|Date of Publication:||18 January 2018|
|First date of review||September 2024|
Purpose of Processing
City of York Council (known to the learner as York Learning) is a post 16 education and training provider. The funding used to provide this education and training comes from a variety of sources as indicated by the following:
- Education Skills and Funding Agency ( ESFA)
- European Social Fund ( ESF)
The Data Controller can be contacted through details on the separate privacy statement issued by the ESFA on the Individual Learner Record (ILR) you sign before the learner (data subject) begins their course, or on the link below.
York Learning is contractually required to process your personal data by the above funding bodies, who act as the data controller. This means that we are legally obliged to have this data as a prerequisite for you attending our learning provision. This is so the controller can meet their statutory responsibilities and exercise its functions. As part of this requirement you may be contacted by the English European Social Fund ( ESF) Managing Authority, or its agents, to carry out research and evaluation on the effectiveness of the programme.
Categories of personal data
The type of personal data captured includes name, date of birth, NINO (National Insurance Number), address, postcode, contact details such as phone or email, employment status, destination information, prior attainment level and other specialist categories of data such as ethnicity, gender and health condition/ disability status. These specialist categories of data are described as being more ‘sensitive’ than ordinary personal data and our additional legal basis for processing is that it is necessary for employment, social security and protection law in so far as it is authorised by Union and Member state law, or in the vital interests of learner.
Source of data/ Data recipients
Although most personal data is supplied directly by the learners to York Learning, we do also process personal data from elsewhere that help us to provide appropriate learning that meets all learners needs including those with additional learning needs and allows us to meet our Health and Safety, Prevent and Safeguarding obligations.
Personal data in the form of Education Health and Care Plans (EHCP) and other relevant reports from medical or therapeutic professionals – usually this data would be supplied by a Special Educational Needs Team within the relevant local authority, the learner or their family, or via a Specialist Careers Adviser or other supporting professional such as a Social Worker. This data would be shared with a chosen subcontracted partner who proposes to provide the personalised learning, in order to ascertain whether they can meet the learners’ specific needs. Again, we are legally obliged to have this data in order to provide the learning, and we also have an additional legal basis for processing special categories of data which is that it is necessary for employment, social security and protection law in so far as it is authorised by Union and Member state law, or in the vital interests of learner. As a matter of good practice, the learner will be made aware in advance that personal data could be shared with relevant bodies.
As part of our contractual obligations we will share your data with the following organisations and awarding bodies (please note the link to their privacy notices) where relevant to the learners’ accredited learning objectives:
City and Guilds www.cityandguilds.com/learner-policy
British Computer Society www.bcs.org
CIH (Chartered Institute of Housing): www.cih.org/privacy-policy
Communications and online learning
Some of our learning is delivered using online meeting software. We use Zoom for this. There is a separate DPIA to cover our use of this and it is available using the contact information below. The privacy notice for Zoom can be found here: ZOOM PRIVACY STATEMENT – Zoom
Some of our learning requires completing an electronic portfolio of assignments. We currently use Google sites for this and OneFile specifically for our apprenticeship programme only. This facility gives access to learners, their tutor and limited access to their employers (if they are an apprentice only) to complete assignments and to receive feedback. This site also monitors how often and when the site is visited by the learner and this information is available to tutors only during the lifetime of the course undertaken. All learners will be required to view a privacy notice from Google/OneFile as part of induction to Google Sites/OneFile so they understand what personal data Google/OneFile is storing and how Google/OneFile is complying with GDPR.
As Google is cloud based it is likely that this data is transferred and held securely outside of the EU. Google is part of both the EU-US and the Swiss- US Privacy Shield Framework which supports additional self regulation around data protection.
Please find the link to Google’s privacy notice here: policies.google.com/privacy/update
Please find the link to OneFile’s privacy notice here: Privacy Notice | OneFile
All other personal data is stored either internally on ICT systems hosted by City of York Council or via databases on secure servers in the UK and are only accessed by authorised personnel. Please find links to their privacy notices:
Your Consortium Ltd
Consent for processing personal data for non learning activities
As a learning provider we would like to make you aware from time to time about our other services. We will ask for your consent to contact you about these services through a clear opt in box for specific marketing services. This data will not be shared with or sold to third parties- all marketing contact about York Learning services will be conducted by York Learning.
We may also ask for learner consent to take photographs of their work as part of our celebration of their achievements or as part of ongoing marketing and publicity.
We will store all personal data securely and with restricted access within the organisation.
We will also ask you for your consent to contact to find out your destination (eg whether you have moved on to a job or other learning) after your course has finished.
The ULN is required to fulfil statutory requirements for administrations of services within the education and training sector. You cannot opt out of being issued with a ULN by the Learning Records Service.
The information you supply is used by the Learning Records Service (LRS). The LRS issues Unique Learner Numbers (ULN) and creates Personal Learning records across England, Wales and Northern Ireland, and is operated by the Education and Skills Funding Agency, an executive agency of the Department for Education (DfE).For more information about how your information is processed, and to access your Personal Learning Record, please refer to: https://www.gov.uk/government/publications/lrs-privacy-notices
However, you can opt-out of sharing your personal learning record (PLR). We will ask you for your consent to access this record, as without it we will need you to bring proof of prior achievement such as exam certificates as a prerequisite for gaining a place on a course.
Retention and Deletion
Personal data required as part of our legal obligations will either be retained until 31 December 2032 or for 6 years from the end of the financial year in which the last payment is made, depending on the regulatory framework associated with various funding streams. Personal data will be securely destroyed after the relevant retention period has elapsed. However, we will regularly review and minimise other records with the aim of partial or full deletion where possible. All data is archived both on site, and eventually off site within the following timeframes:
Hard copy of Individual Learning Record (ILR), enrolment form and personal data associated with Adult Education Budget funded accredited classroom learning or Apprenticeship provision:
- Current learners and current leavers for the most up to date academic year on site in secure locked cabinet. Once learners have completed their programme their information will be archived in a secure area both on site, then off site for until 31 December 2033.
Electronic version of Individual Learning Record (ILR) and enrolment form associated with ESF funded Adult Education Budget funded accredited classroom learning, or Apprenticeship provision:
As part of ESFA/ ESF legal obligations, data is securely deleted when it is no longer required for the purposes collected.
Hard copy of Individual Learning Record (ILR), enrolment form and personal data associated with Community Learning, Foundation Study programmes, and Advanced Learner Loans:
- Current learners and current leavers for the most up to date academic year on site in secure locked cabinet. Once learners have completed their programme their information will be archived in a secure area both on site, then off site for 6 years from the end of the financial year in which the last payment is made.
Electronic copy of Individual Learning Record (ILR), enrolment form and personal data associated with Community Learning, Foundation Study programmes, and Advanced Learner Loans:
- Securely deleted after 6 years from the end of the financial year in which the last payment is made
Rights of Access
To find out about your rights under the GDPR 2018 you can go to the Information Commissioners Office (ICO) https://ico.org.uk/for-the-public/
If you have any questions about this Privacy Notice, your rights, or if you have a complaint about how your information has been used, please contact the Data Protection Officer via the Corporate Governance Team email@example.com or on 01904 554145