Privacy Notice

SEARCH FOR A CAREER

CAMBRIDGE REGIONAL COLLEGE GENERAL PRIVACY NOTICE

Cambridge Regional College (‘the College’) processes personal information about students, employees, partners, suppliers and service users in order to provide quality education and training. The College processes personal information so that staff can be recruited and paid, courses planned and delivered, students and their parents/carers/guardian/host family and employers kept informed of progress, examination registrations completed, and to comply with legal obligations to funding bodies and government, including monitoring performance and achievements.

This privacy notice has been prepared in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act 2018.

The College takes the protection of personal information very seriously. We aim to explain clearly what it is going to be used for and who we may share it with. Unless required or permitted by law, we will always ask you before we use it for any other reason. We will only use your information for marketing with your prior consent.

Personal data will never be supplied to anyone outside the College without first obtaining your consent, unless required or permitted by law.

We keep the personal data we process to the minimum required to carry out each task, remove your personal information from our systems when it is no longer required, and ensure that all personal information supplied is held securely. We keep our privacy notices under regular review.

Whenever you provide us with personal information, we will treat that information in accordance with this statement, our Data Protection Policy, current legislation and our Data Protection Registration (Registration Number: ZA255790)

Click the following links to find out more about the data we collect and why, how long we keep it, and who we share it with.

STUDENT INFORMATION (INCLUDING PROSPECTIVE STUDENTS)

The information that you give us

As part of your admission to the College we will collect your personal details including: name, address, date of birth, National Insurance number, residency information, email address, your photographic image, first and second language, dates of attendance, exam/test results, ethnicity, health information, doctor’s details, next-of-kin/emergency contact details, information about support needs, behaviour record, sex-related information, gender, your employer, academic references, criminal conviction information.

In order to manage the financial affairs of the College we collect and hold the following information about you: funding information including supporting evidence for fee remission, employment status, free meal eligibility, fees paid, bank details and household situation.

Additionally, if you are taking part in International programmes; we will also collect copies of your biometric residence card, your passport and police registration form.

If you are a prospective student at the college we will collect your personal details including name, address, email address, age, previous/current school, course, apprenticeship and provision interests. Where parents or carers register we will collect your details as above and your child/ward’s details.

The uses made of your personal information

We will use your information to manage and administer your application and ongoing education. This will include putting together class lists, for sending event invitations, for communicating with you, for providing you with a College ID card, for dealing with admission and enrolment, for putting together reports and registers, to check entrance exam results, to allocate you to the correct classes for assessments, to make arrangements for exams or visits, to consider whether to offer places to students, to consider whether special provision or assistance is required for exams and visits and to be able to tell other colleges your attendance dates if you leave.

Whilst on your course this will also include information for making registers, class lists, trip lists, communications, reports, employer information (for example for apprentices and day release students).

We deliver online learning using a range of platforms including moodle (the college Virtual Learning Environment/VLE), Microsoft Teams, SmartAssessor and Zoom. We may record taught sessions for quality improvement purposes. These are retained within our college IT infrastructure and protected by network passwords.

We will use your information to ensure your place is appropriately funded, to pay/receive payments from you.

We will use your information to send you information and resources about your course and the college, for example if you need to work remotely.

For prospective students your data will be used to manage delivery of college information events, this will include making delegate lists, communicating with registrants about the event and college courses and for compiling reports.

Any student that is under 18 years of age at the time of enrolment, the college will share information on progress, attendance or any issue that may affect your education or wellbeing with parents/carers/guardians.

The legal basis on which we collect and use your personal information

Your information is processed because it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Where that information is special category personal information (e.g. medical information) we will process it because there is a substantial public interest for us to do so.

Cambridge Regional College aims to be equitable and to meet the legal obligations of the Rehabilitation of Offenders Act 1974, the Data Protection Act 2018 and the Human Rights Act.

We have a legal obligation known as “Duty of Care” to do everything reasonable to protect students, staff and visitors from potential harm. We therefore require students to declare if they:

Are serving/have served a custodial sentence
Are currently/have been on licence
Have served or are serving any type of order (expect pre-court orders such as reprimanded or final warnings)
Are currently on, or having been on and Intensive Supervision and Surveillance Programme (ISSP)
Have Caution/s Warning/s or Reprimand/s (the college does not need to know about convictions that are spent)

The information disclosed will not prevent you from studying the course of your choice. However, if you have a previous conviction(s) that you do not disclose and which is subsequently discovered, you may be refused a place or asked to leave the course. There may be occasions whereby a current/previous conviction may affect the outcome of your course (for example Childcare courses) but we will discuss this with you in full and offer alternatives where appropriate. If you would like to disclose information regarding criminal offenses prior to enrolment, or during the course of your studies, please call the Safeguarding Manager on 01223 418509. Please note that information given will be treated as sensitive data under the Data Protection Act 2018.

How long we keep your personal information

Unsuccessful applications – Current academic year + 1 year
Successful applications – End of student relationship + 6 years
Successful applications potentially match funded by ESF – 31st December 2030.
Recorded material – for the duration of the academic year, unless the recording contains assessment evidence, in which case may be retained for longer, in line with the college Data Retention Schedule.

How we share your personal information

We share your information internally to enable us to manage and administer your education effectively. We use a ‘permissions’ system to make sure that staff only have access to the information they need to carry out their jobs.

We may also share the personal information that you give us with the following organisations (or types of organisation) for the following purposes: If you are on a course that receives public funding, we will share your information with the following organisations, as appropriate

The Education and Skills Funding Agency (ESFA) – ESFA Privacy Notice
The Higher Education Statistics Agency (HESA) – HESA Privacy Notice
The Office for Students (OfS) – OfS Privacy Notice
The Cambridgeshire and Peterborough Combined Authority – CPCA Privacy Notice
Greater London Authority (GLA), as part of the adult education budget funding – GLA Privacy Not ice

Organisation:
The Learner Records Service

Purpose:
To create and or maintain a Personal Learning Record (PLR) on your behalf. Full details about the PLR can be found here https://www.gov.uk/guidance/how-to-access-your-personal-learning-record

Organisation:

Zoom

Purpose:

The college may use Zoom as a platform to virtually meet with students to deliver online learning and for teaching and assessment purposes. More information on Zoom can be found here – https://zoom.us/

Organisation:

Go To Webinar

Purpose:

The college may use Go To Webinar as a platform to virtually meet with prospective students for Open Days, with applicants for Welcome Events or with students to deliver online learning/session for information sharing purposes. More information on Zoom can be found here – https://www.gotomeeting.com/en-gb/webinar

Type of organisation:
Awarding Organisations that accredit your course or qualification.

Purpose:
To register you with an Awarding Organisation so you can be entered for examinations or other work that we assess can be used to claim a certificate when you have finished your course successfully.

Organisation:

The Network for East Anglian Collaborative Outreach (NEACO) project

Purpose:

The college participates in a project aimed at increasing the number of young people going into Higher Education. More information can be found at https://www.takeyourplace.ac.uk/how-we-use-participant-data.

If you are aged 16 or 17: your parent/carer/guardian(s).

Purpose:

If you are aged 16 or 17; we will share information including your attendance, punctuality and academic progress with your parent/carer/guardians(s) unless you specifically withdraw your consent for us to do so.

Organisation

Evolve

Purpose:
Evolve is an online system that is used to manage information relating to trips. The system will hold details of students attending trips including, name, address, contact number, next of kin details, and medical history. The system is used so the trip organiser can ensure the safety of all students while outside of the college premises – https://evolve.edufocus.co.uk

If you are an international student: Host families.

Purpose:
If you are under 18 and taking part in International programmes and have been placed with a host family; we will additionally share medical information that you have provided to your host family. We share will share this information as part of our public interest task of providing education to you.

If you are an Apprentice: your employer.

Purpose:
If you an Apprentice; we will share information including your attendance, punctuality and academic progress with your Employer. We do this as we have entered into a tri party agreement with you and your employer (as detailed in the Apprenticeship Training Agreement). We share information as part of our public interest task of providing education to you.

Type of organisation:
Schools.

Purpose:
If you are a school leaver; we will confirm your enrolment with your school.

Organisation
Cambridgeshire County Council or other Local Authorities for school leavers outside of Cambridge, or for those aged 16-24 with an Education and Health Care Plan (EHCP) and the Police.

Purpose:
If you are a school leaver; we will confirm your enrolment with Cambridgeshire County Council to enable their confirmation of the September Guarantee (which requires local authorities to find suitable education and training places for 16- and 17-year-olds). If you are aged 16-24 and have an EHCP (Education, Health and Care Plan) the College will share information with relevant local authorities to ensure appropriate support is made available to you during your studies. We will also share information relating to safeguarding, prevent and child protection with relevant authorities to keep students and staff safe.

The Cambridgeshire and Peterborough Combined Authority – CPCA Privacy Notice
Cambridgeshire Local Authority – CLA Privacy Notice
Hertfordshire Local Authority – HLA Privacy Notice
Norfolk Local Authority – NLA Privacy Notice
Suffolk Local Authority – SLA Privacy Notice
Essex Local Authority – ELA Privacy Notice
Bedfordshire Local Authority – BLA Privacy Notice

Type of organisation:
Subcontractors/training partners

Purpose:
The College uses sub-contractors for the delivery of some of its courses and programmes. As such these third parties have access to students personal details including name, address, date of birth, gender, nationality, parent/guardian contact names, phone number, email address, student support needs, medical information, education history, qualifications, references, ethnic origin, employment history, attendance data, and other relevant information.
Appropriate contracts are in place with College sub-contractors as data processors to ensure they process personal data in line with the law.

Organisation:

UK Visas and Immigration (UKVI) https://www.gov.uk/government/organisations/uk-visas-and-immigration

Purpose:
The College holds a Tier 4 Licence and may be asked to share information with UKVI if you are an overseas student. We share this information as part of our public interest task of providing education to you.
We may also share your personal information with third parties who provide services to the College.

Type of organisation:
Third party survey companies:
J2 Research Ltd. http://www.j2research.co.uk/ conduct destination surveys on behalf of the College.
QDP Services http://www.qdpservices.co.uk/ conduct on programme satisfactions surveys on behalf of the College.

If you are a HE student your contact details will be shared with the following organisations for the purpose of carrying out a destinations survey called the ‘Graduate Outcomes’ survey.

The Education and Skills Funding Agency (ESFA) – ESFA Privacy Notice
The Higher Education Statistics Agency (HESA) – HESA Privacy Notice
The Office for Students (OfS) – OfS Privacy Notice

Purpose:
The College is required to return details of your progression/destination to organisations that fund us. We also use satisfaction surveys as part of our public interest task of assessing the quality of the education we are providing to you. We may procure the services of specialist companies to do this on our behalf. We will have data sharing agreements in place with any third parties that provide these services on our behalf.

If you are an HE Student on an Anglia Ruskin University programme: Anglia Ruskin University

Purpose:

We deliver ARU Foundation Degrees on behalf of ARU and share information about you and your progress with them for the purpose of managing your enrolment, quality assurance and assessment

Type of organisation:

Third party Software Vendors:

If you attend one of our events, we may share your name, address, email address, address, phone numbers, IP address with Eventbrite https://www.eventbrite.co.uk/ to enable us to manage your attendance at our events. For example, so we know how many are likely to come to an open evening or Festival of Achievement.

If you join the college as a student we may share your name, student identifier, email address, postcode, active directory and IP address with the following third-party organisations in order to support the learning and delivery of your course:

All students:

Overt Software Services https://www.overtsoftware.com/ to create and maintain a Virtual Learning Environment (VLE) account for you.
GO1 – https://www.go1.com/en-gb/ – Allows for the College Blended Learning Courses to be accessible via Microsoft Teams
Padlet – https://padlet.com/ – Padlet is used as an extension to the College Virtual Learning Environemnt and is integrated with Microsoft 365.
Ebooks – https://global.oup.com/ukhe/ebooks/?cc=gb&lang=en& – Oxford University Press ebooks which are accessed via the College Virtual Learning Environment (VLE), used specifically for CELTA courses.
Prospect – this is the College online application and enrolment software – https://prospect.camre.ac.uk/

Students studying English and/or maths:

BKSB https://www.bksb.co.uk to create an English and maths initial assessment account for you.
HegartyMaths – https://hegartymaths.com/ – online learning platform for Maths courses

Students studying for a Higher National Business qualification:

Cogbooks – https://www.cogbooks.com/ – online learning platform for HNC Business courses

Students enrolling on an online course via our portal:

The Skills Network – https://www.theskillsnetwork.com/ – CRC have implemented a new online learning portal which is provided by The Skills Network to deliver AEB funded and full cost L1 & L2 courses.

If you are an Apprentice, we will share your name, phone number, email address, student support needs, education history, qualifications, employer and attendance data with SmartAssessor http://www.smartassessor.com/ or OneFile https://www.onefile.co.uk/

Purpose:

We share your data with these organisations in order to provide learning resources, deliver our programmes, monitor and track your progress.

We have data sharing agreements in place with any third parties that provide services on our behalf.

Organisation:
DHL
Purpose:
The college may share your name and address with DHL if we need to send you equipment to enable you to work remotely, for example due to illness or self-isolation due to Covid-19.

Organisation:
Steve’s Taxis
Panther Taxis

Purpose:
The college may share your name and address with a taxi company if we need to arrange transport for you, for example if you become unwell whilst at College and need to go home.

How we transfer your personal information outside Europe

Where you register on an event with the college, whether a prospective or current student or relation, your details including name, address, email address, phone, emergency contact details, access information, travel requests, courses preferences will be stored in Eventbrite to administer the event. Eventbrite is a US based organisation – please find a link to their privacy notice – Eventbrite privacy notice

If you are a student taking part in an international programme, information including: name, address, date of birth or age, emergency contacts, host family accommodation and other relevant information may be shared with travel organisations, host schools/Colleges/education providers/education agents and a host family (where relevant). Staff and students will be asked to give their explicit consent to the sharing of data where this is relevant.

Your rights over your personal information

You have a number of rights over your personal information, which are:

the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal data is being used – please refer to the ICO’s website for further information about this (https://ico.org.uk/);
the right to ask us what personal information about you we are holding and to have access to a copy of your personal information;
the right to ask us to correct any errors in your personal information;
the right, in certain circumstances such as where our use of your personal information is based on your consent and we have no other legal basis to use your personal information, to ask us to delete your personal information;
the right, in certain circumstances such as where we no longer need your personal information, to request that we restrict the use that we are making of your personal information;
the right, in certain circumstances, to ask us to review and explain our legitimate interests to you; and
the right, where our use of your personal information is carried out for the purposes of an agreement with us and is carried out by automated means, to ask us to provide you with a copy of your personal information in a structured, commonly-used, machine-readable format.

Changes to our Privacy Notice

We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.

How to contact us

If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
DPO@camre.ac.uk

If you have a data protection concern that cannot or has not been resolved by the College, you have the right to raise it with the data protection regulator, the Information Commissioner’s Office (ICO)
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/

PARENT/CARER/GUARDIAN /HOST FAMILY INFORMATION

The information that you give us

As part of the admission of your son/daughter/dependant to the College we may collect parent/carer/guardian details including: parent/carer/guardian name, emergency contact telephone number, address and email address.

The uses made of your personal information

We keep this information so we can contact you in case of emergency. In addition, we will contact you to ask for feedback about the College so we can make improvements to the services we deliver.

Any student that is under 18 years of age at the time of enrolment, the College will share information on the progress, attendance or other issues that may affect the education or wellbeing of students under the age of 18.

Students can request the college not share personal information with a third party, including a parent or carer. The College must comply with this request unless there is another legal basis on which to share information.

The legal basis on which we collect and use your personal information

Information is processed as part of our public interest task of providing education to your son/daughter/dependant.

How long we keep your personal information.

Unsuccessful application of your son/daughter/dependant – Current academic year + 1 year
Successful application of your son/daughter/dependant – End of student relationship + 6 years

How we share your personal information.

We will share your information internally to enable us to manage and administer your son/daughter/dependants education effectively. We use a ‘permissions’ system to make sure that staff only have access to the information they need to carry out their jobs.

Organisation:

QDP Services http://www.qdpservices.co.uk/ conduct parent/carer/guardian satisfactions surveys on behalf of the College.

Purpose:
We use satisfaction surveys as part of our public interest task of assessing the quality of the education we are providing to your son/daughter/dependant. We may procure the services of specialist companies to do this on our behalf. We will have data sharing agreements in place with any third parties that provide these services on our behalf.

Organisation:

Parent Portal – https://proportal.camre.ac.uk/

Purpose:

If your son/daughter/dependant is under the age of 18, the College will set up an account using your email address on the College Parent Portal. The portal will share information on the progress of your son/daughter/dependant. Once your son/daughter/dependant turns 18, access to the account will become obsolete. Consent will be required from your son/daughter/dependant to reinstate your account. If your son/daughter/dependant is over the age of 18, we will have to gain consent from the student before setting up an account on the Parent Portal.

How we transfer your personal information outside Europe

We do not store or transfer your personal data outside Europe.

Your rights over your personal information

You have a number of rights over your personal information, which are:

the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal data is being used – please refer to the ICO’s website for further information about this (https://ico.org.uk/);
the right to ask us what personal information about you we are holding and to have access to a copy of your personal information;
the right to ask us to correct any errors in your personal information;
the right, in certain circumstances such as where our use of your personal information is based on your consent and we have no other legal basis to use your personal information, to ask us to delete your personal information;
the right, in certain circumstances such as where we no longer need your personal information, to request that we restrict the use that we are making of your personal information;
the right, in certain circumstances, to ask us to review and explain our legitimate interests to you; and
the right, where our use of your personal information is carried out for the purposes of an agreement with us and is carried out by automated means, to ask us to provide you with a copy of your personal information in a structured, commonly-used, machine-readable format.

Changes to our Privacy Notice

We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.

How to contact us

EMPLOYER INFORMATION

The information that you give us

As part of the admission of a student on work placement or an apprentice employed by you; or in order to match you with a prospective apprentice, the College will collect details of you as the named employer. This will include: employer name, number of employees, address, main contact name, position, telephone number and email address. Nature of employer business, normal working pattern, name details of other supervisors, details of Employers Liability Insurance, Health & Safety risk assessment and bank details.

The uses made of your personal information

We will use your information to manage and administer the education of students on work placements or apprentices employed by you. This will include securing an effective working relationship between us as the training provider and you as the employer to protect the interests of the student or apprentice.

We will also use your information to ensure students on work placements or apprentices employed by you are appropriately funded, and/or to receive payment from you.

The legal basis on which we collect and use your personal information.

This information is processed as part of our public interest task of providing education to students on work placements or apprentices employed by you.

How long we keep your personal information.

Unsuccessful application of a student on work placement or an apprentice employed by you – Current academic year + 1 year
Successful application of a student on work placement or an apprentice employed by you potentially match funded by ESF – 31st December 2030.

How we share your personal information.

We will share your information internally to enable us manage and administer the education of students on work placements or apprentices employed by you effectively. We use a ‘permissions’ system to make sure that staff only have access to the information they need to carry out their jobs.

We may also share the information that you give us with the following organisations (or types of organisation) for the following purposes.

Type of organisation:

If you are on a course that receives public funding, we will share your information with the following organisations, as appropriate:

The Education and Skills Funding Agency (ESFA) – ESFA Privacy Notice
The Higher Education Statistics Agency (HESA) – HESA Privacy Notice
The Office for Students (OfS) – OfS Privacy Notice
The Cambridgeshire and Peterborough Combined Authority – CPCA Privacy Notice
Greater London Authority (GLA), as part of the adult education budget funding – GLA Privacy Notice

Purpose:
To fund or co-fund the College course for students on work placements or apprentices employed by you. Full details of how the funding agencies may use your information can be found by following the links above.

Organisation:

The Employment Data Service (EDS).

Purpose:
To obtain a valid employer number which identifies you as an employer in the College’s Individualised Learner Record (ILR). This is required for us to ensure apprentices employed by you or students on a work placement are appropriately funded.

Type of organisation:
Subcontractors/training partners

Purpose:
The College uses sub-contractors for the delivery of some of its courses and programmes. As such these third parties collect/have access to employer details including: employer name, number of employees, address, main contact name, position, telephone number and email address. Nature of employer business, normal working pattern, name details of other supervisors, details of Employers Liability Insurance, Health & Safety risk assessment and bank details.
Appropriate contracts are in place with College sub-contractors as data processors to ensure they process personal data in line with the law.

We may also share your personal information with third parties who provide services to the College.

Organisation:
QDP Services http://qdpservices.co.uk/ conduct employer satisfactions surveys on behalf of the College.

Purpose:
We use satisfaction surveys as part of our public interest task of assessing the quality of the education we are providing to apprentices employed by you. We may procure the services of specialist companies to do this on our behalf. We have data sharing agreements in place with any third parties that provide these services on our behalf.

Type of organisation:
Third party Software Vendors:

Purpose:

We may share your company name, address, main contact name, position, telephone number and email with SmartAssessor http://www.smartassessor.com/ or OneFile https://onefile.co.uk/ to create and maintain an e-portfolio for apprentices employed by you. We have data sharing agreements in place with any third parties that provide these services on our behalf.

Organisation:

Microsoft Dynamics – https://dynamics.microsoft.com

Purpose:

The College uses Microsoft Dynamics – a Customer Relationship Management (CRM) platform which allows us to effectively manage employer customer service expectations.

How we transfer your personal information outside Europe.

We do not store or transfer your personal data outside Europe.

Your rights over your personal information

You have a number of rights over your personal information, which are:

the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal data is being used – please refer to the ICO’s website for further information about this (https://ico.org.uk/);
the right to ask us what personal information about you we are holding and to have access to a copy of your personal information;
the right to ask us to correct any errors in your personal information;
the right, in certain circumstances such as where our use of your personal information is based on your consent and we have no other legal basis to use your personal information, to ask us to delete your personal information;
the right, in certain circumstances such as where we no longer need your personal information, to request that we restrict the use that we are making of your personal information;
the right, in certain circumstances, to ask us to review and explain our legitimate interests to you; and
the right, where our use of your personal information is carried out for the purposes of an agreement with us and is carried out by automated means, to ask us to provide you with a copy of your personal information in a structured, commonly-used, machine-readable format.

Changes to our Privacy Notice

We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.

How to contact us

INFORMATION RELATING TO COMPLAINTS AND COMPLIMENTS

The information that you give us

To ensure your matter is dealt with appropriately, the College will require the following information:

Complainant contact details: name, address, email, telephone number
Student details if not complainant: name and EBS number

The uses made of your personal information

To enable us to respond to the you
Ensure we are talking about right student
To check if we need consent from a student if a complaint is made on their behalf

The legal basis on which we collect and use your personal information

We are a public body with an obligation to collect data on complaints and compliments

Low long we keep your personal information

6 years after the last action on your complaint/compliment

How we share your personal information

College staff – We use a ‘permissions’ system to make sure that staff only have access to the information they need to carry out their jobs.
We share anonymised complaint statistics with external bodies such as Ofsted and the Office of the Independent Adjudicator
The college will not share personal information with anyone outside of the college without your consent
Your employer if you are an apprentice or student on a work placement.

How we transfer your personal information outside of Europe

We do not store or transfer your personal data outside Europe.

Your rights over your personal data

the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal data is being used – please refer to the ICO’s website for further information about this (https://ico.org.uk/);
the right to ask us what personal information about you we are holding and to have access to a copy of your personal information;
the right to ask us to correct any errors in your personal information;
the right, in certain circumstances such as where our use of your personal information is based on your consent and we have no other legal basis to use your personal information, to ask us to delete your personal information;
the right, in certain circumstances such as where we no longer need your personal information, to request that we restrict the use that we are making of your personal information;
the right, in certain circumstances, to ask us to review and explain our legitimate interests to you; and
the right, where our use of your personal information is carried out for the purposes of an agreement with us and is carried out by automated means, to ask us to provide you with a copy of your personal information in a structured, commonly-used, machine-readable format.

If you request that your data is not processed by us, please be aware that we will not be able to provide a response to your complaint.

Changes to our Privacy Notice

We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.

How to contact us

JOB APPLICANTS, CURRENT AND FORMER EMPLOYEES AND VOLUNTEERS

The information that you give us

We will collect personal information from you when you apply for a job with us. This will include names; address; phone number; email; date of birth; NI number; current employment details including job title, start and end dates, current salary, notice period, reason for leaving; all past employment details; education and qualification details; professional memberships; personal, sensitive data (gender, sexual orientation, ethnicity, religion, marital status, disability), whether you are related to any personnel of the College or Governing Body; references; criminal record details; Disclosure Barring Service check, including European Economic Area (EEA) check; Check of Barred List/List 99; Pre employment Health Questionnaire/Medical Report.

If you apply to volunteer with us we will collect your name and contact details only.

We will collect personal information from you when you are a new starter and become an employee of the College or a Volunteer. This will be your name; marital status; previous surname(s); address; contact details; date of birth; qualification details including copies of original certificates; occupation/department; type of employment; NI number; start date; signature; sensitive data (gender, sexual orientation, ethnicity, religion, marital status, disability); criminal record details; copies of proof of identity and right to work in the UK; next of kin and emergency contact details; bank details including account number and sort code; fit-to work certificate from Occupational Health, pension details; student loan details; offer letters; employment terms and conditions; changes to your terms and conditions; certifications/qualifications, disciplinary, grievance, capability, job description, sickness absence details, maternity/paternity/adoption information; accidents and injuries at work; working time information; annual leave records; recruitment information; photo; payroll details; flexible working; exit interviews; return to work notifications; training/cpd records; parental leave request forms; appraisal/ probationary/performance review documentation; disqualification information; disclosed medical information and agreed risk assessments.

The uses made of your personal information

We will use your personal information set out above as follows:

for the recruitment process and for carrying out pre employment checks;
for safeguarding students;
for checking your identity and right to work in UK;
for checking your qualifications;
to keep an audit trail of the checks we have made and our relationship with you in case of employment claims;
to set up payroll and pension and to reimburse expenses;
for dealing with HMRC;
for communicating with you, including for marketing purposes;
for carrying out our role as your employer or potential employer;
for providing facilities such as IT services;
for providing wellbeing and support services, ensuring we maintain our duty to provide a safe and supportive work environment;
for monitoring equal opportunities and meeting our legal reporting requirements, eg. Equality and Diversity reporting, Gender Pay Gap;
with your consent, for ensuring that third party bookings/enrolments are made on your behalf eg. booking training courses, BUPA membership.
for preventing and detecting crime, such as using CCTV and using photo ID on ID Badges and IT Systems;
for contacting past employees where required;
for compliance with legal obligations eg. making external/statutory returns.
for confirming your responsibilities relating to College policies and procedures

We treat your personal information with confidentiality and we do not use it for any other purposes.

The legal basis on which we collect and use your personal information

We collect and use your personal information on the basis that it is necessary for performing our employment contract with you, or it is necessary to take steps before entering into the contract with you. We also collect and use your personal information on the basis that we need to do so in order to comply with our legal obligations.

Where we collect your special category personal information, we do this on the basis that it is necessary for the purposes of carrying out our obligations in the field of employment law. Special categories of personal data are personal data that reveal a person’s racial or ethnic origin, political opinions, religions or philosophical beliefs, trade union membership, genetic data (i.e. information about their inherited or acquired genetic characteristics), information about their physical, physiological or behavioural characteristics (such as facial images), physical or mental health, sexual life or sexual orientation and criminal records.

How long we keep your personal information

We will not keep your personal information for longer than we need it for the purposes we have explained above.

When you apply for a job with us, but your application is unsuccessful, we will keep your personal information for a period of 6 months after the completion of the appointment.

When you are an employee, we will keep your personal information for as long as you work with us. After you leave, we will keep your personal information for the period of time we are legally required to, or the period of time in which any employment claims may be made against the College and for which the information would be required for such claims. College staff are able to view the College’s Retention Schedule for further details.

How we share your personal information

We may need to share the personal information and sensitive personal information that you give us with third parties outside of the College who are contracted to work on the College’s behalf, for example pension providers, HMRC or legal consultants.

The College may also disclose data to auditors undertaking audits or investigations.

Any staff member involved in taking students on trips, the College will keep a signed record which confirms your responsibilities in line with College policy and procedure for taking students on trips. This will be stored on the College trip system, Evolve – https://evolve.edufocus.co.uk. The system is used so the trip organiser can ensure the safety of all students while outside of the college premises.

As part of the College’s application for registration with the Office for Students, the College may be asked to provide the following information about its senior staff: salutation; legal first names; preferred first name; surname; role title; month and year of birth; phone number; e-mail address; directorships or trusteeships at other organisations company/charity number and name.

The College will often confirm dates and nature of an individual’s employment to a prospective employer in a reference.

Where a member of staff’s employment with the College requires study, or placement at another organisation it may be necessary for the College to transfer personal data to the third party.

The College may also have to share your personal data with third parties outside the College for other purposes with your consent. However, there may be circumstances where information is shared without consent. This will only be if:

The disclosure is in the legitimate interests of the College or the third party to whom the information is being disclosed.
There is a statutory duty obligation to share the data;
Disclosure is required for the performance of a contract;
Disclosure is necessary to protect your vital interest; for example in medical emergency situations;
Disclosure is made to assist with prevention or detection of crime, or the apprehension or prosecution of offenders;
Disclosure is required by a Court Order;
Disclosure is necessary to assist the College to obtain legal advice.

Sensitive Personal Data
Circumstances may arise where sensitive personal data is shared outside of the College within the EU without first obtaining your explicit consent. This will only occur where one of the following conditions has been met:

The processing is necessary to protect:

Your vital interests and you cannot give your consent or your consent cannot be reasonably obtained
Another person’s vital interest and you have unreasonably withheld your consent

The processing is necessary for the discharge of any function which is designed for the provision of confidential counselling, advice, support or any other service and:

Your consent cannot be given;
We cannot reasonably obtain your explicit consent; or
Requiring your explicit consent would prejudice the provision of that counselling, advice, support or other service.

The processing is necessary to meet our statutory obligations in relation to equality and diversity monitoring.

The disclosure is made for the purpose of prevention or detection of crime, the apprehension or prosecution of offenders and we have received a notice from the police confirming that the disclosure is required for these purposes:

Pursuant to a Court Order requiring disclosure; or
In order for the College to obtain legal advice or for the purposes of any legal proceedings.

How we transfer your personal information outside of Europe

We do not store or transfer your personal data outside of Europe.

Your rights over your personal information

You have a number of rights over your personal information, which are:

the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal data is being used – please refer to the ICO’s website for further information about this (https://ico.org.uk/);
the right to ask us what personal information about you we are holding and to have access to a copy of your personal information;
the right to ask us to correct any errors in your personal information;
the right, in certain circumstances such as where our use of your personal information is based on your consent and we have no other legal basis to use your personal information, to ask us to delete your personal information;
the right, in certain circumstances such as where we no longer need your personal information, to request that we restrict the use that we are making of your personal information;
the right, in certain circumstances, to ask us to review and explain our legitimate interests to you; and
the right, where our use of your personal information is carried out for the purposes of an agreement with us and is carried out by automated means, to ask us to provide you with a copy of your personal information in a structured, commonly used, machine readable format.

Changes to our Privacy Notice

We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.

How to contact us

GOVERNORS

The information that you give us

Personal contact details – As part of the College’s Governing Body, the College will collect personal information from you. This will include: name, address, employer’s name, job title, telephone number and email address
Register of Interests – As part of the Register of Interests, we will collect information on your current employment; appointments (voluntary or otherwise); membership of professional bodies, groups or organisations; companies in which you hold more than 1% of the share capital; gifts in accordance with our Anti-Bribery policy; any other interests not covered by the above. (Register of Interests)
DBS checks – Your name, address and date of birth, and relevant identity documents, will be collected for the Government’s Disclosure and Barring Service (DBS) checks
Images – Images of you (photos or videos) may be used in publicity material, such as adverts, information leaflets, newsletters, press releases or on the internet (websites), to raise awareness of the services provided by the College. We will ask for your consent before using any images in this way.

The uses made of your personal information

Contact you regarding meetings and other relevant events.
Identify possible conflicts of interest, i.e. situations where your interests may (or may appear to) influence your decision making.
Check whether you have any previous convictions which would make you unsuitable for working with children and young people.
Raise awareness of the College’s governance arrangements.

The legal basis on which we collect and use your personal information

The Corporation is under a legal obligation, under the Further and Higher Education Act 1992, to maintain a Governing Body as it senior decision-making body. The Corporation’s Instrument and Articles, defined by that statute require the Corporation to maintain contact with governors to conduct the College’s business and the information above is necessary for these purposes. Under the Children Act 2004 the College has a statutory duty to safeguard and promote the welfare of its learners. In addition, the College, as an exempt charity under the Charities Act 2011, as amended has a statutory duty to ensure that its Governors are eligible to act as trustees and therefore collects their declarations and conducts checks to satisfy this requirement.

How long we keep your personal information

Periods of time as set out in the Retention Schedule for governance data which specifies the maximum period data should be kept for business purposes and is available from the Clerk on request.

How we share your personal information

Except as set out below, your contact information will be held securely and not shared with anyone else or made public. However, other Governors will have access to your email address and telephone number.
The Chair’s personal email address will be made available to the FE Commissioner and relevant contacts at the Education and Skills Funding Agency on request where they need direct contact with the Chair.
Your personal information will be made available to the Office for Students as part of the College’s registration application
Your email address will be made available to selected College staff in order to facilitate College Governance business.
A summary of information in the Register of Interests will be made available on the College website
Information for DBS checks will be shared with the Government’s DBS service so that they can check whether you have any previous convictions which would make you unsuitable for working with children and young people.
Where consent is given, photographic images will be stored in a database and may be used for publication (as described above) and will be viewed by the public.

Your rights over your personal information

the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal data is being used – please refer to the ICO’s website for further information about this (https://ico.org.uk/);
the right to ask us what personal information about you we are holding and to have access to a copy of your personal information;
the right to ask us to correct any errors in your personal information;
the right, in certain circumstances such as where our use of your personal information is based on your consent and we have no other legal basis to use your personal information, to ask us to delete your personal information;
the right, in certain circumstances such as where we no longer need your personal information, to request that we restrict the use that we are making of your personal information;
the right, in certain circumstances, to ask us to review and explain our legitimate interests to you; and
the right, where our use of your personal information is carried out for the purposes of an agreement with us and is carried out by automated means, to ask us to provide you with a copy of your personal information in a structured, commonly used, machine readable format.

Changes to our Privacy Notice

We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.

How to contact us

CCTV DATA

The information that you give us

The College will collect still and video footage from its CCTV, no audio is collected.

The uses made of your personal information

prevent, deter and detect crime
help provide a safer environment for our students, staff, visitors and contractors.
protect public safety
help to provide improved customer service, for example by enabling staff to see customers requiring assistance
monitor operational and safety related incidents
assist with the verification of claims
apprehend and prosecute offenders, and provide evidence to take civil action in the courts

The legal basis on which we collect and use your personal information

To ensure the safety and protection of students, staff, contractors and visitors, to comply with legal acts and to detect and respond to criminal activity.

How long we keep your personal information

We will keep your data for 85 days before it is deleted
In certain circumstances we may need to disclose CCTV images for legal reasons. When this is done there is a requirement for the organisation that has received the images to adhere to the Data Protection Act.

How we share your personal information

CCTV footage is accessed only by trained CCTV operators and engineers undertaking system testing and configuration.

How we transfer your personal information outside of Europe

We do not store or transfer your personal data outside Europe.

Your rights over your personal information

the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal data is being used – please refer to the ICO’s website for further information about this (https://ico.org.uk/);
the right to ask us what personal information about you we are holding and to have access to a copy of your personal information;
the right to ask us to correct any errors in your personal information;
the right, in certain circumstances such as where our use of your personal information is based on your consent and we have no other legal basis to use your personal information, to ask us to delete your personal information;
the right, in certain circumstances such as where we no longer need your personal information, to request that we restrict the use that we are making of your personal information;
the right, in certain circumstances, to ask us to review and explain our legitimate interests to you; and
the right, where our use of your personal information is carried out for the purposes of an agreement with us and is carried out by automated means, to ask us to provide you with a copy of your personal information in a structured, commonly used, machine readable format.

Changes to our Privacy Notice

We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.

How to contact us

WEBSITES AND COOKIES

Our websites, www.camre.ac.uk, www.thepark-cambridge.co.uk, www.theteddybearnursery.co.uk, use cookies to help provide you with the best experience we can.

Cookies are small text files that are placed on your computer or mobile phone when you browse websites. Our cookies help us to:

Make our website work as you’d expect
Improve the speed/security of the site
Continuously improve our website for you.

We do not use cookies to:

Collect any personally identifiable information (without your express permission)
Pass data to advertising networks
Pass personally identifiable data to third parties
Pay sales commissions.

You can learn more about all the cookies we use below.

Granting us permission to use cookies

If the settings on your software that you are using to view this website (your browser) are adjusted to accept cookies we take this, and your continued use of our website, to mean that you are fine with this. Should you wish to remove or not use cookies from our site you can learn how to do this below, however doing so will likely mean that our site will not work as you would expect.

More about our cookies

Strictly necessary cookies

These cookies are essential in order to enable you to move around this website and use its features, such as logging in to apply for courses. Without these cookies these services cannot be provided.

Performance cookies

These cookies collect information about how visitors use a website, for example which pages are the most popular, how long people spend on the site and whether they receive error messages. These cookies do not collect information that identifies a visitor; all the information is aggregated and therefore anonymous. It is only used in order to improve how a website works. If you wish to opt-out of Google Analytics you can install their opt-out browser add-on.

Functionality cookies

These cookies allow the website to remember choices you make (such as user-names) and information you’ve provided (such as applications in progress). This gives a more personal feel to the site and improves usability. The information these cookies collect may be anonymised and they cannot track browsing activity on other sites.

Turning cookies off

You can switch cookies off by adjusting your browser settings to stop it from accepting cookies (more information on how to do this is available here). Doing so however will likely limit the functionality of our site and a large proportion of the world’s websites as cookies are a standard part of most modern websites.

Links to other websites

This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

How to contact us

https://ico.org.uk/

MARKETING

What this notice applies to:

It applies to information we collect about:

People who use or may use our services. This includes for example:
individuals who study a course with us

employers who purchase training from us
employers who take a student on work experience or placement
employers who seek to recruit or employ an Apprentice with us
Individuals who attend events or webinars with us.
Individuals who are customers or interested in the college’s commercial operations eg The Park, Seasons Restaurant and Café, Elements Beauty, Hair Salon, our Gym and Sports Centres, Vitality Salon and venue hire.
Individuals who request information from us.

If you are asked to provide information to us, it will only be used in the ways described in this Privacy Notice.

The information that you give us

The College collects contact information such as your name and email address to share information about our courses when requested, and to book you onto an event, and takes photos of some students and staff for marketing purposes.

We only ask for as much information as we need to fulfil your enquiry, request or booking and meet our legal obligations. This might include, but it not limited to, the following:

name, date of birth, profession, employer, current school
contact information including, phone, email and postal addresses
information about personal preferences and interests
company information eg financial, staff, training needs analysis
Access and dietary requirements
website and email usage data.

The uses made of your personal information

We use contact information to send you details of our courses or offering, including by e-newsletter, or by phone or mail.
We use your name and contact details to book you onto an open day or other event to find out about our services when you ask us to
We use your access or dietary requirements to ensure provision is made for you at events or meetings.
We use information collected for events such as what school you are from, or subjects/ types of course you are interested in, in aggregate form to analyse trends and interest levels to continually improve and inform the college provision.
We gather anonymous statistics about how effective our marketing material is
We use website and email usage data in aggregate to inform performance and improvements of our email communications and website and to improve the relevance of communications to you
We use images of some students and staff on our website, prospectus and other publications for marketing purposes with the consent of those involved
We occasionally use the names of some students and staff in articles on social media, in the press, and on websites to share good news stories.

The legal basis on which we collect and use your personal information

We seek your consent to contact you via email or phone about services, products, offers and other things provided by us which we think may be relevant to you.
We seek your consent to collect and use your personal information in this way. If you sign up to receive one of our e-newsletters or email updates through one of our websites, event registrations or request to receive one of our publications, we will explicitly ask for your consent to contact you by email and to keep your details on file.
We only use these details to provide the service you have requested and for other closely related purposes. For example, we might use information about people who have requested a publication to carry out a survey to find out if they are happy with the level of service they received. When people do subscribe to our services, they can cancel their subscription at any time and are given an easy way of doing this. You have the right at any time to unsubscribe and can do so by clicking unsubscribe on the email or by emailing marketing@camre.ac.uk.
We collect data to provide a service such as an event or webinar, in order to comply with our contractual obligations
We seek consent from our students to use photos in marketing materials such as on our website or in a prospectus. We collect this from enrolment and we check that we have consent in place before we take any photos.
If we wish to use other personal information, for example your name in an article or social media post, we will always ask you first.

How long we keep your personal information

We will keep this data for as long as you are subscribed to our communications. Should you unsubscribe, we will remove your details from any mailing lists, but will retain your details for historic reporting purposes only.

We retain images used for marketing for up to 5 years after collection, for the life of the publication/ communication and for historical archiving purposes.

How we share your personal information

We do not sell or rent your personal information to others.
We share your personal information within the marketing team, but only to those who need to know it. Or where interest is expressed in a particular service of the college, this data will be shared with that area or our business development or customer enquiry management team.
We may use third party software tools and platforms for processing data or performing specialist services and functions. We will only ever use recognised suppliers who can demonstrate their compliance with GDPR. These include for example:
– Pure 360 and Dotdigital – a digital marketing platform and email marketing platform – to deliver our e-newsletters and marketing emails, push notifications, SMS and LiveChat. We gather statistics around email opening, clicks and website engagement behaviour using industry standard technologies to help us monitor and improve our e-newsletter, email and website performance and to enable more relevant communications from CRC.
– Microsoft Dynamics CRM – a CRM platform to manage customer services for employers, commercial customers, event delegates, training courses and apprentice applicants and to manage marketing contacts, behaviours and interactions and preferences.
– GoToWebinar – a webinar tool.
– AssetBank – Digital Asset Management tool to store, sort and organise student and customer images and videos.
– Survey Monkey – a survey and registration tool.
– EventBrite – an event booking and management tool.
– Jot Form – to take online applications for college courses and registration forms.
– We may also share your personal information with any data processors we use to carry out certain functions, for example, a mailing house, email service providers, SMS messaging service, or for telemarketing services.

How we transfer your personal information outside Europe

We do not transfer your personal information outside of the European Economic Area.

Your rights over your personal information

You have a number of rights over your personal information, which are:

the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal data is being used – please refer to the ICO’s website for further information about this (https://ico.org.uk/);
the right to ask us what personal information about you we are holding and to have access to a copy of your personal information;
the right to ask us to correct any errors in your personal information;
the right, in certain circumstances such as where our use of your personal information is based on your consent and we have no other legal basis to use your personal information, to ask us to delete your personal information;
the right, in certain circumstances such as where we no longer need your personal information, to request that we restrict the use that we are making of your personal information;
the right, in certain circumstances, to ask us to review and explain our legitimate interests to you; and
the right, where our use of your personal information is carried out for the purposes of an agreement with us and is carried out by automated means, to ask us to provide you with a copy of your personal information in a structured, commonly-used, machine-readable format.

Changes to our Privacy Notice

We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.

How to contact us

CUSTOMER INFORMATION – COMMERCIAL OUTLETS – THE PARK

The Park is a series of commercial outlets at the Cambridge Campus that Cambridge Regional College operates for the public that provides valuable work experience for our students. This includes the restaurant, bistro, hair and beauty salons, sports centre and gym. This notice aims to give you the information on how we collect and process the personal data that you provide when you:

visit one of our salons
visit our website
sign up for a membership or rewards scheme
register an online booking
make an appointment by the phone
sign up to the Park or Salon email alerts

The information that you give us

As customers of the Park services we will collect a range of personal information dependent on the services you use, in the form of:

Identity data – name, title, date of birth, gender
Contact data – email, telephone numbers, address
Transaction data – details about payments to and from you
Profile data – your interest in areas of the Park, and any marketing / communication preferences and opt ins
Allergy test data – including allergy test information and any medical conditions that may affect services.
Usage data – including information about how you use our email communications.

The uses made of your personal information

Administer your bookings and appointments for the restaurant, gym, sports centre, hair and or beauty treatments
Maintain and manage your gym membership
Manage your table bookings
Communicate with you about offers from the Park where you have signed up for information.

The legal basis on which we collect and use your personal information

We need to fulfil our contract with you for the purposes of the service or product purchased.
For marketing purposes where consent is provided.

How long we keep your personal information

Your data will be kept for 6 years

How we share your personal information

The College will share information with College and Park staff to ensure your needs are met while visiting The Park. We may also share your information with the following organisations to administer the services of the Park which act as data processors, these include:

Type of organisation:

Avenista

Purpose:

For restaurant bookings http://www.avenista.com

Type of organisation:

Shedul

Purpose:

For salon bookings: www.schedul.com

Type of organisation:

Clubwise https://www.clubwise.com/

Purpose:

For the management of gym membership

Type of organisation:

DotDigital

Purpose:

To email customers and subscribers and track web activity.

The College may use third-party contractors to deliver beauty treatments or personal training session. The contractors are obliged to comply with the Colleges data protection and GDPR policy when processing personal data, relating to any client of the commercial salons.

How we transfer your personal information outside of Europe

We do not store or transfer your personal data outside Europe.

Your rights over your personal information

the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal data is being used – please refer to the ICO’s website for further information about this (https://ico.org.uk/);
the right to ask us what personal information about you we are holding and to have access to a copy of your personal information;
the right to ask us to correct any errors in your personal information;
the right, in certain circumstances such as where our use of your personal information is based on your consent and we have no other legal basis to use your personal information, to ask us to delete your personal information;
the right, in certain circumstances such as where we no longer need your personal information, to request that we restrict the use that we are making of your personal information;
the right, in certain circumstances, to ask us to review and explain our legitimate interests to you; and
the right, where our use of your personal information is carried out for the purposes of an agreement with us and is carried out by automated means, to ask us to provide you with a copy of your personal information in a structured, commonly used, machine readable format.

If you withdraw your consent, please be aware that we may not be able to proceed with your booking or appointment.

To unsubscribe from Park email and text marketing you can unsubscribe at any time through the unsubscribe link on the email or by emailing marketing@camre.ac.uk

Changes to our Privacy Notice

We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.

How to lodge a complaint

COLLEGE VISITORS

The information that you give us

To ensure we deal with all visitors safely while on College premises, we require the following information from all visitors:

Full name
Car registration if applicable

The uses made of your personal information

issue visitors with a visitor pass
ensure we know who is on site in case of emergency
to comply with Health and Safety regulations

The legal basis on which we collect and use your personal information

We are obliged to keep records of visitors to the site to comply with Health and Safety laws.

How long we keep your personal information

We will hold your information for 1 year

How we share your personal information

Types of organisation:

Envoy/Horizon Parking

Purpose:

We are required by Health and Safety law to keep an accurate record of all visitors to the site. Envoy and Horizon Parking are online databases the College uses to store the first and last names of all visitors to the site; as well as your vehicle registration number if you park within one of the College’s car parks. This information is retained within the College and will only be shared with a third party such as the Police for the purpose of preventing crime.

How we transfer your personal information outside of Europe

We do not transfer your personal information outside of Europe.

Your rights over your personal information

the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal data is being used – please refer to the ICO’s website for further information about this ();
the right to ask us what personal information about you we are holding and to have access to a copy of your personal information;
the right to ask us to correct any errors in your personal information;
the right, in certain circumstances such as where our use of your personal information is based on your consent and we have no other legal basis to use your personal information, to ask us to delete your personal information;
the right, in certain circumstances such as where we no longer need your personal information, to request that we restrict the use that we are making of your personal information;
the right, in certain circumstances, to ask us to review and explain our legitimate interests to you; and
the right, where our use of your personal information is carried out for the purposes of an agreement with us and is carried out by automated means, to ask us to provide you with a copy of your personal information in a structured, commonly used, machine readable format.

Please note that is you object to the processing of your information, you will not be allowed entry to the site.

Changes to our Privacy Notice

We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.

How to contact us

SUPPLIER INFORMATION

The information that you give us

The College will collect information which is relevant to the procuring of goods and/or services, and making payments. This includes:

Contact details such as names of contacts, address, telephone number(s) and email address
Bank account details

The uses made of your personal information

To ensure the College has contact details and information to support the smooth running of contracts, and to ensure the College pays for procured items and/or services provided.

The legal basis on which we collect and use your personal information
As a publicly funded body the College is required to keep accurate records of financial expenditure.

How long we keep your personal information
6 years after the termination of contract.

The College will share information with staff who are responsible for the procuring of goods and/or services, and making payments. We use a ‘permissions’ system to make sure that staff only have access to the information they need to carry out their jobs. We may also share the information that you give us with the following organisations (or types of organisation) for the following purposes.

Type of organisation:

College auditors

Purpose:

As part of our public task, the College will share information with external auditors to ensure internal and regulatory processes with regards to the College’s financial expenditure are being followed.

Type of organisation:

Funding bodies

Purpose:

As a publicly funded body the College is required to keep accurate records of financial expenditure and may be required to share information with funding bodies such as:

The Education and Skills Funding Agency (ESFA) – ESFA Privacy Notice
The Cambridgeshire and Peterborough Combined Authority – CPCA Privacy Notice
Cambridgeshire Local Authority – CLA Privacy Notice

How we transfer your personal information outside of Europe
We do not store or transfer your personal data outside Europe.

Your rights over your personal information

the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal data is being used – please refer to the ICO’s website for further information about this (https://ico.org.uk/);
the right to ask us what personal information about you we are holding and to have access to a copy of your personal information;
the right to ask us to correct any errors in your personal information;
the right, in certain circumstances such as where our use of your personal information is based on your consent and we have no other legal basis to use your personal information, to ask us to delete your personal information;
the right, in certain circumstances such as where we no longer need your personal information, to request that we restrict the use that we are making of your personal information;
the right, in certain circumstances, to ask us to review and explain our legitimate interests to you; and
the right, where our use of your personal information is carried out for the purposes of an agreement with us and is carried out by automated means, to ask us to provide you with a copy of your personal information in a structured, commonly used, machine readable format.

If you withdraw your consent, please be aware that we may not be able to continue to work with you as a supplier.

Changes to our Privacy Notice
We keep our privacy notice under regular review. If any changes are made to our privacy notice in the future we will contact you.

How to lodge a complaint
If you want to make a complaint about the way we have processed your personal information, please contact:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
DPO@camre.ac.uk

COVID-19 TESTING – FROM JANUARY 2021

Ownership of the Personal Data
To enable the Covid-19 testing to be completed at Cambridge Regional College (CRC) we need to process personal data for staff and pupils taking part, including sharing of personal data where we have a legal obligation. CRC is the Data Controller for the data required for processing the tests and undertaking any actions which are needed by the college to ensure we meet our public health and safeguarding legal obligations.

Personal Data is processed under the legitimate interest of the data controller to ensure we can minimise the spread of COVID in a timely manner and enable us to continue to deliver education services safely and securely.

If you decline a test, we record your decision under the legitimate interest of the college in order to have a record of your decisions and to reduce unnecessary contact with you regarding testing.

The processing of special category personal data is processed under the provisions Section 9.2(i) of GDPR, where it is in the public interest on Public Health Grounds. This data is processed under the obligations set out in Public Health legislation (Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI)) which allows the sharing of data for COVID related purposes and where it is carried out by someone who owes an equivalent duty of confidentiality to that data.

Data Controllership is then passed to the Department for Health and Social Care (DHSC) for all data that we transfer about you and your test results to them. For more information about what they do with your data please see the Test and Trace Privacy Notice. The establishment remains the Data Controller for the data we retain about you.

Personal Data involved in the process
We use the following information to help us manage and process the tests:

Name
Date of birth
College ID number
Gender
Ethnicity
Home postcode
Email address
Mobile number
Unique barcode assigned to each individual test and which will become the primary reference number for the tests
Test result
Parent/guardians contact details (if required)

We will only use information that is collected directly from you specifically for the purpose of the tests, even if you have previously provided us with this information.

How we store your personal information
The information will be stored securely on the college information system whilst it is needed. It will also be entered directly onto DHSC digital services for the NHS Test and Trace purposes. The college will not have access to the information on the digital service once it has been entered.

Processing of Personal Data Relating to Positive test results
The member of staff, student or parent (depending on contact details provided) will be informed of the result by the college and advised how to book a confirmatory test.
We will use this information to enact their own COVID isolation processes without telling anyone who it is that has received the positive test.

The information will be transferred to DHSC, who will share this with the NHS, GPs. PHE and the Local Government will use this information for wider test and trace activities as well as statistical and research purposes.

This information is processed and shared under obligations set out in Public Health legislation under Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) which allows the sharing of data for COVID related purposes.
This information will be kept by the college for up to 14 days and by the NHS for 8 years.

Processing of Personal Data Relating to Negative test results
We will record a negative result and the information transferred to DHSC, NHS. PHE and the Local Government who will use the information for statistical and research purposes.

This information is processed and shared under obligations set out in Public Health legislation under Regulations 3 (1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) which allows the sharing of data for COVID related purposes.
This information will be kept by the college for up to 14 days and by the NHS for 8 years.

Processing of Personal Data relating to declining a test
We will record that you have declined to participate in a test and this information will not be shared with anyone.

Data Sharing Partners
The personal data associated with test results will be shared with:

DHSC, NHS, PHE – to ensure that they can undertake the necessary Test and Trace activities and to conduct research and compile statistic about Coronavirus.
Your GP – to maintain your medical records and to offer support and guidance as necessary
Local Government to undertake local public health duties and to record and analyse local spreads.

Your Rights
Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at DPO@camre.ac.uk if you wish to make a request.

How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at: Officer Corrin Hoyes:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
DPO@camre.ac.uk
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Your Rights

Data Protection law provides the following rights for individuals:

The right to be informed
The right of access
The right to rectification
The right to erase
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling.

You may ask us at any time for information about any personal data we hold about you, or you may request that we correct or delete that information. Where you ask us not to contact you again or to delete information we may need to retain limited information to respect those wishes.

Where we are relying on your consent as a condition for processing your personal data you may revoke your consent to the processing of your data by contacting us.

We may disclose your personal information in circumstances where we have reason to believe that disclosing this information is reasonably necessary to comply with the law or we have another legal basis to do so.

More information can be found in our Data Protection Policy and on the Information Commissioner’s website https://ico.org.uk/

Complaints or queries

If you want to make a complaint about the way we have processed your personal information, please contact our Data Protection Officer Corrin Hoyes:
Data Protection Officer
Cambridge Regional College
Kings Hedges Road
Cambridge CB4 2QT
DPO@camre.ac.uk