Sarum College Ministry Student Privacy Policy

Updated April 2025

1. INTRODUCTION

Sarum College (registered charity number 1161253 and company registration number 951356) and its trading subsidiary, Sarum College Services Ltd. (company registration number 1931038), are committed to protecting and respecting your privacy.

This policy (and any other documents referred to in it) sets out the basis on which we will process and use any personal data about Sarum College Ministry students.

For the purposes of the DPA (Data Protection Act) 2018 and the UK General Data Protection Regulation (UK GDPR), we are the data controllers and are located at 19, The Close, Salisbury SP1 2EE.

If Sarum College and/or Sarum College Services Ltd. – or substantially all of the associated assets – are acquired by a third party, personal data will be one of the transferred assets.

Sarum College’s Data Protection Compliance Manager is Christine Nielsen-Craig, Director of Marketing and Communications, telephone: 01722 424812 and e-mail: cnc@sarum.ac.uk.

We comply with the DPA and UK GDPR in respect of the collection, processing, use, holding and storage of the personal data of Sarum College Formation in Ministry students.

We may change this policy from time to time. Although most changes are likely to be minor, we encourage you to check the policy regularly to ensure that you are happy with amendments or additions.

Sarum College and Sarum College Services Ltd. will not sell, share or rent this information to others in ways different from what is disclosed in this statement.

 

2. PERSONAL AND SENSITIVE PERSONAL DATA THAT WE COLLECT

Personal Data

We collect and use the following types of personal data about all Sarum College Ministry students:

• • title;
  • first name, middle name (if applicable), surname and salutation;
  • postal address and postcode;
  • telephone numbers (daytime, evening and mobile, as applicable);
  • e-mail address(es);
  • course and event booking records;
  • internet protocol (“IP”) addresses;
  • relationship to Sarum College including contact history and details of College involvement outside of the ministry programme (if relevant), eg whether ministry students are also donors and/or accredited students and/or tutors and/or Friends of Sarum College, as the case may be;
  • marketing preferences;
  • subject areas of interest;
  • current and previous course bookings, residential bookings and enquiry history of tentative bookings;
  • library membership;
  • where relevant, financial details related to course payments and donation, and Gift Aid number.

We also collect and use the following additional types of personal data about accredited students not in authorised ministry training pathways:

• • date of birth and age;
  • correspondence between such students and us;
  • correspondence about such students between us and tutors and/or educational authorities including, without limitation, personal data included in references and/or notes or reports in respect of the relevant students’ academic progress; and
  • records of academic progress including, without limitation, notes from tutors.

We also collect and use the following additional types of personal data about accredited students in authorised ministry training pathways:

• • date of birth and age;
  • correspondence between such students and us;
  • correspondence about such students between us and tutors and/or educational authorities including, without limitation, personal data included in references and/or notes or reports in respect of the relevant students’ academic progress;
  • records of academic progress including, without limitation, notes from tutors;
  • papers supplied by students’ sponsoring churches regarding the selection process (including, without limitation, Selection Conference Reports);
  • details of students’ families, educational backgrounds and other church and training related data;
  • emergency contact details (including first names, surnames and telephone numbers of next of kin);
  • correspondence received from sponsoring church authorities and individuals (e.g. Formation in Ministry, Circuit, Training Committee, Training Officers, Ministry Division, Diocesan Directors of Ordinands, (“DDOs”), Bishops, etc.);
  • current, past and prospective employers of our students;
  • Disclosure and Barring Service (DBS) numbers and issue dates;
  • records of grants and other payments made to students by sponsoring church authorities;
  • copies of reports about students (e.g. reports received from staff, consultants, local training ministers and placement supervisors);
  • progress reports; and
  • personal data regarding academic ability and ministerial competence.

We also collect and use the following types of information about ministry students on short courses:

• • correspondence between students/event participants and us and our academic staff and/or administrator notes; and
  • course booking histories and notes regarding areas of interest.

We collect some of the personal data set out above directly from students and event participants and some from third parties (such as other educational authorities and sponsoring church authorities).

Sensitive Personal Data

We also collect and use the following special categories of personal data, “sensitive personal data”, about students on authorised ministry pathways:

• • details of denomination and religious or philosophical beliefs, or other similar beliefs, where relevant; and
  • certain details in respect of physical or mental health or condition (including, without limitation, details of any disabilities and accessibility issues and food sensitivities/dietary requirements).

We also collect and use sensitive personal data regarding the personal and spiritual qualities required for ministry roles about our students in authorised ministry training pathways only.

We collect some of the sensitive personal data set out above directly from students and event participants and some from third parties, such as educational authorities and sponsoring church authorities.

We need the personal and sensitive personal data about students set out above so that we can consider their applications to study at Sarum College, enter into contracts with them for the purposes of providing them with higher educational services and/or ministerial training and/or administering the relevant academic courses.  The information is necessary for these purposes, so if it is not provided this is likely to mean that we will be unable to consider students’ applications, enter into contracts with them and administer them effectively and/or provide such educational services and/or training to them.

We also need the personal and sensitive personal data about event participants set out above so we can enter into contracts with them so that they can attend events connected with Sarum College and likely to be of interest to them and provide related services to them efficiently.  The information is necessary for these purposes, so if it is not provided this is likely to mean that we are unable to enter into the relevant and provide related services to them effectively.

3. HOW WE USE PERSONAL DATA AND SENSITIVE PERSONAL DATA

We obtain, collect, record, hold, store, organise, adapt, alter, retrieve, consult, disclose, destroy and otherwise use personal and sensitive personal data of accredited students not in authorised ministry training pathways, as set out in this Privacy Policy, for the following purposes:

• • student contact details and progress reports are used to enable us to operate effectively as an educational establishment;
  • administering academic matters including, without limitation, working with students to assist them in obtaining their postgraduate qualifications, (personal tutors and validating university administrators also have access to student contact details and progress reports for these purposes);
  • processing course and accommodation bookings and payments and publicising programmes and events (our course administrators and marketing, finance and hospitality staff have limited access to student contact details for these purposes);
  • if students consent, sharing student contact details with fellow students in the same academic year to facilitate communication and promote fellowship;
  • performing our obligations under any contracts that we enter into with the relevant students;
  • if students consent, providing marketing information to students in accordance with their stated preferences; and corresponding with students.

We also obtain, collect, record, hold, store, organise, adapt, alter, retrieve, consult, disclose, destroy and otherwise use personal and sensitive personal data of accredited students not in authorised ministry training pathways, as set out in this Privacy Policy, for the following purposes:

• • recording student contact details and progress reports to enable us to operate our ministry training programmes effectively.

This information is shared with: (i) students’ personal tutors; (ii) the Sarum College Principal; (iii) our administrative staff members responsible for filing and distributing this information in accordance with this Privacy Policy; (iv) sponsoring authorities, if applicable; and, Durham University.

• • providing references (usually upon student request);
  • processing course and accommodation bookings and payments and publicising programmes and events (course administrators and marketing, finance and hospitality staff have limited access to student contact details for these purposes);
  • if students consent, sharing student contact details with fellow students in the same year to facilitate communication and promote fellowship;
  • performing our obligations under any contracts that we enter into with the relevant students;
  • providing course marketing information; and
  • corresponding with students.

We also obtain, collect, record, hold, store, organise, adapt, alter, retrieve, consult, disclose, destroy and otherwise use personal and sensitive personal data of non-accredited students and event participants, as set out in this Privacy Policy, for the following purposes:

• • delivering course information, administering education programmes and administering events (course administrators and hospitality, finance and marketing staff use contact details and booking records for these purposes);
  • performing our obligations under any contracts that we enter into with the relevant students and/or event participants;
  • providing marketing information; and
  • corresponding with students.

4. HOW WE SHARE PERSONAL DATA AND SENSITIVE PERSONAL DATA

In addition to the parties mentioned above, we also share the personal data of students and event participants as necessary with:

• • any member of our group, which means our subsidiaries, our ultimate holding companies and their subsidiaries, (both “subsidiaries” and “holding company” as defined in section 1159 of the UK Companies Act 2006); and
  • selected third parties including:
    • family, associates and representatives of the relevant students or event participants, where appropriate;
    • current, past and prospective employers of our students and event participants (if requested by students);
    • educators and examining bodies; (view the University of Durham privacy policy here)
    • HMRC, central and local Government agencies and quasi Government agencies and other relevant regulatory bodies;
    • credit reference agencies;
    • debt collection and tracing agencies;
    • banks and financial organisations;
    • business partners, business associates, associate companies, advisers, suppliers, service providers and sub-contractors (for example, IT services providers and accountancy services providers) to perform any contract we enter into with them or our students and/or event participants;
    • if we sell or buy any business or assets, we will disclose the personal data of students and/or event participants to the prospective seller or buyer of such business or assets;
    • if Sarum College and/or Sarum College Services Ltd., or substantially all of the assets of one or both entities, are acquired by a third party. In this case personal data of students and event participants held by either or both will be one of the transferred assets;
    • any other third parties if we are under a duty or it is otherwise necessary or desirable to disclose to or share personal data of students and/or event participants to comply or ensure compliance with any legal obligation, or to enforce or apply the terms and/or conditions of any agreements;
    • any other third parties to the extent that this is necessary to protect the rights, property, or safety of Sarum College and/or Sarum College Services Ltd., and/or those of our students, event participants or others; and
    • our higher education validation partners (accredited student personal data which students supply to us is shared with these partners).

 

5. LEGAL BASIS FOR PROCESSING PERSONAL DATA AND SENSITIVE PERSONAL DATA

Personal Data

We rely on various legal bases to justify our processing of personal data. Further details of these are set out below.

• • In most cases, the processing will be necessary for our legitimate interests. Our legitimate interests include:
    • in respect of students, considering applications for places on academic courses, offering positions to students or informing them that applications have been unsuccessful and providing and administering educational and ministry training services to students; and
    • in respect of event participants, effective administration of events and related services.

In these circumstances our interests are not overridden by those of students or event participants or fundamental rights and/or freedoms which require the protection of personal data.

In some cases, personal data processing may be necessary to enter and perform a contract with students and event participants.

Students and event participants should seek permission from third parties to give us personal data for the purposes as set out in this Privacy Policy, such emergency contact details.

Sensitive Personal Data

We also rely on various different legal bases to justify our processing of certain sensitive personal data of our students and event participants.

Further details of these are set out below.

• • In some cases, those on non-accredited courses and events give their explicit consent to the processing of their sensitive personal data for the purposes set out above. They may withdraw their consent at any time by contacting us using the contact details set out in the “Contact and Complaints” section of this Privacy Policy (which will not affect the lawfulness of any processing of any sensitive personal data which was carried out before consent was withdrawn);
  • In other cases, the processing is carried out in the course of our legitimate activities, namely the administration of Sarum College and the provision of educational and/or ministry training related services, with appropriate safeguards and on the condition that:
    • the processing relates solely to the relevant students or event participants who have regular contact with us in connection with our purposes; and
    • that the personal data is not disclosed outside our organisation without the relevant consent.
  • In other limited cases, the processing of health-related sensitive personal data may be necessary to protect the vital interests of students, event participants and other third parties in circumstances where students or event participants are physically or legally incapable of giving consent. This legal basis for processing is only relied on in “life or death” type situations.

 

6. WHERE WE TRANSFER AND STORE PERSONAL DATA AND SENSITIVE PERSONAL DATA

The personal data that we collect from students and event participants may be transferred to and stored at destinations outside the UK with adequate protection for the personal data and sensitive personal data.

The personal and sensitive personal data that we collect from students and event participants will also be processed by staff and volunteers who work for us or for one of our suppliers. This includes those involved in, among other things, providing support services. We will take all steps reasonably necessary to ensure that all such personal and sensitive personal data of students and event participants is treated securely and in accordance with this Privacy Policy and applicable law.

• • All information that our students and event participants provide to us is stored on our secure servers. We will actively retain this data before it is destroyed, archived or anonymised according to a retention schedule.
  • Sarum College follows the University of Durham data retention schedule as outlined in its privacy policy which set out the period of time that categories of data we hold will normally be kept.
  • Data retention schedules monitor and maintain compliance with the storage limitation principle under the GDPR. The storage limitation principle states that we must not keep data longer than necessary for the purposes for which it was collected.

7. INDIVIDUALS’ RIGHTS

Students and event participants have certain rights in respect of the personal information that we hold about them.  Details of these rights are set out below. To exercise any of these rights, please contact us using the contact details set out in the “Contact and Complaints” section of this Privacy Policy below.

We will process all personal and sensitive personal data in line with the rights of students and event participants, including those set out below, in each case to the extent required by and in accordance with applicable law only (including, without limitation, in accordance with any applicable time limits and requirements regarding fees and charges).

Access.  We will confirm to students and event participants whether or not we are processing and using personal data about them at their request and, if so, provide them with access to and a copy of such personal data and the other details to which they are entitled.

Rectification.  We will correct any inaccurate personal data and complete any incomplete personal data (including by providing a supplementary statement) that we hold about students and/or event participants without undue delay at their request.

Prevention of Processing Likely to Cause Damage or Distress. We will respect students and/or event participants’ rights to require us to cease or not to begin processing their personal data for a specific purpose, or in a specific way, that is likely to cause unwarranted damage or distress, either to the relevant individual or a third party.

Erasure.  We will erase personal data concerning students and event participants at their request without undue delay in certain circumstances, for example if their personal data is no longer needed for the purposes for which it was collected or otherwise used.

Restriction.  Upon request, we will restrict the personal data processing in certain circumstances, for example if a student believes that the personal data we hold is inaccurate.

Data Portability. We will respect the rights of students and event participants in certain circumstances to receive the personal data provided to us in a structured, commonly used and machine readable format and to transmit such personal data to another data controller without hindrance.

Right to Object. We will respect the general rights of students and event participants to object to processing their personal data in certain circumstances.

Right to Object to Marketing.  We will respect the rights of students and event participants regarding the use of personal data for direct marketing purposes.  In particular, if at any time individuals ask us not to use or process personal data for direct marketing (including profiling) we will not begin or we will cease to do so.

We will usually inform students and event participants (before collecting their data) if we intend to use their data for such purposes or if we intend to disclose their information to any third party for such purposes.  Students and event participants can exercise their right to prevent such processing by noting preferences on the forms we use to collect data, or otherwise at any time by contacting us using the contact details set out below in the “Contacts and Complaints” section of this Privacy Policy.

Automated Individual Decision-Making, Including Profiling.  We will respect the rights of students and event participants in certain circumstances (which are subject to certain exceptions) not to be subject to decisions which are based solely on automated processing of their personal data, including profiling, especially where such processing has legal or other significant effects on them.  We inform students and event participants about any such decisions.  Subject to certain exceptions, we will usually obtain explicit consent before making any decisions based solely on automated processing activities and put in place appropriate safeguards to protect their rights, freedoms and legitimate interests in these circumstances.  Among other things, students and event participants can request a review of automated decisions to comment and contest any such decisions.

We will not make any automated decisions based on sensitive personal data unless we have obtained explicit consent from individuals to do so, or this is otherwise necessary for substantial public interest reasons based on applicable law.

Scientific or Historical Research Purposes or Statistical Purposes.  To the extent relevant, we will respect the rights of students and event participants to object to our processing of their personal data for scientific or historical research purposes, or statistical purposes, unless this is necessary to perform a task which is carried out for reasons of substantial public interest.

8. CHANGES TO OUR PRIVACY POLICY

Any changes we make to our Privacy Policy in the future will be posted on this page and, where appropriate, notified to students and event participants by e-mail or SarumLearn. Students should check the policy from time to time for updates or changes to our Privacy Policy.

9. CONTACT AND COMPLAINTS

Questions, comments, requests or complaints regarding this Privacy Policy and/or our use of your personal information should be addressed to Christine Nielsen-Craig

If you have any complaints regarding this Privacy Policy you may also contact the UK Information Commissioner at telephone number 0303 123 1113 or https://ico.org.uk/.