Privacy Policy

York Learning
Author: Will Harris
Date of Publication: 18 January 2018
Revision September 2023
First date of review September 2024

Purpose of Processing

City of York Council (known to the learner as York Learning) is a post 16 education and training provider. The funding used to provide this education and training comes from a variety of sources as indicated by the following:

  • Education Skills and Funding Agency ( ESFA)
  • European Social Fund ( ESF)

The Data Controller can be contacted through details on the separate privacy statement issued by the ESFA on the Individual Learner Record (ILR) you sign before the learner (data subject) begins their course, or on the link below.

ESFA privacy notice – GOV.UK (www.gov.uk)

York Learning is contractually required to process your personal data by the above funding bodies, who act as the data controller. This means that we are legally obliged to have this data as a prerequisite for you attending our learning provision. This is so the controller can meet their statutory responsibilities and exercise its functions. As part of this requirement you may be contacted by the English European Social Fund ( ESF) Managing Authority, or its agents, to carry out research and evaluation on the effectiveness of the programme.

 

Categories of personal data

The type of personal data captured includes name, date of birth, NINO (National Insurance Number), address, postcode, contact details such as phone or email, employment status, destination information, prior attainment level and other specialist categories of data such as ethnicity, gender and health condition/ disability status. These specialist categories of data are described as being more ‚Äėsensitive‚Äô than ordinary personal data and our additional legal basis for processing is that it is necessary for employment, social security and protection law in so far as it is authorised by Union and Member state law,¬† or in the vital interests of learner.

 

Source of data/ Data recipients

Although most personal data is supplied directly by the learners to York Learning, we do also process personal data from elsewhere that help us to provide appropriate learning that meets all learners needs including those with additional learning needs and allows us to meet our Health and Safety, Prevent and Safeguarding obligations.

Personal data in the form of Education Health and Care Plans (EHCP) and other relevant reports from medical or therapeutic professionals Р usually this data would be supplied by a Special Educational Needs Team within the relevant local authority, the learner or their family, or via a Specialist Careers Adviser or other supporting professional such as a Social Worker. This data would be shared with a chosen subcontracted partner who proposes to provide the personalised learning, in order to ascertain whether they can meet the learners’ specific needs.  Again, we are legally obliged to have this data in order to provide the learning, and we also have an additional legal basis for processing special categories of data which is that it is necessary for employment, social security and protection law in so far as it is authorised by Union and Member state law, or in the vital interests of learner.  As a matter of good practice, the learner will be made aware in advance that personal data could be shared with relevant bodies.

As part of our contractual obligations we will share your data with the following organisations and awarding bodies (please note the link to their privacy notices) where relevant to the learners’ accredited learning objectives:

AAT  www.aat.org.uk/get-myaat/privacy-policy
Sage   www.sagequalifications.com/Privacy
Skillsfirst   www.skillsfirst.co.uk/index.php?page=policies&url=data-protection-policy&id=680&type=Article
ACE   www.acecerts.co.uk/web/privacy-policy
City and Guilds  www.cityandguilds.com/learner-policy
AQA www.aqa.org.uk/about-us/privacy-policy
CPCAB www.cpcab.co.uk/public_docs/privacy_notice_template_guidance
NOCN www.nocn.org.uk
ILM https://www.i-l-m.com/privacy 
NCFE www.ncfe.org.uk/privacy-notice
ASDAN: www.asdan.org.uk/privacy-statement/
British Computer Society www.bcs.org
Ascentis: www.ascentis.com/privacy-policy/
CIH (Chartered Institute of Housing): www.cih.org/privacy-policy
TQUK: https://www.tquk.org/privacy-policy/

Communications and online learning

Some of our learning is delivered using online meeting software. We use Zoom for this. There is a separate DPIA to cover our use of this and it is available using the contact information below.  The privacy notice for Zoom can be found here: ZOOM PRIVACY STATEMENT РZoom

A very limited number of our curriculum areas, including but not limited to our Apprenticeship provision and our Projects delivery, use WhatsApp if this has been indicated as the preferred communication method of the learner. There is a separate DIPA to cover our use of this and it is available using the contact information below. The privacy notice for WhatsApp (Europe) can be found here: Privacy Policy (whatsapp.com). As WhatsApp is not owned/controlled in any way by CYC however if an FOI or SAR request is served we may well not be able to retrieve any information/conversations etc. conducted this way.  If the above is of concern, please raise your concerns with the CYC staff member working with you and they will suggest an alternative way of communicating.

Electronic Storage

Some of our learning requires completing an electronic portfolio of assignments. We currently use Google sites for this and OneFile specifically for our apprenticeship programme only. This facility gives access to learners, their tutor and limited access to their employers (if they are an apprentice only) to complete assignments and to receive feedback. This site also monitors how often and when the site is visited by the learner and this information is available to tutors only during the lifetime of the course undertaken. All learners will be required to view a privacy notice from Google/OneFile as part of induction to Google Sites/OneFile so they understand what personal data Google/OneFile is storing and how Google/OneFile is complying with GDPR.

As Google is cloud based it is likely that this data is transferred and held securely outside of the EU. Google is part of both the EU-US and the Swiss- US Privacy Shield Framework which supports additional self regulation around data protection.

Please find the link to Google’s privacy notice here: policies.google.com/privacy/update

Please find the link to OneFile’s privacy notice here: Privacy Notice | OneFile

All other personal data is stored either internally on ICT systems hosted by City of York Council or via databases on secure servers in the UK and are only accessed by authorised personnel. Please find links to their privacy notices:

https://www.gov.uk/government/publications/lrs-privacy-notices

https://www.tribalgroup.com/privacy-policy

https://www.microsoft.com/en-us/trustcenter/privacy/

https://privacy.microsoft.com/en-gb/privacystatement

Your Consortium Ltd

Consent for processing personal data for non learning activities

As a learning provider we would like to make you aware from time to time about our other services. We will ask for your consent to contact you about these services through a clear opt in box for specific marketing services. This data will not be shared with or sold to third parties- all marketing contact about York Learning services will be conducted by York Learning.

We may also ask for learner consent to take photographs of their work as part of our celebration of their achievements or as part of ongoing marketing and publicity.

We will store all personal data securely and with restricted access within the organisation.

We will also ask you for your consent to contact to find out your destination (eg whether you have moved on to a job or other learning) after your course has finished.

The ULN is required to fulfil statutory requirements for administrations of services within the education and training sector. You cannot opt out of being issued with a ULN by the Learning Records Service.

 

The information you supply is used by the Learning Records Service (LRS). The LRS issues Unique Learner Numbers (ULN) and creates Personal Learning records across England, Wales and Northern Ireland, and is operated by the Education and Skills Funding Agency, an executive agency of the Department for Education (DfE).For more information about how your information is processed, and to access your Personal Learning Record, please refer to: https://www.gov.uk/government/publications/lrs-privacy-notices

However, you can opt-out of sharing your personal learning record (PLR). We will ask you for your consent to access this record, as without it we will need you to bring proof of prior achievement such as exam certificates as a prerequisite for gaining a place on a course.

As part of your enrolment process you may also be asked for your consent to be contacted by Tribal Group for other services they offer. Please see the link to their privacy policy for more details: https://www.tribalgroup.com/privacy-policy

Retention and Deletion

Personal data required as part of our legal obligations will either be retained until 31 December 2032 or for 6 years from the end of the financial year in which the last payment is made, depending on the regulatory framework associated with various funding streams. Personal data will be securely destroyed after the relevant retention period has elapsed.  However, we will regularly review and minimise other records with the aim of partial or full deletion where possible. All data is archived both on site, and eventually off site within the following timeframes:

Hard copy of Individual Learning Record (ILR), enrolment form and personal data associated with Adult Education Budget funded accredited classroom learning or Apprenticeship provision:

  • Current learners and current leavers for the most up to date academic year on site in secure locked cabinet. Once learners have completed their programme their information will be archived in a secure area both on site, then off site for until 31 December 2033.

Electronic version of Individual Learning Record (ILR) and enrolment form associated with ESF funded Adult Education Budget funded accredited classroom learning, or Apprenticeship provision:

As part of ESFA/ ESF legal obligations, data is securely deleted when it is no longer required for the purposes collected.

Hard copy of Individual Learning Record (ILR), enrolment form and personal data associated with Community Learning, Foundation Study programmes, and Advanced Learner Loans:

  • Current learners and current leavers for the most up to date academic year on site in secure locked cabinet. Once learners have completed their programme their information will be archived in a secure area both on site, then off site for 6 years from the end of the financial year in which the last payment is made.

Electronic copy of Individual Learning Record (ILR), enrolment form and personal data associated with Community Learning, Foundation Study programmes, and Advanced Learner Loans:

  • Securely deleted after 6 years from the end of the financial year in which the last payment is made

 

Rights of Access

To find out about your rights under the GDPR 2018 you can go to the Information Commissioners Office (ICO) https://ico.org.uk/for-the-public/

If you have any questions about this Privacy Notice, your rights, or if you have a complaint about how your information has been used, please contact the Data Protection Officer via the Corporate Governance Team information.governance@york.gov.uk or on  01904 554145