1. Who we are and how to contact us?

Information we collect from you

  • 1.1. We are Leicester College (the “College”). This privacy notice sets out how and why we use personal information, and your related rights.

  • 1.2. For the purposes of applicable data protection law (mainly the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018)), we are the “controller” of your personal information. That means that we determine the purposes and the means of using your personal information (i.e. “why” and “how” your personal information is used), and that we take on legal obligations to you.

  • 1.3. If you have any questions or queries which are not answered by this Privacy Notice, or have any potential concerns about how we may use the personal data we hold, please write to the Data Protection Officer at Leicester College, Freemen’s Park Campus, Welford Road, Leicester, LE2 7LW or email dpo@leicestercollege.ac.uk.

2. What information do we hold about you?

Information we collect from you

  • 2.1. You provide us with personal data when a member of the apprenticeship team meets with you for the first time to complete sign up/enrolment paperwork. We use this data to register you and your employee with the Awarding Organisations and to ensure we have the correct information for you should we need to contact you. We will also use your personal information to set up Smart Assessor so you can track your employees’ progress. Your data will be accessible by the Apprentice Skills Coach for the delivery of an apprenticeship programme.

    2.2. This may include your name, address, contact information and bank account information for payment purposes only.

    Other Information

    2.3. We also hold other information about you. We may keep information contained in any correspondence by post or electronically. We may record phone and video calls.

    2.4. We may also obtain other information about you permitted by law from other sources. This may include from previous educational institutions, social services, the police or other agencies.

3. Why do we collect this information?

  • 3.1. We collect information in order to enable us to fulfil our legal obligations in relation to providing further education in line with the Further and Higher Education Act 1992, to comply with the requirements of government funding agencies, and to meet other statutory requirements.

  • 3.2. We process the information in order to support you or any employees/apprentices who are studying with us and to communicate with you about them. Where you have given us your consent, we may also use the data to contact you about other education and training that may be of interest and to keep you up to date with Leicester College information.

  • 3.3. Under Article 6 of the UK GDPR, we are required to have a “lawful basis” to collect and use personal information. A lawful basis is a reason or justification for use which is accepted and recognised by the UK GDPR. The lawful bases we rely on for processing personal information are:

    • where we have your consent;

    • to perform contractual obligations to you;

    • to comply with the College’s legal obligations;

    • to perform various tasks which are in the public interest, including educating and safeguarding our staff and apprentices;

    • where necessary in an emergency situation; and

    • where necessary to achieve the College’s “legitimate interests”. In overview, a legitimate interest is any valid and genuinely held educational, operational, legal or commercial objective; and

    • where necessary to achieve a “recognised legitimate interest”. These include, among others, emergencies, detection, investigation or prevention of crime and safeguarding vulnerable individuals.

  • 4. Who might we share your information with?

    • 4.1. We do not share your information with anyone unless the law and our policies allow us to do so. Some of the most likely instances of where we may share your personal information are listed below.

    • 4.2. Your information may be shared internally, including with members of the Apprenticeships Team, Student Services and IT staff if access to the data is necessary for the performance of their roles.

    • 4.3. We will keep this information about you confidential but in some instances, we may need to share your data. We will share the information with government funding agencies (the Department for Education, the Office for Students, the Student Loan Company) in order to comply with our legal duties. We may also share the information with exam boards and other regulatory bodies, national bodies for the purposes of monitoring and research.

    • 4.4. We may be asked to share data with other third parties where there is a lawful reason for their request. These may include: the police, social services, legal firms acting on your, or the College’s behalf, debt collection companies, insurance companies acting on your, or the College’s behalf, HMRC, or other government agencies.

    • 4.5. We will not share your details with any other third party including commercial companies without your consent to do so.

    • 4.6. We may also share the information in an anonymised format, with national bodies for the purposes of monitoring and research.

    • 4.7. We may share your information with our professional advisers such as accountants and solicitors.

  • 5. Transferring your personal data to other countries?

    • 5.1. In most cases we expect your information to stay here in the UK. However, on the few occasions where we do transfer your information outside the UK, we will ensure it is protected and handled in line with data protection law.

      5.2. If we do transfer your personal data, we generally do not expect to transfer it to territories outside the European Economic Area (EEA). However, in instances where we need to do so (for example, where one of our service providers is based outside of the EEA), we will put in place the necessary additional protections required by Article 46 UK GDPR or rely on one of the exemptions in Article 49 UK GDPR in order to transfer your data.

      5.3. If you would like more information about how we protect your personal information if it is transferred outside the UK, please email dpo@leicestercollege.ac.uk.

  • 6. How do we protect your data?

    • 6.1. We take the security of your data seriously and implement technical (i.e. IT/technological) and organisational (i.e. physical/documentary) measures to ensure that your data is not lost, accidentally destroyed, misused or disclosed inappropriately.

    • 6.2. Where we engage third parties to process personal data on our behalf, we do so on the basis of written instructions, ensuring they are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

  • 7. How long do we keep this information about you?

    • 7.1. We keep information in accordance with our document retention policy. Retention periods are in line with the length of time we need to keep your personal information in order to manage and administer your contract of employment, carry out our statutory functions or public interest tasks, establish or defend legal claims, or ensure the success of any of our legitimate interests. They also take into account our need to meet any legal, statutory and regulatory obligations. These reasons can vary from one piece of information to the next. In all cases our need to use your personal information will be reassessed on a regular basis and information which is no longer required will be anonymised or deleted.

  • 8. Automated decision-making?

    • 8.1. Automated decision-making is when a computer or similar electronic system uses personal information to make decisions about people without any human involvement. Profiling involves collecting various pieces of information about a person in order to analyse or evaluate certain aspects relating to that person or to make predictions about them (for example, how that person may behave or what their preferences are). Automated decision-making does not have to involve profiling, though it often will.

      8.2. We do not use your personal information in automated decision-making, including profiling (i.e. we do not create profiles or make decisions about you based solely on automated decision-making without human involvement). If that changes, we will tell you.

  • 9. What are my rights?

    • 9.1. The UK GDPR gives you certain rights regarding how your information is collected and used. To exercise any of these rights, contact dpo@leicestercollege.ac.uk.

    • 9.2 You have the following rights:

      • the right to be informed about the collection and use of your personal data – this is called ’right to be informed’;

      • the right to ask us for copies of your personal information we have about you – this is called ’right of access’, and is also known as the right to make a subject access request (SAR), data subject access request or right of access request;

      • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’;

      • the right to ask us to delete your personal information – this is called ‘right to erasure’;

      • the right to ask us to stop using your information – this is called ‘right to restriction of processing’;

      • the ‘right to object to processing’ of your information, in certain circumstances;

      • rights in relation to automated decision making and profiling;

      • the right to withdraw consent at any time (where relevant); and

      • the right to complain to the Information Commissioner if you feel we have not used your information in the right way.

    • 9.3. Please note that some of these rights are only available in certain circumstances and may be subject to legal exemptions.

    • 9.4. There are legitimate reasons why we may refuse your information rights request.

      • For example:

        • the right to erasure does not apply when the use of the data is necessary in order to comply with a legal obligation; to establish or defend a legal claim; or to carry out a task in the public interest;

        • the right to portability does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests;

        • right to object does not apply when the lawful basis for processing is contract, legal obligation or vital interests. And if the lawful basis is consent, you don’t haven’t the right to object, but you have the right to withdraw consent.

    • 9.5. We may also refuse your request if it is manifestly unfounded or excessive.

  • 10. How can I contact if I have any questions or concerns?

    • 10.1. If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance. We will acknowledge all complaints within 30 days and aim to deal with them without undue delay. Please write to the Data Protection Officer at Leicester College, Freemen’s Park Campus, Welford Road, Leicester, LE2 7LW or email dpo@leicestercollege.ac.uk.

  • 11. Privacy notice changes

    • 11.1. This Privacy Notice is regularly reviewed. This is to make sure that we continue to meet the highest standards and to protect your privacy. We reserve the right at all times, to update, modify or amend this Notice. We suggest that you review this Privacy Notice from time to time to ensure you are aware of any changes we may have made. The latest version of this Notice can be found on the College’s website.

Updated September 2025