Terms, Conditions & Policies.
Please enter your search term below
1. INTRODUCTION
SCL Education Group is committed to preserving the privacy of its staff and students, and to comply with the Data Protection Act (2018) and the General Data Protection Regulation (GDPR).
The data protection principles are set out in the Data Protection Act (2018). Article 5 of the General Data Protection Regulation requires that personal data shall be:
2. PURPOSE
SCL Education Group processes personal data to fulfil contractual obligations, salary and benefits, holiday and sickness, funding claims, performance and achievement, safeguarding, equality diversity and inclusion, health & safety, accident reports, disciplinary, provision of education, support and advice to the students and clients, to promote the services, for publications, financial and staffing records, and other statutory obligations. Processing of this data also includes the use of CCTV in order to monitor and maintain the security of the premises and for the prevention or detection of crime. This is not an exhaustive list.
3. DEFINITIONS
Personal data is defined as data relating to a living individual who can be identified from that data alone, or with other data held by SCL or which SCL is likely to receive. This includes sensitive data relating to an individual’s gender, age, ethnicity, disability, trade union membership, political opinions, religious or similar beliefs, physical or mental health, sexual life, commission or alleged commission of any offence or information concerning related criminal proceedings or outcomes.
The GDPR regulates the “processing” of personal information which has a very broad meaning and includes obtaining, storing, viewing, using, updating, disclosing and destroying any data held electronically, in structured manual records and to a limited extent to unstructured manual records. SCL is committed to using personal data responsibly to protect and keep secure from loss or destruction.
The requirements SCL has for processing personal data are recorded on the public register maintained by the Information Commissioner’s Office (ICO). SCL notify and renew the notification on an annual basis as the law requires. If there are any interim changes, these will be notified to the ico within 28 days. SCL’s registration with the Information Commissioner’s Register of Data Controllers is : ZA063549, and can be found using this link: https://ico.org.uk/esdwebpages/search
4. POLICY STATEMENT
This policy outlines the responsibilities of all staff (including 3rd parties under contract, and or self-employed / volunteers) with regard to the Data Protection Act (2018) and the General Data Protection Regulation.
Staff are required to handle and process data in any of SCL’s records or systems in accordance with this policy and in accordance with other related policies concerning the handling or processing of data.
5. IMPLEMENTATION
To meet the responsibilities SCL will:
6. TRAINING
Training relating to responsibilities and awareness of GDPR for SCL can include any of the following:
7. SCL POLICIES AND LEGISLATIVE CONNECTIONS
The following Policies and guidance are relevant to personal information.
SCL will adhere to its obligations under the Regulation relevant to the use and monitoring of electronic communications, which are predominantly:
8. DATA SECURITY
SCL has an Information Security Policy that staff must adhere to in order to ensure personal information is protected from unauthorised viewing and from loss (including computer documents, emails and paper copies by ensuring staff are provided with adequate awareness training and follow guidelines set out in the GDPR code of practice:
SCL will take steps to ensure that personal data is kept secure at all times against unauthorised or unlawful loss or disclosure. All users must take reasonable responsibility to ensure the data is accurate and up to date, relevant and not excessive. Any unauthorised disclosure of personal data to a third party by any staff member may result in disciplinary or legal action.
Failure to comply with policies and procedures for handling staff/student data is a disciplinary offence which may be considered gross misconduct and may also involve personal criminal liability.
9. DATA SUBJECT RIGHTS / SUBJECT ACCESS REQUESTS
Individuals have a right under the GDPR to ask SCL if it holds their personal data, and if so, be provided with a copy of it. Any person wishing to exercise this right should apply in writing to SCL, or via SCL website.
In order to ensure SCL has met the security requirements of the GDPR. The following information will be required before access is granted: (relevant identifying details including, Full name, Date of birth, National insurance number. SCL may also require proof of identity.
The following forms of ID will be acceptable: birth certificate, passport, or driving licence.
Subject Access Requests will be dealt with in line with the GDPR recommended timescales. SCL will aim to comply with requests for access to personal information as soon as possible but will ensure it is provided within one month as required by the Regulation from receiving the written request. SCL will provide the information in a clear format that is easily understood and, in a format, suitable for the requesters needs. SCL may request further details to clarify the exact requirements prior to the start of the one month.
If an individual considers the details provided in response to a subject access request are incorrect or out of date, they should contact SCL immediately.
Anyone whose personal information SCL processes has the right to know:
It is a criminal offence under the GDPR for any user to alter, illegally access, deface or remove any record (including e-mails) following receipt of an information request. SCL will take necessary action against any individual who is found to have carried out this act, which may result in disciplinary or legal action. Other Criminal acts under GDPR may also result in disciplinary or criminal proceedings; definitions can be found at www.ico.org.uk
If you have any queries or concerns regarding SCL’s management of personal data, then you can contact SCL directly.
Any comments or complaints will be dealt with through SCL complaints procedure. SCL will maintain records of all complaints and their outcome.
If you are still unhappy after having made a complaint individual can contact the ico through their website: www.ico.org.uk.
10. DATA SHARING
There are occasions when it is necessary for SCL to share data with other organisations or people and where consent is required SCL will seek and gain this from the Data Subject except where exemptions apply i.e.:
For further information, access the website of the ico: https://ico.org.uk/
11. RETENTION AND DISPOSAL OF DATA
SCL will retain information about staff and students for as long as is reasonable and necessary to comply with the law and for legitimate business needs. This will include information needed in connection with administering pensions and taxation, for potential or current disputes or litigation regarding employment, in the case of job applicants, in relation to any complaints or claims regarding the selection process, and information required for job references.
For students this will include information needed in connection with administering student applications, enrolment, attendance, achievement, success, post-college destinations, personal tutor notes, academic records, and information required for references, and in the case of prospective students, in relation to any enquiries, applications and interviews.
SCL will dispose of data in line with SCL Data Retention Policy written in conjunction with JISC recommended data retention principles for Further Education, any legal and funding audit requirements. Once the retention period has elapsed, SCL will ensure that any information is destroyed by secure means, i.e., by shredding, pulping or burning for hard copy, deletion etc. for electronic/digitised copy. SCL will use a reputable ISO Accredited company and obtain destruction certification.
12. DATA SECURITY BREACH PROCEDURE
SCL takes the risk to security loss very seriously and adheres to the legal framework set down by the Information Commissioner’s Office and industry standards. SCL has a Breach Management Procedure to be followed in the event of a data breach or suspected data breach to ensure SCL responds and effectively manages any breach in line with the GDPR recommendations. Actions may include:
Notification of breaches – if appropriate SCL Education Group will inform a Data Subject about an information security breach, the ICO; (and if in doubt will consult) other regulatory bodies; other third parties such as the police and the banks; or the media.
1. INTRODUCTION
SCL Education Group is committed to preserving the privacy of its staff and students, and to comply with the Data Protection Act (2018) and the General Data Protection Regulation (GDPR).
The data protection principles are set out in the Data Protection Act (2018). Article 5 of the General Data Protection Regulation requires that personal data shall be:
2. PURPOSE
SCL Education Group processes personal data to fulfil contractual obligations, salary and benefits, holiday and sickness, funding claims, performance and achievement, safeguarding, equality diversity and inclusion, health & safety, accident reports, disciplinary, provision of education, support and advice to the students and clients, to promote the services, for publications, financial and staffing records, and other statutory obligations. Processing of this data also includes the use of CCTV in order to monitor and maintain the security of the premises and for the prevention or detection of crime. This is not an exhaustive list.
3. DEFINITIONS
Personal data is defined as data relating to a living individual who can be identified from that data alone, or with other data held by SCL or which SCL is likely to receive. This includes sensitive data relating to an individual’s gender, age, ethnicity, disability, trade union membership, political opinions, religious or similar beliefs, physical or mental health, sexual life, commission or alleged commission of any offence or information concerning related criminal proceedings or outcomes.
The GDPR regulates the “processing” of personal information which has a very broad meaning and includes obtaining, storing, viewing, using, updating, disclosing and destroying any data held electronically, in structured manual records and to a limited extent to unstructured manual records. SCL is committed to using personal data responsibly to protect and keep secure from loss or destruction.
The requirements SCL has for processing personal data are recorded on the public register maintained by the Information Commissioner’s Office (ICO). SCL notify and renew the notification on an annual basis as the law requires. If there are any interim changes, these will be notified to the ico within 28 days. SCL’s registration with the Information Commissioner’s Register of Data Controllers is : ZA063549, and can be found using this link: https://ico.org.uk/esdwebpages/search
4. POLICY STATEMENT
This policy outlines the responsibilities of all staff (including 3rd parties under contract, and or self-employed / volunteers) with regard to the Data Protection Act (2018) and the General Data Protection Regulation.
Staff are required to handle and process data in any of SCL’s records or systems in accordance with this policy and in accordance with other related policies concerning the handling or processing of data.
5. IMPLEMENTATION
To meet the responsibilities SCL will:
6. TRAINING
Training relating to responsibilities and awareness of GDPR for SCL can include any of the following:
7. SCL POLICIES AND LEGISLATIVE CONNECTIONS
The following Policies and guidance are relevant to personal information.
SCL will adhere to its obligations under the Regulation relevant to the use and monitoring of electronic communications, which are predominantly:
8. DATA SECURITY
SCL has an Information Security Policy that staff must adhere to in order to ensure personal information is protected from unauthorised viewing and from loss (including computer documents, emails and paper copies by ensuring staff are provided with adequate awareness training and follow guidelines set out in the GDPR code of practice:
SCL will take steps to ensure that personal data is kept secure at all times against unauthorised or unlawful loss or disclosure. All users must take reasonable responsibility to ensure the data is accurate and up to date, relevant and not excessive. Any unauthorised disclosure of personal data to a third party by any staff member may result in disciplinary or legal action.
Failure to comply with policies and procedures for handling staff/student data is a disciplinary offence which may be considered gross misconduct and may also involve personal criminal liability.
9. DATA SUBJECT RIGHTS / SUBJECT ACCESS REQUESTS
Individuals have a right under the GDPR to ask SCL if it holds their personal data, and if so, be provided with a copy of it. Any person wishing to exercise this right should apply in writing to SCL, or via SCL website.
In order to ensure SCL has met the security requirements of the GDPR. The following information will be required before access is granted: (relevant identifying details including, Full name, Date of birth, National insurance number. SCL may also require proof of identity.
The following forms of ID will be acceptable: birth certificate, passport, or driving licence.
Subject Access Requests will be dealt with in line with the GDPR recommended timescales. SCL will aim to comply with requests for access to personal information as soon as possible but will ensure it is provided within one month as required by the Regulation from receiving the written request. SCL will provide the information in a clear format that is easily understood and, in a format, suitable for the requesters needs. SCL may request further details to clarify the exact requirements prior to the start of the one month.
If an individual considers the details provided in response to a subject access request are incorrect or out of date, they should contact SCL immediately.
Anyone whose personal information SCL processes has the right to know:
It is a criminal offence under the GDPR for any user to alter, illegally access, deface or remove any record (including e-mails) following receipt of an information request. SCL will take necessary action against any individual who is found to have carried out this act, which may result in disciplinary or legal action. Other Criminal acts under GDPR may also result in disciplinary or criminal proceedings; definitions can be found at www.ico.org.uk
If you have any queries or concerns regarding SCL’s management of personal data, then you can contact SCL directly.
Any comments or complaints will be dealt with through SCL complaints procedure. SCL will maintain records of all complaints and their outcome.
If you are still unhappy after having made a complaint individual can contact the ico through their website: www.ico.org.uk.
10. DATA SHARING
There are occasions when it is necessary for SCL to share data with other organisations or people and where consent is required SCL will seek and gain this from the Data Subject except where exemptions apply i.e.:
For further information, access the website of the ico: https://ico.org.uk/
11. RETENTION AND DISPOSAL OF DATA
SCL will retain information about staff and students for as long as is reasonable and necessary to comply with the law and for legitimate business needs. This will include information needed in connection with administering pensions and taxation, for potential or current disputes or litigation regarding employment, in the case of job applicants, in relation to any complaints or claims regarding the selection process, and information required for job references.
For students this will include information needed in connection with administering student applications, enrolment, attendance, achievement, success, post-college destinations, personal tutor notes, academic records, and information required for references, and in the case of prospective students, in relation to any enquiries, applications and interviews.
SCL will dispose of data in line with SCL Data Retention Policy written in conjunction with JISC recommended data retention principles for Further Education, any legal and funding audit requirements. Once the retention period has elapsed, SCL will ensure that any information is destroyed by secure means, i.e., by shredding, pulping or burning for hard copy, deletion etc. for electronic/digitised copy. SCL will use a reputable ISO Accredited company and obtain destruction certification.
12. DATA SECURITY BREACH PROCEDURE
SCL takes the risk to security loss very seriously and adheres to the legal framework set down by the Information Commissioner’s Office and industry standards. SCL has a Breach Management Procedure to be followed in the event of a data breach or suspected data breach to ensure SCL responds and effectively manages any breach in line with the GDPR recommendations. Actions may include:
Notification of breaches – if appropriate SCL Education Group will inform a Data Subject about an information security breach, the ICO; (and if in doubt will consult) other regulatory bodies; other third parties such as the police and the banks; or the media.