Privacy Notice - Applications

Who is collecting the information?

West Lothian College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: GDPR@west-lothian.ac.uk  

Why are we collecting it and what are we doing with it (Purpose)?

When you apply for a course run at the College it is necessary to collect your personal information to process your application and assess whether you meet the course requirements. This privacy notice is specific to the student application purpose. The data you provide will be used by the college to process your application to a course at the college, this may include guidance on the suitability, or otherwise, of any courses to your individual circumstances.

If successful there is a further step for enrolment purposes. There is a separate notice for enrolment which will be provided when you enrol.

The information you provide is also used to produce anonymised statistical analysis of applications to the college for the purpose of curriculum planning and application tracking and ensuring we are providing accessible ways to submit applications.

What personal data do we collect?

The lawful basis for the processing?

The legal basis for processing under data protection law if GDPR Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject” and 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The Post 16 Education (Scotland) Act 2013 and the Further and Higher Education (Scotland) Act 2005 detail the functions that Colleges are required to carry out.

For the processing of special category data, the legal basis is Article 9(2)(g) “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.” This is to meet the requirements of the Equalities Act 2010 and under the Data Protection Act 2018 Schedule 1(2)(8) Equality of opportunity or treatment.

Who we share the information with:

For successful applications to Further Education courses we will share your information with our student funding area for the purpose of inviting you to apply for funding.

Anonymised statistical analysis is used within the college or as responses to information requests. Personal data is only provided to the college marketing department if you have consented to it. They are provided with your name, email address and course you have applied for.

Statistical personal information will be shared with the Scottish Funding Council (SFC) to allow them to allocate appropriate funding to colleges in line with Scottish Government strategies and their statutory duties. For more information on how the Scottish Funding Council use your personal data please see their student privacy policy on their website at http://www.sfc.ac.uk/about-sfc/how-we-operate/access-information/privacy-notice/college-student-data.aspx

We also share with Skills Development Scotland (SDS) to allow them to support individuals in their learner journey and to meet their statutory duties.

Where we do share your personal data, this will be done securely and a data sharing agreement will be in place.

How long do we hold the personal data?

West Lothian College will hold this data for two academic years. Historical anonymised data will be held for statistical analysis for curriculum planning etc. The data will be destroyed securely following two years retention.

Individuals’ rights in relation to this processing

Under data protection law, individuals have a number of rights. These rights are as follows:

• Right to be Informed – i.e. a privacy notice
• Right of Access – this means that you can request access or copies of your personal data
• Right to Rectification – this means you have the right to correct inaccurate or incomplete data held about you
• Right to Erasure (commonly known as the Right to be Forgotten (RTBF)) – this means you have the right to request your personal data held is deleted/destroyed.
• Right to Restrict – this means you have the right to restrict processing of your data, this links with other rights and if there is disagreement then you can request the processing is restricted until the issue is resolved.
• Right to Object – this means you can object to how your data is processed.
• Right to Data Portability – this means you can request your personal data in a machine-readable format (e.g. a .csv file). You can also request that the organisation transfers the file to another organisation
• Right to know of any automated decision making, including profiling – the college does not do this with personal data, so this right does not apply.

Please note some of these rights only apply in certain circumstances and are not absolute. To exercise any of your rights please email the data protection mailbox at GDPR@west-lothian.ac.uk The College will process your request accordingly and respond within one month of receipt of your request.

Complaints to UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at GDPR@west-lothian.ac.uk . If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF