Notice about how we use your personal information

At Bury College, we take data protection seriously. We are the data controller of personal information held and processed by our students, staff and other individuals.

Our head office contact details are; Bury College, Head Office, Woodbury Centre, Market Street, Bury, Manchester, BL9 0BG

Our Data Protection Officer is Mike Doherty. If you have any questions about our Data Protection Policy or the ways in which we use your personal information, please contact him at dpo@burycollege.ac.uk

This privacy notice has been prepared in accordance with the General Data Protection Regulation (EU), (GDPR) and the Data Protection Act 2018. You can view the College’s Data Protection Policy here.

Changes to our privacy policy

We keep our privacy policy under regular review. Any material changes to our Privacy Policy will be updated on this site as the earliest opportunity. However, if you have any questions in relation to anything on this site please contact our Data Protection Officer at dpo@burycollege.ac.uk

Overview of Data Protection

The Data Protection Act 1998 governs how personal data should be processed by organisations and applies to anything we do with personal data, such as collecting, accessing, sharing, analysing, storing and archiving it etc. The College is a Data Controller which means the College is responsible for compliance with the Act.

There are eight key principles in the Data Protection Act:

  • Personal data shall be processed fairly and lawfully
  • It shall be obtained for specified purposes
  • shall be adequate, relevant and not excessive
  • It shall be accurate and up-to-date
  • It shall not be kept longer than necessary
  • It shall be processed in accordance with the rights of the data subject
  • Measures shall be taken to protect processing, and to prevent loss and damage
  • It shall not be transferred outside the EEA (European Economic Area) unless there is an adequate level of protection in that country

The information that you give us

As part of your application or admission to the College we will collect personal details from you. This may include: name, address, date of birth, siblings, email address, first and second language, work assessment data, dates of attendance, exam/test results, previous or current education establishment, religion, ethnicity, health information, doctor’s details, parental/carer information, sex-related information, genetic data and special needs details.

The uses made of your personal information

We will use your information to manage and administer your education. This will include putting together class lists, for sending event invitations, for communicating with you, for dealing with admissions, for putting together reports and registers, to check entrance exam results, to allocate you to the correct classes for assessments, to make arrangements for exams or visits, to consider whether to offer places to students, to consider whether special provision or assistance is required for exams and visits and to be able to tell other colleges your attendance dates if you leave.

The legal basis on which we collect and use your personal information.

Generally, the information is processed as part of our public task of providing education to you or activities relating to that education.

Where that information is special category personal information (e.g. medical information), we will process it because there is a substantial public interest to do so.

There may be some instances where we rely on consent, for example your marketing preferences and where this is the case we will request your explicit consent, and you will be able to withdraw this if you choose.

For more about lawful bases you can visit the Information Commissioner’s website https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/

How long we keep your personal information.

We keep your information according to the timeframes set out in the College’s Retention and Disposal Policy. This policy is current under review so please check back soon to read the updated policy. We will destroy all sensitive information within the timescales set out within this policy unless there is a legitimate purpose for us retaining it. We will keep some basic details for statistical, research and historical purposes in the public interest and to ensure we have an accurate record of your study and qualifications.

How we share your personal information.

We will also share your data with the Education and Skills Funding Agency which is an executive agency of the Department of Education. For information on how they manage your data please click the link below.

https://www.gov.uk/government/publications/esfa-privacy-notice/education-and-skills-funding-agency-privacy-notice-may-2018

For some students we might also communicate with your current school or educational establishment and/or your parents/carers regarding your progress or welfare.  If you have applied to the College, we might share the progress of your application with your current school or educational establishment. You have the right to object to this communication. For apprentices we might share information with your employer and for students undertaking work placements we will share information with the organisation where you will be working.

We may also share your personal information with third parties who provide services to the College, for example, The Prince’s Trust, local education agencies and careers guidance services, but only if it is relevant and necessary for your education and/or support at the College. Where we share information with third-parties we will ensure there are adequate contractual arrangements are in place and that your data is secure.

How we transfer your personal information outside Europe.

There are very few instances where we transfer your information outside of Europe. Examples where this might happen include;

 

  • Information about international students might be shared with the British Council and any body within the student’s country of origin which is involved in their education
  • Once you become a student, you might make use of the Virtual Learning Environment (VLE). Bury College use the Canvas VLE and the servers for this sit outside the EEA. However, Canvas is a member of the Privacy Shield Framework, which has been approved for Data Transfers by the EU.
  • There might also be examples where the college makes use of Eventbrite, SurveyMonkey and MailChimp, which can all potentially transfer your data to storage areas outside of the EU. All three providers are also members of the Privacy Shield Framework.

 

You can find out more about Privacy Shield here https://www.privacyshield.gov/welcome

For staff and applicants.

We will hold and process any personal data, including sensitive (special category) personal data, relating to you in accordance with our legal obligations, in the manner set out in this Privacy Notice for Staff and in accordance with our Data Protection Policy.  All staff should familiarise themselves with our Data Protection Policy (and all other subsidiary policies to it) and comply with them at all times. Neither this Privacy Notice for Staff nor those policies form a part of your contract of employment.

 

Notice about how we use your personal information

We are the data controller of personal information about you.  We are Bury College and our address is Woodbury Centre, Market Street, Bury Manchester, BL90BG.

Our Data Protection Officer is Mike Doherty.  If you have any questions about this policy or the ways in which we use your personal information, please contact our Data Protection Officer at dpo@burycollege.ac.uk

This privacy notice has been prepared in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act 2018.

 

The Information you give us

We will collect personal information from you when you apply for a job with us. The College uses a third-party company to manage recruitment and we will ensure there is a robust contract in place with this third-party to ensure your data is secure. The details we will collect will, or may include; name; address; phone number; email; date of birth; DofE number; NI number; current employment details including job title, start and end dates, current salary, notice period, reason for leaving; past employment details; education details; interests; whether you are related to any personnel of the College or Governing Body; references/referees; special arrangement details for interview; criminal record details; Disclosure Barring Service check, including European Economic Area (EEA) check; Prohibition from Management check; Prohibition from Teaching check; Check of Barred List/List 99; Pre‑employment Health Questionnaire/Medical Report.

We will collect and process personal information from you when you are a new starter and become an employee of the College.  This will, or may, include: name; marital status; previous surname(s); address; date of birth; occupation; type of employment; phone number; email addresses; NI number; start date; next of kin and contact details; bank details; pension details; statement about employment; student loan details; offer letters; employment terms and conditions; changes to your terms and conditions; certifications/qualifications, disciplinary, grievance, capability, job descriptions, sickness absences, maternity/paternity/adoption information; accidents and injuries at work; working time information; annual leave records; recruitment information; photo; payroll details; gender; flexible working; exit interviews; return to work notifications; parental leave request forms; appraisal/performance; bank account number; sort code; disqualification information; sickness absences; medical information; thumb print].

The uses made of your personal information

We will use your personal information set out above as follows:

  • for the recruitment process and for carrying out pre‑employment checks;
  • for safeguarding students;
  • for checking your identity and right to work in UK;
  • for checking your qualifications;
  • to keep an audit trail of the checks we have made and our relationship with you in case of employment claims;
  • to set up payroll and pension and to reimburse expenses;
  • for dealing with HMRC;
  • for communicating with you, including sending you information about the College and things which might be of interest to you;
  • to help us improve our services and to grow as a fair and responsive employer
  • for carrying out our role as your employer or potential employer.

 

We treat your personal information with confidentiality and we do not use it for any other purposes.

The legal basis on which we collect and use your personal information

We collect and use your personal information on the basis that it is necessary for performing our employment contract with you, or it is necessary to take steps before entering into the contract with you.  We also collect and use your personal information on the basis that we need to do so in order to comply with our legal obligations and to perform our duties as a public body.

Where we collect your special category personal information, we do this on the basis that it is necessary for the purposes of carrying out our obligations in the field of employment law.  Special categories of personal data are personal data that reveal a person’s racial or ethnic origin, political opinions, religions or philosophical beliefs, trade union membership, genetic data (i.e. information about their inherited or acquired genetic characteristics, information about their physical, physiological or behavioural characteristics (such as facial images and fingerprints), physical or mental health, sexual life or sexual orientation and criminal records).

How long we keep your personal information

We will not keep your personal information for longer than we need it for the purposes we have explained above. The retention periods for differing record types are outlined in our Retention and Disposal Policy.

When you are an employee, we will keep your personal information for as long as you work with us and then after you leave, we will keep your personal information for the time periods set out in our Retention and Disposal Policy.

How we share your personal information

We may share the personal information with third-party organisations to fulfil the obligations we have as an employer and to enable us to service the purposes outlined above. We will never share your information for any other purpose without your consent. Organisations we share your data with include

  • The College uses a third-party organisation to manage the application process. There is a two-way sharing of data at the application, appointment and post-appointment stage.
  • The College uses an outsourced Payroll Provider, SD Systems, to manage the payroll services including monthly salary, national insurance contributions, pensions and expenses.
  • The College may share your details with an external provider to survey your views on the College, your role, your well-being and your working environment. This is help us continually improve and grow as an employer. Any responses to a survey would remain anonymous, however.

 

How we transfer your personal information outside of Europe

We do not store or transfer your personal data outside of Europe.

Your rights over your personal information

You have a number of rights over your personal information, which are:

  • the right to ask us what personal information about you we are holding and to have access to a copy of your personal information;
  • the right to ask us to correct any errors in your personal information;
  • the right, in certain circumstances, such as where our use of your personal information is based on your consent and we have no other legal basis to use your personal information, to ask us to delete your personal information;
  • the right, in certain circumstances such as where we no longer need your personal information, to request that we restrict the use that we are making of your personal information;
  • the right, in certain circumstances, to ask us to review and explain our legitimate interests to you; and
  • the right, where our use of your personal information is carried out for the purposes of an agreement with us and is carried out by automated means, to ask us to provide you with a copy of your personal information in a structured, commonly‑used, machine‑readable format.

 

Changes to our privacy policy

We keep our privacy policy under regular review.  Any changes we make to our privacy policy will be updated here at the earliest opportunity.

This information will be updated shortly. If you require any information ahead of this please contact our data protection officer by emailing dpo@burycollege.ac.uk

What are my individual rights?

Individuals have a number of rights in relation to their personal data. These rights might change depending on the lawful basis for processing your data, but they might include

 

  • a right to find out details about data processing, if the College holds your information and what it is being used for. You all this right in all circumstances;
  • a right of access, to a copy of the information comprising your personal data referred to as a Subject Access Request (SAR);
  • a right to object to processing that is likely to cause or is causing you damage or distress;
  • a right to prevent processing for direct marketing;
  • a right to object to decisions being taken by automated means;
  • a right in certain circumstances to have personal data rectified, blocked, erased or destroyed;

 

If you would like to raise a query or, request some action regarding one of your individual rights, please contact our data protection officer on dpo@burycollege.ac.uk. We will respond to your query within one month, and more quickly if possible.

The ICO’s website provides further information on scope of these rights and how to exercise them

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

 

What can you expect from Bury College

We will:

  • manage your request promptly. There is a requirement on Bury College to respond to requests within 28 days and will ensure we meet this and where possible respond far sooner
  • ensure our registration with the Information Commissioners Office is current and kept up to date;
  • ensure any third parties who have access to or share our data follow the College’s policies and procedures. Either we have either a Data Sharing Agreement or a Data Processing Agreement, which will allow third parties to act lawfully on the behalf of the College
  • ensure all College employees involved in the collection and processing of personal data are aware of their responsibilities to provide adequate protection and safeguards against unlawful disclosure
  • be helpful, honest, professional, courteous and consistent.
  • provide the relevant information that you need.
  • take ownership of your query.
  • be realistic in what we say we can or can’t do.
  • treat your personal data as confidential; and keep it secure.
  • listen to your comments and feedback on how we can make a better service.

 

Students: If you wish to exercise one of your rights in relation to your personal data, please contact: dpo@burycollege.ac.uk

Please note if you are seeking access to our personal data (a Subject Access Request), we may require you to confirm your identity. Your request can be delivered to the college at Woodbury Centre, Bury College, Market Street, BL9 0BG or by emailing our data protection officer at dpo@burycollege.ac.uk.

Documents

Contact Us

We are here to help you.