1. GENERAL INFORMATION

The Association of Colleges (The AoC) is the membership body for colleges and exists to promote and support their interests. Everything AoC does is aimed at helping colleges deliver their purpose and to make an impact. The AoC believes that every community should be supported by a strong and successful college, which develops students, delivers relevant skills, and supports stronger communities, social justice, employers and the economy.

The AoC is committed to protecting the privacy and security of the personal information of students.

This privacy notice describes how the AoC collects and uses personal information about you for the Vector service for AoC members, in accordance with the General Data Protection Regulation (GDPR).

The aim of the Vector service is to improve the performance of colleges by helping to ensure that they meet the needs of their local community. The Vector service uses information on employment needs, demographic and social trends alongside learner data about post-16 learners studying in colleges, schools, Universities, private training providers and adult education providers. The learner data uses the Individualised Learner Record (ILR), School National Pupil Database (NPD) and Higher Education HESA records to give a complete picture of all learning taking place in a local area.

The AoC is a “data controller”. This means that they are responsible for deciding how they hold and use personal information about you to deliver the Vector service. They are required under data protection legislation to notify you of the information contained in this privacy notice. Data is processed on behalf of AoC by RCU Ltd. who are the “data processor”.

This notice applies to “data subjects” who are post-16 learners. This notice does not form part of any contract, and AoC reserves the right to update this notice at any time.

It is important that you read this notice and understand it, together with any other information notice provided on specific occasions when AoC are collecting or processing personal information about you, so that you are aware of how and why AoC are using such information.

2. DATA PROTECTION OFFICER

AoC have appointed a data protection officer (DPO) to oversee compliance with this information notice. If you have any questions about this information notice or how AoC handle your personal information, please contact the DPO@aoc.co.uk .

If at any point you believe the information we process on you is incorrect you can request to see this information and have it corrected or deleted. If you wish to raise a complaint on how we have handled your personal data, you can contact AoC’s Data Protection Officer DPO@aoc.co.uk

If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you can complain to the Information Commissioner’s Office https://ico.org.uk/

3. DATA PROTECTION PRINCIPLES

AoC will comply with data protection law. This says that the personal information AoC hold about you must be:

1. Used lawfully, fairly and in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is not with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.

4. THE KIND OF INFORMATION AoC COLLECTS ABOUT YOU

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

There are “special categories” of more sensitive personal data which require a higher level of protection. The Vector service does not use special categories of data.

The Vector service has been designed and developed to minimise the use of and access to personal data (see section 5 below). The service uses information from learner records to create information on what is being delivered in a locality. The service uses the following categories of personal information about you;

• – Course details and overall performance
• – Age, home location based on lower level super output area/output area

5.  HOW IS YOUR PERSONAL INFORMATION COLLECTED?

AoC collect personal information about learners through formal data sharing agreements with the Department for Education (DfE) and the Education and Skills Funding Agency (ESFA).

AoC will only use your personal information when the law allows us to. AoC will use your personal information for producing the Vector service.

AoC’s lawful basis for processing personal data for the Vector Service is “Legitimate interests – the processing is necessary for the organisation’s legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s individual data that overrides those legitimate interests”.

6. RECIPIENTS OF THE PERSONAL DATA

 RCU Ltd (as the Data Processor

7. RIGHTS OF ACCESS, CORRECTION, ERASURE, AND RESTRICTION

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This allows you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that AoC hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing.
• Object to processing of your personal information where AoC are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the Data Protection Officer identified under point 1 above, in writing.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

8. DATA SHARING

The following third-party service providers process personal information about you for the following purposes:

RCU Ltd as the data processor, shall process data solely for the purposes of the Vector service.

9. DATA SECURITY

AoC and RCU Ltd have put in place extensive measures to protect the security of your information. Details of these measures are available upon request

RCU will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

RCU have put in place detailed security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Details of these measures may be obtained from our Data Processing Officer as identified under point 1 above.

RCU have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where legally required to do so.

10. DATA RETENTION

RCU will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Once AoC and / or any third parties have anonymised your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Download Privacy Policy