, previous/current school, course, apprenticeship and provision interests. Where parents or carers register we will collect their details as above and your child/ward’s details.
The uses made of your personal information
We will use your information to manage and administer your application and ongoing education. This will include putting together class lists, for sending event invitations, for communicating with you, for providing you with a College ID card, for dealing with admission and enrolment, for putting together reports and registers, to check entrance exam results, to allocate you to the correct classes for assessments, to make arrangements for exams or visits, to consider whether to offer places to students, to consider whether special provision or assistance is required for exams and visits and to be able to tell other colleges your attendance dates if you leave.
Whilst on your course this will also include information for making registers, class lists, trip lists, communications, reports, employer information (for example for apprentices and day release students).
We deliver online learning using a range of platforms including moodle (the college virtual learning environment/VLE), Microsoft Teams, SmartAssessor and Zoom. We may record taught sessions for quality improvement purposes. These are retained within our college IT infrastructure and protected by network passwords.
We will use your information to ensure your place is appropriately funded, to pay/receive payments from you.
We will use your information to send you information and resources about your course and the college, for example if you need to work remotely.
For prospective students your data will be used to manage delivery of college information events, this will include making delegate lists, communicating with registrants about the event and college courses and for compiling reports.
Any student that is under 18 years of age at the time of enrolment, the college will share information on progress, attendance or any issue that may affect your education or wellbeing with parents/carers/guardians.
The legal basis on which we collect and use your personal information
Your information is processed because it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
Where that information is special category personal information (e.g. medical information) we will process it because there is a substantial public interest for us to do so.
Cambridge Regional College aims to be equitable and to meet the legal obligations of the Rehabilitation of Offenders Act 1974, the Data Protection Act 2018 and the Human Rights Act.
We have a legal obligation known as “Duty of Care” to do everything reasonable to protect students, staff and visitors from potential harm. We therefore require students to declare if they:
The information disclosed will not prevent you from studying the course of your choice. However, if you have a previous conviction(s) that you do not disclose and which is subsequently discovered, you may be refused a place or asked to leave the course. There may be occasions whereby a current/previous conviction may affect the outcome of your course (for example Childcare courses) but we will discuss this with you in full and offer alternatives where appropriate. If you would like to disclose information regarding criminal offenses prior to enrolment, or during the course of your studies, please call the Safeguarding Manager on 01223 418470. Please note that information given will be treated as sensitive data under the Data Protection Act 2018.
How long we keep your personal information
How we share your personal information
We share your information internally to enable us to manage and administer your education effectively. We use a ‘permissions’ system to make sure that staff only have access to the information they need to carry out their jobs.
We may also share the personal information that you give us with the following organisations (or types of organisation) for the following purposes: If you are on a course that receives public funding, we will share your information with the following organisations, as appropriate
Organisation:
The Learner Records Service
Purpose:
To create and or maintain a Personal Learning Record (PLR) on your behalf. Full details about the PLR can be found here https://www.gov.uk/guidance/how-to-access-your-personal-learning-record
Organisation:
Zoom
Purpose:
The college may use Zoom as a platform to meet virtually with students to deliver online learning and for teaching and assessment purposes. More information on Zoom can be found here – https://zoom.us/
Organisation:
Go To Webinar
Purpose:
The college may use Go To Webinar as a platform to meet virtually with prospective students for open days, with applicants for welcome events or with students to deliver online learning/sessions for information sharing purposes. More information on Zoom can be found here – https://www.gotomeeting.com/en-gb/webinar
Type of organisation:
Awarding Organisations that accredit your course or qualification.
Purpose:
To register you with an awarding organisation so you can be entered for examinations or other work that we assess can be used to claim a certificate when you have finished your course successfully. In the event of an academic appeal, the college may be required to share your name, candidate number and details regarding exam concession with the respective awarding organisations.
Organisation:
The Network for East Anglian Collaborative Outreach (NEACO) project
Purpose:
The College participates in a project aimed at increasing the number of young people going into higher education. More information can be found at https://www.takeyourplace.ac.uk/how-we-use-participant-data.
If you are aged 16 or 17: your parent/carer/guardian(s).
Purpose:
If you are aged 16 or 17; we will share information including your attendance, punctuality and academic progress with your parent/carer/guardians(s) unless you specifically withdraw your consent for us to do so.
Organisation
Evolve
Purpose:
Evolve is an online system that is used to manage information relating to trips. The system will hold details of students attending trips including, name, address, contact number, next of kin details, and medical history. The system is used so the trip organiser can ensure the safety of all students while outside of the college premises – https://evolve.edufocus.co.uk
Organisation
The University of Nottingham
Purpose
The College receives funding from the Department of Education as part of the Centres for Excellence in maths project. As part of this project the College may share information with The University of Nottingham Centre for Research in Mathematics Education, for research purposes. The type of information that will be shared is your name, date of birth, gender, ethnicity, unique learner number, GCSE candidate number and maths GCSE grade.
Organisation
School Cloud
Purpose:
School Cloud is an online booking system that the College uses to book parents’ evening events. The college will process your name to enable parents to book a session with your tutor. https://www.schoolcloud.co.uk/
Organisation
Collsys
Purpose
Collsys supports students’ with finding work placements as part of their study programme. The information we will share is your name, address, contact details and email address. This will allow the creation of your Collsys account and enable you to evidence details of your work placement. https://www.collsys.co.uk/
Organisation
Heritage
Purpose
Heritage is an online library management system that students use when borrowing books and resources from the LRC. Your name and email address will be used to create an account and keep track of books and resources borrowed. https://isoxford.com/about-us
Organisation
Pay My Student
Purpose
Pay My Student is an online bursary management system. Your name, date of birth, age, address, contact details, residency status, asylum seeking status, care arrangement and bank details will be used to support bursary applications and to track payments if this applies to you. https://www.paymystudent.com/
Organisation:
Symmetry
Purpose
The College may share your name, contact details, email address and bank details with symmetry for the purpose of maintaining direct debit payment plans.
Organisation
ACT Credit
Purpose
ACT is a debt recovery agency. The College may pass on your name, address, contact details, email address and date of birth to ACT credit for the purposes of recovering any outstanding debt. https://www.actcredit.com/
Organisation
Purlos
Purpose
WhatsApp will be used to communicate with perspective and enrolled students, assist with queries and to send updates and micro surveys. The College will share your name, phone number, sex and email address with the company that provides this service. https://www.purlos.com/
In turn, Purlos share your data with a company called Twilio to allow integration with WhatsApp, however all data is encrypted and not visible to them.
Organisation
Horizon
Purpose
The College uses Horizon parking to manage the parking spaces within its car parks. In the event of having to issue a penalty notice, the college will share your name and car registration number https://horizonparking.co.uk/
If you are an international student: Host families.
Purpose:
If you are under 18 and taking part in International programmes and have been placed with a host family; we will additionally share medical information that you have provided to your host family. We share will share this information as part of our public interest task of providing education to you.
If you are an apprentice: your employer.
Purpose:
If you an apprentice; we will share information including your attendance, punctuality and academic progress with your employer. We do this as we have entered into a tri party agreement with you and your employer (as detailed in the Apprenticeship Training Agreement). We share information as part of our public interest task of providing education to you.
Type of organisation:
Schools.
Purpose:
If you are a school leaver; we will confirm your enrolment with your school, and request further details to support your application from them, such a reference and other application details eg exam results.
Organisation
Cambridgeshire County Council or other local authorities for school leavers outside of Cambridge, or for those aged 16-24 with an Education and Health Care Plan (EHCP) and the police.
Purpose:
If you are a school leaver; we will confirm your enrolment with Cambridgeshire County Council to enable their confirmation of the September Guarantee (which requires local authorities to find suitable education and training places for 16- and 17-year-olds). If you are aged 16-24 and have an EHCP (Education, Health and Care Plan) the College will share information with relevant local authorities to ensure appropriate support is made available to you during your studies. We will also share information relating to safeguarding, prevent and child protection with relevant authorities to keep students and staff safe.
Type of organisation:
Subcontractors/training partners
Purpose:
The College uses sub-contractors for the delivery of some of its courses and programmes. As such these third parties have access to students personal details including name, address, date of birth, gender, nationality, parent/guardian contact names, phone number, email address, student support needs, medical information, education history, qualifications, references, ethnic origin, employment history, attendance data, and other relevant information.
Appropriate contracts are in place with College sub-contractors as data processors to ensure they process personal data in line with the law.
Organisation:
UK Visas and Immigration (UKVI) https://www.gov.uk/government/organisations/uk-visas-and-immigration
Purpose:
The College holds a Tier 4 Licence and may be asked to share information with UKVI if you are an overseas student. We share this information as part of our public interest task of providing education to you.
We may also share your personal information with third parties who provide services to the College.
Type of organisation:
Third party survey companies:
J2 Research Ltd. http://www.j2research.co.uk/ conduct destination surveys on behalf of the College.
QDP Services http://www.qdpservices.co.uk/ conduct on programme satisfactions surveys on behalf of the College.
If you are an HE student your contact details will be shared with the following organisations for the purpose of carrying out a destinations survey called the ‘Graduate Outcomes’ survey.
The Education and Skills Funding Agency (ESFA) – ESFA Privacy Notice
The Higher Education Statistics Agency (HESA) – HESA Privacy Notice
The Office for Students (OfS) – OfS Privacy Notice
Purpose:
The College is required to return details of your progression/destination to organisations that fund us. We also use satisfaction surveys as part of our public interest task of assessing the quality of the education we are providing to you. We may procure the services of specialist companies to do this on our behalf. We will have data sharing agreements in place with any third parties that provide these services on our behalf.
If you are an HE Student on an Anglia Ruskin University programme: Anglia Ruskin University
Purpose:
We deliver ARU foundation degrees on behalf of ARU and share information about you and your progress with them for the purpose of managing your enrolment, quality assurance and assessment
Type of organisation:
Third party Software Vendors:
If you attend one of our events, we may share your name, address, email address, address, phone numbers, IP address with Eventbrite https://www.eventbrite.co.uk/ to enable us to manage your attendance at our events. For example, so we know how many are likely to come to an open evening or Festival of Achievement.
If you join the college as a student we may share your name, student identifier, email address, postcode, active directory and IP address with the following third-party organisations in order to support the learning and delivery of your course:
All students:
Students studying English and/or maths:
Students studying for a Higher National business qualification:
Cogbooks – https://www.cogbooks.com/ – online learning platform for HNC business courses – do we use this?
Students enrolling on an online course via our portal:
Organisation:
DHL
Purpose:
The college may share your name and address with DHL if we need to send you equipment to enable you to work remotely, for example due to illness or self-isolation due to Covid-19.
Organisation:
Steve’s Taxis
Panther Taxis
Purpose:
The college may share your name, address and image with a taxi company if we need to arrange transport for you, for example if you become unwell whilst at College and need to go home.
We have data sharing agreements in place with any third parties that provide services on our behalf.
How we transfer your personal information outside Europe
Where you register on an event with the College, whether a prospective or current student or relation, your details including name, address, email address, phone, emergency contact details, access information, travel requests, courses preferences will be stored in Eventbrite to administer the event. Eventbrite is a US based organisation – please find a link to their privacy notice – Eventbrite privacy notice
If you are a student taking part in an international programme, information including: name, address, date of birth or age, emergency contacts, host family accommodation and other relevant information may be shared with travel organisations, host schools/colleges/education providers/education agents and a host family (where relevant). Staff and students will be asked to give their explicit consent to the sharing of data where this is relevant.
The following organisations may transfer your data outside of the EU. We carry out privacy impact assessments to minimise risk where data is shared with a third party. Please note that where data is shared below, it is encrypted:
Purlos (WhatsApp chat software) – Purlos uses a sub-processor, Twilio to support the integration between their system and WhatsApp. Your personal information may be processed in the Unites States; but your data will be encrypted. Their privacy notice can be found here – Public Policy – Twilio.
Microsoft Teams – your data will be processed in the United States. All data is encrypted and their privacy notice can be found here https://privacy.microsoft.com/en-gb
SKOOLER (Teams integration software) – your data will be processed in the United States. All data is encrypted and their privacy notice can be found here –https://skooler.com/privacy-policy/
Your rights over your personal information
You have a number of rights over your personal information, which are:
Changes to our Privacy Notice
We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.
How to contact us
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/
The information that you give us
As part of the admission of your son/daughter/dependant to the College we may collect parent/carer/guardian details including: parent/carer/guardian name, emergency contact telephone number, address and email address.
The uses made of your personal information
We keep this information so we can contact you in case of emergency. In addition, we will contact you to ask for feedback about the College so we can make improvements to the services we deliver.
Any student that is under 18 years of age at the time of enrolment, the College will share information on the progress, attendance or other issues that may affect the education or wellbeing of students under the age of 18.
Students can request the college not share personal information with a third party, including a parent or carer. The College must comply with this request unless there is another legal basis on which to share information.
The legal basis on which we collect and use your personal information
Information is processed as part of our public interest task of providing education to your son/daughter/dependant.
How long we keep your personal information.
How we share your personal information.
We will share your information internally to enable us to manage and administer your son/daughter/dependants education effectively. We use a ‘permissions’ system to make sure that staff only have access to the information they need to carry out their jobs.
Host Families:
As part of your employment with the College we will need to collect your contact details including: mobile/telephone number, address, and email address. As we work with a large variety of hosts, photos of communal areas of your home may be stored as an aide memoire. We may wish to share photos with students in order to better prepare them for arrival, you will be notified if this is the case.
We will also need to see but not store: an ID document e.g driver’s license/passport, a proof of address, and your DBS certificate.
Organisation:
QDP Services http://www.qdpservices.co.uk/ conduct parent/carer/guardian satisfactions surveys on behalf of the College.
Purpose:
We use satisfaction surveys as part of our public interest task of assessing the quality of the education we are providing to your son/daughter/dependant. We may procure the services of specialist companies to do this on our behalf. We will have data sharing agreements in place with any third parties that provide these services on our behalf.
Organisation:
Parent Portal – https://proportal.camre.ac.uk/
Purpose:
If your son/daughter/dependant is under the age of 18, the College will set up an account using your email address on the College Parent Portal. The portal will share information on the progress of your son/daughter/dependant. Once your son/daughter/dependant turns 18, access to the account will become obsolete. Consent will be required from your son/daughter/dependant to reinstate your account. If your son/daughter/dependant is over the age of 18, we will have to gain consent from the student before setting up an account on the Parent Portal.
Organisation
School Cloud
Purpose:
School Cloud is an online booking system that the College uses to book parents’ evening events. The college will process your name to enable parents to book a session with your tutor. https://www.schoolcloud.co.uk/
Organisation
Evolve
Purpose:
Evolve is an online system that is used to manage information relating to trips. The system will hold details of students attending trips including, and it will include next of kin details – name and contact details. The system is used so the trip organiser can ensure the safety of all students while outside of the college premises – https://evolve.edufocus.co.uk
DotDigital
Purpose:
DotDigital is a marketing platform which will be used to communicate the college’s ParentaL Newsletter. You name and email address will be processed so that the newsletter can be sent to you.
How we transfer your personal information outside Europe
Your personal information may be stored and processed in countries such as the Unites States; where our suppliers have facilities or service providers, such as DotDigital. This will only be applicable when the college are required to use out of hours technical support services – the likelihood of the College using these services are very rare. If a scenario should ever arise where we are required to use out of hours technical support, the college will contact you to inform you. We carry out privacy impact assessments to minimise risk where data is shared with a third party.
Your rights over your personal information
You have a number of rights over your personal information, which are:
Changes to our Privacy Notice
We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.
How to contact us
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/
The information that you give us
As part of the admission of a student on work placement or an apprentice employed by you; or in order to match you with a prospective apprentice, the College will collect details of you as the named employer. This will include: employer name, number of employees, address, main contact name, position, telephone number and email address. Nature of employer business, normal working pattern, name details of other supervisors, details of Employers Liability Insurance, Health & Safety risk assessment and bank details.
The uses made of your personal information
We will use your information to manage and administer the education of students on work placements or apprentices employed by you. This will include securing an effective working relationship between us as the training provider and you as the employer to protect the interests of the student or apprentice.
We will also use your information to ensure students on work placements or apprentices employed by you are appropriately funded, and/or to receive payment from you.
The legal basis on which we collect and use your personal information.
This information is processed as part of our public interest task of providing education to students on work placements or apprentices employed by you.
How long we keep your personal information.
How we share your personal information.
We will share your information internally to enable us manage and administer the education of students on work placements or apprentices employed by you effectively. We use a ‘permissions’ system to make sure that staff only have access to the information they need to carry out their jobs.
We may also share the information that you give us with the following organisations (or types of organisation) for the following purposes.
Type of organisation:
If you are on a course that receives public funding, we will share your information with the following organisations, as appropriate:
Purpose:
To fund or co-fund the College course for students on work placements or apprentices employed by you. Full details of how the funding agencies may use your information can be found by following the links above.
Organisation:
The Employment Data Service (EDS).
Purpose:
To obtain a valid employer number which identifies you as an employer in the College’s Individualised Learner Record (ILR). This is required for us to ensure apprentices employed by you or students on a work placement are appropriately funded.
Type of organisation:
Subcontractors/training partners
Purpose:
The College uses sub-contractors for the delivery of some of its courses and programmes. As such these third parties collect/have access to employer details including: employer name, number of employees, address, main contact name, position, telephone number and email address. Nature of employer business, normal working pattern, name details of other supervisors, details of Employers Liability Insurance, Health & Safety risk assessment and bank details.
Appropriate contracts are in place with College sub-contractors as data processors to ensure they process personal data in line with the law.
We may also share your personal information with third parties who provide services to the College.
Organisation:
QDP Services http://qdpservices.co.uk/ conduct employer satisfactions surveys on behalf of the College.
Purpose:
We use satisfaction surveys as part of our public interest task of assessing the quality of the education we are providing to apprentices employed by you. We may procure the services of specialist companies to do this on our behalf. We have data sharing agreements in place with any third parties that provide these services on our behalf.
Type of organisation:
Third party Software Vendors:
Purpose:
We may share your company name, address, main contact name, position, telephone number and email with SmartAssessor http://www.smartassessor.com/ to create and maintain an e-portfolio for apprentices employed by you. We have data sharing agreements in place with any third parties that provide these services on our behalf.
Organisation:
Microsoft Dynamics – https://dynamics.microsoft.com
Purpose:
The College uses Microsoft Dynamics – a Customer Relationship Management (CRM) platform which allows us to effectively manage employer customer service expectations.
Organisation
Collsys
Purpose
Collsys is a system used to support students finding work placements as part of their study programme. The college will process named contacts which will be used to link students to their relevant work placements and so that tutors can make contact to discuss feedback and progress. https://www.collsys.co.uk/
How we transfer your personal information outside Europe.
The following organisations may transfer your data outside of the EU. We carry out privacy impact assessments to minimise risk where data is shared with a third party. Please note that where data is shared below, it is encrypted:
Microsoft Dynamics – your data will be processed in the United States. All data is encrypted and their privacy notice can be found here https://privacy.microsoft.com/en-gb
Your rights over your personal information
You have a number of rights over your personal information, which are:
Changes to our Privacy Notice
We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.
How to contact us
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/
The information that you give us
To ensure your matter is dealt with appropriately, the College will require the following information:
The uses made of your personal information
The legal basis on which we collect and use your personal information
Low long we keep your personal information
How we share your personal information
How we transfer your personal information outside of Europe
Your rights over your personal data
If you request that your data is not processed by us, please be aware that we will not be able to provide a response to your complaint.
We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/
We will collect personal information from you when you apply for a job with us. This will include names; address; phone number; email; date of birth; NI number; current employment details including job title, start and end dates, current salary, notice period, reason for leaving; all past employment details; education and qualification details; professional memberships; personal, sensitive data (gender, sexual orientation, ethnicity, religion, marital status, disability), whether you are related to any personnel of the College or Governing Body; references; criminal record details; Disclosure Barring Service check, including European Economic Area (EEA) check; Check of Barred List/List 99; Pre employment Health Questionnaire/Medical Report.
If you apply to volunteer with us we will collect your name and contact details only.
We will collect personal information from you when you are a new starter and become an employee of the College or a Volunteer. This will be your name; marital status; previous surname(s); address; contact details; date of birth; qualification details including copies of original certificates; occupation/department; type of employment; NI number; start date; signature; sensitive data (gender, sexual orientation, ethnicity, religion, marital status, disability); criminal record details; copies of proof of identity and right to work in the UK; next of kin and emergency contact details; bank details including account number and sort code; fit-to work certificate from Occupational Health, pension details; student loan details; offer letters; employment terms and conditions; changes to your terms and conditions; certifications/qualifications, disciplinary, grievance, capability, job description, sickness absence details, maternity/paternity/adoption information; accidents and injuries at work; working time information; annual leave records; recruitment information; photo; payroll details; flexible working; exit interviews; return to work notifications; training/cpd records; parental leave request forms; appraisal/ probationary/performance review documentation; disqualification information; disclosed medical information and agreed risk assessments.
We will use your personal information set out above as follows:
We treat your personal information with confidentiality and we do not use it for any other purposes.
We collect and use your personal information on the basis that it is necessary for performing our employment contract with you, or it is necessary to take steps before entering into the contract with you. We also collect and use your personal information on the basis that we need to do so in order to comply with our legal obligations.
Where we collect your special category personal information, we do this on the basis that it is necessary for the purposes of carrying out our obligations in the field of employment law. Special categories of personal data are personal data that reveal a person’s racial or ethnic origin, political opinions, religions or philosophical beliefs, trade union membership, genetic data (i.e. information about their inherited or acquired genetic characteristics), information about their physical, physiological or behavioural characteristics (such as facial images), physical or mental health, sexual life or sexual orientation and criminal records.
We will not keep your personal information for longer than we need it for the purposes we have explained above.
When you apply for a job with us, but your application is unsuccessful, we will keep your personal information for a period of 6 months after the completion of the appointment.
When you are an employee, we will keep your personal information for as long as you work with us. After you leave, we will keep your personal information for the period of time we are legally required to, or the period of time in which any employment claims may be made against the College and for which the information would be required for such claims. College staff are able to view the College’s Retention Schedule for further details.
We may need to share the personal information and sensitive personal information that you give us with third parties outside of the College who are contracted to work on the College’s behalf, for example pension providers, HMRC or legal consultants.
The College may also disclose data to auditors undertaking audits or investigations.
Any staff member involved in taking students on trips, the College will keep a signed record which confirms your responsibilities in line with College policy and procedure for taking students on trips. This will be stored on the College trip system, Evolve – https://evolve.edufocus.co.uk. The system is used so the trip organiser can ensure the safety of all students while outside of the college premises.
As part of the College’s application for registration with the Office for Students, the College may be asked to provide the following information about its senior staff: salutation; legal first names; preferred first name; surname; role title; month and year of birth; phone number; e-mail address; directorships or trusteeships at other organisations company/charity number and name.
The College will often confirm dates and nature of an individual’s employment to a prospective employer in a reference.
Where a member of staff’s employment with the College requires study, or placement at another organisation it may be necessary for the College to transfer personal data to the third party.
The College may also have to share your personal data with third parties outside the College for other purposes with your consent. However, there may be circumstances where information is shared without consent. This will only be if:
Sensitive Personal Data
Circumstances may arise where sensitive personal data is shared outside of the College within the EU without first obtaining your explicit consent. This will only occur where one of the following conditions has been met:
The processing is necessary to protect:
The processing is necessary for the discharge of any function which is designed for the provision of confidential counselling, advice, support or any other service and:
The processing is necessary to meet our statutory obligations in relation to equality and diversity monitoring.
The disclosure is made for the purpose of prevention or detection of crime, the apprehension or prosecution of offenders and we have received a notice from the police confirming that the disclosure is required for these purposes:
We do not store or transfer your personal data outside of Europe.
You have a number of rights over your personal information, which are:
We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/
The Corporation is under a legal obligation, under the Further and Higher Education Act 1992, to maintain a Governing Body as it senior decision-making body. The Corporation’s Instrument and Articles, defined by that statute require the Corporation to maintain contact with governors to conduct the College’s business and the information above is necessary for these purposes. Under the Children Act 2004 the College has a statutory duty to safeguard and promote the welfare of its learners. In addition, the College, as an exempt charity under the Charities Act 2011, as amended has a statutory duty to ensure that its Governors are eligible to act as trustees and therefore collects their declarations and conducts checks to satisfy this requirement.
Periods of time as set out in the Retention Schedule for governance data which specifies the maximum period data should be kept for business purposes and is available from the Clerk on request.
We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/
The information that you give us
The uses made of your personal information
The legal basis on which we collect and use your personal information
How long we keep your personal information
How we share your personal information
How we transfer your personal information outside of Europe
Your rights over your personal information
We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/
Our websites, www.camre.ac.uk, www.thepark-cambridge.co.uk, www.theteddybearnursery.co.uk, use cookies to help provide you with the best experience we can.
Cookies are small text files that are placed on your computer or mobile phone when you browse websites. Our cookies help us to:
We do not use cookies to:
You can learn more about all the cookies we use below.
If the settings on your software that you are using to view this website (your browser) are adjusted to accept cookies we take this, and your continued use of our website, to mean that you are fine with this. Should you wish to remove or not use cookies from our site you can learn how to do this below, however doing so will likely mean that our site will not work as you would expect.
These cookies are essential in order to enable you to move around this website and use its features, such as logging in to apply for courses. Without these cookies these services cannot be provided.
These cookies collect information about how visitors use a website, for example which pages are the most popular, how long people spend on the site and whether they receive error messages. These cookies do not collect information that identifies a visitor; all the information is aggregated and therefore anonymous. It is only used in order to improve how a website works. If you wish to opt-out of Google Analytics you can install their opt-out browser add-on.
These cookies allow the website to remember choices you make (such as user-names) and information you’ve provided (such as applications in progress). This gives a more personal feel to the site and improves usability. The information these cookies collect may be anonymised and they cannot track browsing activity on other sites.
You can switch cookies off by adjusting your browser settings to stop it from accepting cookies (more information on how to do this is available here). Doing so however will likely limit the functionality of our site and a large proportion of the world’s websites as cookies are a standard part of most modern websites.
This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
What this notice applies to:
It applies to information we collect about:
People who use or may use our services. This includes for example:
individuals who study a course with us
If you are asked to provide information to us, it will only be used in the ways described in this Privacy Notice.
The information that you give us
The College collects contact information such as your name and email address to share information about our courses when requested, and to book you onto an event, and takes photos of some students and staff for marketing purposes.
We only ask for as much information as we need to fulfil your enquiry, request or booking and meet our legal obligations. This might include, but it not limited to, the following:
The uses made of your personal information
The legal basis on which we collect and use your personal information
How long we keep your personal information
We will keep this data for as long as you are subscribed to our communications. Should you unsubscribe, we will remove your details from any mailing lists, but will retain your details for historic reporting purposes only.
We retain images used for marketing for up to 5 years after collection, for the life of the publication/ communication and for historical archiving purposes.
How we share your personal information
How we transfer your personal information outside Europe
We do not transfer your personal information outside of the European Economic Area.
Your rights over your personal information
You have a number of rights over your personal information, which are:
Changes to our Privacy Notice
We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.
How to contact us
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/
The Park is a series of commercial outlets at the Cambridge Campus that Cambridge Regional College operates for the public that provides valuable work experience for our students. This includes the restaurant, bistro, hair and beauty salons, sports centre and gym. This notice aims to give you the information on how we collect and process the personal data that you provide when you:
As customers of the Park services we will collect a range of personal information dependent on the services you use, in the form of:
Your data will be kept for 6 years
The College will share information with College and Park staff to ensure your needs are met while visiting The Park. We may also share your information with the following organisations to administer the services of the Park which act as data processors, these include:
Type of organisation:
Avenista
Purpose:
For restaurant bookings http://www.avenista.com
Type of organisation:
Shedul
Purpose:
For salon bookings: www.schedul.com
Type of organisation:
Clubwise https://www.clubwise.com/
Purpose:
For the management of gym membership
Type of organisation:
DotDigital
Purpose:
To email customers and subscribers and track web activity.
The College may use third-party contractors to deliver beauty treatments or personal training session. The contractors are obliged to comply with the Colleges data protection and GDPR policy when processing personal data, relating to any client of the commercial salons.
How we transfer your personal information outside of Europe
We do not store or transfer your personal data outside Europe.
If you withdraw your consent, please be aware that we may not be able to proceed with your booking or appointment.
To unsubscribe from Park email and text marketing you can unsubscribe at any time through the unsubscribe link on the email or by emailing
We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/
The information that you give us
To ensure we deal with all visitors safely while on College premises, we require the following information from all visitors:
The uses made of your personal information
The legal basis on which we collect and use your personal information
We are obliged to keep records of visitors to the site to comply with Health and Safety laws.
How long we keep your personal information
We will hold your information for 1 year
How we share your personal information
Types of organisation:
Envoy/Horizon Parking
Purpose:
We are required by Health and Safety law to keep an accurate record of all visitors to the site. Envoy and Horizon Parking are online databases the College uses to store the first and last names of all visitors to the site; as well as your vehicle registration number if you park within one of the College’s car parks. This information is retained within the College and will only be shared with a third party such as the Police for the purpose of preventing crime.
How we transfer your personal information outside of Europe
We do not transfer your personal information outside of Europe.
Your rights over your personal information
Please note that is you object to the processing of your information, you will not be allowed entry to the site.
We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/
The information that you give us
The College will collect information which is relevant to the procuring of goods and/or services, and making payments. This includes:
The uses made of your personal information
To ensure the College has contact details and information to support the smooth running of contracts, and to ensure the College pays for procured items and/or services provided.
The legal basis on which we collect and use your personal information
As a publicly funded body the College is required to keep accurate records of financial expenditure.
How long we keep your personal information
6 years after the termination of contract.
The College will share information with staff who are responsible for the procuring of goods and/or services, and making payments. We use a ‘permissions’ system to make sure that staff only have access to the information they need to carry out their jobs. We may also share the information that you give us with the following organisations (or types of organisation) for the following purposes.
Type of organisation:
College auditors
Purpose:
As part of our public task, the College will share information with external auditors to ensure internal and regulatory processes with regards to the College’s financial expenditure are being followed.
Type of organisation:
Funding bodies
Purpose:
As a publicly funded body the College is required to keep accurate records of financial expenditure and may be required to share information with funding bodies such as:
How we transfer your personal information outside of Europe
We do not store or transfer your personal data outside Europe.
Your rights over your personal information
If you withdraw your consent, please be aware that we may not be able to continue to work with you as a supplier.
Changes to our Privacy Notice
We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.
How to lodge a complaint
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/
Ownership of the Personal Data
To enable the Covid-19 testing to be completed at Cambridge Regional College (CRC) we need to process personal data for staff and pupils taking part, including sharing of personal data where we have a legal obligation. CRC is the Data Controller for the data required for processing the tests and undertaking any actions which are needed by the college to ensure we meet our public health and safeguarding legal obligations.
Personal Data is processed under the legitimate interest of the data controller to ensure we can minimise the spread of COVID in a timely manner and enable us to continue to deliver education services safely and securely.
If you decline a test, we record your decision under the legitimate interest of the college in order to have a record of your decisions and to reduce unnecessary contact with you regarding testing.
The processing of special category personal data is processed under the provisions Section 9.2(i) of GDPR, where it is in the public interest on Public Health Grounds. This data is processed under the obligations set out in Public Health legislation (Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI)) which allows the sharing of data for COVID related purposes and where it is carried out by someone who owes an equivalent duty of confidentiality to that data.
Data Controllership is then passed to the Department for Health and Social Care (DHSC) for all data that we transfer about you and your test results to them. For more information about what they do with your data please see the Test and Trace Privacy Notice. The establishment remains the Data Controller for the data we retain about you.
Personal Data involved in the process
We use the following information to help us manage and process the tests:
We will only use information that is collected directly from you specifically for the purpose of the tests, even if you have previously provided us with this information.
How we store your personal information
The information will be stored securely on the college information system whilst it is needed. It will also be entered directly onto DHSC digital services for the NHS Test and Trace purposes. The college will not have access to the information on the digital service once it has been entered.
Processing of Personal Data Relating to Positive test results
The member of staff, student or parent (depending on contact details provided) will be informed of the result by the college and advised how to book a confirmatory test.
We will use this information to enact their own COVID isolation processes without telling anyone who it is that has received the positive test.
The information will be transferred to DHSC, who will share this with the NHS, GPs. PHE and the Local Government will use this information for wider test and trace activities as well as statistical and research purposes.
This information is processed and shared under obligations set out in Public Health legislation under Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) which allows the sharing of data for COVID related purposes.
This information will be kept by the college for up to 14 days and by the NHS for 8 years.
Processing of Personal Data Relating to Negative test results
We will record a negative result and the information transferred to DHSC, NHS. PHE and the Local Government who will use the information for statistical and research purposes.
This information is processed and shared under obligations set out in Public Health legislation under Regulations 3 (1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) which allows the sharing of data for COVID related purposes.
This information will be kept by the college for up to 14 days and by the NHS for 8 years.
Processing of Personal Data relating to declining a test
We will record that you have declined to participate in a test and this information will not be shared with anyone.
Data Sharing Partners
The personal data associated with test results will be shared with:
Your Rights
Under data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at if you wish to make a request.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at: Officer Corrin Hoyes:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Data Protection law provides the following rights for individuals:
You may ask us at any time for information about any personal data we hold about you, or you may request that we correct or delete that information. Where you ask us not to contact you again or to delete information we may need to retain limited information to respect those wishes.
Where we are relying on your consent as a condition for processing your personal data you may revoke your consent to the processing of your data by contacting us.
We may disclose your personal information in circumstances where we have reason to believe that disclosing this information is reasonably necessary to comply with the law or we have another legal basis to do so.
More information can be found in our Data Protection Policy and on the Information Commissioner’s website https://ico.org.uk/
If you want to make a complaint about the way we have processed your personal information, please contact our Data Protection Officer Corrin Hoyes:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/
For details on our Freedom of Information Publication Scheme, read more here