Privacy and Data Protection

This Privacy Notice will provide information regarding how we will use your personal information when you contact or visit Activate Learning College Group, attend one of our courses or work for us. 

This privacy notice will tell you: 

• Why we process your information 
• What purpose we are processing it for 
• The legal basis for processing it 
• How long we store it for 
• Whether there are other recipients of your personal information 
• Whether we intend to transfer it to another country, and 
• Whether we undertake automated decision-making or profiling. 

This privacy notice has been prepared in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. 

Activate Learning College is a further education and higher education provider and exempt charity. The College is the data controller for the personal information we process, unless otherwise stated. 

There are many ways you can contact us, including by phone, email and post. See contact details with section 3 and at the bottom of this page.

You can contact the College’s Data Protection Officer at DPO@activatelearning.ac.uk or via our postal address. 

Data Protection Officer 
Activate Learning  
City of Oxford College 
Oxpens Road, 
Oxford 
OX11SA 

Please ensure the envelope is addressed to ‘Data Protection Officer’

We have divided this privacy notice into sections to make it easier to read only the sections relevant to you, please be aware that multiple sections may apply depending on your relationship with the College. 

In each section we have set out the legal basis we rely on for processing your personal data, in addition, we have provided a table in the section titled ‘Legal Basis for Processing Personal Data’ to provide an easy to read summary and quick reference to the full details of the data processing. 

Personal information may be processed by the College for one or more of the following reasons: 

Our Services 

• Enquiry about our Services 
• Attendance at a College Event 
• Visitor to one of our Campuses (including CCTV) 
• Information Request 
• Representing an Organisation 
• Customer of our Restaurants, Gym or Hair and Beauty Services 
• Member of our gyms
• Visiting our website 
• Making a Complaint 

Studying with Us 

• Undertaking a Course at the College 
• Undertaking a Course/program through a University Partner 
• Data about Health, Additional Support or Reasonable Adjustments 
• Work Experience 
• Careers Advice 

Parents/Guardians of Students 

• Parents/Guardians 

People Who Work for Us 

• Job Applicants 
• Employees 
• Volunteers
• Governors 
• Agency workers

People who may live on Campus Premises

• Residents
• Partners 
• Immediate family members

In general, the personal information we process will have been provided directly from you. 

We may also receive your personal information indirectly, in the following scenarios: 

• From organisations working with us to deliver courses or training 
• From schools whose students are attending an event (such as Primary or Secondary College) 
• From a student who has given parental and/or emergency contact details (see section titled ‘Parents/Guardians’) 
• From UCAS where you have applied for a higher education course 
• From other public authorities, regulators, or law enforcement bodies 
• From an organisation with whom we have a contract with to provide a service to our employees 
• We may receive personal data from an organisation or individual who the College has appointed as an international education advisor for the purpose of recruitment of students in specific international territories 
• From a prospective employee of ours where they have given your contact details as an emergency contact or a referee 

If it is not disproportionate, we will contact you to let you know we are processing your personal information.

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. 

You are not required to pay any charge for exercising your rights. We have one month to respond to you. 

Please contact DPO@activatelearning.ac.uk if you wish to make a request. 

Your rights under data protection are: 

• Your Right of Access
  You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. 

• Your Right to Rectification
  You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. 

• Your Right to Erasure
  You have the right to ask us to erase your personal information in certain circumstances. 

• Your Right to Restriction of Processing
  You have the right to ask us to restrict the processing of your information in certain circumstances. 

• Your Right to Object to Processing
  You have the right to object to processing if we are processing your information as part of our public tasks, or in our legitimate interests. 

• Your Right to Data Portability
  Your right to data portability only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or if we are in talks about entering into a contract and the processing is automated. 

As a public authority and a provider of services to the public, we have a legal duty to comply with the Equality Act (2010). 

This means we need to make service adjustments for anyone with a disability who contacts us in any capacity, to eliminate any barriers to accessing our services. Our lawful basis for processing this information is article 6(1)(c) of the UK GDPR as we have a legal obligation to provide this. Our processing of special category data, such as health information you give us, will be based on article 9(2)(b), where the processing of data fulfils our legal obligations. This may include the aggregation of your data to monitor our outcomes and inform our policy making. This statistical analysis will not identify you or lead to a direct intervention or contact. 

We’ll create a record of your adjustment requirements. These will give your name, contact details and type of adjustment required, along with a brief description of why it is required. Relevant staff can access this to ensure they are communicating with you in the required way. 

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation). 

As a general guide: 

• Student (including parent/guardian) details: will be retained for 7 years after completion of studies or withdrawal from a course. In some cases, for example to comply with UK or European funding rules we are required to keep records for much longer. 
• Nursery children and parents: all data will generally be retained for 25 years 
• Employee data: all data will be retained for 7 years with some limited data retained until the employee’s 100th birthday (as required for pension administration and certain health surveillance requirements) 

The College has a Retention Procedure which specifically sets out detailed retention timescales. For more information on how long information will be retained please contact our Data Protection Officer. 

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. 

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. 

We have been certified under the Cyber Essentials Plus scheme. 

We use antivirus and malware filtering to protect our systems and block harmful emails. However, we cannot guarantee that a message or any attachment is free from viruses or malicious content, and we accept no liability for any resulting loss or damage. Recipients are advised to conduct their own security checks before opening attachments.

Where you have previously studied at the College, enquired about a course, or commenced an application process, then we may send you information about future courses and learning opportunities we provide. We will only do so where you provided your consent. You can withdraw this consent at any time. 

Additionally, where you have previously been a customer of one of our gyms, restaurants, or hair/beauty services, we may send you information about these services on the basis of our legitimate interests. 

In doing so, we will comply with the requirements of the “soft opt in” under the Privacy and Electronic Communications Regulations and offer you an opportunity to refuse marketing when your details are first collected and in subsequent messages (by way of an unsubscribe). 

We may contact parents/guardians to send postal marketing materials highlighting the range of relevant courses, qualifications and career options offered through the College. If you do not wish to receive such marketing materials, please contact us to opt out. 

We will not share your information with any third parties for the purposes of those third parties conducting direct marketing. 

Where students or staff take part in any international programmes e.g., residential or exchange programs their data will be sent outside the UK. Information including name, address, date of birth or age, emergency contacts, and other relevant information may be shared with any travel organisation e.g., travel agents, hotels, or airlines. The information will also be passed to the host school/College/education provider and a host family (where relevant). Such transfers usually are necessary to meet our contractual or legal obligations. Where the destination country is not in the European Economic Area or a country with an EU ‘adequacy’ finding, the College will ensure appropriate safeguards are in place to ensure the confidentiality and security of your personal information. 

Data may also be transferred outside of the European Economic Area by our suppliers, such as where data is to be hosted on IT servers (equipment). The College shall always provide an adequate level of protection for the data processed, in accordance with the requirements of data protection laws. 

Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.

The College is committed to processing personal data fairly and lawfully. If you have queries or concerns, please contact us at DPO@activatelearning.ac.uk and we’ll respond or alternatively complete a Feedback form on the College website 

If you remain dissatisfied after the conclusion of the internal review, you can make a complaint to the Information Commissioners Office (ICO). Please follow this link to the ICO website for more information https://ico.org.uk/make-a-complaint/. Or contact them at: 

Information Commissioner’s Office 
Wycliffe House                   
Water Lane 
Wilmslow 
Cheshire  
SK9 5AF 

Helpline number: 0303 123 1113 

For information about how we process a complainant’s information, please see this section of our privacy notice titled ‘Making a Complaint’ (Sec. 21) or further details may be found on the Customer Feedback page on our website. 

What we need and why we need it 

We need enough information from you to answer your enquiry. If you call our phone lines, we won’t make an audio recording. In certain circumstances we may make notes to provide you with a further service as required. We may ask for you to provide certain personal data so that we can verify your identity before discussing information further; for example, if a parent makes enquiries about a student, we will verify the details on our system to identify the parent and their right to receive any personal information.  

If you contact us via email or post, we’ll need a return address. 

If you contact us by email, we may retain a copy of your enquiry for audit and record keeping purposes. 

What we do with it 

For individuals making a general enquiry e.g., regarding opening hours or our facilities we will not record the personal details or the enquiry. 

Where an enquiry relates to a student, we may record the details of the enquiry including the date, time, and content on our student management system. 

Purpose and lawful basis for processing 

When you contact us to make an enquiry, we collect information, including your personal data, so that we can respond to it and fulfil our responsibilities. 

If you are enquiring about education, the lawful basis we rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to perform our public tasks as a further education provider. 

If you are enquiring about our public services such as a customer of our restaurants, gym or Hair and Beauty Services the lawful basis we rely on for processing your personal data is article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract. 

If you are enquiring about one of our other services (such as room or facilities hire) the lawful basis, we rely on to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests of the College or a third party. 

If the information you provide us in relation to your enquiry contains special category data, such as health, religious or ethnic origin information the lawful basis we rely on to process it is article 9(2)(g) of the UK GDPR, which also relates to our public task and the safeguarding of your fundamental rights. And Schedule 1 part 2(6) of the Data Protection Act 2018 which relates to statutory and government purposes. 

What we need and why we need it 

The College runs a range of events to showcase our services to prospective students and the wider community. When you register to attend or physically attend one of our events, we may collect your contact details (name, phone number and/or email address). Depending on your age and the type of event we may also ask for the school you attend, your year group and a name, email, or phone number for a parental/emergency contact. 

Your photograph or video may also be taken and used as part of promotion of the College events or activities taking place at the College. You will be informed if photographs or video is being taken so you can refrain from being included (if you wish not to be). 

What we do with it 

We will use your information to monitor the number of people attending the events and may also contact you to seek feedback on the event. 

We may send you information about future courses and learning opportunities we provide on the basis of our legitimate interests. We will offer you an opportunity to refuse marketing when your details are first collected and in subsequent messages (by way of an unsubscribe).   

Purpose and lawful basis for processing 

The lawful basis we rely on for processing your personal data is article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract. 

In relation to marketing, photographs of the event or surveys the lawful basis, we rely on to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests of the College. 

What we need and why we need it 

When you visit one of our campuses, we will collect your name, the organisation you represent (if applicable), your contact details, image/video and in some cases your vehicle registration. 

What we do with it 

The College uses CCTV on its premises and may collect your photograph for an ID card (where appropriate) for the purpose of identifying and protecting our students, staff and premises. This data may be shared with the Local Authorities, the Police or Safeguarding Agencies where the College is required or permitted to do so by law. 

Purpose and lawful basis for processing 

The lawful basis, we rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to perform our public tasks as an education provider. 

What we need and why we need it 

We need information from you to respond to you and to locate the information you are looking for. This enables us to comply with our legal obligations under the legislation we are subject to: 

• UK General Data Protection Regulations 
• Data Protection Act 2018 
• Freedom of Information Act 2000 
• The Data (Use and Access) Act 2025 
• Environmental Information Regulations 2004 
• Re-use of Public Sector Information Regulations 

What we do with it 

When we receive a request from you, we will record the details of your request on our internal registers. This normally includes your contact details and any other information you have given us. We’ll also store a copy of the information that falls within the scope of your request. 

If you are making a request about your personal data or are acting on behalf of someone making such a request, then we’ll ask for information to satisfy us of your identity. If it’s relevant, we’ll also ask for information to show you have authority to act on someone else’s behalf. 

We’ll use the information supplied to us to process your information request and check on the level of service we provide. 

Purpose and lawful basis for processing 

Our purpose for processing your personal data is so we can fulfil your information request to us. 

The lawful basis for this is article 6(1)(c) of the UK GDPR, which relates to processing necessary to comply with a legal obligation to which we are subject. 

If any of the information you provide us in relation to an information request contains special category data, such as health, religious or ethnic origin information the lawful basis we rely on to process it is article 9(2)(g) of the UK GDPR, which also relates to our public task and the safeguarding of your fundamental rights. And Schedule 1 part 2(6) of the Data Protection Act 2018 which relates to statutory and government purposes. 

What we need and why we need it 

If you are one of our clients or suppliers, or someone (not a student) who helps us to provide our business services, we may collect and process (where applicable) the following data about you: 

• Your full name, job title, contact telephone number and email or other contact details such as a website 
• Details about the business relationship between you and us 
• Details of any calls, correspondence or meetings between you and us, including any business transactions 
• Any references, opinions, or statements you may provide about one of our candidates, 
• Any marketing preferences you may have provided to us 
• We may require evidence of a DBS check, Right To Work or other checks as required by KCSIE

What do we do with your data 

We may collect and store (electronically or manually) your personal data. This may include any correspondence, telephone calls or meetings we have with you as a way of record keeping. 

We may use your personal details: 

• To record any business transactions between us including all proper administration, i.e., issuing of contracts to meet the obligations that arise from contracts entered between you and us. 
• To provide information to the regulatory authorities (such as HMRC) or statutory bodies. 
• To provide details (as necessary) to our legal or other professional advisers including our insurers. 
• For quality, training, and the purpose of best practice. 
• To send you information about our range of courses, and other services that we offer, which we feel may be of interest to you. If you have consented to receive promotional information from us, you may opt out at a later date. You have a right at any time to stop us from contacting you for marketing purposes. If you no longer wish to be contacted for marketing purposes, please click on the unsubscribe link at the bottom of our e-mails. We will not share your information for marketing purposes with third-party organisations. 
• To offer for you to take part in any of our competitions and surveys which we use for research or promotional purposes. 
• To record non-personally identifiable details of your website usage data and computer when you visit our website. 
• To supply you with articles, insight, news, jobs, relevant information and products that we feel may be of interest to you. 
• To provide interactive features of our service that you choose to take part. 
• To notify you of significant changes to our service. 

Purpose and lawful basis for processing 

The lawful basis we rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to perform our public tasks and in some cases article 6(1)(b) of the UK GDPR which allows us to process personal data when this is necessary to perform a contract. 

We will ask for details of any criminal convictions or offenses. For processing Criminal Convictions data, the College relies on Schedule 1 part 2 paragraphs 18 and 19 of the Data Protection Act 2018 which relating to safeguarding of children and of individuals at risk and safeguarding of economic well-being of certain individuals. 

What we need and why we need it 

If you book to attend one of our restaurants, we will record your name and contact details for the purpose of fulfilling your booking. 

If you become a member of the gym or use any of the College exercise facilities for recreational use, we will ask you to provide your personal details alongside completing a health questionnaire. 

If you use any of our hair or beauty facilities including acting as a model or receiving treatments, we will collect your personal information including any health related (special category) information that we may require to provide those services. 

What we do with it 

We will record your contact details and any services received. 

We will use your health information to inform the services we provide and assess any additional requirements. 

We may use your contact details to send you marketing information and other relevant information about our services. If you do not wish to receive such marketing materials, you will be given the opportunity to opt out. 

Purpose and lawful basis for processing 

The lawful basis we rely on for processing your personal data is article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract. 

Our processing of any special category data you choose to provide us, such as health information you give us, will be based on article 9(2)(b), where the processing of data fulfils our legal obligations around health and safety and equality law. 

In the event of an emergency, we rely on the lawful basis of Article 9(2)(c) where processing is necessary to protect vital interests. 

In relation to marketing, the lawful basis, we rely on to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests of the College. 

What we need and why we need it 

When you visit the College websites, we use a third-party service (Smoothwall) to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. For information about how Smoothwall uses your personal information, please request details. 

We also collect the request made by your browser to the server hosting the website which includes the IP address, the date and time of connection and the page you ask for. We use this information to ensure the security of our website, and we delete it after a maximum of 3 months. We may use and disclose it as necessary in the event of a security concern or incident. 

Like many websites, we also obtain certain types of information when your web browser accesses our website via the use of Cookies. 

Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. For further information visit the Cookies link on the Data Protection website. 

You can set your browser not to accept cookies; however, in a few cases some of our website features may not function as a result. 

What we do with it 

This information is used to track visitor use of the website and to compile statistical reports on website activity. 

Purpose and lawful basis for processing 

The lawful basis we rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to perform our public tasks and in some cases article 6(1)(b) of the UK GDPR which allows us to process personal data when this is necessary to perform a contract. 

We will ask for details of any criminal convictions or offenses. For processing Criminal Convictions data, the College relies on Schedule 1 part 2 paragraphs 18 and 19 of the Data Protection Act 2018 which relating to safeguarding of children and of individuals at risk and safeguarding of economic well-being of certain individuals. 

What we need and why we need it 

We will need your personal information to investigate your complaint, and we need to know the details of your complaint so we can investigate it. 

If you are acting on behalf of someone making a complaint, we’ll ask for information to satisfy us of your identity and if relevant, ask for information to show you have authority to act on someone else’s behalf. 

What we do with it 

We will use your personal information to investigate your complaint. 

Purpose and lawful basis for processing 

The lawful basis we rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to perform our public tasks as a provider of further education. 

If the information you provide us in relation to your complaint contains special category data, such as health, religious or ethnic origin information the lawful basis we rely on to process it is article 9(2)(g) of the UK GDPR, which also relates to our public task and the safeguarding of your fundamental rights. And Schedule 1 part 2(6) of the Data Protection Act 2018 which relates to statutory and government purposes. 

Undertaking a Course at the College 

What we need and why we need it 

We will collect and process your name, address, date of birth, gender, nationality, parent/guardian contact names, phone number, email address, student support needs, medical information, education history, qualifications, references, ethnic origin, employment history, attendance data, and other relevant information. 

We collect your photograph for the purpose of issuing your student ID card and we also use CCTV for security at our campuses. 

We will ask for details of any criminal convictions or offenses to identify any students who may need additional support and, in some cases, review whether a student may pose a risk to the safety or security of other students, staff or our premises. In some cases, we may reject a student’s application due to a disclosure, but this is rare, and we have a panel that would meet to review each case before this decision is made. If a student declares a criminal record or a DBS reveals a criminal record which is likely to cause the student to be unable to complete some mandatory element of the course, a place cannot be offered. If you don’t provide information about a criminal conviction or offense and this is later disclosed to us it may result in removal from a specific course or exclusion from the College. 

We will collect bank details if we need to administer any charges or refunds relating to courses or training programs. We may also process your bank details and information about Income Support, Universal Credit, Employment Support Allowance and Disability Living Allowance or Personal Independence payment where you apply for or receive financial support or a bursary. We will share your name with the College bank if there is a problem with the payment, and our auditors have access to our payment records. 

We may ask to take photographs and/or video during your course, or on specific occasions in order to promote individual success stories and the wider College. 

What we do with it 

We will use your details for the fulfilment of the College’s contractual relationship with its Students (or in the case of work-based learning with their employer) and for our public task to deliver educations programmes, this includes to determine and apply admissions criteria, process applications for admission, and monitor overall student numbers. 

We will use photographs and videos to promote the College and specific initiatives or events. 

Criminal convictions and offenses data is kept securely and separate from general student records and is only available to identified staff from the Student Services Team.  

Purpose and lawful basis for processing 

When you apply and enrol at the College, the lawful basis we rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to perform our public tasks as a further education provider and article 6(1)(b) of the UK GDPR, which allows us to process personal data when this is necessary to perform a contract. 

We will ask for information as required by the ESFA including race, ethnic origin, and sexual orientation. The College is legally required to provide this information and relies on the legal basis of article 9(2)(g) and Schedule 1 part 2, paragraph 6 of the Data Protection Act which relates to substantial public interest and statutory etc and government purposes. Data about you will be supplied to ESFA for the purposes set out in their Privacy Notice available at  https://www.gov.uk/government/publications/esfa-privacynotice. 

We may also rely on the legal basis Article 9(2)(b) for processing your special category data, where the processing of data fulfils our legal obligations around health and safety and equality law. 

We will ask for details of any criminal convictions or offenses. For processing Criminal Convictions data, the College relies on Schedule 1 part 2 paragraphs 18 and 19 of the Data Protection Act 2018, which relates to safeguarding of children and of individuals at risk and safeguarding of economic well-being of certain individuals. 

We ask for your consent under Article 6(1)(a) of the UK GDPR when using your photograph or video. We may ask for your consent at the start of your course or at the time depending on the purpose of the photographs/videos. 

Undertaking a Course/program through a University Partner 

What we need and why we need it 

We will collect and process your name, address, date of birth, gender, nationality, parent/guardian contact names, phone number, email address, student support needs, medical information, education history, qualifications, references, ethnic origin, employment history, attendance data, and other relevant information.  

We will ask for details of any criminal convictions or offenses to identify any students who may need additional support and, in some cases, review whether a student may pose a risk to the safety or security of other students, teachers or our premises. In some cases, we may reject a student’s application due to a disclosure, but this is rare, and we have a panel that would meet to review each case before this decision is made. If a student declares a criminal record or a DBS reveals a criminal record which is likely to cause the student to be unable to complete some mandatory element of the course, a place cannot be offered. If you don’t provide information about a criminal conviction or offense and this is later disclosed to us it may result in removal from a specific course or exclusion from the College. 

We use your personal information for administering applications and admission to, enrolment on, delivery of and participation on a Programme, including ensuring suitability for the Programme, administration of assessments and examinations, the issue of results and certificates, awards and (where applicable) the provision to an employer or other sponsor of information about attendance and performance. Provision of teaching, research, educational and other services, facilities and support and the protection of health, safety, and welfare whilst on Programme (which may involve disclosure of personal data to the Students’ Union, health service providers, staff and other third parties) 

We will collect bank details if we need to administer any charges or refunds relating to courses or training programs. We may also process your bank details and information about Income Support, Universal Credit, Employment Support Allowance and Disability Living Allowance or Personal Independence payment where you apply for or receive financial support or a bursary. We will share your name with the College bank if there is a problem with the payment, and our auditors have access to our payment records. 

We may ask to take photographs and/or video during your course, or on specific occasions in order to promote individual success stories and the wider College/University.   

What we do with it 

We will use your information for monitoring of attendance and performance and the provision of targeted learning support, administration of the financial aspects of a student’s Programme, sponsors or funders including collection of fees and any other monies due, equal opportunities monitoring and the provision of reasonable adjustments or other entitlements under equality law. 

We will also use your information for the purpose of graduation, career follow-up and alumni activities, statistical and research including internal and statutory reporting purposes and to enable effective communication, including providing information relating to university services and products, funding and/or sponsorship opportunities. 

We will use photographs and videos to promote the College and/or University and specific initiatives or events. 

Further information on how a student’s personal information will be processed by the University will be available in the University’s Privacy Notice. 

Purpose and lawful basis for processing 

The lawful basis we rely on to process your personal data is article 6(1)(b) of the UK GDPR which allows us to process personal data when this is necessary to perform a contract. 

We may also rely on the legal basis Article 9(2)(b) for processing your special category data, where the processing of data fulfils our legal obligations around health and safety and equality law. (See Data about Additional Support Needs (Health and/or Reasonable Adjustments). 

We will ask for details of any criminal convictions or offenses. For processing Criminal Convictions data, the College relies on Schedule 1 part 2 paragraphs 18 and 19 of the Data Protection Act 2018, which relates to safeguarding of children and of individuals at risk and safeguarding of economic well-being of certain individuals. 

We ask for your consent under Article 6(1)(a) of the UK GDPR when using your photograph or video. We may ask for your consent at the start of your course or at the time depending on the purpose of the photographs/videos. 

Data about Additional Support Needs (Health and/or Reasonable Adjustments) 

What we need and why we need it 

The College will ask for information about additional support needs, this can include learning difficulties and/or disabilities, health needs such as allergies, conditions such as asthma or diabetes and recording that a student is pregnant. We will use this information to inform support plans which will be shared with the appropriate staff. 

We may receive information from children’s social services relating to additional support needs. 

What we do with it 

The Student Services Team will use the information gathered to identify support needs and any required reasonable adjustments. Where appropriate support plans will be negotiated with the students and shared with identified staff to inform teaching and support strategies. The Student Services Team will receive Education, Health and Care Plans and other educational and/or medical documentation from parents, schools, health professionals and local authorities and will identify College staff who these will need to be shared with. 

To enable the Student Services Team to fully support Students they may actively contact parents and other relevant professionals to make a request for information relating to support needs. These will be shared with the College to help inform support plans. These plans will be shared with identified academic and support staff. 

We will also collect details about learning difficulties or disabilities where you apply for financial support or a bursary. 

We may also need to process health information for health and safety reasons including prior to taking students on a field trip/external visit. 

Purpose and lawful basis for processing 

We process special category data relating to additional support needs under the lawful basis of article 9(2)(g) of the UK GDPR, which also relates to our public task and Schedule 1 part 2(6) of the Data Protection Act 2018 which relates to statutory and government purposes. 

Where collecting health information for the purposes of field trips/visits we rely on the legal basis Article 9(2)(b), where the processing of data fulfils our legal obligations around health and safety and equality law. 

In the event of an emergency, we rely on the lawful basis of Article 9(2)(c) where processing is necessary to protect vital interests. 

Work Experience 

What we need and why we need it 

We will process your name, date of birth, parent/carer’s details/emergency contact details, course details and any health, well-being, and educational needs (special category data) so that we can facilitate a work experience placement. 

We will use your information to confirm your placement details with the employer (and in some cases your parent/guardian). 

What we do with it 

We will use the details to conduct risk assessments on placements and monitor attendance. 

Your details will be processed by Grofar (as our Data Processor) who support the delivery of our work experience programme and provide work experience IT software. 

Purpose and lawful basis for processing 

We rely on the lawful basis of article 6(1)(e) of the UK GDPR to process your personal data, which allows us to process personal data when this is necessary to perform our public tasks as a further education provider. 

Our legal basis for processing your special category data is on the legal basis Article 9(2)(b), where the processing of data fulfils our legal obligations around health and safety and equality law. 

Careers Advice 

What we need and why we need it 

The Careers Team collect your personal details (Name, address, contact details, date of birth, employment status and qualification levels) so that we can tailor the services and advice and guidance we offer to you. 

What we do with it 

We collect and use your information for the following purposes: 

To deal with the service that you requested and to allow us to be able to communicate and provide services appropriate to your needs and to monitor our performance in responding to your request 

To ensure we meet our legal obligations 

To conduct research and surveys and to allow for the statistical analysis of data so we can plan the provision of services 

Purpose and lawful basis for processing 

We rely on the lawful basis of article 6(1)(e) of the UK GDPR to process your personal data, which allows us to process personal data when this is necessary to perform our public tasks as a further education provider. 

Where we undertake surveys or analysis of our careers service, we rely on article 6(1)(f) of the UK GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests of the College. 

Recording Lessons 

What we need and why we need it 

Lessons may need to be recorded at the College or when delivered online. ​​​​​​When any recording is taking place, all people present will be made aware. 

What we do with it 

As a learning organisation, it is normal practice in modern learning for lectures and sessions to be recorded for students who haven’t attended and for revision purposes. Equally this also supports students who have disabilities or learning difficulties as a supportive learning method. 

​​​​​​If you do not wish to be recorded, please raise this with your tutor. In the case where a student needs to record lessons as a reasonable adjustment to support their learning (but another student objects) this would need to be carefully considered and the situation will be reviewed by a member of the Executive Team in consultation with the Data Protection Officer/Senior Information Risk Owner (SIRO). 

Purpose and lawful basis for processing 

Where we make recordings for educational purposes, we rely on article 6(1)(f) of the UK GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests of the College and in some cases for the legitimate interests of students (for example those with additional learning needs). 

Parents/Guardians personal information 

What we need and why we need it 

If your child is under the age of 18 years old and will be attending the College either as a student or as part of an event (such as Primary or Secondary College), we require them to provide a parent/guardian name, email, and phone number. 

What we do with it 

We collect this information to support the communication during the application process and to keep you informed about your child’s performance and attendance. 

For students under 18 at the time of application, students with additional needs or those attending 16-19 programmes the College will contact named parents/guardians to discuss academic progress, attendance, welfare concerns and conduct for the duration of their course. This may include by phone, email, online account or through face-to-face meetings. 

We will also use the contact details of our student’s parents/guardians to send postal marketing materials highlighting the range of courses and qualifications offered by the College and the career options that may be available to the student. If you do not wish to receive such marketing materials, please contact us to opt out via marketing@ccsw.ac.uk. 

Purpose and lawful basis for processing 

We rely on the lawful basis of article 6(1)(e) of the UK GDPR to process your personal data, which allows us to process personal data when this is necessary to perform our public tasks as a further education provider. 

Where we contact you about our services by post, we rely on article 6(1)(f) of the UK GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests of the College. 

What we need and why we need it  

Application stage  

We ask you for your personal details including name and contact details. We will also ask you about your previous experience, education, referees and answers to questions relevant to the role you have applied for.  

You will be asked to complete a criminal records declaration to declare any criminal convictions. Our HR Team will have access to this information, but the hiring manager will not. 

You will also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. This information will not be made available to any staff outside of our HR team, including hiring managers in a way which can identify you. Any information you do provide, will be used only to produce, and monitor equal opportunities statistics.  

Shortlisting  

Our hiring managers shortlist applications for interview. They will not be provided with any equal opportunities information you have provided.  

Delete current third sentence and replace with the following: If you are unsuccessful for the position you have applied for, your data will be held for a period of 5 years in case of any queries regarding the outcome or for feedback purposes and for our talent pool.  You can request deletion of your data at any time. 

Offer 

If we make an offer of employment, we will ask you for information so that we can carry out pre-employment checks. You must successfully complete pre-employment checks to progress to a final offer. We are required to confirm the identity of our staff, their right to work in the UK and assess suitability for the role.  

You will therefore be required to provide:  

• Proof of your identity 

• Proof of your right to work in the UK.  This may include asking you to use our Identity Documentation Validation Technology. 

• Proof of your qualifications  

• You will be asked to complete a criminal records declaration to declare any criminal convictions.  

• We will require you to complete an application for a Criminal Record check via the Disclosure and Barring Service  

• We will contact your referees, using the details you provide in your application, directly to obtain references.  

• We will also ask you to complete a questionnaire about your health, which may, if necessarily be reviewed by our Occupational Health Unit. This is to establish your fitness to work.  

Upon commencement of your employment, we will also ask you for the following:  

• Bank details – to process salary payments  

• Emergency contact details – so we know who to contact in case you have an emergency at work  

• Employment status for tax code purposes  

Our contract of employment requires all staff to declare if they have any potential conflicts of interest, other employment, or engagement. If you make a declaration, the information will be held on your personnel file.  

The College will arrange for you to have a photograph taken, which will be used for your ID Badge.  

What we do with it  

The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for, but it may affect your application if you don’t. We do not collect more information than we need to fulfil our stated purposes and will not keep it longer than necessary.  

Purpose and lawful basis for processing  

Our purpose for processing this information is to assess your suitability for a role you have applied for and to help us develop and improve our recruitment process.  

The lawful basis we rely on for processing your personal data is article 6(1)(b) of the GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract.  

If you provide us with any information about reasonable adjustments, you require under the Equality Act 2010 the lawful basis we rely on for processing this information is article 6(1)(c) to comply with our legal obligations under the Act.  

The lawful basis we rely on to process any information you provide as part of your application which is special category data, such as health, religious or ethnicity information is article 9(2)(b) of the GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights. And Schedule 1 part 1(1) of the Data Protection Act 2018 which again relates to processing for employment purposes.  

We process information about applicant criminal convictions and offences. The lawful basis we rely on to process this data are Article 6(1)(e) for the performance of our public task. In addition, we rely on the processing condition at Schedule 1 part 2 paragraphs 18 and 19 of the Data Protection Act 2018 which relating to safeguarding of children and of individuals at risk and safeguarding of economic well-being of certain individuals.  

Employees  

What we need and why we need it  

The following are examples of personal data which may be collected, stored, and used for your employment:  

• Personal contact details such as name, date of birth, title, addresses, telephone numbers, and personal email addresses  

• Marital status and dependants  

• Gender  

• Next of kin and nominated emergency contact information  

• National Insurance number, bank account details, payroll records and tax status information  

• Salary, annual leave, pension, and benefits information  

• Copy of driving licence and insurance  

• Employment records (including job titles, work history, working hours, training records and professional memberships)  

• Salary benchmarking and pay modelling  

• Personal development information (including appraisal, CPD and progression)  

• Disciplinary, grievance and performance management information  

• Information relating to maternity, paternity, shared parental or adoption leave  

• CCTV footage and other information obtained through electronic means such as swipe/identity card records  

• Information about your use of our IT systems  

• Photographs  

• Information about your race or ethnicity, religious beliefs  

• Trade union membership  

• Information about your health, including any medical condition, health and sickness records, and disability information  

• Information about criminal convictions and offences (through the DBS check process)  

We do not collect more information than we need to fulfil our stated purposes and will not keep it longer than necessary.  

The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for, but it may affect your application if you don’t.  

What we do with it  

We will use your information to fulfil your contract of employment with us, this includes:  

• Making decisions about your recruitment, continued engagement or termination  

• Conducting performance reviews, managing performance, and determining performance requirements, including making decisions in relation to completion of probation  

• Paying you and making the relevant tax and deductions  

• Liaising with your pension provider and administering your pension  

• Carrying out DBS checks  

• Equal opportunities monitoring  

• Monitoring your use of IT or other facilities  

• Publication of photograph and staff profile on the College website (if you are a member of the College Leadership, Senior Leadership or Executive Leadership Team), or in certain cases where you have a public facing role.  

• Monitoring your entry in to and movement on campus to ensure compliance with our policies/ procedures and relevant legislation – e.g., Health and Safety.  

Purpose and lawful basis for processing  

The lawful basis we rely on for processing your personal data is article 6(1)(b) of the GDPR, which relates to processing necessary to perform your contract of employment.  

The lawful basis we rely on for special category data, such as health, religious or ethnicity information is article 9(2)(b) of the GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights. And Schedule 1 part 1(1) of the Data Protection Act 2018 which again relates to processing for employment purposes.  

We process information criminal convictions and offences. The lawful basis we rely on to process this data are Article 6(1)(e) for the performance of our public task. In addition, we rely on the processing condition at Schedule 1 part 2 paragraph 6(2)(a).  

We may process special category data for the establishment, exercise, or defence of legal claims (for example employment tribunals) under Article 9(2)(f).  

We share personal data with various government bodies (see Data Sharing with Government Agencies) under Article 6(2)(e), Article 9(2)(g), Article 89 (statistical and research purposes) and also Schedule 1, Part 2, paragraph 8 (Equality) of the Data Protection Act 2018.  

The College publishes leadership staff profiles on its website under article 6(1)(f) of the UK GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests of the College.  

In relation to staff surveys, the lawful basis we rely on to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests of the College.  

Volunteers and Governors  

What we need and why we need it  

• We will collect and record your personal details including name and contact details. We will also ask you about your previous experience, education, referees and for information in support of your application.  

• We will also keep on file proof of your identity 

• You may be asked to complete a criminal records declaration to declare any convictions.  

• We may also ask about any disability, health issue or factor which may affect your ability to volunteer or work with us.   

What we do with it  

• We will store the personal detail alongside our employee records.  

• We will share the required personal details of our Governors with the Office for Students.  

• We will publish the photograph and profile of Governors on the College website.  

The information we ask for is used to assess your suitability for your role as a volunteer or governor. You don’t have to provide what we ask for, but it may affect your application if you don’t.  

We do not collect more information than we need to fulfil our stated purposes and will not keep it longer than necessary.  

Purpose and lawful basis for processing  

The lawful basis we rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to perform our public tasks and in some cases article 6(1)(b) of the UK GDPR which allows us to process personal data when this is necessary to perform a contract.  

We will ask for details of any criminal convictions or offenses. For processing Criminal Convictions data, the College relies on Schedule 1 part 2 paragraphs 18 and 19 of the Data Protection Act 2018 which relating to safeguarding of children and of individuals at risk and safeguarding of economic well-being of certain individuals.  

We may process special category data for the establishment, exercise, or defence of legal claims (for example employment tribunals) under Article 9(2)(f).  

The College publishes Governor profiles on its website under article 6(1)(f) of the UK GDPR, which allows us to process personal data when this is necessary for the purposes of the legitimate interests of the College. 

What we need and why we need it 

We collect the personal information of you, your child/children and other parents/carers and emergency contacts. This will include name, address, contact details and any medical issues including medication and allergies. We process this information for fulfilment of our contract with you for delivering childcare services and may process this data for the purpose of safeguarding. 

We will ask for your consent to take photographs of your child/children and for your consent to share these on our website, on social media and in any communications or promotional materials. 

The Data Controller for your information is Activate Learning College. 

What we do with it 

We routinely share child information with schools or settings that the child attends after leaving us, the local authority, Ofsted, and regional Safeguarding Board in the event of any safeguarding concerns. We do not share information about our children with anyone without consent unless the law and our policies allow us to do so. 

Purpose and lawful basis for processing 

The lawful basis we rely on for processing your personal data is article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract. 

Where we take photographs of your child the legal basis is your consent under article 6(1)(a) of the UK GDPR. 

We may also rely on the conditions at 6(1)(d) processing is necessary to protect the vital interests of the data subject or of another natural person and/or 6(1)(e) the processing is necessary for the performance of a task carried out in the public interest. 

We may also share information for safeguarding purposes, under article 9(2)(g) of the UK GDPR, which also relates to our public task and the safeguarding of your fundamental rights. And Schedule 1 part 2 paragraphs 18 and 19 of the Data Protection Act 2018 which relating to safeguarding of children and of individuals at risk and safeguarding of economic well-being of certain individuals. 

The College will share data with: 

• Parents/ Guardians of students 
• Local Authorities and other education providers 
• Local Authorities, the Police or Safeguarding Agencies 
• Government Agencies 
• An employer or Work Experience placement 
• Supported Internship Job Coaches 
• Awarding Bodies 
• Apprenticeships, Exam bodies and Scholarship organisation 
• Data Processors 
• Sub-contractors who deliver some of our services 
• Debt collection agencies 
• Transport providers 
• Disclosure Barring Service (DBS) 
• Courts or Legal representatives
• External Auditors
• Financial institutions and similar services (i.e. insurance), and HR service providers (including Occupational Health)

The following section sets on who the College shares information with and why. In some circumstances we are legally obliged to share information. In any scenario, we’ll satisfy ourselves that we have a lawful basis on which to share the information and document our decision making and satisfy ourselves we have a legal basis on which to share the information. 

Parents/ Guardians of Students 

When a student attends the College under the age of 18, we will contact named parents/guardians to discuss academic progress, attendance, welfare concerns and conduct for the duration of their course.  This may include by phone, email, online account or through face-to-face meetings. Students can request that we do not contact their parents/guardian; however, there are some cases where we may still need to do so or may be required to disclose certain information by law. For example, for students who use college transport services we may contact you or your parent/guardian in the event of some disruption to services or due to an emergency, bad weather or accident. 

Local Authorities and other Education Providers 

The College will share information with the local authority to support the provision of education and for obtaining and providing support for those with a special education need or disability. We will also share information about the status of a student’s application with schools as part of their responsibilities to ensure the provision of suitable education. 

The College will share student details with third parties commissioned by local authorities to provide careers and other relevant support. 

The College will share students’ details with education providers (secondary schools) where students are attending the College as an out of school setting. 

We may share personal details including name, attendance details, courses completed and results with other education providers on receipt of a reference request. 

Local Authorities, the Police or Safeguarding Agencies 

We may share information when we feel there’s a good reason that’s more important than protecting your privacy. This doesn’t often happen, but we may share your information: 

• if there are serious risks to the public, our staff or to other professionals. 
• to protect a child; or 
• to protect a vulnerable adult. 

The Police may contact us and ask us to provide personal data including CCTV footage where it would support the prevention or detection of crime. In general, we would provide this information where the Police have provided us a written request outlining the basis for the information sharing. 

The College will share details of students in full time education with local authorities to support the assessment or collection of Council tax under schedule 2-part 1 paragraph 2 (1) (c) of the Data Protection Act 2018. 

Government Agencies 

The College is legally required to share your information with the Education and Skills Funding Agency (ESFA) (an executive agency of the Department for Education (DfE)). Data about you will be supplied to ESFA for the purposes set out in their Privacy Notice available at https://www.gov.uk/government/publications/esfa-privacynotice. 

Every year the College will send some of the information it holds about you (students and staff) to the Higher Education Statistics Agency Limited (HESA). HESA is the official source of data about UK universities, higher education colleges, alternative HE providers, and recognised higher education courses taught at further education institutions in the UK. HESA is a registered charity and operates on a not-for-profit basis. Data about you will be supplied to HESA for the purposes set out in their Privacy Notice available at https://www.hesa.ac.uk/about/website/privacy 

The College will share learner data with the Student Loans Company to deliver requirements in respect of the administration of student finance. 

The College will share learner data to deliver requirements in respect of the administration of the Education Maintenance Allowance (EMA) and Government Learning Grant (GLG). 

The College will share learner data with Higher Horizons who are funded by Office for Students. Higher Horizons will use this data to evaluate the effectiveness of Higher Horizons service provision and also to track a learner’s education journey. Higher Horizon’s privacy notice is available at https://higherhorizons.co.uk/privacy-policy/ 

The College may share personal data as part of Channel which is part of the Prevent strategy. The process is a multi-agency approach to identify and support individuals at risk of being drawn into terrorism. More details on how data is shared is available at https://www.gov.uk/government/publications/channel-data-privacy-notice/channel-data-privacy-information-notice 

An Employer or Work Experience Placement 

Where you are undertaking an Apprenticeship course whilst working for an employer we will share your name, address, progress, attendance, learning plans, progress in learning, assessment plans and qualification results with your employer. Your employer will also share relevant information with us. In this the College and the employer are each acting as Data Controllers, and you should review the employers Privacy Notice and Data Protection policies (where appropriate). 

Where you are undertaking work experience your name, date of birth, parent’s details, emergency contact details, course details and any health, well-being and educational needs may be shared with the employer. 

We may also share personal details including name, attendance details, courses completed and results with employers on receipt of a reference request. 

Supported Internship Job Coaches 

The College may collect and processes personal details so that we can deliver the Supported Internship programme to you and facilitate your time as a student at the College. 

We will share this personal data with other staff at the College to administer this programme and meet your needs. We will also share your details including personal contact details and health and support needs (as detailed in your Education Healthcare Plan) with your Job Coach and the organisation who they are employed by. 

We will share your name, address, progress, attendance, learning plans, progress in learning, assessment plans and qualification results with the employer who you are completing your internship with. Your employer will also share relevant information with us. The College and the employer are each acting as Data Controllers, and you should review the employers Privacy Notice and Data Protection policies (where appropriate). We will also contact named parents during your course to discuss academic progress, attendance, welfare concerns and conduct. 

Awarding Bodies 

The College is an approved centre for a range of awarding bodies. Depending on the student’s course personal data will be shared with these awarding bodies. Awarding bodies may be required to provide a candidate’s personal data to educational agencies such as DfE, WG, DE, The Skills Funding Agency, regulators, HESA, UCAS, Local Authorities, EFA and Learning Records Service (LRS). Additionally, candidates’ personal data may be provided to a central record of qualifications approved by the awarding bodies for statistical and policy development purposes. Awarding bodies maintain a comprehensive archive record of candidates’ examination results. The purpose is to provide an audit trail of the results certificated and to maintain an accurate record of an individual’s achievements. It is the responsibility of centres to ensure that candidates are made aware of this. For full details of each awarding bodies privacy notice can be found on their websites. 

Apprenticeships, Exam bodies and Scholarship organisation 

The College will share data with apprenticeship organisations including End Point Assessment providers, sponsors, and providers of scholarships for the purpose of fulfilment of your learning contract. These organisations include: 

• ECITB https://www.ecitb.org.uk/privacy-statement/ 
• IMI https://tide.theimi.org.uk/about-imi/campaigns/imi-privacy-policy 
• AAT https://www.aat.org.uk/policies/privacy 
• Highfield https://highfield.co.uk/privacy-and-cookies 
• CMI https://www.managers.org.uk/about-cmi/governance/policies/data-privacy/ 

Full details of our exam and awarding bodies are available on request. 

For full details of each awarding bodies privacy notice can be found on their websites. 

Data Processors 

We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct. 

Full details of all our data processors are available from our Data Protection Officer on request at DPO@activatelearning.ac.uk 

Sub-contractors who Deliver some of our Services 

The College uses sub-contractors for the delivery of some of its courses and programs. As such these third parties have access to Student personal details including name, address, date of birth, gender, nationality, parent/guardian contact names, phone number, email address, student support needs, medical information, education history, qualifications, references, ethnic origin, employment history, attendance data, and other relevant information. 

Appropriate contracts will be implemented with these sub-contractors to ensure they process personal data in line with the law. 

Debt Collection Agencies 

We may share your information in the event of the non-payment of an invoice (for example for a course or hire of our facilities). If the debt remains outstanding after the specified timeframe for payment, no payment plan is in place or an agreed payment plan is not being adhered to, we may initiate formal proceedings to recover the full amount of the unpaid invoice. As a result, the College will share personal data with the debt recovery specialists it instructs in order for them to take recovery action. 

Transport Providers 

We will share a passenger list with the bus companies so that the drivers can check Student ID and bus passes on embarkation. A photo of students may sometimes be shared with the bus company/driver so that they are aware of students with any additional needs or if a student is not permitted to use transport services e.g., due to issues with behaviour. 

Employee Benefits  

The College uses several organisations to provide benefits to its employees including SpecSavers, Westfield Health, local travel schemes, Pluxee Cycle to Work scheme, Employee Assistance Programme (EAP), and Occupational Health. The following organisations provide benefits to College employees however the College does not share any personal data with them: Adora, Irwin Mitchell, Life Cover People, Trinity Bridge. More information about how your personal information is used by the above-named organisations is available from HR. 

* – Relevant article (Art.) of the UK General Data Protection Regulations (UK GDPR) or schedule (sch.), part (pt.) or paragraph of the Data Protection Act 2018 (DPA).