GENERAL PRIVACY NOTICE

Responsible for Implementation: DATA PROTECTION OFFICER
Latest Review Date: MARCH 2025 ~
Next Review Date: MARCH 2026
Authorised By: DIRECTOR OF ESTATES, TECHNICAL OPERATIONS & RESOURCES

Contents
1. About Us
2. Who Is Responsible For Your Data
3. The Data We Collect & How We Use It
4. Criminal Conviction Data
5. Safeguarding Data
6. Third Party Processors
7. Your Rights
8. Our DPO
9. How To Contact Us
10. How To Contact The ICO

About Us
Access Further Education Ltd (‘The College’) has subsidiary companies, trading names and trading partnerships through which it operates. The trading names and partnerships might have their own names or brands, but the legal entity for the purpose of this policy is Access Further Education Ltd. Trading subsidiaries, trading names and trading partnerships include Access Creative College (‘ACC’), National College for Creative Industries (‘NCCI’) and Access Sport. The dBs Institute (DBS Music UK Holdings and its subsidiaries), whilst a separate legal entity, shares common Directorships with the College, however, responsibility for Data Protection related Policies within dBs falls to the DPO for Access Further Education Ltd.

This Privacy Notice is intended to provide information on how we handle the personal data of prospective learners and employees, visitors to our website and those who contact us about our services. We have separate Privacy Notices available for our employees, and our current learners and alumni.

Who Is Responsible for your Data
● For prospective learners/website visitors of Access Creative College, Access Sport, Access Industry and our relevant subcontractors, the associated controller is Access Further Education Ltd. The Information Commissioner’s Office (ICO) registration number is: Z7480437.
● For prospective Higher Education learners/website visitors of dBs Institute, the associated controller is one of the below companies, in joint controllership with Falmouth University:
○ Deep Blue Sound Limited (Z8751984)
○ DBS Bristol Limited (ZA546654)
○ DBS (Falmouth) Limited (ZB586460)

The Data We Collect & How We Use It

Website visitors
When you visit one of our websites, we collect and store information relating to your use of that website, through the use of cookies. This information includes activity data, location data, weblogs and other communication data. We also collect and store information about your device, including where available your IP address, operating system, and browser type.

We use this information to improve our website and ensure its functionality.

Lawful basis: Consent

Enquiries and event bookings
When you complete one of our website forms, submit an enquiry, or book to attend an event, we collect the following information:
● Your name
● Your contact details: postal address, email address and telephone number
●Your date of birth
● What year of study you are currently in (if relevant)
● Name of your current school (where relevant)
● Parent / Guardian details (if relevant for attending an event)
● Support needs (if relevant for attending an event)

We use this information to contact you regarding your interest in the college, to plan your attendance at events, and to send you promotional emails about new events or other information from the College that we think may be of interest. We will retain your information for 6 years following the end of the event before deletion.

Lawful basis: Legitimate Interest

Course Applications
When you apply to study with us, we will collect the following from you in our application forms:
● Full name
● Date of birth
● Nationality
● Residency
● Your contact details: postal address, email address and telephone number
● Name and contact details of your parent/guardian/carer
● Previous learning support information (where applicable)
● Disability details (where applicable)
● Place of previous education and achieved/pending qualifications
● Information relevant to your course application (e.g. skills and interests)
● Unspent criminal convictions (see Criminal Conviction Data section below)
● Functional Skills Assessments (for 19+ Access to HE courses only)

We use this information to:
● Assess your suitability for the course you have applied to
● Keep you and your parent/guardian/carer updated on the progress of your application
● To arrange an interview with you, or to request additional information
○ Please note, interviews may be recorded for the purpose of training and quality improvement. Further details can be found in our Interview Observations notice, available from admissions@accesstomusic.ac.uk.
● Contact you for feedback relating to the application process, so that we may make improvements

Certain courses with Access Creative and Access Sport offer purchases of starter packs to offer holders before enrolment, via our online shop. When you purchase from this site we will use your personal data to process the sale and ensure your products are available for you to collect.

If you enrol as a learner with the College, we will collect further information from you. You can find out more about what this data is, and what we do with it, from our Learner Privacy Notice, which will be made available to you alongside your enrolment form. You may request a copy of this at any time.

If your application is unsuccessful, your data will be retained for 2 years following the end of the relevant academic year before deletion.

Lawful basis: contractual (necessary for the performance of a contract - our provision of education/training)

Employment Applications
When you apply for a role with us you are taken to our vacancy portal, hosted by Talos360. We collect the following information from you:
● Full name
● Contact details, including email address, address, telephone numbers including mobile numbers
● Work history, education, training, skills, experience, position held, dates of employment and any other information included in your CV including names of current and previous employers
● Details of job preferences
● Names and contact details of referees where provided
● Special category personal data linked to equality and diversity monitoring (not linked to your application, nor mandatory fields)
● Answers to questions that we pose to ascertain your suitability for the job for which you are applying

We will use this information to assess your suitability for the role you have applied to, to invite you for an interview, or to request more information. If you are unsuccessful, your data will be retained for 6 months before deletion.

If you become a member of our workforce, then a separate Workforce Privacy Notice will be made available to you.

Lawful basis: legitimate interest & compliance with legal obligations

Criminal Conviction Data
We collect, store and use information about criminal convictions and offences for both course applications and employment applications. All employees are required to undergo either a Standard or Enhanced DBS check before employment commences. All potential learners are asked to disclose any criminal convictions/offences at the interview stage of their application.

Lawful basis: Compliance with legal obligations

Safeguarding Data
If a prospective learner discloses information during the application and interview process which relates to potential safeguarding concerns, and would require additional review or risk management, the College will collect this information. Personal Data processed for safeguarding includes name, address, date of birth, contact details, health information, details of the nature of the safeguarding case and previous safeguarding information.

Safeguarding data is stored within our MyConcern account, and may be shared with external third parties, such as local authorities or the police, only where there is a legal requirement to do so. We are required to maintain records of safeguarding cases of children until the 25th birthday of the child.

Third Party Processors
The College uses external companies to process personal data on our behalf:
● Google - email hosting and electronic document storage. Data stored within our Google account is transferred to servers in the EU. We utilise the adequacy decisions made under both the UK GDPR and EU GDPR to safeguard this transfer.
● HubSpot - website enquiry forms/application forms, prospective/current learner data, marketing preferences, bulk messaging, alumni management. Data stored within our HubSpot account is transferred to servers in the EU. We utilise the adequacy decisions made under both the UK GDPR and EU GDPR to safeguard this transfer.
● SignUpAnywhere - data collection onsite at our events
● Aircall - prospective learner interviews (Access Creative & Access Sport)
● Zoom - prospective learner interviews (dBs)
● Talos360 - recruitment of employees
● EBS/Tribal - learner management system
● MyConcern - safeguarding case management
● Century - functional skills assessments
● Shopify - online shop hosting. Used for course starter pack purchases where available. Data stored within our Shopify account is transferred to servers in the EU. We utilise the adequacy decisions made under both the UK GDPR and EU GDPR to safeguard this transfer.

Processors used specifically for the data of fully enrolled learners and employees are listed within the respective Privacy Notices (available on request).

Your Rights
You have a number of rights over your personal data, and how we handle it. These are listed below.

The Right to be Informed:
We keep you informed through our Privacy Notices, and by uploading our relevant data protection policies to our websites.

Right to Access:
You have the right to access the personal information that we hold by making a ‘Subject Access Request’. If we agree that we are obliged to provide this to you (or to someone else on your behalf), we will provide it free of charge and aim to do so within 30 days, starting from the date that we confirm your identity.

Right to Rectification:
If any of the personal information we hold about you is inaccurate, incomplete or out of date, you may ask us to correct it.

Right to Stop or Limit Our Processing of Your Data:
You can ask us to stop or limit your data being processed under certain circumstances - where data is being used for direct marketing, or where we use the legal basis of legitimate interest and we do not have a compelling basis to continue this processing following an objection.

Right to Erasure:
This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances.

Right to Portability:
You have the right to receive your personal data in a structured, commonly used and machine readable format, to allow you to pass this data easily to another controller. It also gives you the right to request that we transmit this data directly to another controller.

Our DPO
We meet the criteria set within the Data Protection Legislation to appoint a DPO (Data Protection Officer). They advise and inform the College about all aspects of data protection, and monitor our compliance with the legislation. They assist with risk assessments, staff training and awareness. The DPO is our designated point of contact for both you, our data subjects, and the ICO.

Their email address is: dpo@accesscreative.ac.uk

How To Contact Us
If you have any questions about this policy, or wish to complain about how your data is being processed, please contact us via one of the following methods:
By email: dataprotection@accesscreative.ac.uk
By post: Access Creative College (Access Further Education Limited) 26 Hulme Street Manchester M2 5BW

How To Contact the ICO
If you are not happy with the way your information is being handled, or with a response we have provided to you regarding a complaint, you have the right to lodge a complaint with the Information Commissioner’s Office:
Wycliffe House, Water Lane, Wilmslow, SK9 5AF (https://ico.org.uk/)