GDPR 2018 PRIVACY POLICY

Visitors to our website

Lewis College uses a third-party service to help maintain the security and performance of the Lewis College website. To deliver this service it processes the IP addresses of visitors to the Lewis College website.

We use a standard WordPress service to run our website. We collect anonymous information about users’ activity on the site, for example the number of users viewing pages on the site, to monitor and report on the effectiveness of the site and help us improve it.

Lewis College also uses AdWords for marketing purposes. Please see AdWords Privacy Policy in connection with their service.

We do not share any information with third parties other than as described in the AdWords Privacy Policy.

Use of cookies by the Lewis College

We use cookies for statistical reasons and to personalise adverts. We share this information with our analytical and advertising partners, who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. You will be given an option to consent to this when visiting the website for the first time.

Social Media

Any messages or other forms of contact made to us via our social media channels may be responded to by our Social Media team if relevant. This information is not processed for marketing or used in any other way by us or shared with any third-parties.

Pictures/Images

If a student provides us with a picture of themselves in connection with any social media promotion this is deleted from our storage as soon as the picture is uploaded to the social media platform.

Links to other websites

This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

Enquirers

Those enquiring about our courses either through submission of an enquiry form or by email will have the relevant personal information stored on our systems for a period of 12 months. After such time personal details will be erased. This is in our legitimate interest as from experience, some enquirers can take from anything up to 12 months from the initial enquiry to booking confirmation.

In order to provide a good customer service, the ability to provide continuity to the enquirer, review any information regarding the student’s suitability for the course, (which is a requirement of our awarding body), we hold submitted information through the enquiry form for 12 months.

If you enquire details of our services and courses by telephone your details are provided to the relevant member of staff to respond. Any manual records are immediately destroyed.

The personal details of an enquirer are not used for remarketing purposes, we will not contact you again with new marketing material. We do not share any information with third parties.

Enrolling on a Course

To enrol on a course, you will need to complete an enrolment form which will form the basis of the Contract between us. The personal details include name and address, contact details, details of the course you wish to enrol on, course fees, payment method, start and end date, overview of career and training history.

We need to have your personal details to complete the Contract between us as well as to comply with identification requirements by our awarding bodies.

Completed Enrolment Forms are stored for 3 years after your course has been claimed for certification, whether partial or in full, to comply with requirements by the awarding body, unless you close your course without completion of any Assessments.

In this situation your Enrolment Form will be stored for a period of 1 year from the date of the course closure request, in case you wish to resume your course.

If you make no contact with the college over a period of time, we will email you and ask what you would like to do with your course. If no contact is made after this, the enrolment form is deleted one year from the date of this email being sent.

Enrolment forms are also stored for this period of time in order for us to apply Recognised Previous Learning (RPL). It is deemed any work completed longer than 3 years ago, is no longer current and RPL cannot be applied.

After the 3-year period, the enrolment form will be erased.

All enrolment forms are stored electronically. Any paper-based enrolment forms received through the post are scanned and then stored electronically. The paper-based version is destroyed (shredded).

Identification Documents

We shall also need to see identification documents e.g. copy of passport or driving licence and utility bill to confirm your identification and to ensure it matches the enrolment form. This is a requirement by the awarding bodies.

We ask that you send photos of your identification documents to us through What’s App. We chose this application because it has end to end encryption, ensuring that your identification documents cannot fall into the wrong hands.

For more information on the security of What’s App; https://www.whatsapp.com/security.

All images of identification document are deleted once they have been confirmed by a member of our Admin Team.

For those that don’t have access to What’s App, we also offer a video call, to be arranged at a convenient time, through Skype. During the call you will be required to show your identification documents to a member of our Admin Team who will confirm the identification. The call is not recorded.

The Identification Process is a requirement both in the early stages of your course (once your first unit has been completed), and at the end when it is time to claim your certificates.

A formal record is made that the check has been satisfied. There is no requirement for us to keep copies of these ID documents once they have been checked.

CVs

If we are sent a CV by a prospective student or current/past student for the purposes of providing careers advice or for any other reason the document will be erased as soon as a response has been sent by the College.

Assessments and Audit Trail

Assessments and email correspondence for both lessons and assessments are required to be retained for 3 years, from the date of claiming the completed assessments, as evidence for the awarding body. This is to provide evidence to the awarding body that you studied and completed the lessons and Assessments and to check our quality assurance requirements.

These are inspected by a representative of the awarding body at our premises or the Assessments are sent to the awarding body’s Internal Verifier for quality assurance purposes.

Please see OCR and NCFE websites for their Privacy Policy details.

After the 3-year period all relevant records will be erased.

Reference Request

We can provide a reference to students who have studied with us albeit limited to confirmation of studying with us and the qualifications gained.

If the reference request is for a past student who studied with us longer than 3 years ago our only source of information will be the records held by the relevant awarding body, and our financial records

Please see our ‘Financial Records’ section for more information.

Because we will only hold this limited information, we will only be able to confirm attendance of the course and no further information beyond that.

If you do not wish us to erase your records after 3 years, please advise us before 3 years has elapsed from the end of your course or when your course closed.

Change of personal details

If any of your personal details change e.g. name, address, other contact details, please ensure you provide us with up to date information so that we can ensure the records we hold are accurate and complete.

Skype Contact Details

After we communicate with a student or prospective student through Skype, the Skype contactdetails are stored for the remainder of the course. The contact details will only be used to assist in delivering the course and no other reason.

These details are removed once the course has been closed or completed.

We do not share any Skype contact information with third parties.

External Exam Arrangements

Should any of our students require support in organising an external examination as part of their course, we do not pass on any personal details to the relevant centre. We source the relevant information without providing any personal details of the relevant student. Details of the centre are given to the relevant student who then in turn provides their personal details with the centre who should in turn provide them with details of their Privacy Policy. We are not responsible for any third-party breaches of data.

Course Reviews

Students completing their course are invited to provide a Course Review to help with further developments of our services and courses. The Course Reviews are stored for a period of 1 year from receipt to help us plan and develop modifications to our courses and services. Comments from these Course Reviews may be used on our Testimonial page on our website with permission of the student. The comments are only identified with a first name and no full names are used. Therefore, no personal data is used on our website.

Financial Records

As a Limited business we are required by law to retain our financial records for 6 years. These records are digital and are not shared with anyone except our Accountants and HMRC. After 6 years the records are deleted.

Manual Records

We do not hold manual records at our premises or anywhere else except for historic financial records as required by law.

Sharing Personal Information

We do not share any information with third parties for those enquiring about courses or visiting our website except the IP addresses as detailed in our Right to be Informed – Visitors to our Website section on page 1 of this policy.

We share personal information e.g. your full legal name and your date of birth only with the awarding body as part of the qualification claim process.

Your name and full contact details are stored in our financial records as required by law and shared with our Accountants and HMRC.

We share your email address with amazon.co.uk when arranging vouchers for your books, which are provided if relevant to your course. Only your email address is required, your full name nor any other personal details are provided to Amazon. Please refer to Amazon for their Privacy Policy.

We do not share your details with any other person or body, unless you have provided specific consent to do so. (e.g. sending a reference to a prospective employer).

Security

We use Transport Layer Security (TLS) to encrypt and protect email traffic. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected in transit. However, most common email providers such as Gmail, Outlook.com and Yahoo Mail do utilise the TLS system. Please refer to your email providers information pages for confirmation.

We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.

All the computer systems used at the college that will receive part, or all your personal data, are fully encrypted with GDPR compliant software.

Enrolment forms (our main source of personal data) are not stored on laptops but stored on our central computer with a secure backup system in place which is GDPR compliant.

We use specialist eraser software which completely eradicates any deleted documents and ensure they are no longer stored on the computer.

Our website is GDPR compliant by third parties.

Processing Information

Enrolment forms are received through our GDPR compliant website and sent to our secure central computer only. The forms are not sent onto any other member of staff.

Email communication between students, different members of staff, enquirers, tutors, job applicants or anyone else or organisation, in the normal day to day running of the business is carried out using secure email system and fully encrypted computers.

Data minimisation is applied i.e. the restriction of processing data to other members of staff with only senior management having unrestricted access.

Training and Development

We continually train staff and develop our systems to ensure we are compliant with GDPR. We are registered with the ICO under No Z1311996.

Access

If you wish to know what personal information we hold about you, please email qualifications@lewiscollege.co.uk. We shall aim to provide the information within 7 days.

By law we are required to provide this information within 30 days.

Rectification

If you wish to rectify any personal information we hold you will need to email us on qualifications@lewiscollege.co.uk.

Please provide us with details of what personal information needs to be rectified.

Right to erasure

Please see above the different erasure policies we hold for different personal information/situations.

If you wish your personal information to be erased earlier than as detailed above, please contact administration@lewiscollege.co.uk

We shall inform you of any possible consequences (to the best of our ability) that may arise from early erasure and may need to consult with the relevant awarding body.

We shall not be able to erase personal information from financial records as this would cause us to be in breach of legislation.

Right to Restrict Processing

Please see above our processing policy. Should you wish to restrict your personal information being processed as detailed above please email administration@lewiscollege.co.uk.

We shall inform you of any possible consequences (to the best of our ability) that may arise from restricted processing and may need to consult with the relevant awarding body.

We would not be able to restrict our processing as detailed above if essential to fulfil the contract.

Data Portability

Requested data will be sent to the individual through our secure email system.

Right to Object

You have the right to object prior to entering into a Contract with us about any matters concerning our Privacy Policy.

Complaints or queries

Lewis College tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of Lewis College’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to administration@lewiscollege.co.uk.

Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated on 5 June 2018.