Data Protection

Southern Regional College (SRC) (Data Controller) values the relationships with all students, staff and stakeholders and this notice explains how the College collects, processes and manages your personal data. The College will process all personal data in compliance with the Data Protection Act 2018 for the purpose of providing you with the service you have requested and to meet our statutory obligations. We will never ask for information that is unnecessary to deliver this service.

SRC is the Data Controller registered with the Information Commissioner Office (ICO) and is responsible under the Data Protection Act 2018 for the personal data that you submit to us.

The College’s registration reference number with ICO is Z1309317.

As a FE College our main lawful basis for processing your personal data are as follows:

• Article 6.1 (a)
  The data subject has given consent to the processing of his or her personal data for one or more specific purposes e.g. consent to contact next of kin, direct marketing, photographs.

• Article 6.1 (b)
  Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract e.g. staff employment contracts, contracts for a service for a third party, student relationship with the College.
• Article 6.1 (c)
  Processing is necessary for compliance with a legal obligation to which the controller is subject e.g. The Health and Safety at Work (Northern Ireland) Order 1978, The Safeguarding Vulnerable Groups (Northern Ireland) Order 2007, Disability Discrimination Act 1995, SENDO, Employment Law.
• Article 6.1 (d)
  Processing is necessary in order to protect the vital interests of the data subject or of another natural person e.g. we may need to disclose information to medical provider.
• Article 6.1 (e)
  Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. On behalf of the Department for the Economy (DfE), our role is to provide you with quality education. e.g. The Further Education (Northern Ireland) Order 1997.
• Article 6.1 (f)
  Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data; in particular where the data subject is a child e.g. nursery provider, sponsors to the program.

On occasions we may be required to process your personal data for other reasons, however we will only do so where a Lawful Basis applies.

We are also required to collect, process and maintain special category data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. Our lawful basis for processing this information is mainly:

• Article 9.2 (b)
  Processing is necessary for the purposes of carrying out the obligations and exercising specific rights in the field of employment and social security and social protection law. e.g. requirements by The Department for Economy to ensure meaningful equal opportunity monitoring and reporting or where learning support details are required for compliance with the Disability Discrimination Act (1995).

• Article 9.2(g) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;

And

• Schedule 1(1) Data Protection Act (2018) - Employment, social security and social protection
• Schedule 1(8) Data Protection Act (2018) - Equality of opportunity or treatment
• Schedule 1(16) Data Protection Act (2018) - Support for individuals with a particular disability or medical condition
• Schedule 1 (18) Data Protection Act (2018) - Safeguarding of children and of individuals at risk
• Schedule 1 (18) Data Protection Act (2018) – Occupational Pensions

Additional conditions relating to criminal convictions:

• Extension of conditions in Data Protection Act (2018) Part 2 of Schedule 1 referring to substantial public interest.

Where appropriate, the College is required collect information about criminal convictions as part of the student admission or staff recruitment process or we may be notified of such information directly by you in the course of you working for us. As per the Safeguarding Vulnerable Groups (NI) Order 2007, Rehabilitation of Offenders Act 1974 and Protection of Freedoms Act 2012, there is a legitimacy in our field of work to ask for this. We will use the information to make decisions about your engagement or continued employment/enrolment in line with the above legislation.

Personal data and special category data captured may include:

• Name
• Date of birth
• Contact details
• Next of kin details
• Religious beliefs
• Dependents
• Ethnicity
• Gender
• Sexual orientation
• Marital status
• Employment status
• Political opinion
• Residency
• Educational background i.e. grades
• Disabilities, learning difficulties, long-term medical conditions
• Criminal convictions

Information may be obtained directly from the individual, or in some cases from a third-party organisation involved in the services provided by the College that obtained the information in the first instance.

All employees, students and visitors should have a reasonable expectation of being captured on CCTV daily. While the use of CCTV is primarily for the following purposes, the College will regulate its use within the provisions of GDPR so as not to become intrusive:

• Deterrence, prevention and detection of a crime including misuse/abuse of College equipment
• Identification, apprehension and prosecution of offenders
• Security of campus buildings and ground
• Safeguarding/health and safety

In exceptional circumstances the images may be viewed for investigatory purposes. The College will only collect and process the necessary information required for these purposes, and without it the College may not be able to fulfil its obligations. Information is passed between various sections of the College for operational reasons and where a lawful basis exists, to process as is necessary and proportionate for the intended purposes only.

The College holds the personal data and special category data of its students and staff in order to implement and manage all services and processes relating to students, including;

• Student recruitment, admission, registration, teaching and learning (including attendance, progress and achievement), examination, graduation, collection and payment of monies; and
• Other services, such as student support and careers, and for staff including, recruitment, staff development, payroll, contractual requirements, quality improvement and staff related policies.

We collect personal information about students and employees through the initial application/enrolment stages, internal departmental processes, manual forms, telephone calls and online systems and via third parties e.g. school partnerships.

We will share personal information with third parties where required to do so by law, where it is necessary to administer the working relationship with you or where there is a third-party legitimate interest in doing so.

Information may be passed between various sections of the College for operational reasons and may also be disclosed to external agencies to which we have obligations, for example: government agencies and associated statutory bodies (e.g. Department for the Economy, HMRC); FE shared services – data collection; Higher Education Statistics Agency; funding bodies; government survey and research organisations; UCAS; Student Loans Company; Education Authority; Learner Records Service; crime prevention agencies; employers who pay fees and/or allow you time off work to attend your course; placement providers; examination awarding bodies; social welfare organisations; trade unions; careers service; UKBA; debt recovery agencies; and potentially other such organisations for defined purposes. We may also disclose information to examining bodies and legal representatives.

We require third-party service providers to respect the security of your data and to treat it in accordance with the law.

The College will hold your contact details after you graduate in order for you to be contacted to complete the Graduate Outcomes survey. Your contact details will be passed to the Higher Education Statistics Agency Limited (HESA) and organisations contracted to undertake the Graduate Outcomes survey. The survey contractors will only use your contact details for the survey and will delete them when the survey is closed. HESA may hold your contact details for further Graduate Outcomes surveys where these are in the public interest. Responses to the Graduate Outcomes survey will be used to create statistics to meet the public interest in the outcomes of higher education. Your responses will also be made available to the College , and we may choose to add additional questions to the survey for our own use. Information from third parties (such as your parent, or your provider, if you are in further study) might be used to complete sections of the surveys if you can’t be contacted. Further privacy and data protection information will be provided if you are contacted for any of these surveys. You might also be contacted as part of an audit to check that the survey has been undertaken properly.

For more information about the Graduate Outcomes survey visit the dedicated website www.graduateoutcomes.ac.uk. For more information about HESA’s data protection compliance, including contact details and your rights, please see HESA’s Privacy Information. Controller Higher Education Statistics Agency Limited (HESA) will be the Controller of personal data processed for the Graduate Outcomes survey Legal basis for processing your information to conduct national surveys Processing of your information to conduct Graduate Outcomes survey is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (See GDPR Article 6(1)(e)) and for statistical and research purposes (See GDPR Article 89).

Please see below all other privacy notices relating to the following key business areas of the College:

• Apprenticeships (All)
• Business Support & Innovation
• Finance
• Human Resources
• Learning Support
• Marketing
• Student Enrolment
• Training for Success 2013
• Training for Success 2017

Transfer of personal data outside the European Union, to third countries or international organisations is restricted under GDPR regulations. Overseas sharing will be processed in accordance with Chapter V of GDPR - https://gdpr-info.eu/chapter-5/

We will only retain personal data for as long as necessary to fulfil the purpose we collected it for and for the purpose of satisfying any legal, accounting or reporting requirements. The College will retain records in line with the FE Sector Retention and Disposal Schedule - click here to access.

You have the right to:

• Be informed about what we do with your information at point of data collection
• Access your personal data that we process
• Rectify inaccuracies in personal data that we hold about you
• Be forgotten, that is your details to be removed from systems that we use to process your personal data
• Restrict the processing of your personal data
• Obtain a copy of your personal data in a commonly used electronic form
• Object to certain processing of your personal data by us
• Request that we stop sending you direct marketing communications
• Withdraw consent – only where processing is based on consent

For additional information on exercising your rights, please contact our Data Protection Officer (details below) or see our Data Protection Policy, click here to access.

If you are not happy with how your information is being processed by the College, contact the Data Protection Officer:

Ian Boden
Corporate Compliance Manager
Southern Regional College
Banbridge Campus, Castlewellan Road, Banbridge, Co Down, BT32 4AY
E: dpo@src.ac.uk

If you are dissatisfied with the College’s response, you have a right to complain to the Information Commissioners Office (ICO). The ICO contact details are:

Information Commissioner's Office
Wycliffe House, Water Lane, Cheshire, SK9 5AF
T: 0303 123 1113 or 01625 545 745

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.

The College will not use automated decision making to make decisions that will have significant impacts on data subjects.

If you fail to provide certain information when requested, we will not be able to fulfil our legal obligations or deliver the service you have requested.

We reserve the right to update this privacy notice where there is a significant or unforeseen change to our processing activity. We will notify you of any updates to this notice.

The College is committed to protecting the personal data we process and ensuring full compliance with current data protection legislation. If you believe your personal data has been mishandled, unlawfully processed, or your data protection rights have not been upheld, you have the right to raise a complaint. Examples include:

• There has been potential unlawful processing, loss, or unauthorised disclosure of your personal data.
• You are concerned about how your data is being shared or stored by the College.
• There has been a failure to uphold your data protection rights.
• You believe the College is using inaccurate data in relation to you.
• You have not received a response to a ‘Subject Access Request’ within expected timeframes.

If you wish to make a complaint about how the College has managed your personal data, this can be most easily done using our online complaints form.

Alternatively, you can contact the Data Protection Officer (DPO) directly via the following methods:

E: dpo@src.ac.uk
T: 0300 123 1223

In writing:

Data Protection Officer
Southern Regional College
Banbridge Campus
Castlewellan Road
Banbridge
BT32 4AY

Please provide the DPO with:

• Your name and contact details
• A description of the issue
• Any other relevant information to help us inform our review of the issue.

In line with the requirements of the Data (Use and Access) Act 2025, the College will acknowledge receipt of a complaint within 30 calendar days of receipt. Where possible, the College will always endeavour to provide an acknowledgement and a response to you at the earliest opportunity.