Privacy Policy for Winchester MA students

Sarum College Privacy Policy
For students on Winchester University-validated programmes

Who We Are
Sarum College and our trading subsidiary, Sarum College Services Ltd., (“Sarum”, “we”, “us” or “our”) are committed to protecting and respecting your privacy. This Privacy Policy (and any other documents referred to in it) sets out the basis on which we will process and use any personal information about students enrolled in Sarum College postgraduate study programmes validated by the University of Winchester. Please read this Privacy Policy carefully to understand our practices regarding your personal information and how we will treat it.

We are legally obliged to protect personal information that we collect and use under the Data Protection Act 2018, (the “DPA”) and the General Data Protection Regulation (EU) 2016/679, (the “GDPR”). For the purposes of the DPA and the GDPR we are the data controllers and are located at 19, The Close, Salisbury SP1 2EE.

Our data protection compliance manager is Christine Nielsen-Craig, Director of Marketing and Communications. Contact information

Personal Data We Collect

We collect and use certain types of personal data about students on University of Winchester-validated programmed directly:
1. Your name and contact details (including your title, first name, middle name, (if applicable) surname and salutation, postal address and postcode, telephone numbers (daytime, evening and mobile, as applicable), e-mail address(es) and internet protocol (“IP”) address(es), (if relevant).
2. Details of your current and previous course and event bookings, residential bookings and booking enquiry history, including financial details related to course and event payments.
3. If you ask us to collect these, details of whether, when and how you agree to receive marketing messages from us, and subject areas of interest. Certain personal information connected with correspondence with you (whether by post, telephone, e-mail or otherwise).

We may also collect directly from you and use certain other types of personal data:
1. Details of your relationship to Sarum more broadly than your status as a postgraduate student, if relevant.
[We may collect and use details of, for example, whether students are also donors and/or accredited students and/or tutors and/or Friends of Sarum, details of library membership (if relevant) and financial details related to donation, including your Gift Aid number, if applicable.]
• Emergency contact details (including first names, surnames and telephone numbers of next of kin).

We may also collect and use certain other types of personal data directly from you and from third parties, such as educational authorities and sponsoring church authorities. Such data includes:
1. Your date of birth and age.
2. Correspondence about you between us and tutors and/or educational authorities (including, without limitation, references).
3. Records of your academic progress (e.g. notes and/or reports from tutors).

Legal Basis for Processing Personal Data
We need the personal data set out above so that we can administer your applications, provide to you and administer educational services, organise and administer events. Without this information, we may be unable to consider and administer your application and your progress as a student.
We collect and use your personal data as necessary for the purposes of these legitimate interests.
We also collect and use some of your personal information where this is necessary to perform contracts with you, or to take steps at your request prior to entering into such contracts.
We also collect and use some of your personal data if required to comply with our legal obligations.
We also collect and use some of your personal information for marketing purposes as set out in this Privacy Policy if you agree to this. You may withdraw your consent at any time by contacting us using the contact details set out in the “Contacts and Complaints” section of this Privacy Policy below.

Special categories of data we collect
We may collect and use certain types of personal data about the following individuals:

1. All those who attend courses and events operated by Sarum College.
We may collect and use various special categories of data of a sensitive nature about all students of and participants in events. We collect some of this data from you and some from third parties, such as educational authorities and medical professionals. Such data includes details concerning any relevant disabilities, allergies, food sensitivities, dietary requirements, access requirements to accommodate your needs during courses and residential stays.

Legal Basis for Processing Special Categories of Data

We use some of the special categories of personal data set out above to administer educational services. Without this information, we may be unable to provide you with the training that you have requested. We use other special categories of data set out above to accommodate any dietary and access requirements that you may have during your visits to Sarum. Without this information, we may be unable to provide you with particular goods or services that you have requested (e.g. we may be unable to arrange for special meals or to guarantee particular access requirements).
We collect and use some special categories of data with your explicit consent. If you consent to the use of your special categories of data, you may withdraw your consent at any time (however, please note that if you withdraw consent to the processing of certain of their special categories of data, we may be unable to continue to provide you with some education services).

We also collect and use some of your special categories of data in the course of our legitimate activities (as an educational establishment, a promoter of social improvement and as a fundraiser), with appropriate safeguards. Such processing relates solely to you as our students, former student, or someone who has regular contact with us in connection with our purposes and your special categories of data are not disclosed outside our organisation without your consent.
We also may need to use or disclose your health related special categories of data if necessary to protect you or someone else in “life or death” situations, (e.g. in medical emergencies where we need to urgently disclose special categories of data about your health to medical professionals) if you are unable to agree to this.

How we use personal information

We use personal data and special categories of data about students on our courses for various purposes including:
1. Operating effectively as an educational establishment, delivering course information and administering education and training programmes, academic matters and events, (for example, public lectures and performances).
2. Processing course and accommodation bookings and payments.
3. Publicising programmes and events.
4. Performing our obligations under any contracts that we enter into with you.
5. If you agree, providing marketing information to you in accordance with your stated preferences.
6. Corresponding with you.

How we share personal information
We share student personal data, as necessary, with:
1. Any member of our group, which means our subsidiaries, our ultimate holding companies and their subsidiaries.
2. Selected third parties, such as business partners, service providers and their staff to perform contracts that we enter into with them or you. We may share your personal information with selected third parties, including with our business partners and associates, advisers, suppliers, service providers and sub-contractors, such as IT services providers and accountancy services providers, providers of technical services, search engine providers and analytics providers, to perform any contract we enter into with them or you.
• Your current, past and prospective employers (if you ask us to do this).
• Educators and examining bodies.
• HMRC, central and local Government agencies and quasi Government agencies and other relevant regulatory bodies.
• Credit reference agencies and debt collection and tracing agencies.
• Banks and financial organisations.
• Our higher education validation partners in the case of accredited student personal data.
• Prospective or actual buyers of our business or assets, which may include your personal information.
• Any other third parties if necessary to comply with legal obligations or enforce agreements.
• Any other third parties if this is necessary to protect our or your rights, property, or safety and/or those of others.

Where we transfer personal information
The personal data and special categories of data that we collect from students of and participants in events operated by Sarum College may be transferred to and stored at destinations outside the UK. As such, adequate protection for such data will be ensured.

Retention of personal information
We may not keep your personal information for longer than is necessary for the purposes for which it was collected and we will keep it for limited and appropriate time periods only in accordance with certain retention schedules. Such retention schedules set out the periods of time for which categories of personal data that we hold would usually be kept. These retention schedules support us in monitoring and maintaining compliance with the storage limitation principle under the GDPR and DPA18. We will regularly review any personal information that we hold to ensure that it is only kept for an appropriate time.

Your rights regarding your personal information
You have certain rights in respect of the personal information that we hold about you and details are set out below. To exercise any of these rights, please contact us (see the “Contact and Complaints” section of this Privacy Policy below):
We will process all your personal information in line with your rights, in each case to the extent required by and in accordance with applicable law only (including, in accordance with any applicable time limits and requirements regarding fees and charges). We will respect your personal information rights in respect of:
1. Access.
[We will confirm to you whether or not we are processing and using personal information about you, at your request and, if so, provide you with access to and a copy of such personal information and the other details to which you are entitled.]
• Rectification.
[We will correct any inaccurate personal information and complete any incomplete personal information (including by providing a supplementary statement) that we hold about you.]
• Erasure.
[We will erase your personal information at your request without undue delay in certain circumstances.]
• Restriction.
[We will restrict the processing of your personal data in certain circumstances at your request.]
• Data portability.
[We will provide you or third parties on your behalf with a copy of any personal information that we hold about you which you have provided to us in a structured, commonly used and machine readable format in certain circumstances.]
• Objection (including objection to direct marketing).
[We will respect your general rights to object to the processing of your personal information in certain circumstances, including for direct marketing purposes. We will usually inform you (before collecting your information) if we intend to use your information for such purposes or if we intend to disclose your information to any third party for such purposes.]
• Automated decisions and profiling.
[Where requested and, if relevant, we will not make decisions based on automated processing, including profiling and we will ensure that you can always obtain a review by one of our staff members of any automated decisions and are able to express your point of view and contest any such decisions. We will not make any automated decisions based on special categories of data unless we have obtained your explicit consent to do so, or this is otherwise necessary for substantial public interest reasons based on applicable law.]
• Scientific or Historical Research Purposes or Statistical Purposes.
[To the extent relevant, we will respect your rights to object to our processing of your personal information for scientific or historical research purposes, or statistical purposes, unless this is necessary to perform a task which is carried out for reasons of substantial public interest.]

Changes to Our Privacy Policy
We reserve the right to modify this Privacy Policy from time to time. Any changes we make in the future will be posted on this page and, where appropriate, students and event participants will be notified by e-mail. You should check regularly to see any updates or changes to our Privacy Policy.

Contact and Complaints
Questions, comments, requests or complaints regarding this Privacy Policy and/or our use of your personal information should be addressed to Christine Nielsen-Craig, cnc@sarum.ac.uk

If you have any complaints regarding this Privacy Policy you may also contact the UK Information Commissioner at telephone number 0303 123 1113 or https://ico.org.uk/.