Privacy Policy

Privacy Notice

 Introduction

The Henley College is committed to protecting your privacy.

This privacy notice explains: how the College collects, uses and shares your personal data; your rights in relation to the personal data we hold; and how we protect your privacy.

The Henley College is the controller of your personal data and complies with the requirements of the General Data Protection Regulation (GDPR) and related UK data protection legislation.

Our Data Protection Officer is Eva Dixon. If you have any questions about this policy or the ways in which we use your personal information, please contact our Data Protection Officer at dpo@henleycol.ac.uk.

 

The information that you give us

We will collect personal information from you when you enquire or apply for one of our courses and when you become and while you are a student of the College. This might include your: name, address, date of birth, phone number, email address, parent/guardian/next of kin and contact details, ethnicity, health information, exam results, photos.

 

The legal basis for processing your information and how we use it

We may process your personal data because it is necessary as part of our public interest task of providing education to you. In this respect, we use your personal data for the following:

We may also process your personal data because it is necessary for the performance of our tasks carried out in the public interest or because it is necessary for our or a third party’s legitimate interests. In this respect, we may use your personal data for the following:

We may also process your personal data in order to comply with our legal obligations. In this respect, we may use your personal data for the following:

We may also process your personal data where we have your specific, explicit consent to do so. In this respect, we may use your personal data for the following:

We may also process your personal data where it is necessary to protect your or another person’s vital interests.

 

Special category personal information

Where we collect your special category personal information, we do this on the basis that there is a substantial public interest for us to do so as it is necessary for the purposes of carrying out our obligations to the funding bodies.  Special categories of personal data are personal data that reveal a person’s racial or ethnic origin, political opinions, religions or philosophical beliefs, trade union membership, genetic data (i.e. information about their inherited or acquired genetic characteristics, information about their physical, physiological or behavioural characteristics (such as facial images and fingerprints), physical or mental health, sexual life or sexual orientation and criminal records).

 

Sharing information with others

For the purposes referred to in this privacy notice and relying on the bases for processing as set out above, we may share your personal data with certain third parties. We do not share personal information with anyone unless the law and our policies in accordance with the GDPR allow us to do so, or if we have specifically obtained consent. Otherwise, there will always be an agreement or contract in place to ensure that your data is handled in accordance with the College’s Data Protection Policy by the third party. We may disclose limited personal data to a variety of recipients including:

You are given the opportunity to opt out of some of these data sharing arrangements, for example when you register with us, but you should carefully consider the possible impact of doing this.

 

International data transfers

Some of the personal data we process about you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”), for example where it is processed by staff operating outside the EEA who work for us or for one of our suppliers, or where personal data is processed by one of our suppliers who is based outside the EEA or who uses storage facilities outside the EEA. There will always be an agreement or contract in place to ensure that your data is handled in accordance with the College’s Data Protection Policy.

In these circumstances, your personal data will only be transferred on one of the following bases:

 

Your Rights

Under the GDPR you have the following rights:

 

How long your information is kept

We receive government funding for your education and as such your personal information is treated as financial information which may be required for audit purposes.

As such, we will keep your personal information for 7 academic years after you leave ​unless you are an apprentice or aged 19 or over on 31st August in your last year as a student, in which case we are required to keep your personal information until 31st December 2030.

After this time, we will continue to store a subset of your personal information electronically to enable us to provide you with an academic reference or transcript of results. If you do not want us to do this, you can request that all of your personal information be removed from our systems. ​PLEASE NOTE​: if you make this request we will no longer be able to provide you with any form of reference or confirmation of the qualifications you achieved at The Henley College.