Dumfries & Galloway College (the College) is providing you with this information to comply with data protection law to ensure that you are fully informed and that we are transparent in how we collect and use your personal data.
Your privacy and trust are very important to us and this Privacy Notice provides essential information about how the College handles your personal data and the rights you have in relation to how we use your data. The College is committed to complying with all applicable Data Protection legislation.
Who are we?
Dumfries & Galloway College is the ‘Controller’ and is responsible for looking after the personal data that you provide.
Registered office:
Dumfries & Galloway College
Bankend Road
Dumfries
DG1 4FD
For any queries or concerns about how your personal data is being processed, you can contact the Data Protection Officer (DPO) at DPO@dumgal.ac.uk.
This privacy notice relates to the following process:
Student enrolment
Purpose for processing – why do we collect information about you?
We collect and use your information for the following purposes:
Purpose 1 – Academic purposes, including teaching, learning and support services
We collect and use your information to:
- Maintain student records (to ensure we have the correct data for current students);
- Provide core teaching, learning and support services (e.g. enrolment, attendance, managing progression, academic misconduct investigations, assessment, certification and graduation);
- Enable the provision of teaching and learning, on campus and/or using Virtual Learning Environments (VLEs), which may include the recording of teaching sessions that are remotely delivered;
- Monitor your performance and attendance, supervise, conduct assessments and examinations, confer AC awards; and provide awarding bodies with assessment results and any other information required to enable them to confer awards.
- Produce student ID cards;
- Provide advice and support to you, including careers guidance and information about educational programmes and services;
- Communicate with you about learning, teaching, student support, graduation (and FE awards events);
- Seek your feedback on our courses;
- Deal with appeals, complaints and disciplinary matters promptly and fairly.
Purpose 2 – Student Support, Duty of Care and other Legal Obligations
We collect and use your information to:
- Provide additional support services for those who wish to receive it, including disability services and any reasonable adjustments required under Equalities legislation;
- Fulfil statutory obligations related to disability, protected characteristics and other priority groups.
- Carry out PVG checks for students on placements
- To protect your vital interests e.g. in an emergency situation.
Purpose 3 – Fees & funding
We collect and use your information to:
- Identify your fee status;
- Administer and collect payment of course fees from you, or an employer;
- Assess your entitlement to student support payments (like Education Maintenance Allowances (EMAs), Childcare Fund payments, bursaries and discretionary funds) and make arrangements for the payment of these to you in the event you are successful;
- Administer and collect payments for use of college resources and over payment of any student support funds;
- Communicate with you in connection with administrative and financial services.
Purpose 4 – Statutory returns & statistics
We collect and use your information to:
- Fulfil other administrative purposes, including carrying out internal statistical analysis and completing statutory Further Education Statistical (FES) returns to Scottish Funding Council (SFC) and other external bodies, such as the Scottish Government.
Purpose 5 – Library & ICT services
We collect and use your information to:
- Give you access to learning and teaching tools. This includes library resources and services, IT and information services such as email, Microsoft Teams, Office 365 and the Virtual Learning Environment, and other online tools used as part of your course.
- Produce usage statistics for all library resources and services. We use statistical information only to produce internal reports for College monitoring purposes and this does not include personal data about individuals.
Purpose 6 – Academic standards
We collect and use your information to:
- Ensure rigorous academic standards (for example checking work for originality and ensuring the correct information is present for examination boards).
Purpose 7 – Student placements
For courses that require you to undertake a placement in a childcare setting or work with vulnerable adults we collect and use your information to:
- Make sure that you are not barred from this type of work and meet our legal obligations under the Protection of Vulnerable Groups (Scotland) Act 2007.
Purpose 8 – Marketing.
We collect and use your information to:
- Contact you about College activities and wider opportunities that may be of interest.
The lists above are not exhaustive but indicate the main purposes for which the College will process your personal data.
Our lawful bases (reasons) for processing your information are:
Public Task to achieve the following purposes:
Purpose 1 – Academic matters
Purpose 2 – Student support
Purpose 3 – Fees & funding
Purpose 4 – Statutory & statistical returns
Purpose 5 – Library / ICT
Use is necessary to carry out our Public Task duties and responsibilities as a regional college under the Post 16 Education (Scotland) Act 2013 and Higher Education (Scotland) Act 2005.
Contract to achieve the following purposes:
Purpose 1 – Academic matters
Purpose 2 – Student support
Purpose 3 – Fees & funding
Purpose 5 – Library / ICT
Use is necessary for the performance of a contract with you, or to take steps, at your request, before entering into such a contract. This is the contract between the College and its students for the provision of educational services and / or products.
Legal Obligation to achieve the following purposes:
Purpose 2 – Student support
Purpose 3 – Fees & funding
Purpose 4 – Statutory & statistical returns
Purpose 6 – Academic standards
Purpose 7 – Student placements
Use is necessary for us to comply with a legal obligation. This includes the return of statistical data and reports to satisfy various agencies that the College’s academic standards and funding arrangements are sufficient, and our obligations are being met.
Consent to achieve the following purposes:
Purpose 8 – Marketing communications
If you have given consent for the use, this is where you have agreed for us to send you information about College activities and wider opportunities by email.
This list is not intended to be exhaustive and personal information may be used for a number of purposes, for which there may be several justifications. However, we will only use your data for the purpose(s) for which it was collected and any purposes that are compatible with that original purpose. If we need to use your personal information for any other unrelated purpose, we will notify you and explain the legal basis for this additional processing.
The data being used includes special category (sensitive) data. Our legal reason for using this sensitive data is/are:
Use is necessary for carrying out obligations under substantial public interest – and is authorised by domestic law proportionate to the aim pursued – Equality and Diversity Act 2010; Protection of Vulnerable Groups (Sco) Act 2007
Use is necessary for performing a task in the public interest or under official authority vested in us.
The data being used includes special category (sensitive) data. Our legal reason for using this sensitive data is/are:
Use is necessary for carrying out obligations under substantial public interest – and is authorised by domestic law proportionate to the aim pursued – Equality and Diversity Act 2010; Protection of Vulnerable Groups (Sco) Act 2007.
Use is necessary for performing a task in the public interest or under official authority vested in us.
Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes.
Dumfries and Galloway College operates a combined application and enrolment process. For full time courses this usually takes place in two stages; for part time courses it is often combined. This means that we collect all personal data required for application and enrolment at the same time so you only provide your information to us once. If you are offered a place on a course and accept the offer, information you provide in your application form will be pre populated into your student record.
What information do we collect about you?
For applicants, current and former students:
- Personal contact details, including address, email and telephone numbers
- Date of birth
- Information about your residency status, nationality, and English language skills
- Scottish Candidate Number (SCN)
- Education, qualifications and work history
- Equalities monitoring information, such as marital status and whether you are care experienced
- Personal Statement in support of your application
- Your photograph
- References
- Gender
- Care experience
- Caring responsibilities
We also ask for some ‘special category data’. This is personal information which is more sensitive. We will ask you about:
- Sexual orientation
- Religious or other beliefs
- Ethnicity
- Disability and health data (including mental health and learning support)
- Gender identity and trans history
- Pregnancy
This allows us to carry out statistical analysis to ensure we’re advancing equality of opportunity and treatment for all student groups. This enables the College to meet its duties under the Equality Act 2010. The Data Protection Act 2018 also allows us to process your information for this purpose (but only where you’ve chosen to provide this data).
For current and former students only:
- Unit and Course Enrolment Data
- Assessment Information and course work
- Attendance data
- Personal Learning Support Plans
- Financial Information needed to assess eligibility for fee waiver, bursaries, EMA etc.
- Complaints and Appeals
- Disciplinary information related to the Student Disciplinary Policy
- Health and Safety Information
- Information related to your use of the College’s IT systems, including login details
- CCTV footage (as a campus user).
- For students undertaking a placement with children and / or vulnerable groups only – Criminal Conviction Information (including PVG Certificates and any related information). This allows us to make sure that you are not barred from this type of work and meet our legal obligations under the Protection of Vulnerable Groups (Scotland) Act 2007
How do we collect it?
Your personal information is collected when you enquire about our services in person, on the phone, online, via a written form or via email. Most of the information above will have been provided to the College by you and will have been collected through the application/enrolment process. Other information may be added to your student record when you provide it throughout your studies.
Some information, such as references, will have been provided by named contacts that you have given to the College. Other information may be provided to us by relevant third parties, such as medical professionals, the Student Awards Agency for Scotland (SAAS) or Disclosure Scotland.
The above lists are not exhaustive but are indicative of the main types of personal information processed by the College about you.
You are contractually bound to provide your information for the purpose of enrolling on a course at Dumfries and Galloway College.
If you were to withhold the information we require for this process, the consequences would be:
We would not be able to process your enrolment, set up your student record, provide access to other College services or award you your qualification.
You are not obliged to provide the special category information listed above. If you choose to withhold this information this will not have any negative impact on your enrolment on a course. However if you choose not to disclose that you have a disability we will be unable to provide any reasonable adjustments required.
You would not be offered a placement if you do not provide criminal conviction information under the PVG scheme if this is a requirement for your course.
Who do we share your information with?
For current/former students:
Your personal information will be shared with the following organisations:
- Statistical personal information will be shared with the Scottish Funding Council (SFC) to allow them to allocate appropriate funding to colleges in line with Scottish Government strategies and their statutory duties. For more information on how the Scottish Funding Council use your personal data please see their student privacy policy on their website.
- Data will be shared with any awarding bodies, e.g. Scottish Qualifications Authority (SQA) that are relevant to your course for registration, membership, assessment and certification purposes. For more information on how SQA use your personal data, please see their privacy notice on their website.
- Data will also be shared with relevant government agencies where we have a legal obligation to comply with the Equality Act 2010.
- Data will also be shared with the College’s auditors.
- We will share your data with the following public bodies: Skills Development Scotland (SDS), Scottish Government, Student Awards Agency for Scotland (SAAS) and the Student Loans Company (SLC).
- In the event of a system failure or other software error, your data may be shared with our software suppliers, currently Tribal.
- For students whose course includes a work experience element, your data will be shared with external companies who provide work experience placements to the College.
- For students whose employer, sponsor or management agent require them to attend college, we will share information with them regarding your attendance at college, progress and achievement.
- Where you are a school leaver, or are still at school and have been referred to the College via a school, local authority department or support service we will share information with the relevant local authorities and/or school regarding your attendance at college, progress and achievement.
- Where the College works with 3rd party partners for the delivery of courses, your data will be shared for specific courses on which you are enrolled.
Limited personal data will, or may, be shared with contracted third parties to enable provision of services for the purposes of teaching, learning and administrative support and IT provisioning.
This includes:
- Microsoft 365 software including email, Teams and other Microsoft 365 systems;
- Originality checking system/ plagiarism software (Turnitin);
- Virtual Learning Environment;
- Library Management System.
- ID card production
In all cases, your data will only be shared in accordance with Data Protection Legislation.
Details of data transfers to any third countries or international organisations
We transfer data to Turnitin who process data both in Europe and in the United States. The data transferred comprises:
- Student assignment (your own work, as submitted in the course of study)
- Student name and ID (where you have provided this on your assignment)
This is a system data transfer from the Virtual Learning Environment (VLE) directly to the originality software (Turnitin). This data is transferred for processing to ensure student work is original and to confirm that the College is making awards based on original student work.
This relevant protection in place for this international transfer:
The data is transferred to Turnitin in the USA via the UK extension to the EU-US Data Privacy Framework.
How do we look after your information and how long do we keep it for?
We will take all reasonable steps to prevent the loss, misuse or alteration of information you give us. Your personal information will be stored securely and will only be accessed by authorised staff, agents, contractors and other organisations who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality and must comply with data protection law.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Your information will be kept in line with the College’s data retention schedule and then will be destroyed confidentially or anonymised for the purpose of internal statistical analysis.
We keep information about you only for as long as needed to provide you with academic and support services and to meet our legal obligations.
The core record of a student as a learner may be kept indefinitely in line with the JISC records retention schedule found here: https://www.jisc.ac.uk/guides/records-retentions-management/academic-administration which states “This is the minimal record kept to provide references for former students and may be retained for the lifetime of the student (80 years). A core (minimal) transcript may be retained indefinitely after this time and transferred to the archive if the institution has one. This depends on the requirements of the individual institution and their archival facilities/policies. The core record may vary according to the policy of each institution but is likely to contain name and dates of study, modules studied, and the qualifications conferred.”
Automated decision making processes, including profiling
The College uses its own in-house profiling tool, called Learner Analytics. This analyses your attendance and performance, in order to better understand how to help you achieve your goals.
Your rights
Under Data Protection laws you have certain rights in relation to how the College manages and uses your personal information:
- The right to be informed (this is the Privacy Notice)
- The right to access your personal data
- The right to rectification if the personal data we hold about you is incorrect
- The right to restrict processing of your personal data
In addition the following rights apply only in certain circumstances:
- The right to withdraw consent at any time (if consent is our lawful basis for processing your data)
- The right to object to our processing of your personal data
- The right to request erasure (deletion) of your personal data
- The right to data portability
- The right not to be subject to automated decision-making including profiling.
For more information about your rights please see www.ico.org.uk.
Contact us
If you have any issues about this notice or the way the College has handled your personal information, please contact our Data Protection Officer in the first instance:
email DPO@Dumgal.ac.uk
Telephone: 01387 734364 or write to:
Data Protection Officer
Dumfries & Galloway College
Bankend Road
Dumfries
DG1 4FD
Complaints to UK Information Commissioner’s Office (ICO)
If you are dissatisfied with the response from the College you have the right to lodge a complaint with the Information Commissioner’s Office about our handling of your data:
You can do this online: ICO Online
By telephone: 0303 123 1113
Or write to:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF