Print
Edinburgh College Privacy Notice
  • Student Enrolment Privacy Policy

    Who are we?

    We are Edinburgh College, and we’re respo​nsible for looking after the information you giv​e us when you enrol at Edinburgh College (under data protection law we are the Data Controller). Our address is: Milton Road Campus, 24 Milton Road East, Edinburgh EH15 2PP. Our designated Data Protection Officer (DPO) is Alice Wilson, who can be contacted by email at: DataProtection@edinburghcollege.ac.uk

    What is our commitment to you, and your personal data?

    ​​

    Edinburgh College is committed to protecting the privacy and security of your personal information.

    This privacy notice explains how we collect, use and share your personal data, and your rights in relation to the personal data we hold. (You can read more about these in “Your Rights” below).

    We will comply with the data protection principles of data protection law.

    We will:

    • Use your data in a lawful, fair and transparent way (lawfulness, fairness and transparency)
    • Collect it only for valid purposes, that we have clearly explained to you, and not use it for any purpose incompatible with the original purpose (purpose limitation)
    • Ensure it’s adequate and relevant to (and just enough to achieve) these purposes (data minimisation)
    • Ensure your data are accurate and up-to-date (accuracy)
    • Keep your data only as long as necessary for the purposes we collected it for (storage limitation)
    • Keep your personal data secure (security)

    What is "personal data"?

    Personal data is information which identifies you specifically, and also relates to your life (whether that’s your home life, education, business or job). We tell you about the specific items of personal data we collect from you below. When we completely anonymise your data (so that individuals cannot be identified) it stops being personal data.

    What is “special category data”?

    Some of your personal data (like your health information, religion, criminal convictions or ethnicity) is more sensitive – this is called “special category data” (we tell you which special category data we collect from you below). In most circumstances you do not have to provide this information (unless you are completing a PVG application, where you must supply this information).

    When you apply for certain specific special categories of Additional Support Funding (for example, because you’re eligible for additional help to travel to college due to a pre-existing health condition), the college must ask you to give us certain health details to process your application.

    Where you’ve agreed special college attendance arrangements with your Learning Development Tutor (under the college’s Flexible Attendance Policy) you will need to provide certain health information to your Learning Development Tutor (where this is the reason for the putting the special attendance arrangement in place). If you receive discretionary funding your Learning Development Tutor will inform the college’s Student Funding Team that you have agreed flexible attendance, but will not pass on details of your health condition.

    What information do we collect about you?

    Personal dataSpecial category data (only where you provide this; or it is required by law*)
    Name, address, telephone number, email addressGender (and gender identity)
    Date of birthSexual orientation
    NationalityReligion or religious denomination
    Next of kin and emergency contact detailsEthnicity
    Employer detailsDisability & health data (including mental health)
    National Insurance Number (Modern Apprentices only)Marital/civil partnership status
    Bank account detailsSpecial interest group status (e.g. asylum seeker; refugee; care-experienced; stateless person; veteran; person with profound or complex needs).
    Previous education, qualifications and employment history*Offences and alleged offences (for the purposes of PVG checks)
    Employment status (e.g. jobseeker) and history*Criminal proceedings, outcomes and sentences (for the purposes of PVG checks)
    Course and units of study (including previous courses of study)
    Assessment information related to your course, including assessment and exam dates and results
    Disciplinary information
    Appeals and complaints information
    Attendance data
    Financial information
    Personal financial circumstances (including family)
    Photographic footage
    Passport number and country of domicile
    Your IP Address (your unique online identifier when browsing the internet).
    Your unique student ID
    If you are a carer or have caring responsibilities
    First/preferred language
    Pregnancy and maternity information

    How do we collect your personal data?

    • When you first apply for a place on an Edinburgh College course, we will collect data about you on our application form (we explain this in our Application Privacy Notice).
    • When you formally enrol on a course by completing our self-enrolment form, we give you the chance to check some of the personal information you provided at application stage; and we also ask you for new items of personal information.
    • If you’re a private individual (or company) purchasing a course.
    • When you apply for discretionary funding (including bursaries, Educational Maintenance Allowance, childcare or discretionary funding); we will use information you have already provided at application and enrolment stage; together with information we’ll ask you to provide on our discretionary funding application forms.

    Why do we need the information we’re asking for?

    For Academic purposes

    For academic purposes: to provide you with teaching, learning and support services; to assess your work; record your progress and ensure you receive certificates from awarding bodies like SQA and BTEC.

    We collect and use your information to:

    • Enrol you as a student
    • Administer our programmes of study, including funding and fee arrangements
    • Monitor your performance and attendance, supervise, conduct assessments and examinations, confer Edinburgh College awards; and provide awarding bodies with assessment results to enable them to confer awards.
    • To give you access to Student Support, IT, library, careers, and other college services.
    • To give you access to learning and teaching tools (including online tools) used as part of your course (e.g. Moodle, Mahara, Turnitin)
    • Deal with appeals, complaints and disciplinary matters promptly and fairly
    • Provide academic guidance and enable you to communicate with staff, your student representatives and fellow students on your programme of study
    • Invite you to college graduation ceremonies
    • Seek your feedback on our courses
    • Communicate with you about learning, teaching, student support, graduation (and FE awards events)

    What’s our legal basis for using your personal information?

    We’re collecting your personal information for the academic purposes above, as part of our Public Task (this is called a “condition for processing” and we need one of these under data protection law to allow us to process your information lawfully). The Post-16 Education (Scotland) Act 2013 allows Edinburgh College to run educational courses, and to provide support services, for students.

    The Data Protection Act 2018 allows us to process your health and other special category data, when we’re specifically providing student support services or making adjustments during your course in relation to any disabilities, because this is set out in statute (law) (the Post-16 Education (Scotland) Act 2013) .

    We also use your health and other special category data (e.g. ethnicity, sexual orientation, race) to carry out statistical analysis (where you provide this information) to ensure we’re advancing equality of opportunity and treatment for all student groups; the Data Protection Act 2018 allows us to process your information for this purpose (but only where you’ve chosen to provide this data).

    For administrative and financial management services

    For administrative and financial management services: to administer fees due and paid for by you and to process payment made for other college related services (for example accommodation); to provide eligible students with childcare and other discretionary funding.

    We collect and use your information to:

    • Administer and collect payment of course fees from you, or an employer
    • Process payments for additional college services like accommodation; graphics and printing services; and library fines
    • Assess your entitlement to student support payments (like Education Maintenance Allowances (EMAs), Childcare Fund payments, bursaries and discretionary funds) and make arrangements for the payment of these to you in the event you are successful.
    • Communicate with you in connection with administrative and financial services.

    What’s our legal basis for using your personal information?

    Where we are collecting your data to ensure payment of course fees, to provide accommodation, graphics and printing services, or library fines we need to process your data to fulfil a contract you have entered into with us.

    Where we’re using your personal information to provide you with a bursary, an EMA, childcare funding or discretionary funding we’re doing this as part of our Public Task. This comes from the Education Student Loans Scotland Regulations (2002); the Education (Access Funds) Scotland Determination (2014); and the Education Maintenance Allowances (Scotland) Regulations 2007.

    To meet our duty of care to you and other legal obligations

    To meet our duty of care to you and other legal obligations: to comply with a legal obligation; protect your vital interests in an emergency; exercise or defend legal claims or comply with court judgements; and protect public health.

    We collect and use your information to:

    • Meet our legal duty of care to you under health and safety and safeguarding laws;
    • Protect your vital interests or someone else’s e.g. in a medical emergency;
    • Provide health and counselling services
    • Comply with a statutory obligation (e.g. under tax or immigration law; as part of the Protection of Vulnerable Groups (PVG) Act 2007).
    • Meet our obligations under equality law. Under the UK Equality Act 2010 we need to collect special category personal data about our students to assist with monitoring equality of opportunity and eliminating unlawful discrimination. We hold this information in strictest confidence and disclose it to bodies with a statutory duty to collect it (i.e the Scottish Funding Council). You can choose whether you want to provide information for this purpose.
    • If a student or applicant declares they have a disability, we have a duty to disclose this information on a need-to-know basis to staff to ensure that reasonable adjustments are made, enabling disabled students to meet their full academic potential.

    What’s our legal basis for using your personal information?

    To:

    • Comply with a legal obligation (e.g. providing your personal data, including equality and health information, to the Scottish Funding Council for funding and equalities monitoring purposes).
    • Protect vital interests in an emergency (e.g. if you are unwell and an ambulance is required; or if we have a safeguarding concern about a student)
    • Exercise or defend legal claims or comply with court judgements

    For public safety and the prevention and detection of crime

    For public safety and the prevention and detection of crime: where this is necessary for the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against and the prevention of threats to public security.

    Processing your personal data for these purposes includes:

    • Use of CCTV to monitor and collect visual images
    • Monitor use of IT facilities
    • Apply security and welfare measures for the safety and security of students and the wider College community under health and safety and other relevant laws

    What’s our legal basis for using your personal information?

    Where this is necessary for the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against and the prevention of threats to public security

    To promote the college

    To promote the college: we may take photographs, and other images and recordings of students for possible use in our publicity and promotional material in print and online on our websites and social media. We would also like to inform you of other college services (including the gym and college restaurants); and college events; for direct marketing purposes.

    Processing your personal data for these purposes includes:

    • We will take photographs of students at events including Graduation, Open Days, and our FE Awards ceremony. Where you are the subject of the photo we will ask for your consent before using your image in our publicity and promotional material (which will include print and online material - both on our website and on social media).
    • Where you are not the subject of a photograph or film, but are included in a group setting (e.g. as part of the crowd at graduation) we will make you aware of the filming and photography and give you the chance to object/not be filmed/photographed.
    • We will keep copies of promotional material in our archives as a record of the College’s activities.
    • We will keep you informed of additional college services (like the gym, and our restaurants) and college events which may be of interest to you (but only where you have given your consent to receive direct marketing).

    What’s our legal basis for using your personal information?

    Where we have your consent (where you are the subject of the image/footage; or where we’ve asked you if you’re interested in receiving direct marketing); or because it is in the legitimate interest of the college to use your image in the promotion of its services (group photos and footage at graduation and college events. Where you object to being filmed or photographed as part of a record of college events, please inform a member of staff or following instructions on signage at events).

    How do I withdraw consent to a photograph, once I’ve given it?

    If you’ve completed a photographic consent form, but have changed your mind and want to withdraw your consent, please email: marketingteam@edinburghcollege.ac.uk

    How do I withdraw consent to direct marketing from Edinburgh College?

    If you’ve given your consent to receive direct marketing from Edinburgh College, please email: marketingteam@edinburghcollege.ac.uk

    For research

    For research: where this is necessary for statistical purposes and also research in the public interest.

    Processing your personal data for these purposes includes:

    • Surveying graduates from our full time programmes of study to find out if they entered work, further study, or are doing something else.
    • Producing management and statistical information to monitor and improve our performance and our services to you and inform strategic planning (e.g. for recruitment).

    What’s our legal basis for using your personal information?

    Where this is necessary for statistical and research purposes. The Scottish Funding Council require the College to survey its full time graduates to find out their destination after finishing their studies at Edinburgh College.

    Who your information will be shared with and why:

    We will share your personal data only where we must do so to comply with a legal obligation; or where sharing your personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Edinburgh College. Where sharing is not on the basis of one of the two reasons above, we will share your personal information only when we have your consent (for example, for direct marketing about college goods and additional services)

    Please be aware that we will appoint people and organisations to work for us, and contract them to act as data processors on our behalf. Examples of when we do this include: Moodle, plagiarism detection systems (Turnitin); and BePersonnel (to enable them to provide one to one tailored support where this has been identified as a requirement of your Personal Learning Support Plan).

    We will also share limited personal data where this is necessary for the following purpose:

    For academic purposes

    For academic purposes: such as providing the results of assessments to awarding bodies to enable them to confer you with academic awards (e.g. a HNC, SVQ, BTEC qualification); arranging an industry placement for you as part of your studies, to allow you to join the Edinburgh College Students’ Association (ECSA) or verifying your attendance and progress to your sponsor.

    Processing your personal data for these purposes includes:

    • Sharing your personal details and assessment results with awarding bodies (e.g. SQA, BTEC, City and Guilds) to enable them to confer awards upon you (e.g. HNC, HND certificate)
    • To deliver a programme collaboratively or jointly between the College and the partner institution, for example, a University.
    • To check that our assessment of your work is fair we will share information with external examiners.
    • To undertake official independent assessment of our programmes e.g. by the SQA, BTEC
    • To confirm your attendance, progress and assessment marks to your sponsor (e.g. your employer) or the institution through which you are studying.
    • To arrange a suitable industry placement if this is part of your course.
    • To publicise your award in our graduation programme and in the list of awards we provide in press releases to news media. (We will ask you for your consent for this).
    • To enable you to participate in the National Student Survey or other official surveys that give us your feedback on our academic quality and your student experience.

    Where we have a legal obligation

    Where we have a legal obligation: this will include sharing with emergency services in a medical emergency, or to assist police investigating a crime, or to provide local councils with information on your choice of course, attendance and progress, and whether you are facing any barriers to education (if you are a school leaver, or school-college partnership student).

    Processing your personal data for these purposes includes:

    • To help the emergency services (fire, police, ambulance) or a health professional to protect your vital interests or someone else’s e.g. in a medical emergency.
    • To administer your right to be a member of the Edinburgh College Student Association and vote in its elections.
    • Submitting statistical returns to the government or its agencies, including the Scottish Funding Council (SFC), Skills Development Scotland (SDS), and other official bodies. This will include sharing your special category data (where you’ve provided it) with the Scottish Funding Council for equality monitoring purposes; we will also share the destinations of full time graduates with the Scottish Funding Council, where graduates have agreed to take part in our survey.
    • To meet a statutory or regulatory obligation, (e.g. providing details on your course choice, progress, and any barriers to your local authority).
    • Confirming your eligibility for tuition fee funding with agencies including the Student Awards Agency for Scotland (SAAS), the Student Loans Company or your sponsor.
    • To comply with immigration laws. This involves disclosure and data sharing with UK Visas and Immigration authorities about applicants and students who are subject to immigration law.
    • To provide limited information necessary to an organisation with a statutory function, such as the police, where this is necessary for law enforcement.

    To enable you to access the services of Edinburgh College Development Trust

    To enable you to access the services of Edinburgh College Development Trust: including financial hardship and extra-curricular grants.

    Processing your personal data for these purposes includes:

    • Where you indicate you wish to receive direct marketing from Edinburgh College Development Trust, about their activities, we will share you contact preferences with them.
    • Where you are applying to the Edinburgh College Development Trust through the Green Project Fund we will share your forename, surname, contact details, and programme of study. Where you are applying to the Edinburgh College Development Trust through the McLeod Memorial Fund, we will also share your health and socio-economic circumstances, as part of the process of evaluating your application.
    • We will share you information with the Edinburgh College Development Trust either where this it required in order for you to enter into a contract with them (to access funding) or where we have your consent (to inform them of your direct marketing preferences).

    International Data Transfers

    As a global organisation we may process your personal information in a country outside the European Economic Area (EEA), when this is necessary to provide you with academic and support services, or fufil a contract with you.

    When doing so we will:

    • Make sure that appropriate safeguards are in place to protect your information and your rights under privacy law;
    • Apply the same high standards of privacy and security wherever we process your data.

    Your rights

    Because this is your personal information, you have rights under data protection law. You have the right to:

    • Be told what personal information Edinburgh College is keeping about you (this privacy notice)
    • Obtain a copy of the data, free of charge within one month of your request (known as a Subject Access Request)
    • Make Edinburgh College change any personal information that’s wrong, out of date or incomplete.
    • If it’s wrong or out of date, to stop us using your personal information until we’ve put it right.

    If you think we are acting unfairly or unlawfully you can:

    • Object to the way we are using your data, by contacting Edinburgh College’s Information Management team by emailing DataProtection@edinburghcollege.ac.uk or you can speak to the team on 0131 297 8663. The team will be happy to help; but we also have an independent Data Protection Officer (Alice Wilson) you can speak to if you’d prefer – we’ve included her details in a separate section below.
    • Complain to the UK Information Commissioner’s Office by calling their helpline on 0303 123 1113. (The Information Commissioner’s Office is the regulator and makes sure organisations across the UK treat your personal information properly).

    Under certain conditions you also have the right to ask:

    • To restrict the use of your data (e.g. if you have raised issues about the accuracy or use of your personal data, until we have investigated and responded to your concerns);
    • Erase your information, known as the ‘Right to be Forgotten’
    • Tell us to stop using your personal data to make decisions about you;
    • Tell us to comply with your wishes where you have previously consented to us processing your data for a particular purpose and have withdrawn your consent to further processing;
    • Provide you with a portable electronic copy of the data you’ve given us (data portability).

    Data Protection Officer and contact details

    Edinburgh College has an independent Data Protection Officer (Alice Wilson) you can speak to – she can be contacted via DataProtection@Edinburghcollege.ac.uk or 0131 297 8663.

    How long will we keep your data?

    We will keep information about you only for as long as needed to provide you with academic and support services and meet our legal obligations and rights.

  • Student Application Privacy Policy

    Edinburgh College is providing you with this information, as an applicant to one of our programmes of study, to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your personal data for the following purposes:

    To process your application to study one of our courses

    This will include reviewing your application to see if you have met the entry criteria for a course; and offering a place on an Edinburgh College course where appropriate (some courses will require you to attend an interview).

    Where you accept an offer of a place on an Edinburgh College course we will use your information to provide you with a timetable; provide you with other essential information required to begin your studies, and to invite you to a registration event.

    If your course requires you to have a Protecting Vulnerable Groups (PVG) check we will use the information you have supplied to arrange this with you directly.

    To review your student funding and childcare funding eligibility

    When you have been offered a place on an Edinburgh College course, if you choose to apply for funding, the college’s Student Funding Team will review your course and funding applications, and use the information provided about your education, location and personal circumstances to consider whether you are eligible for student funding support.

    When you accept an offer of a place on a Further Education (FE) course at Edinburgh College you will have the opportunity to apply for student funding on the EMA/Bursary and Childcare funding sections of the application website. If you choose to apply for funding you will receive an email asking you for documentary evidence to support your application. This email will give you instructions on how to supply this and about what will happen next. (Please note childcare funding can only be awarded for registered childcare costs whilst you are attending classes).

    If you accept a place on a Higher Education (HE) course you will have the opportunity to apply for childcare funding on the funding application website. If you choose to apply for funding you will receive an email asking you for documentary evidence to support your application. This email will give you instructions on how to supply this and about what will happen next. (Please note childcare funding can only be awarded for registered childcare costs whilst you are attending classes).

    To arrange payment of course fees

    If you or your employer are paying for your course of study, the college will contact you separately to request further information, including bank details (for example).

    If you are eligible for a fee waiver, and have been offered a place on an Edinburgh College course, the college will collect further information and evidence from you separately – this will either be through the course application system, or directly from you.

    If you have applied for an Individual Training Account to part pay your course fees you will be asked to provide the college with proof of income in the form of a P60 or your last three months’ payslips.

    To review any additional support needs you may have

    This application form gives you the opportunity to tell the college about any additional support need(s) you may have. The Learning Support Team contacts applicants who indicate an additional support need to provide them with information about learning support at college. This information is not used in any selection or allocation process.

    To analyse student applications for business, planning and equal opportunities purposes

    The college analyses student applications, including by key protected characteristic groups (including age; disability; gender reassignment; marriage and civil partnership; pregnancy and maternity; race; religion or belief; gender; and sexual orientation) to plan and improve its services and curriculum offering. Analysing applications by key protected characteristic groups forms part of the college’s responsibilities under the Public Sector Equality Duty, part of the Equality Act 2010. This information (where you choose to supply it) will not be used in any selecting or allocating process.

    To keep in touch with you about wider college activities (for marketing purposes)

    The college will inform you about the essential information you will need to begin your course. However, the college would also like to keep in touch with you, before you start your course, about wider events and activities across the college beyond your course of study – we will always ask for your consent to send you this additional information, and if you consent, you can withdraw this at any time by emailing Marketing@edinburghcollege.ac.uk

    To meet our responsibilities in relation to your school, local authority, and Skills Development Scotland

    If you are a “school leaver” (you are due to leave school and are applying for a college place whilst still at school) we will share basic information about the status of your application with Skills Development Scotland and in certain cases with school guidance teachers. This will be limited to the status/progress of your application.

    If you have been referred to the college by a local authority or local authority support service we will share basic information about the status of your application with that local authority/local authority support service. This will be limited to the status/progress of your application.

    We will share your personal data with other third parties (for example a parent or guardian if you are 16 or over) only where we have your consent.

    The college is required to provide certain information on “young people” (individuals aged 15 to 25) to Skills Development Scotland (SDS), to enable SDS to a). monitor that young person’s involvement in education or training; b) provide advice or support with regard to that young person’s training. This is explained in our information sharing section below.

    What personal data do we collect?

    Personal dataSpecial category data (only where you provide this; or it is required by law*)
    Name, primary & term address, telephone number, email addressGender (and gender identity)
    Date of birthSexual orientation
    NationalityReligion or religious denomination
    Next of kin and emergency contact detailsEthnicity
    Method of course payment (if applicable)Disability & health data (including mental health)
    National Insurance Number (Modern Apprentices; ESF-funded students; ITA-funded students only)Marital/civil partnership status
    Previous education (including Scottish Candidate Number), qualifications and employment historyPregnancy and maternity information
    Employment status (e.g. jobseeker) and historySpecial interest group status (e.g. asylum seeker; refugee; stateless person; person with profound or complex needs).
    Skills & experience (personal statement)*Offences and alleged offences (for the purposes of PVG checks where required)
    UK Visa status*Criminal proceedings, outcomes and sentences (for the purposes of PVG checks where required)
    Your IP Address (your unique online identifier when browsing the internet)
    Method of payment
    If you are a carer or have caring responsibilities
    Care experienced/looked after background status (if applicable)
    First/preferred language
    Residency information/date & reason of entry to UK/EU
    Veteran status

    How are we collecting this information? What is the source?

    We collect this information directly from you through the college’s application form (or directly from you, after you have submitted your application, in the circumstances explained below):

    If your course of study requires you to be subject to a PVG check we will collect further details directly from you, following submission of your application.

    If you apply for student funding we will use information from your application (name; date of birth; gender; address and course details) and collect additional information from you through the Student Funding Application Form – we will explain how we use that information in a separate privacy notice provided to you at that time.

    Where we need further information around the payment of your course fees, or your exemption from paying course fees, we will collect this information from you separately. (Please note, fee-waiver evidence will be collected through the college’s application form for certain courses).

    If you enrol on an Edinburgh College course we will confirm the information you have provided via our self-enrolment form (you will be provided with a link to our enrolled students’ privacy notice at that point).

    The lawful basis for the processing

    For processing of your personal data in order to process your application, the lawful basis is GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The specific law authorising this is the Post-16 Education (Scotland) Act 2013.

    Where your special category personal data are processed, the lawful basis is GDPR Article 9(2)(g) “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”.

    Where the college processes your special category data specifically to provide learning support, the specific law authorising this is the Post-16 Education (Scotland) Act 2013.

    Where applicants’ special category demographic information (gender identity, sexual orientation, race, ethnicity) are processed for the purposes of analysis in order to advance equality of opportunity and treatment for all student groups, the specific law authorising this is the Equalities Act 2010 (but only where you’ve chosen to supply this information).

    Where your personal data are shared with your school or local authority for the purposes of updating them on your application status, the specific law authorising this is the Education (Scotland) Act 1980.

    Where your personal data are shared with Skills Development Scotland, the specific law authorising this is the Post-16 Education (Scotland) Act 2013 and specifically the Young People's Involvement in Education and Training (Provision of Information) (Scotland) Order 2014.

    Who we share the information with:

    The college shares your information with the following data controllers:

    Your local authorities and/or school (where you are a school leaver, or have been referred to the college via a local authority department or support service)

    Skills Development Scotland: if you are aged 15-25 the college is required to provide the following information to Skills Development Scotland via a secure data hub: your name, address, telephone number, date of birth, Scottish Candidate Number; course information (including start and end date); application/enrolment status; course withdrawal or completion information.

    Data processors:

    The college uses the following data processors to process your personal information:

    Unit-E and CAMS are provided by third party suppliers, to process student applications and student funding applications. These are hosted by Edinburgh College and sit within the college’s technical controls.

    How long do we hold the personal data?

    Paper application forms deleted after seven years; personal data will remain on the college’s Student Record System in line with the college’s retention schedule.

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice); right of access; right of rectification; right of erasure (commonly known as the right to be forgotten); right to restrict processing; right to object; right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing and the College would be required to process your request in one month.

    The rights that apply for this particular processing are:

    • Right to be informed – this privacy notice addresses this.
    • Right of access – you can request access and copies of your personal data held by the college. To do this, please email the DataProtection@edinburghcollege.ac.uk and your request will be processed accordingly.
    • Right to rectification – you can request that inaccurate or incomplete personal data is rectified.
    • Right to Erasure (this right is not absolute and is subject to specifics of the request).
    • Right to object (including to direct marketing). The right to object to direct marketing is absolute and will be responded to accordingly.
    • Right to data portability (this right is not absolute and is subject to specifics of the request).

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • Student School-College Partnership (S4-S6) Privacy Notice

    Edinburgh College is providing you with this information, as one of our school-college partnership S4-S6 students, to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your personal data for the following purposes:

    To process your application to study one of our courses

    This will include reviewing your application and personal statement in order to offer you a place on an appropriate Edinburgh College course.

    To review any additional support needs you may have

    This application form gives you the opportunity to tell the college about any additional support need(s) you may have. This information is not used in any selection or allocation process.

    To analyse student applications for business, planning and equal opportunities purposes

    The college analyses student applications, including by key protected characteristic groups (including age; disability; gender reassignment; marriage and civil partnership; pregnancy and maternity; race; religion or belief; gender; and sexual orientation) to plan and improve its services and curriculum offering. Analysing applications by key protected characteristic groups forms part of the college’s responsibilities under the Public Sector Equality Duty, part of the Equality Act 2010. This information (where you choose to supply it) will not be used in any selecting or allocating process.

    To meet our responsibilities in relation to your school, local authority, and Skills Development Scotland

    We will share basic information about the status of your application with your local authority (for example City of Edinburgh Council; Midlothian and East Lothian councils) and your school. This will be limited to the status/progress of your application.

    We will share your personal data with other third parties (for example a parent or guardian if you are 16 or over) only where we have your consent.

    The college is also required to provide certain information on “young people” (individuals aged 15 to 25) to Skills Development Scotland (SDS), to enable SDS to a). monitor that young person’s involvement in education or training; b) provide advice or support with regard to that young person’s training. This is explained in our information sharing section below.

    What personal data do we collect?

    Personal dataSpecial category data (only where you provide this; or it is required by law*)
    Name, primary & term address, telephone number, email addressGender (and gender identity)
    Date of birthSexual orientation
    NationalityReligion or religious denomination
    Next of kin and emergency contact detailsEthnicity
    Previous education (including Scottish Candidate Number), qualifications and employment historyDisability & health data (including mental health); additional support need information
    School year at start of next academic session (i.e. S4, S5 or S6)Medical information and medication administration information
    Skills & experience (personal statement)Special interest group status (e.g. asylum seeker; refugee; stateless person; person with profound or complex needs).
    If you are a carer or have caring responsibilities
    Care experienced/looked after background status (if applicable)
    First/preferred language
    Additional learning support provided in class (e.g. scribe; 1-2-1; and Alternative Assessment Arrangements information (e.g. read or scribe in examinations)
    Evidence to support Alternative Assessment Arrangements (including examinations).
    Travel/transport to and from college arrangements

    How are we collecting this information? What is the source?

    We collect the majority of information directly from you through the college’s application form.

    However, information on any learning support provided at school and/or alternative assessment arrangements; and any medication you need to carry with you during your studies at college, will be supplied by your guidance teacher in a separate section of your application form.

    The lawful basis for the processing

    For processing of your personal data in order to process your application, the lawful basis is GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The specific law authorising this is the Post-16 Education (Scotland) Act 2013.

    Where your special category personal data are processed, the lawful basis is GDPR Article 9(2)(g) “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”.

    Where the college processes your special category data specifically to provide learning support, the specific law authorising this is the Post-16 Education (Scotland) Act 2013.

    Where applicants’ special category demographic information (gender identity, sexual orientation, race, ethnicity) are processed for the purposes of analysis in order to advance equality of opportunity and treatment for all student groups, the specific law authorising this is the Equalities Act 2010 (but only where you’ve chosen to supply this information).

    Where your personal data are shared with your school or local authority for the purposes of updating them on your application status, the specific law authorising this is the Education (Scotland) Act 1980.

    Where your personal data are shared with Skills Development Scotland, the specific law authorising this is the Post-16 Education (Scotland) Act 2013 and specifically the Young People's Involvement in Education and Training (Provision of Information) (Scotland) Order 2014.

    Who we share the information with

    The college shares your information with the following data controllers:

    Your local authority and/or school (for example: City of Edinburgh Council; Midlothian Council; East Lothian Council). This is provided through a secure ‘schools tracker’.

    Skills Development Scotland: the college is required to provide the following information to Skills Development Scotland via a secure data hub: your name, address, date of birth, Scottish Candidate Number; course information (including start and end date); application/enrolment status; course withdrawal or completion information.

    Data processors

    The college uses the following data processer to process your personal information:

    Unit-E is provided by a third party supplier, to process student applications. This software is hosted by Edinburgh College and sits within the college’s technical controls.

    How long do we hold the personal data?

    Personal data will remain on the college’s Student Record System in line with the college’s retention schedule.

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice); right of access; right of rectification; right of erasure (commonly known as the right to be forgotten); right to restrict processing; right to object; right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing and the College would be required to process your request in one month.

    The rights that apply for this particular processing are:

    • Right to be informed – this privacy notice addresses this.
    • Right of access – you can request access and copies of your personal data held by the college. To do this, please email the DataProtection@edinburghcollege.ac.uk and your request will be processed accordingly.
    • Right to rectification – you can request that inaccurate or incomplete personal data is rectified.
    • Right to Erasure (this right is not absolute and is subject to specifics of the request).
    • Right to object (including to direct marketing). The right to object to direct marketing is absolute and will be responded to accordingly.
    • Right to data portability (this right is not absolute and is subject to specifics of the request).

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • International Student Privacy Notice

    Edinburgh College is providing you with this information, as one of our international students, to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your information for the purpose of processing your application and enrolling you on an Edinburgh College programme of study; and to facilitate your studies at the college (we explain this in more detail below).

    We use your information to provide you with accommodation services, cultural activities (e.g. to arrange visits to local attraction), arrange school visits and transport services (e.g. collecting you from the airport).

    We specifically need your information:

    To process your application to study one of our courses

    This will include reviewing your application to see if you have met the entry criteria for a course; evaluating whether the college is able to offer you a place on a course/fulfil a contract of study; and offering a place on an Edinburgh College course where appropriate.

    To review any additional support needs you may have

    This application form gives you the opportunity to tell the college about any additional support need(s) (including health needs) you may have.

    For academic purposes (once you enrol)

    To provide you with teaching, learning and support services; to assess your work; record your progress and ensure you receive certificates from awarding bodies like SQA and BTEC. To give you access to learning and teaching tools, Student Support, IT, library, careers, and other college services. To seek your feedback on our courses.

    For administrative and financial management services

    To administer fees due and paid for by you and to process payment made for other college-related services (for example if you are staying in college accommodation).

    For immigration purposes

    To support you with your application for a visa to study in the UK, and to comply with our Tier 4 Sponsor obligations to support immigration control.

    To analyse student applications and enrolments for business, planning and equal opportunities purposes

    The college analyses student applications and enrolments, including by key protected characteristic groups (including age; disability; gender reassignment; marriage and civil partnership; pregnancy and maternity; race; religion or belief; gender; and sexual orientation) to plan and improve its services and curriculum offering. Analysing applications and enrolments by key protected characteristic groups forms part of the college’s responsibilities under the Public Sector Equality Duty, part of the Equality Act (2010).

    What personal data do we collect?

    Personal dataSpecial category data (only where you provide this; or it is required by law*)
    Name, address, telephone number, email addressDisability & health data (including mental health)
    Date of birthSpecial interest group status (e.g. asylum seeker; refugee)
    NationalityPassport number and country of domicile
    Next of kin and emergency contact detailsVisa information
    Employer detailsImmigration history
    Previous education, qualifications and employment historyAttendance data
    Bank account details
    Financial information (including family)
    Course and units of study (including previous courses of study)
    Assessment information related to your course, including assessment and exam dates and results
    Disciplinary information
    Appeals and complaints information
    Photographic image and footage (CCTV)
    Your IP Address (your unique online identifier when browsing the internet).
    Your unique student ID
    First/preferred language
    Gender (M/F)
    Marital/civil partnership status (*if your visa status is dependent on your partner)

    How are we collecting this information? What is the source?

    When you first apply for a place on an Edinburgh College course, we will collect data about you from your completed application form.

    When you formally enrol on a course, we will also ask you for new items of personal information as identified on the list above.

    If you are referred by an agent representative, or are being sponsored on your course, we will receive some or all of your personal information directly from your agent or sponsor.

    The lawful basis for the processing

    Under GDPR Article 6(1)(b) “Processing is necessary for the performance of a contract to which the data subject is party to in order to take steps at the request of the data subject prior to entering into a contract.” Is legal basis for processing your personal data (to enrol you as a student at Edinburgh College and deliver the educational experience detailed to you).

    For special category (sensitive) personal data, the legal basis is Article 9(2)(b) “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.” The specific social protection law which authorises processing of special category personal data is The Equality Act (2010).

    Who we share the information with

    For immigration purposes

    As a Tier 4 Sponsor Edinburgh College has a responsibility to comply with all aspects of the Immigration Rules and sponsor guidance, and support immigration control, including taking steps to ensure that every student at our institution has permission to study in the UK throughout the whole period of their study. We must co-operate with the Home Office (UK Visas and Immigration) by complying with requests for information, including in connection with the prevention or detection of crime, the administration of illegal working civil penalties and/or the apprehension or prosecution of immigration offenders.

    For sponsored programmes

    We may be required to provide reports to your financial sponsors to update them about your attendance, progress and welfare.

    For students under 18

    We may contact your parents or guardians if we have any concerns about your attendance, progress or welfare.

    For academic purposes

    such as providing the results of assessments to awarding bodies to enable them to confer you with academic awards (e.g. a HNC, SVQ, BTEC qualification); arranging an industry placement for you as part of your studies.

    For democratic purposes

    To enable you to vote in Edinburgh College Students’ Association (ECSA) elections, as per your legal right to elected student representation.

    Where we place you in accommodation (e.g. halls of residence with a home stay host)

    We will share your personal information (name, age, gender; contact details and special category information dietary requirements, allergies, medical requirements) to facilitate your stay.

    Where we arrange transport (e.g. bus passes or taxi transfers)

    We will share your name and (homestay) address in Edinburgh with the transport provider.

    Where we arrange a school visit

    we will share you name with the school you are visiting.

    Where we have a legal obligation to do so

    Edinburgh College is obliged to share limited information on international students with the Scottish Funding Council – the regulatory body for Scottish colleges. This information is limited to your: gender; name; date of birth; postcode; Scottish Candidate Number; how your place on an Edinburgh College course is being funded.

    Details of data transfers to any third countries or international organisations

    For sponsored programmes: we may be required to provide reports to your financial sponsors to update them about your attendance, progress and welfare – subject to where your sponsor is located this may be outside the EU. Where a sponsor is outside the EU the college ensures appropriate organisational and technical security measures are in place to safeguard your data and that a clear agreement is in place around the security of your information.

    How long do we hold the personal data?

    We will keep paper records in relation to you studies for three years after the end of the academic year in which you are studying. Digital information will be held on the college’s systems and student records database in line with college retention and disposal schedules.

    Individuals’ rights in relation to this processing

    Under data protection law you have a number of rights regarding how an organisation processes your personal data. You have various rights including:

    • Right to be informed (provided by this Privacy Notice)
    • Right of access to the personal information Edinburgh College holds about you.
    • Right to rectification - To change any personal information that’s wrong, incomplete or out of date.
    • The right to restrict processing – this links with the other rights and if there is an issue you can request that the processing restricted until the issues are resolved
    • The right to to object (including to direct marketing – which is an absolute right)
    • The right to erasure (commonly known as the ‘right to be forgotten’) – this means you have the right to request all you data is destroyed
    • The right to data portability – this means you have the right to have your personal data in a machine-readable format (e.g. .csv file) provided to you (or if you request transferred to another organisation).

    If you want to know more about your rights, or if you want to contact Edinburgh College to make use one or more of your rights, please email DataProtection@edinburghcollege.ac.uk or phone 0131 297 8663. Please note some of these rights are not absolute and require certain conditions to be met.

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • Cookie Policy

    Cookie Privacy Notice

    A cookie is a small text file which is placed on your computer or mobile device by your web browser when you access a website. Cookies store information such as user preferences, to allow web applications to offer you a personalised experience and allow us to monitor which pages users find useful so we can improve your website experience.

    This statement aims to provide you with information on what cookies are how we use them and how to accept or reject them.

    About Cookies

    There are two different types of cookies:

    Session Cookies: These are created temporarily when a user visits a website. Once the user closes the browser the cookie is deleted.

    Persistent Cookies: This type of cookie remains on the user’s device for a certain period of time. The cookie is re-activated when the user returns to the website that set that particular cookie. These cookies can be removed manually.

    The UK International Chamber of Commerce categorises cookies as:

    • Strictly necessary cookies: These cookies are essential in order to enable you to move around a website and use its features, such as accessing secure areas of the website.
    • Performance cookies: These cookies collect information about how visitors use a website to help improve the performance of the site, for instance, which pages visitors go to most often. These cookies are anonymous and do not collect personal data that could identify a visitor.
    • Functionality cookies: These cookies provide an enhanced, more personalised experience by storing your preferences such as username or region you are in.
    • Targeting/advertising cookies: These cookies are used to deliver targeted adverts more relevant to you and your interests.
    • No information from cookies can be traced to an individual person, and the cookie only relates to activity on our website.

    The information cannot be used for marketing on an individual basis and does not compromise the security of your device.

    Please visit www.allaboutcookies.org for further information about cookies.

    Edinburgh College Cookies

    Google Analytics

    Edinburgh College uses Google Analytics to track how our website is being used. This enables us to improve the website to better meet the needs of users.

    Cookie Names: _utma, _utmb, _utmc, _utmv _utmz

    Google Analytics cookies are present on every page on the website and store information such as the location of the user, how they found the site (search engine, direct link etc,), what pages they have visited and how long they have spent on the site.

    This information is anonymous and cannot be traced to an individual.

    Share This Content

    Users can share information on our website the various social media through the “Share this Content” toolbar.

    Cookie Name: _atuvc

    The __atuvc cookie is created and read by the AddThis social sharing site JavaScript on the client side in order to make sure the user sees the updated count if they share a page and return to it before our share count cache is updated. No data from that cookie is sent back to AddThis and removing it when disabling cookies would cause unexpected behaviour for users.

    Website Accessibility

    Users can use the website accessibility features to change the font size, background colour and text colour of pages on the website. This allows for better readability of the website.

    Cookie Names: _ecad , _ecbgc , _ectc , _ecfs

    These cookies are used to ensure that any changes made are present on all pages on the website. As such, these cookies are present on all pages, but only if the user has specified a custom setting.

    Previously Viewed Courses

    Users can see their previously visited courses on the right-hand side of any course pages.

    Cookie Name: _ecrv

    This provides the user with the ability to quickly navigate to one of up to the last three courses that they have viewed on the website. This cookie is only used on Course Pages.

    Managing Cookies

    If you would prefer cookies not to store data or would like to manage individual cookies, you can do this through your web browser.

    Click on the links below for more information on the most popular browsers:

    • Google Chrome
    • Microsoft Internet Explorer
    • Mozilla Firefox
    • Apple Safari
    • Opera
    • iOS
    • Android
    • Blackberry®​
  • National Fraud Initiative Privacy Notice

    Edinburgh College is providing you with this information to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it (Purpose)?

    Sharing Data with Audit Scotland: National Fraud Initiative

    This College is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud.

    On behalf of the Auditor General for Scotland, Audit Scotland appoints the auditor to audit the accounts of the College. It is also responsible for carrying out data matching exercises under the National Fraud Initiative.

    Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This will include personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified but the inclusion of personal data within a data matching exercise does not mean that any specific individual is under suspicion. Where a match is found it indicates that there may be an inconsistency that requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out. The exercise can also help bodies to ensure that their records are up to date.

    Audit Scotland currently requires Edinburgh College to participate in a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to Audit Scotland for matching. The exact nature of the data supplied is set out in Audit Scotland’s instructions, which can be found at: http://www.audit-scotland.gov.uk/our-work/national-fraud-initiative

    The use of data by Audit Scotland in a data matching exercise is carried out under their statutory authority, normally under its powers in Part 2A of the Public Finance and Accountability (Scotland) Act 2000. It does not require the consent of the individuals concerned under the Data Protection Act 2018. Data matching by Audit Scotland is subject to a Code of Practice. This may also be found at: http://www.audit-scotland.gov.uk/our-work/national-fraud-initiative

    For further information on Audit Scotland’s legal powers and the reasons why it matches particular information, see the full text privacy notice at: http://www.audit-scotland.gov.uk/our-work/nationalfraud-initiative

    The lawful basis for the processing

    Our legal reason for processing the data is that use is necessary for the performance of a task in the public interest. Article 6, (1), (e)

    Special category (sensitive) data: Processing is necessary for reasons of substantial public interest and is authorised by domestic law proportionate to the aim pursued. The legal basis for processing your special category and criminal convictions data is Article 9 (2) (g) substantial public interest, and sections 6, 10, 11, and 12 of schedule 1 to the Data Protection Act 2018.

    Individuals’ rights in relation to this processing:

    • The right to access your personal data
    • The right to rectification if the personal data we hold about you is incorrect
    • The right to restrict processing of your personal data

    The following rights apply only in certain circumstances:

    • The right to withdraw consent at any time if consent is our lawful basis for processing your data
    • The right to object to our processing of your personal data
    • The right to request erasure (deletion) of your personal data
    • The right to data portability

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • College Employee Privacy Notice

    Edinburgh College is providing you with this information, as one of our employees, to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your personal data for the following purposes:

    Recruitment and retention of staff:

    • Making a decision about your recruitment/appointment;
    • Determining the terms on which you work for us;
    • Checking that you are legally entitled to work in the UK;
    • Checking your criminal history, including PVG Disclosure Scotland checks;
    • Assessing qualifications, including decisions about promotions;
    • Making decisions about your continued employment;
    • Undertaking/implementing salary reviews and calculating compensation e.g. voluntary severance;
    • When outsourcing particular business areas of the college we are required to provide information to your new employer in adherence with TUPE regulations.

    Payroll and pensions administration (including National Insurance and Tax Administration):

    • Paying you and deducting tax and national insurance contributions;
    • Providing employee benefits to you;
    • Liaising with your pension provider and the Department of Work & Pensions

    Supporting your Continuing Professional Development and career progression:

    • Identifying education, training and development requirements (e.g. Training Needs Analysis);
    • Conducting appraisal/development reviews.

    For occupational health and managing sickness absence purposes:

    • Ascertaining your fitness to work when managing sickness absence;
    • Referring you to Occupational Health to assess your fitness for work (this may be an internal or external practitioner); a separate Occupational Health privacy notice will be provided at that time.

    For disciplinary and conduct purposes:

    • Gathering evidence during the course of investigations for possible disciplinary, grievance or capability hearings;
    • To monitor your use and ensure security of our information and communication systems, in partnership with IT, to ensure compliance with our IT Policies;
    • Dealing with legal disputes involving you, or other employees.

    For health and safety purposes:

    • Complying with health and safety obligations (e.g. monitoring compulsory training).
    • Dealing with legal disputes arising from accidents at work.

    For Equality and Diversity monitoring purposes:

    • Equal opportunities monitoring, in line with legal obligations, to promote inclusion.

    For management planning purposes:

    • Business management and planning, including accounting and auditing;
    • Producing quarterly and annual statistical HR Dashboards for senior management and the Policy & Resources Committee to inform business planning which includes headcount (and full-time equivalents), establishment, turnover, absence, recruitment, training and workforce demographics such as age, disability, part-time status.

    For collective bargaining purposes:

    • Providing information and data to Colleges Scotland under the Trade Union and Labour Relations (Consolidation) Act 1992 which enables agreements to be reached under National Bargaining with recognised Trade Unions i.e. pay agreements, job evaluation etc.

    What personal data do we collect?

    • Name/Title
    • Address(es)
    • Telephone number(s) – home & mobile
    • Personal email address
    • Date of birth
    • Gender
    • Marital status
    • Dependants
    • Next of kin
    • Emergency contact information
    • National Insurance number
    • Bank account details
    • Payroll number & tax code
    • Salary
    • Pension scheme details
    • Benefit information e.g. childcare voucher membership
    • Application form (or if via agency CV & covering letter)
    • Proof of Right to work
    • References
    • Qualification certificates
    • PVG Membership Number

    We also process special category personal data:

    • Race
    • Ethnicity
    • Religious beliefs
    • Sexual orientation
    • Disability
    • Gender identity
    • Criminal convictions information
    • Medical questionnaire
    • Absence records and reasons as this may contain health data or other special category data
    • Occupational Health reports
    • Trade Union membership

    How are we collecting this information? What is the source?

    We will collect the majority of your personal information from you during our recruitment and selection process. If you applied for a post through myjobscotland.gov.uk we will have received your information from myjobscotland: they will be a separate controller of your personal data – for further information on how they process your data please see their privacy notice.

    We will ask you to keep your personal information current throughout your time with us by updating our self-service HR system. However, in certain circumstances we will collect information from third parties including:

    • Former employers
    • Employment agencies
    • Disclosure Scotland
    • GPs/Consultants/Occupational Health professionals
    • HMRC
    • Department of Work & Pensions

    The lawful basis for the processing

    For processing of your personal data, the lawful basis is GDPR Article 6(1)(b) “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.

    Where your special category personal data are processed, the lawful basis is GDPR Article 9(2)(b) “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject”.

    • Where employees’ health data are processed, there are several laws which require this. They are as follows: Health and Safety at Work etc. Act 1974; The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013; and Employment Rights Act 1996.
    • Where employees special category demographic information (gender identity, sexual orientation, race, ethnicity) the specific law authorising this is the Equalities Act 2010.
    • Where employees’ criminal conviction data are processed, the specific law authorising this is the Protection of Vulnerable Groups (Scotland) Act 2007.
    • Where employees’ data are processed for the purposes of collective bargaining, involving Colleges Scotland, the specific law authorising this is the Trade Union and Labour Relations (Consolidation) Act 1992.

    Exceptionally, we may also use your personal information:

    • Where we need to protect your vital interests (or someone else’s interests);

    Who we share the information with:

    We share your personal information with the following third party data controllers:

    • Disclosure Scotland
    • Audit Scotland (as part of the National Fraud Initiative)
    • Pension providers (e.g. Lothian Pension Fund, STSS & Prudential for AVCs);
    • HMRC;
    • Colleges Scotland (e.g. national initiatives such as National Bargaining);
    • GPs/Consultants/Occupational Health practitioners (a separate privacy notice will be provided at that time);

    We share your personal information with the following data processor:

    • Midland HR (providers of iTrent) only for the purposes of maintaining and upgrading the HR system and resolving technical queries. Edinburgh College hosts the iTrent application and database internally.

    How long do we hold the personal data?

    We will retain personal data about employees for a maximum of six years after their employment has ceased, with certain exceptions:

    The college will retain documents relating to pre-employment health screenings of individuals exposed to hazardous substances through their employment; and records relating to major injuries arising from accidents in the workplace; for 40 years after an employee’s employment has ceased.

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice); right of access; right of rectification; right of erasure (commonly known as the right to be forgotten); right to restrict processing; right to object; right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing and the College would be required to process your request in one month.

    The rights that apply for this particular processing are:

    • Right to be informed – this privacy notice addresses this.
    • Right of access – you can request access and copies of your personal data held by the college. To do this, please email the DataProtection@edinburghcollege.ac.uk and your request will be processed accordingly.
    • Right to rectification – you can request that inaccurate or incomplete personal data is rectified.
    • Right to Erasure (this right is not absolute and is subject to specifics of the request).
    • Right to object (including to direct marketing). The right to object to direct marketing is absolute and will be responded to accordingly.
    • Right to data portability (this right is not absolute and is subject to specifics of the request).

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF
  • College Job Applicant Privacy Notice

    Edinburgh College is providing you with this information, as someone who applied for a post/job role at Edinburgh College, to comply with data protection law and to ensure that you are fully informed and we are transparent in how we collect and use your personal data.

    Who is collecting the information?

    Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

    Why are we collecting it and what are we doing with it (Purpose)?

    We collect your personal data in order to effectively manage our recruitment process and in order to assist us in:

    • Making a decision about your recruitment/appointment
    • Determining the terms on which you work for us
    • Checking that you are legally entitled to work in the UK
    • Checking your criminal history, including PVG Disclosure Scotland checks
    • Assessing qualifications
    • Checking whether you are eligible for guaranteed offer of interview under Disability Confident Scheme
    • Monitoring and advancing equality of opportunity and eliminating unlawful discrimination, as per the college’s legal duty under the Equality Act 2010 (the Scottish Public Sector Equality Duty requires the college to analyse and produce anonymised reports on the recruitment of persons from specific protected characteristic groups)

    What personal data do we collect?

    We process the following personal data for all applicants:

    • Name/Title
    • Address(es)
    • Telephone number(s) – home & mobile
    • Personal email address
    • Date of birth
    • Salary
    • Application form (or, if via agency, CV & covering letter)
    • Proof of Right to work in the UK
    • Caring responsibilities
    • Gender
    • Marital Status

    And for applicants who are offered a role with Edinburgh College we also process:

    • References
    • Qualification certificates
    • Bank details
    • Next of kin/emergency contact details
    • Pension details

    We also process special category personal data for all applicants:

    • Race
    • Ethnicity
    • Religious beliefs
    • Sexual orientation
    • Disability
    • Gender identity
    • Criminal convictions information

    And for applicants who are offered a role at Edinburgh College, we will also process the following special category data (further information on how we use this information is provided in the college’s employee privacy notice):

    • PVG Membership Number
    • Medical questionnaire

    How are we collecting this information? What is the source?

    We will collect the majority of your personal and sensitive information from you during the application stage of our recruitment process. Further information will be requested directly from you if you are offered a role with Edinburgh College (bank details, medical questionnaire, PVG application information (e.g. previous addresses); next of kin details; pension details; occupational health information questionnaire).

    If you applied for a post directly through our Edinburgh College website (or link to our website) from January 14th, 2019 onwards, we will store your personal and sensitive information securely on our recruitment module within our HR system (currently iTrent).

    If you previously applied for a post through myjobscotland.gov.uk we will have received your information from myjobscotland: they will be a separate controller of your personal data – for further information on how they process your data please see their privacy notice.

    The lawful basis for the processing

    For processing of your personal data, the lawful basis is GDPR Article 6(1)(b) “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.

    To meet our Public Sector Equality Duties under the Equality Act 2010, we collect additional personal and special category data about our applicants, via our Equalities Monitoring form, to assist the college in monitoring and advancing equality of opportunity and eliminating unlawful discrimination.

    Where your special category personal data (e.g. gender identity, sexual orientation, race, ethnicity) are processed for this purpose the lawful basis is GDPR Article 9(2)(g) “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject”.

    Where applicants’ special category demographic information (gender identity, sexual orientation, race, ethnicity) are processed for the purposes of monitoring and advancing equality of opportunity and eliminating unlawful discrimination the specific law authorising this is the Equality Act 2010.

    Where applicants’ criminal convictions information are processed the specific law authorising this is the Rehabilitation of Offenders Act 1974 (Exclusions and Exceptions) (Scotland) Amendment Order 2016.

    Where applicants’ asylum status/right to work in the UK information are processed the specific law authorising this is the Immigration, Asylum and Nationality Act 2006.

    Who we share the information with:

    We share personal information with the following data processor:

    • Midland HR (providers of iTrent) only for the purposes of maintaining and upgrading the HR system and resolving technical queries. Edinburgh College hosts the iTrent application and database internally.

    If you are offered a role at Edinburgh College we will share your personal information with the following third party data controllers as part of our new starter process and in order to enter into an employment contract with you (further information on how we use this information is provided in the college’s employee privacy notice):

    • Disclosure Scotland
    • Pension providers (e.g. Lothian Pension Fund, STSS & Prudential for AVCs)
    • HMRC
    • Department of Work & Pensions
    • GPs/Consultants/Occupational Health practitioners (a separate privacy notice will be provided at that time)

    How long do we hold the personal data?

    If you are unsuccessful in our recruitment process (i.e. you are not offered a role with Edinburgh College) your information will be deleted 6 months after the closure of the recruitment campaign for which you applied.

    If you are successful in being appointed to a role at Edinburgh College, we will transfer your personal and sensitive information into our iTrent employee module (please see Privacy Notice for Employees of Edinburgh College (November 2018)).

    Individuals’ rights in relation to this processing

    Under data protection law, you have a number of rights, some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing and the College would be required to process your request in one month.


    The rights that apply for this particular processing are:

    • Right to be informed – this privacy notice addresses this.
    • Right of access – you can request access and copies of your personal data held by the college. To do this, please email the DataProtection@edinburghcollege.ac.uk and your request will be processed accordingly.
    • Right to rectification – you can request that inaccurate or incomplete personal data is rectified.
    • Right to erasure (this right is not absolute and is subject to specifics of the request).
    • Right to object (including to direct marketing). The right to object to direct marketing is absolute and will be responded to accordingly.
    • Right to data portability (this right is not absolute and is subject to specifics of the request).

    Complaints to UK Information Commissioner’s Office (ICO)

    If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk.

    If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

    You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:


    Customer Contact
    Information Commissioner's Office
    Wycliffe House
    Water Lane
    Wilmslow
    SK9 5AF

Edinburgh College Data Protection Policy
Edinburgh College is committed to a policy of protecting data, and to protecting the rights and freedoms of individuals with respect to the processing of their personal data. 

Our Data Protection Policy sets out the legal framework and risks which govern the college’s use of data; the college’s commitment to protecting its data; and the obligations of users to protect all data (with particular reference to personal and special (previously called sensitive) categories of personal data).

Download PDF Data Protection Policy ​
​​​​​​​​​​​​​

Edinburgh College Data Breach Reporting Procedure
For information on how to report a suspected data breach, involving personal data, please read our Data Breach Reporting Procedure.


​​
InfoGraphic
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
  • Gallery Image
Name Email Phone Message
Please leave this field blank
For further information please contact the College t: 0131 669 4400 | Disclaimer
Text Size + - Background Colour Text Colour
Inverted Grey Simple Soft Red Blue Green Yellow Violet Default
Black Grey White Soft Red Blue Green Yellow Violet Default
×