Storing student information
We store student information securely and in line with our Data Protection Policy and associated procedures. A copy of our Data Protection Policy can be obtained from the Data Protection Officer, whose contact details are listed below. The majority of evidence we collect is required by our funders who stipulate the amount of time we need to hold your records. We hold student information for the following timeframes:
- Personal information, characteristics and attendance information – 7 years from the academic year in which you enrolled
- Educational records information – up to 3 years from the academic year in which you enrolled depending on different Awarding Organisation’s requirements
- Medical, special educational needs and prior educational records information - 7 years from the academic year in which you enrolled
- Photographs and other media – up to 3 years from the end of the academic year in which it was taken/recorded
- Bank Details (allowing us to collect payments and pay you any awards you are eligible to receive) – 6 months after your enrolment is completed with us
The exception to this is where you undertake programmes funded through specific bodies that require a different retention period. This difference currently applies to adult (19+) funded through European Social Fund or National Lottery contracts, where we are required to retain the above documentation until 1/12/2030.
Who we share student information with
We routinely share student information with:
- The college’s local authority and the local authority in which you reside now and, if different, the local authority you lived in whilst at school;
- The Department of Education (DfE);
- The Education and Skills Funding Agency (ESFA);
- The Office for Students (OfS) for Higher Education provision;
- Your parent/carer/emergency contact, if you are aged under 18 at enrolment, for your safety, wellbeing and to support your learning;
- Your employer if they are sponsoring your course/you are an Apprentice;
- Any employer that you are undertaking work experience with;
- Your previous school for their destination monitoring;
- Awarding organisations to allow us to claim certification;
- External software suppliers so that they can store your information externally and securely in order to display it in their tools, or where they need a copy of our data to resolve software issues;
- Childcare and travel providers if you are awarded a childcare or travel bursary;
- Our delivery partners if your course is being delivered by one of our partners;
- In the event that you fail to pay your course fees and we are unable to work with you to achieve a solution, carefully selected debt recovery partners;
- UK Visas and Immigration Department if you are studying on a Tier 4 visa.
If you attend one of our campuses, we may share your information with Department of Health and Social Care for the purpose of supporting NHS Test and Trace activity; we are legally required to share information in this way. You can read the Department of Health and Social Care privacy notice here.
We do not share information about our students with anyone unless it is necessary and in line with the lawful basis for processing listed above, or with the consent of the student concerned. Where data is routinely shared, a data processing agreement will be established to ensure the protection of students’ information.
Requesting access to your personal data
Under data protection legislation, students have the right to:
- Request access to the information we hold about them (Subject Access Request);
- Be informed of the identity of the controller, the reasons for processing their personal data and other relevant information necessary to ensure the fair and transparent processing of personal data;
- Object to processing of personal data that is likely to cause, or is causing, damage or distress;
- Prevent processing for the purpose of direct marketing;
- Object to decisions being taken by automated means;
- In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and/or
- Claim compensation for damages caused by a breach of the data protection regulations.
In order to make a Subject Access Request or to discuss anything in this privacy notice, please contact our Data Protection Officer:
Jamie Wade, Clerk to the Corporation
Phone: 01865 551226
Address: Activate Learning
City of Oxford College
If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/