We understand that privacy and the security of your personal information is extremely important. This policy sets out what we do with your information and what we do to keep it secure. It also explains where and how we collect your personal information, as well as your rights over the personal information we hold about you.
This policy relates to The Bedford College Group (registered Bedford College) and includes the brands Bedford College, National College for Motorsport, Shuttleworth College, The Bedford Sixth Form and Tresham College. It also includes any other brands we add to this group in the future.
This policy applies to students, prospective students and employees, and visitors who attend one of our campuses, visit our website and social media pages or contact the College by other means.
1.1 If you apply for a course or enrol
a) We collect the following personal data under GDPR Article 6.1c (Legal Obligation), and 6.1e
(Public Task) in order to meet our legal obligations with the Education & Skills Funding Agency (ESFA) and Office for Students (OfS). They are also necessary in order for us to carry out our public task to provide education and training. We are required by ESFA to retain this data until at least 2030:
b) We collect data about criminal convictions in order to protect vital interests of others under GDPR Article 6.1d (Vital Interest) and also in order to carry out our duty to support those with a conviction GDPR Article 6.1e (Public Task).
c) We collect your sexual orientation and religion under GDPR Article 6f (Legitimate Interests) so that we can ensure that you are not discriminated against in any way.
d) We collect parent/carer/emergency contacts under GDPR Article 6.1d (Vital Interests) and Article 6.1e (Public Task) in order to support your education and learning as fully as possible. For those over age 18 at the start of the academic year, the information is optional.
e) We collect your bank details if you need to pay for your course or you are in receipt of a bursary under GDPR Article 6.1b (Contracts). If you pay for a course online, your card information is not held by us. It is collected by our third party payment processors who specialise in the secure online capture and processing of credit/debit card transactions.
f) We collect the name of your last school under GDPR Article 6.1f (Legitimate Interests) so that we can monitor progression from our feeder schools..
g) We collect your consent to keep in touch with you about our products and services, future events and College news, and to take photography and record audio and video content to showcase the College to prospective students and the community (GDPR Article 6.1a Consent).
h) We take your photograph to display on your College ID card under GDPR Article 6.1f (Legitimate Interests) ensure the safety of all our students and provide you access to our facilities.
1.2 If you make an enquiry, book to attend an event or enter a competition
a) We collect personal contact details under GDPR Article 6.1b (Contracts) including email address and mobile telephone number and postal address so that we can respond to you.
b) For enquiries and events, we collect your date of birth under GDPR Article 6.1b (Contracts) so that we can uniquely identify you if you wish to follow up your enquiry or attendance.
c) In some cases, we collect the name of your last school and your subject interests under GDPR Article 6.1f (Legitimate Interests) so that we can monitor progression from our feeder schools.
d) We collect your consent to keep in touch with you about our products and services, future events and College news (GDPR Article 6.1a Consent).
1.3 If you visit our websites
a) We place cookies and text files on your computer to collect data on your behaviour on our websites under GDPR Article 6.1f (Legitimate Interests) so that we can tailor our website content to you and connect with you online (see our Cookies & Remarketing Policy at www.bedford.ac.uk/downloads).
1.4 If you apply for a job
a) We collect personal information, such as name, address, contact details, employment history, qualifications achieved under GDPR Article 6.1b (Contracts) so that we can process your job application.
b) We also collect special categories of data such as gender, age, ethnic group, religious beliefs, disability and sexual orientation, and information about your health under GDPR Article 6.1c (Legal Obligations) in relation to equalities and non-discrimination.
1.5 If you attend one of our campuses
a) We may capture your image on our CCTV systems under GDPR Article 6.1f (Legitimate Interests) to ensure the safety of our students, staff and visitors, and the protection of our buildings and assets.
b) If you are a visitor, we will also collect your name, company (if applicable) and car registration number under GDPR Article 6.1f (Legitimate interests) for the same reason.
c) We monitor your internet browsing under GDPR Article 6.1f (Legitimate Interests) to ensure the safety of our students.
We collect and process your personal data to:
We are committed to being transparent about what we collect, how we use your data and meeting our data protection obligations. The Bedford College Group needs to collect and process data so we can provide you with the highest standards of service we are able to give, and to meet its legal obligations from government organisations such as the DfE and OfS. Data regarding employment status and benefits is required to assess your eligibility for fee discounts, support or access to student bursaries.
Where the organisation processes other special categories of personal data, such as information about age, gender, ethnic origin, disability or health, this is done for the purposes of equal opportunities monitoring and monitor our service provision to improve our services to specific groups. We also use the data so we can personalise the provision to each student to provide them with the best possible opportunities to succeed.
Most of the information above is collected directly from you via online forms on our websites, application forms, enrolment forms or in person over the telephone or face-to-face. However some information such as previous qualifications, or special needs, may be collected from other organisations such as the DfE, the Local Education Authority, or your previous school.
If you do not provide the data required to meet legal obligations, we will not be able to enrol you as a student. If you do not provide the other information we request, for example whether you have a learning difficulty or disability, it may result in us being unable to provide the high standard of service we would wish to deliver.
Your personal information is stored securely in a range of different places, including student information and recruitment management systems, on electronic documents within a secure network and on paper, stored in secure places and with restricted access by only those authorised.
Your information may be shared internally, including with any staff from The Bedford College Group who need the data to provide services to students. This will include special categories of data where appropriate.
The College will only share your data with third parties where there is a legal obligation to do so, including ESFA, OfS, Learner Records Service (LRS), examination bodies, Student Loans Company (SLC) and local authorities.
From time to time, we engage non-statutory third parties to process personal data on our behalf, for example to follow up course applications during busy periods or undertake research. Where this happens, we require these parties to do so on the basis of written instructions, under a duty of confidentiality and an obligation to implement appropriate technical and organisational measures to ensure the security of data, and never to use it for their own direct marketing purposes. We will only disclose personal information that is necessary to carry out the task or provide the service to you on our behalf.
6.1 ESFA Data Sharing Agreement
This privacy notice is issued by the Education and Skills Funding Agency (ESFA), on behalf of the Secretary of State for the Department of Education (DfE). It is to inform students how their personal information will be used by the DfE, the ESFA (an executive agency of the DfE) and any successor bodies to these organisations. For the purposes of relevant data protection legislation, the DfE is the data controller for personal data processed by the ESFA.
Your information may be shared with third parties for education, training, employment and well-being related purposes, including for research. This will only take place where the law allows it and the sharing is in compliance with data protection legislation.
The English European Social Fund (ESF) Managing Authority (or agents acting on its behalf) may contact you in order for them to carry out research and evaluation to inform the effectiveness of training.
Further information about use of and access to your personal data, and details of organisations with whom we regularly share data, are available at: information about how long we retain your data, and how to change your consent to being contacted, please visit: https://www.gov.uk/government/publications/esfa-privacy-notice
6.2 LRS Data Sharing Agreement
The information you supply will be used by the Skills Funding Agency, an executive agency of the Department for Education (DfE), to issue you with a Unique Learner Number (ULN), and to create your Personal Learning Record. For more information about how your information is processed and shared refer to the Extended Privacy Notice available on gov.uk
Where Bedford College engages non-statutory third parties to process personal data on its behalf, we require them to do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
The organisation takes the security of your personal information very seriously. We have policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. Our Data Protection Policy is available to view on our website at www.tresham.ac.uk/about-us/our-policies).
We review our retention periods for personal information on a regular basis.
We are legally required to hold some types of information to fulfil our statutory obligations, for example all personal data collected and processed on behalf of the ESFA or OfS is held for as long as we are legally required to do so, currently until at least 2030.
Other data will be held as long as is necessary to fulfil our duty as a college and/or to undertake relevant activity. See our Retention Policy at www.tresham.ac.uk/about-us/our-policies for more details.
From time to time, we would like to tell you about our products and services, events and College news we think you might be interested in. We will do this by post and, where you have consented to us doing so, we may also do this by email, text message or telephone. We will not send you marketing messages if you tell us not to.
As a student, and where you have consented to us doing so, we may also take photographs, audio and video of your time here to showcase the College to prospective students and the community.
You can change your marketing preferences at any time by contacting us as set out below.
Our websites contain links to other websites. This Privacy Statement only applies to this website so when you link to other websites you should read their own privacy statements.
When using one of our websites, you may be able to share information through social networks like Facebook and Twitter. For example when you ‘like’ or ‘share’ a new story. When doing this your personal information may be visible to the providers of those social networks, their other users and/or The Bedford College Group. Please remember it is your responsibility to set appropriate privacy settings on your social network accounts so you are comfortable with how your information is used and shared on them.
You can engage with us on social media through one of our official social media pages. To participate in these you will need to like our page and can opt-out at any time.
You have the right to:
If you would like to exercise any of these rights, please contact us as set out below.
If you would like to exercise one of your rights as set out above, or have a question or complaint about this Policy, the way your personal information is processed, please contact us:
For data breaches:
By email: firstname.lastname@example.org
By post: Data Protection Officer for The Bedford College Group, DPO Centre, The DPO Centre Ltd, 50 Liverpool Street, London EC2M 7PY
For all other enquiries:
By email: email@example.com
By post: Student Data, The Bedford College Group (Registered Bedford College), Cauldwell Street, Bedford MK42 9AH