Introduction 

As a Data Controller, South West College (“the College”) values the relationships with all our students, staff and stakeholders and recognises and respects the importance of protecting the privacy of your personal data. The College will process all personal data in compliance with GDPR and the Data Protection Act 2018 for the purpose of providing you with a service you have requested and to meet our statutory obligations. 

We will never ask for information that is unnecessary to deliver this service. SWC is the Data Controller registered with the Information Commissioner Office (ICO) and is responsible under the Data Protection Act 2018 for the personal data that you submit to us. 

The Data Protection Officer for the College is Nicola Nugent. 

The College’s registration reference number with ICO is Z1124639. 

 

Lawful Basis

As an FE College our main lawful basis for processing your personal data are as follows: 

  • Article 6.1(a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes e.g. consent to contact next of kin, direct marketing, opting into a scheme.
  • Article 6.1(b) – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, e.g. staff employment contracts, contracts for a service by a third party, student relationship with the College.
  • Article 6.1(c) – processing is necessary for compliance with a legal obligation to which the controller is subject, e.g. The Health and Safety at Work (Northern Ireland) Order 1978, The Safeguarding Vulnerable Groups (Northern Ireland) Order 2007, Disability Discrimination Act 1995, SENDO, Employment law.
  • Article 6.1(d) – processing is necessary in order to protect the vital interests of the data subject or of another natural person e.g. we may need to disclose information to medical provider.
  • Article 6.1(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. On behalf of the Department for the Economy (DfE), our role is provide you with quality education. e.g. The Further Education (Northern Ireland) Order 1997.
  • Article 6.1 (f) – processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child e.g. Nursery provider, photographs. 

On occasions we may be required to process your personal data for other reasons however we will only do so where a Lawful Basis applies. 

 

Special Category Data 

We are also required to collect, process and maintain special category data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. 

Where the College is required to process Special Category data, we will only do so where a lawful basis exists in Article 9 of GDPR or where appropriate, Schedule 1 and 2 of the Data Protection Act (2018). 

Further information is available in the College Appropriate Policy Document. 

 

Children’s Data 

Where we process personal data relating to children (for example, students under 18), we take additional care to protect their rights and freedoms. Processing of children’s data is carried out in accordance with the UK GDPR, and, where required, with parental or guardian consent. Further information is available in our Child Protection and Safeguarding Policies.

 

Information on Criminal Convictions

Where appropriate, the College is required collect information about criminal convictions as part of student admission and staff recruitment process or we may be notified of such information directly by you in the course of you working for us. As per the Safeguarding Vulnerable Groups (NI) Order 2007, Rehabilitation of Offenders Act 1974, Protection of Freedom Act 2012, there is a legitimacy in our field of work to ask for this. We will use the information to make decisions about your engagement or continued employment/ enrolment. 

The College lawful basis for processing this information is Schedule 1(18) of the Data Protection Act (2018) ‘Safeguarding of children and of individuals at risk’. 

Further information is available in the College Appropriate Policy Document. 

 

Categories of Personal Data 

Personal data and special category data captured may include:

  • Name
  • Date of birth
  • Contact details
  • Next of Kin
  • Religious Belief
  • Dependents
  • Ethnicity
  • Gender
  • Sexual Orientation
  • Marital Status
  • Employment Status
  • Political Opinion
  • Residency
  • Educational Background i.e. grades
  • Disabilities, learning difficulties, long term medical conditions
  • Criminal Convictions
  • Photographic image for student/staff ID cards
  • Barriers to learning
  • Career aspirations 

Information may be obtained directly from the individual, or in some cases from a third party organisation involved in the services provided by the College that has obtained the information in the first instance. 

All employees, students and visitors should have a reasonable expectation of being captured on CCTV on a daily basis. 

While the use of CCTV is primarily for the following purposes, the College will regulate its use within the provisions of GDPR so as not to become intrusive: 

  • Deterring, prevention and detection of a crime including misuse/abuse of College equipment.
  • Identification, apprehension and prosecution of offenders.
  • Security of campus buildings and ground.
  • Safeguarding/Health and Safety. 

In exceptional circumstances the images may be viewed for investigatory purposes.

The College will only collect and process the necessary information required for these purposes, and without it the College may not be able to fulfil its obligations. Information is passed between various sections of the College for operational reasons and where a lawful basis exist to process as is necessary and proportionate for intended purposes only. 

 

Purpose of Processing 

The College holds the personal data and special category data of its students and staff in order to implement and manage all services and processes relating to students, including; student recruitment, admission, registration, teaching and learning (including attendance, progress and achievement), examination, graduation, collection and payment of monies and other services such as student support and careers; and for staff, including; recruitment, staff development, payroll, contractual requirements, quality and improvement and staff related policies. 

 

How do we Collect Personal Data? 

We collect personal information about students and employees through the initial application/enrolment stages from you, internal departmental processes, manual forms, telephone calls and on-line systems, third parties e.g. School Links. 

 

Who will have access to my information, or who will you share it with? 

We will share personal information with third parties where required to do so by law, where it is necessary to administer the working relationship with you or where there is a third party legitimate interest in doing so. 

Information may be passed between various sections of the College for operational reasons and may also be disclosed to external agencies to which we have obligations, for example Government Agencies and associated Statutory Bodies (e.g. Department for the Economy, HMRC), FE Shared Services – Data Collection, Higher Education Statistics Agency, Funding Bodies, Government Survey & Research Organisations, UCAS, Student Loans Company, Education Authority, Learner Records Service, Crime Prevention Agencies, Employers who pay fees and/or allow you time off work to attend your course, Placement Providers, Examination Awarding Bodies, Social Welfare Organisations, Trade Unions, Careers Service, UKBA, Debt Recovery Agencies and potentially other such organisations for defined purposes. We may also disclose information to examining bodies, legal representatives.

We require third party service providers to respect the security of your data and to treat it in accordance with the law. 

 

International Data Transfer 

Transfer of personal data to the European Union, to third countries or international organisations is restricted under UK GDPR regulations. Overseas sharing will be processed in accordance with Chapter V of UK GDPR. 

 

Retention Period 

We will only retain personal data for as long as necessary to fulfil the purpose we collected it for, for the purpose of satisfying any legal, accounting or reporting requirements. The College will retain records in line with the FE Sector Retention and Disposal Schedule.

 

Exercising your Rights 

You have the right to:

  • To be informed about what we do with your information at point of data collection;
  • Access your personal data that we process;
  • To rectify inaccuracies in personal data that we hold about you;
  • In certain circumstances to be forgotten, that is your details to be removed from systems that we use to process your personal data;
  • In certain circumstances to restrict the processing of your personal data;
  • To obtain a copy of your personal data in a commonly used electronic form;
  • To object to certain processing of your personal data by us;
  • To request that we stop sending you direct marketing communications;
  • In certain circumstances to withdraw consent – (only where processing is based on consent). 

For additional information on exercising your rights, please contact our Data Protection Officer (details below) or see our Data Protection Policy. 

If you require this Privacy Notice in an alternative format or easy-read version, please contact the Data Protection Officer. We are committed to ensuring all individuals can access and understand this information. 

 

The Right to Lodge a Complaint 

If you are not happy with how your information is being processed by the College, please contact the DPO: 

Data Protection Officer South West College  

2 Mountjoy Road 

Omagh 

Co Tyrone      

BT79 7AH 

Email: gdpr@swc.ac.uk  

 

If you are dissatisfied with the College response, you have a right to complain to the Information Commissioners Office (ICO). 

The ICO contact details are: 

Information Commissioner's Office 

Wycliffe House 

Water Lane 

Cheshire 

SK9 5AF 

Tel: 0303 123 1113 or 01625 545 745 

 

Your duty to inform us of changes 

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us. 

 

Use of Artificial Intelligence (AI) and Automated Decision Making 

South West College may use Artificial Intelligence (AI) technologies to support application processing, enrolment management, and to enhance student services. Where AI tools process personal data, this will be done in compliance with UK GDPR and the Data Protection Act 2018. All outputs generated by AI are subject to human review before any decisions affecting individuals are made. 

The College will not use automated decision making, including AI, to make decisions that will have significant impacts on data subjects without appropriate safeguards. 

 

Failure to provide personal information 

If you fail to provide certain information when requested, we will not be able to fulfil our legal obligations or deliver the service you have requested. 

 

Changes to this Privacy Notice 

This Privacy Notice is reviewed annually, or sooner if there are significant changes in legislation, College Policy, or processing activities. 

We reserve the right to update this privacy notice at any time and the current version is available at http://www.swc.ac.uk/discover/public-information/data-protection.