Privacy notice

This privacy notice outlines how West Notts College handles personal information across our wider community, including visitors, partners, and service users.

These privacy notices apply to all college campus sites.

West Nottinghamshire College is registered with the ICO (registration no. Z8144426). 

If you have any complaints regarding our handling of data please let us know in the first instance using the college Complaints Procedure.

---

How we use your personal information

West Nottinghamshire College are the data controller of personal information about you.

Our address is:
West Nottinghamshire College,
Derby Road,
Mansfield,
Notts,
NG18 5BH

If you have any questions about this policy or the ways in which we use your personal information, please contact our Data Protection Officer:

The Data Protection Officer
West Nottinghamshire College
Derby Road
Mansfield
NG18 5BH

• 0808 100 3626
• This email address is being protected from spambots. You need JavaScript enabled to view it.

This privacy notice has been prepared in accordance with the Data Protection Act 2018 (DPA2018), the United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any legislation implemented in connection with the aforementioned legislation. Where data is processed by a controller or processor established in the European Union or comprises the data of people in the European Union, it also includes the EU General Data Protection Regulation (EU GDPR). This includes any replacement legislation coming into effect from time to time.

Please note the college engages the services of 3rd party operators eg vending machine and payment systems, where the college is not the data controller and the service is provided for the convenience of our learners, staff and visitors. We follow strict due diligence procedures with all of our suppliers. If you would like more information, please contact This email address is being protected from spambots. You need JavaScript enabled to view it..

---

Visitor to our college

• The information we collect about you and why we collect it

  As part of your visit to the college we store and use your personal details and information about your visit for the purposes of managing and operating the college. We collect full name, vehicle registration number and mobile phone number.

  We use CCTV at our buildings for the purposes of crime prevention, security and health and safety and, accordingly, will capture imagery of visitors to the college.

  We may use your data to contact you in an emergency using your mobile number and to identify your vehicle while in our car parks.

• The legal basis on which we collect and use your personal information

  Except in the circumstances highlighted below, we process this information on the basis of our legitimate interests:

  • we have a legitimate interest in wishing to interact with you to manage and operate effectively our college and to ensure that the college is safe and secure for all persons visiting; and
  • to be able to do so, we need to understand details of who is in the building and to be able to communicate with them.
  • Where we are required by law to hold certain records, then we collect and hold those records to comply with that legal obligation.

• How long we keep your personal information

  We will only use and store information for so long as it is required for the purposes it was originally collected or for legal and regulatory reasons. How long information will be stored, depends upon the information in question and what it is being used for.

  CCTV: CCTV footage is deleted after 28 days on a rolling basis unless it is required as part of an investigation, in which case it will be kept until the completion of the investigation. Visitor’s record: The daily visitors’ record book pages are destroyed after two working days.

  Health and Safety: Up to 40 years, to comply with legislation.

  We will always retain your personal information in accordance with the prevailing data protection legislation and will never retain your information for longer than is necessary.

• How we share your personal information

  We may share the personal information that you give us with the following organisations (or types of organisation) for the following purposes.

  Organisation/type of organisation:

  • Law enforcement agencies
  • Insurance Companies

  Purpose:

  • Reporting and/or investigation of criminal and/or antisocial behaviour
  • In the event of an insurance claim

• How we transfer your personal information outside Europe

  We do not store or transfer your personal data outside Europe.

• Automated decisions we take about you

  We do not make automated decisions using this information.

---

One of our suppliers to the college

We store and use your information for the purposes of managing our suppliers in respect of the supply of goods and services that our college may need.

• The information we collect about you and why we collect it

  In order to engage and manage our suppliers, where you are a supplier (or where if it is a company, you are its representative) we collect and store your contact information and, where appropriate, your bank account details. We hold this information in order to arrange payments and exchange financial details with yourselves.

  You may also be asked to provide details of your occupation and your CV.

  In addition, where you visit a building we will collect and process the information set out in the “A visitor to our college” section above.

• The legal basis on which we collect and use your personal information

  Except in the circumstances highlighted below, we process this information on the basis of our legitimate interests:

  • we have a contractual obligation we have entered into which involves engaging and managing our suppliers; and
  • to be able to do so, we need to hold details of who those suppliers are.

  Where we are required by law to hold certain records for health and safety purposes, then we hold those records to comply with that statutory obligation.

  Where we hold your bank account details, we do so on the basis that it is necessary for us to perform our contract with you.

• How long we keep your personal information

  Financial information is usually kept for 6 years after the end of the financial year. However, certain financial information may be kept longer if it is a condition of a grant that the college has received or on occasion and where necessary data may be kept longer if there is a dispute with a supplier.

  Health & Safety – 40 years.

  We will always retain your personal information in accordance with the prevailing data protection legislation and will never retain your information for longer than is necessary.

• How we share your personal information

  We may share the personal information that you give us with the following organisations (or types of organisation) for the following purposes.

  Organisation/type of organisation:

  • Government agencies
  • Insurance companies
  • Law enforcement agenices
  • Internal and external auditors
  • Insurance companies
  • Bank
  • Health & Safety

  Purpose:

  • Reporting and/or investigation of criminal and/or antisocial behaviour in the event of an insurance claim.

• How we transfer your personal information outside Europe

  We do not store or transfer your personal data outside Europe.

• Automated decisions we take about you

  We do not make automated decisions using this personal data.

---

Enquiries

We store and use your information for the following purposes

• We collect only the information we need to respond to your enquiry and provide relevant information or support.
• We may use trusted suppliers to provide systems, communications, events, surveys and address-validation services.
• Where required, we ask for consent before sending marketing communications or using non-essential cookies.

You can object to direct marketing at any time and can exercise your data protection rights by contacting us.

{qaccordion|The information we collect about you and why we collect it}

Depending on your request, we may collect:

• your name and contact details, such as postal address, email address and telephone number
• your date of birth or age group, where relevant to course eligibility or support
• details of the course, subject, event, product or service you are interested in
• your current or former school, year group, qualifications or expected results, where relevant
• the content of your enquiry and your communication preferences
• event registration and attendance information
• information needed if your enquiry progresses to an application or enrolment

Direct marketing

We may contact you about courses, events and opportunities that we think are relevant. Where consent is required, we will ask for it. In limited circumstances, we may rely on the electronic marketing “soft opt-in” for similar services where the legal conditions are met. Every electronic marketing message will provide a simple way to unsubscribe.

You can change your preferences or object to direct marketing at any time by using the unsubscribe option in a message or contacting the college.

Address validation

When you enter an address in an application or enrolment form, details may be sent securely to Loqate for real-time validation. This helps improve accuracy. You may be able to ignore the suggestions and enter the address manually.

When you enter an address in an application or enrolment form, the information may be sent securely to Loqate for real-time validation. This helps us ensure that the address information we collect is accurate and complete. You can avoid using the address suggestions and enter your address manually.

Loqate generally acts as an independent data controller when providing its core address validation and data maintenance services. However, its role may vary depending on the specific service used and how personal information is handled.

Contact by selected partners

We may appoint carefully selected suppliers to contact applicants, students or parents and carers on our behalf, for example to confirm enrolment intentions, collect destination information or gather feedback. We use contracts and appropriate access controls, and information must be used only for the stated purpose. You may object or withdraw consent where applicable by telling the supplier or contacting the college.

We use a variety of suppliers to help process your information and ensure that we are making the most relevant information available to you regarding our courses. These may include:-

• Providers of bulk communication services
• Admissions and learner-record system
• Bulk text messaging
• Applicant engagement through WhatsApp
• Event registration and administration
• Surveys and feedback
• Address lookup, validation and data maintenance.
• Website analytics and digital advertising, where applicable.
• Card payment processing, secure storage of card details and refunds

{/qaccordion}

• The legal basis on which we collect and use your personal information

  The legal basis depends on why we are using the information. We may rely on:

  Public task - Responding to enquiries and carrying out activities connected with our public education functions.

  Legitimate interests - Improving services, maintaining appropriate records, service communications and limited marketing, where our interests are not overridden by your rights.

  Consent - Optional marketing, non-essential cookies and other activities where we specifically ask for permission.

  Contract or steps before a contract - Where you ask us to take steps relating to a paid course or another agreement.

  Legal obligation - Where processing is necessary to comply with a law that applies to the college.

• How long we keep your personal information

  Enquiries that do not progress to an application are usually kept for 4 years in order to provide details of alternative opportunities.  For all enquiries that result in an application please see under “One of our Customers”.

• How we use & share your personal information

  We may share the personal information that you give us with the following organisations (or types of organisations) for the following purposes:

  We may use your information to:

  • respond to and administer your enquiry
  • send requested information, such as a prospectus or course details
  • arrange appointments, interviews, introductions or event attendance
  • identify and discuss reasonable adjustments, accessibility requirements or other support
  • manage the transition from enquiry to application or enrolment
  • understand demand for courses and services, improve our events and develop future provision
  • keep appropriate records, protect our systems and meet legal or regulatory obligations
  • send marketing communications where permitted and measure their effectiveness.

• Direct marketing

  We may contact you about courses, events and opportunities that we think are relevant. Where consent is required, we will ask for it. In limited circumstances, we may rely on the electronic marketing “soft opt-in” for similar services where the legal conditions are met. Every electronic marketing message will provide a simple way to unsubscribe.

  You can change your preferences or object to direct marketing at any time by using the unsubscribe option in a message or contacting the college.

  Cookies, pixels and online advertising

  Our website uses essential cookies to operate. With your permission, it may also use analytics, advertising and social media cookies or pixels. These technologies can help us understand website performance, measure interest in courses and show more relevant advertising after you leave our site.

  You can accept or reject optional cookies and change your choices through the cookie-control tool. Rejecting optional cookies will not stop essential cookies required for the website to work.

  The college’s cookie policy can be found here https://www.wnc.ac.uk/about-us/policies-and-privacy-notices/cookie-policy

• How we transfer your personal information outside UK

  We do not routinely store your personal data outside the United Kingdom. However, we do use some United States based providers as data processors. Where this occurs, we ensure appropriate safeguards are in place in accordance with Data Protection Laws.

• Automated decisions we take about you

  We do not make decisions about enquiries solely by automated means where the decision would have a legal or similarly significant effect.

---

One of our customers

We store and use your information for the purposes of managing and charging for the services that our college offers.

• The information we collect about you and why we collect it

  In order to engage and best serve our customers, we may collect information to meet service requirements and assess the fees that we will charge for the services provided. We may also collect financial information such as credit or debit card details and contact information in order to charge for services.

  In addition, where you visit a building we will collect and process the information set out in the “visitor to our college” and “College students” sections above (if relavent).

• More sensitive information

  We may occasionally need information that receives additional protection under data protection law, for example information about health, disability, ethnicity or support needs. We will only ask for this where it is relevant, explain why it is needed and apply an appropriate legal condition for using it.

  Photographs and videos are not automatically special category data. However, they may reveal sensitive information in context. We will explain how images will be used and seek consent where this is the appropriate basis.

• Information collected through our website

  We may collect technical and usage information when you use our website, such as pages visited, interactions, device or browser information and cookie identifiers. We use aggregated or anonymised information where possible. For more detail and to manage optional cookies, use the cookie-control tool on our website.

  The college’s cookie policy can be found here https://www.wnc.ac.uk/about-us/policies-and-privacy-notices/cookie-policy

• Information from other sources

  In limited circumstances, we may receive information from a school, local authority, parent or carer, employer, event platform or another person acting on your behalf. We will use it only where we have a valid reason to do so.

• Payment information

  If you make a card payment, the payment is processed through Trust Payments, our card payment service provider. The college does not directly store your full card details. A limited number of authorised administration staff can view only part of the card number on payment receipts and within the payment portal, where this is needed to administer the payment. 

  Trust Payments securely processes and stores the full card details within its payment system. This enables authorised college staff to arrange a refund through the payment terminal when required. Trust Payments handles card information in accordance with its own security and data protection obligations. 

  Please note that since we are not your payment acquirer (i.e. we do not process your transactions, only provide the payment gateway) we do not provide PCI DSS services to you, or hold the responsibility of your PCI compliance. This responsibility lays with your payment processor.

• The legal basis on which we collect and use your personal information

  Except in the circumstances highlighted below, we process this information on the basis of our legitimate interests:

  Where we are required by law to hold certain records for health and safety purposes, then we hold those records to comply with that statutory obligation.

  Where we hold your bank account details, we do so on the basis that it is necessary for us to perform our contract with you.

• How long we keep your personal information

  Financial information is usually kept for 6 years after the end of the financial year. However, certain financial information may be kept longer if it is a condition of a grant that the college has received or on occasion and where necessary data may be kept longer if there is a dispute with a customer.

  We will always retain your personal information in accordance with the prevailing data protection legislation and will never retain your information for longer than is necessary.

• How we share your personal information

  We may share the personal information that you give us with the following organisations (or types of organisation) for the following purposes:

  Organisation/type of organisation:

  • Government agencies
  • Insurance companies
  • Law enforcement agencies
  • Internal and external auditors
  • Debt collection agencies
  • Financial software providers
  • Banks

  Purpose:

  • To comply with statutory reporting
  • Reporting and/or investigation of criminal and/or antisocial behaviour
  • In the event of an insurance claim
  • To pursue unpaid amounts
  • Receiving or making payments

  We may also use your information to send you details of other courses which may be of interest to you. You can opt out of this marketing information by contacting the college general number (01623 627191) or by contacting This email address is being protected from spambots. You need JavaScript enabled to view it..

• How we transfer your personal information outside Europe

  We do not store or transfer your personal data outside Europe.

• Automated decisions we take about you

  We do not make automated decisions using this information.

---

Your rights

• In each case, you have certain rights, including how to get a copy of your data, how to get it corrected or deleted, and how to complain.

  Please note that on occasions we may process “special categories” of information about you. This is information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

  You have a number of rights over your personal information, which are:

  • 1.1.1 The right to be informed about our collection and use of personal data;

  You have the right to be informed about the collection and use of your personal data. We ensure we do this with our internal data protection policies and through our external website policy. These are regularly reviewed and updated to ensure these are accurate and reflect our data processing activities.

  • 1.1.2 Right to Access Your Personal Information

  You have the right to access the personal information that we hold about you in many circumstances, by making a request. This is sometimes termed ‘Subject Access Request’. If we agree that we are obliged to provide personal information to you (or someone else on your behalf), we will provide it to you or them free of charge and aim to do so within 1 month from when your identity has been confirmed.

  We would ask for proof of identity and sufficient information about your interactions with us that we can locate your personal information.

  If you would like to exercise this right, please contact us as set out below.

  • 1.1.3 Right to Correction Your Personal Information

  If any of the personal information we hold about you is inaccurate, incomplete or out of date, you may ask us to correct it.

  If you would like to exercise this right, please contact us as set out below.

  • 1.1.4 Right to restrict processing

  You have the right to ask us to restrict the processing of your personal data. For example, this may be because you have issues with the accuracy of the data we hold or the way we have processed your data. The right is not absolute and only applies in certain circumstances.

  If you would like to exercise this right, please contact us as set out below.

  • 1.1.5 Right to Erasure

  You have the right to have personal data erased. This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances.

  If you would like to exercise this right, please contact us as set out below.

  • 1.1.6 Right to Portability

  The right to portability gives you the right to receive personal data you have provided to a controller in a structured, commonly used and machine readable format. It also gives them you the right to request that a controller transmits this data directly to another controller.

  If you would like to exercise this right, please contact us as set out below.

  • 1.1.7 Right to object

  You have the right to object to our processing of some or all of the personal data that we hold about you. This is an absolute right when we use your data for direct marketing, but may not apply in other circumstances where we have a compelling reason to do so, e.g., a legal obligation.

  • 1.1.8 For more information about your privacy rights

  The Information Commissioner's Office (ICO) regulates data protection and privacy matters in the UK. They make a lot of information accessible to consumers on their website and they ensure that the registered details of all data controllers such as ourselves are available publicly. You can access them here https://ico.org.uk/for-the-public.

  You can make a complaint to the ICO at any time about the way we use your information. However, we hope that you would consider raising any issue or complaint you have with us first. Your satisfaction is extremely important to us, and we will always do our very best to solve any problems you may have.

• Changes to our Privacy Policy

  We keep our privacy policy under regular review and will update it from time to time to make sure it remains up-to-date and accurate.

---

Data security