The Scotland College of Chiropractic
Privacy Notice Enquirers, Applicants, and Students
The Scotland College of Chiropractic (the College) is a registered data controller in the UK and will collect and use information and data about enquirers, applicants, and its students in accordance with the UK’s data protection legislation, including the data protection principles, set out in the UK General Data Protection Regulations (UKGDPR) and the Data Protection Act 2018 (DPA).
Purpose of this notice
If you are or have been a student at the College, or are making an enquiry or application to become a student at the College, this privacy notice outlines what you can expect when the College collects your personal information (or personal data). Personal data is any information or data that relates to and identifies you (“information” or data”). UK data protection legislation sets out how we should handle your personal information.
It also includes information about how applicant/enquirer or student data is used by the College, where it is supplied to its validating partner, Buckinghamshire New University (BNU), and by BNU to the Higher Education Statistics Agency (HESA) and other external parties (eg UCAS or your funding body).
Why do we collect and process your personal data as an enquirer, applicant, and student?
The College must collect and process data about its enquirers, applicants, and students in order to implement and manage education-related services and processes, including student recruitment, admission, registration, teaching and learning, support for individuals with a disability, learning difficulty, or health condition, examination, graduation, and other services including to implement and perform the contract in terms of which the College provides services to you or in order to comply with a legal obligation imposed on the College.
As an enquirer:
We collect and process your data so that we can use your information to answer your enquiry and communicate effectively with you via email, telephone, text (SMS), social media, or other methods. We will use it to keep you updated about a number of things that may be helpful if you are considering applying to study at the College. We will also use your data to administer events that you may book onto either physical or virtual. We may also use your information for research purposes, including surveys and market research.
As an applicant:
We collect and process your data for the administration of your application (verifying your identity, eligibility to study, and assessing your application some of which is shared with BNU). Communicating with you throughout the application process until you successfully enrol. If you have accepted an offer, we will also keep you informed of important updates in the run-up to you beginning of your studies, as well as research, reporting, and statistics such as market research, college planning, and statutory reporting purposes to external agencies when required. If you have applied for non-statutory funding, such as a scholarship or bursary, and finally, monitoring and compliance regarding health and safety and equality, diversity, and inclusion.
As a student:
We collect and process your data so that we can complete the enrolment process with you. Thereafter, we will use your information to deliver and administer all aspects of your education at the College including placements, assessment, quality assurance purposes, financial administration as provided by you, or your funding bodies requirements and process, including debt recovery, as well as security and crime prevention, delivery of facilities and services, and provision of student support. Including any data (personal and financial) if have applied for non-statutory funding, such as a scholarship or bursary.
What categories of personal data do we process?
The College will hold and process personal data and sensitive personal data about current, past, or prospective students and others who are defined as data subjects under the DPA.
Personal data is data relating to a living individual who can be identified from that data (eg name, address, telephone number, and student number). It can also include expressions of opinions about an individual.
Sensitive personal data (or ‘special categories of data’ as described under the UKGDPR) relates to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or orientation, bio-metric data and criminal convictions. Personal data concerning disability is sensitive data.
We will collect and process personal data about you for the purposes described below. The College recognises the significance of sensitive personal data and will only process such data if certain conditions are met. These records will be kept in strict confidence and will not be released to third parties without your explicit consent or required by law.
We ask you to declare your ethnic origin and any disabilities at the time of your enrolment. These fall within the definition of sensitive data. If you choose to provide such data, you give your consent for the College to use them, in an aggregated form, for statistical purposes.
All students registered at the College on the MChiro programme need to complete or have completed a Disclosure Scotland PVG (Protecting Vulnerable Groups) check. This is because you are likely to undertake regulated work with children and protected adults as part of their training; and also because, on graduation and as part of the process of formal registration as a chiropractor, the General Chiropractic Council will undertake checks on you to ensure you are of good character, have sound mental and physical health and will be fit to practice safely, ethically and effectively. The lawful basis for our processing this information is therefore in compliance with a legal obligation.
How will we use information about you?
As an enquirer:
When you make an enquiry about studying at the College, we will use your information to answer your enquiry and to communicate effectively with you via email, post, telephone, text (SMS), social media or other methods, as appropriate. We will keep in touch with our enquirers and also use your information to send you messages about College events such as open days and to keep you updated about a variety of things that may be helpful if you are considering applying to study here. You can opt-out of receiving communications from us by indicating this when making your enquiry or at any time by letting us know.
We may also use your information for research purposes, including conducting surveys and market research, compiling statistics, monitoring quality standards and for internal reporting purposes, to help us to improve our service and learning and teaching experience for our students.
As an applicant:
To assess your application to study here, the College uses the information you provide on your UCAS application form or another type of application form, as well as any supporting documents, references, or records from interviews provided as part of the admissions process. If we decide to offer you a place on a course, we will also collect information about whether or not you have certain types of criminal convictions, which may include conducting a check with Disclosure Scotland and the Disclosure and Barring Service (if out with Scotland).
As a student:
Once you enrol at the College we use information and data about you for a variety of purposes including the purposes mentioned above.
The administration of your studies
We use your information to deliver and administer all aspects of your education (including any placements with external providers), teaching, assessment, and quality assurance purposes; considering and approving academic progression and managing academic appeals; managing re-sits; considering any applications for mitigating circumstances, and determining and confirming awards.
Financial administration
We will use your information, as provided by you or by funding bodies, to administer all financial aspects of your relationship with the College and any funders, where relevant. This includes managing and collecting payments for course fees, scholarships, bursaries, and other support allowances, as well as for debt recovery purposes in the event money is owed to the College. We may use external debt collection agencies for this purpose.
Operation of the College’s regulations, procedures, and codes of practice
We will use information about you if you make, or are the subject of, a complaint or allegation involving another student, member of staff, or external party under any of the College’s rules, regulations, procedures, or codes of practice. We may also use information about you that is publicly available, such as information posted to social media and other public forums, where this is relevant in a particular case e.g. complaints about inappropriate posts on social media. Information will be used to investigate complaints or allegations, manage the outcomes, and put in place any remedies, including additional support or disciplinary measures. This includes investigating cases where academic misconduct is suspected (which includes suspected plagiarism, cheating, or collusion), fitness to study, and fitness to practice cases (where this is relevant to your course). The investigations mentioned here may also involve using information about any criminal convictions you receive during the time you are enrolled, in order to determine whether or not you are able to continue on the programme or to determine any steps that should be taken in the context of helping to provide a safe community in which staff and students can teach and learn, and in which we can safeguard children (those under 18 years old) and vulnerable adults.
Security and crime prevention
The College operates a CCTV system for security and crime prevention purposes. The CCTV system covers inside the College. Your images are likely to be captured by the CCTV system while you are on the premises. CCTV footage will be used to maintain the security of the College, enhance public safety, assist in the protection of staff and students, prevent and detect crime and apprehend and prosecute offenders. CCTV footage may be used, where there is a lawful basis, in the investigation of complaints and allegations made under the College’s rules and regulations.
The College will also use your information and data to carry out welfare checks, maintain a safe environment around the campus and investigate complaints or concerns.
Monitoring and compliance
We will use your information and data to monitor our compliance with legislation including laws relating to equality, and health and safety. We will also use your information to monitor our compliance with regulatory requirements set by external agencies.
Providing an alumni service
When you complete and pass your course, you automatically become a member of The Scotland College of Chiropractic alumni network and will be provided with information about its services. We will use information and data about you from your student record to populate our alumni system and offer you an alumni service, which includes keeping you informed of college news, publications and events, career opportunities, academic and professional development opportunities, and much more. Further information is available in the Alumni, Donor, and Supporters Privacy Notice. You can opt out of receiving communications from the alumni service at any time by contacting the College team.
Finally, The College will also use your contact details to keep you informed of events relevant to your studies and in the case of emergencies.
Where do we get your personal data from as an enquirer and applicant?
The College uses the information you provide when you register your interest in studying at the College. We collect this information when you make enquiries by phone, email, social media, or other similar methods, when you book on and/or attend events, request a prospectus or booklet, and when you visit our stand at a recruitment event or fayre.
To assess your application to study at the College, we use the information you provide on your UCAS or the College application form, as well as supporting documents, references, and records from interviews provided as part of the admissions process. If you receive an offer to study at the College, supporting documents, and references, we will also collect the information you provide about criminal convictions and may include a check with Disclosure Scotland, and the Disclosure and Barring Service (or equivalent in other jurisdiction, as applicable).
Where do we get your personal data from as a student?
The College uses information you provided on your UCAS or the College application form, as well as supporting documents, references, or records from interviews obtained as part of the admissions process. We will also collect and use information you provide during enrolment, including information about any disabilities and long-term health conditions you inform the College about. As you progress through your course, we will collect and use other information to assist you with your studies, maintain records about your studies and academic achievements, student finance, and about your use of the services that the College offers.
Who has access to your data?
Your information will be processed by the College’s Registry and Senior Management Team. Access to your information is carefully controlled and will be seen only by members of staff who are authorized to do so.
Who might we share your data with?
The College may disclose certain personal data to external bodies as categorised below where we have a legitimate reason or basis to use that data in connection with your time at the College or where the College is under a legal requirement to do so. Information will be disclosed in accordance with the provisions and obligations of the DPA. Please note this is not an exhaustive list.
| Disclosure to | Details |
|---|---|
| Central and Local Government Departments | The College may disclose student personal data and sensitive personal data to external agencies that are part of central or local government to fulfil statutory or legal obligations related to, for example, immigration, council tax and electoral registration. For this reason, the College may disclose personal data to various such organisations including Quality Assurance Agency (QAA), Office for Students (OfS), Higher Education Statistics Agency (HESA), UK Visa and Immigration (UKVI), the Student Loans Company (SLC), Student Awards Agency Scotland (SAAS), the Office of the Independent Adjudicator for Higher Education, Research Councils, Disclosure Scotland, Disclosure and Barring Service , and potentially other such organisations for defined purposes. |
| Police and Enforcement Agencies | The College may provide data on request to the police and other enforcement agencies in emergencies or where crime detection or prevention can be aided by its release, for example, by responding to information requests from individual police forces or other enforcement agencies, such as UKVI. |
| Regulatory Bodies | The College, and BNU as its validating partner, may be required to provide data to organisations like OfS, HESA, the University and Colleges Admissions Service (UCAS) or to other bodies acting on their behalf for regulatory, research and monitoring purposes. Examples of this include where the College is required to: * provide student contact details to HESA for the National Student Survey (NSS) * confirm student qualifications by recording this data in the student records database for OfS and others to check the information with HESA or other institutions * capture data to help evaluate the effectiveness of government policy to widen participation in higher education, which may be shared with OfS, HESA and UCAS |
| Higher Education Statistics Agency (HESA) | It is a statutory requirement for BNU to send some of the information it holds about you to HESA every year. HESA is the official source of data about UK universities and higher education colleges (www.hesa.ac.uk). Some of the information sent to HESA will be passed to other statutory bodies involved with the funding of education. Further information on how your Student Record may be used by HESA can be found at www.hesa.ac.uk/collection-notices. |
| Financial Organisations | The College will also provide data to the Student Loans Company. If necessary the College will also release data to parties involved in the recovery of debts to the College. |
| Bucks Students’ Union | BNU, as the College’s validating partner, will share your personal data (e.g. contact details, student number and course) and some sensitive personal data (e.g. ethnicity) with Bucks Students’ Union in order to help them to communicate effectively with you about elections, general membership, access to services etc. |
| Professional Bodies (General Chiropractic Council and professional chiropractic associations) | The College may pass some identifying data to the General Chiropractic Council in order for students to be registered with this regulatory body. Data may also be shared with relevant professional chiropractic associations if applicable (e.g. for student membership or attendance at seminars under student fees). |
| Sponsors of Funders | Where students are sponsored or funded, the College will provide details of applications, attendance and attainment to the donor, sponsor or funder on request. |
| Third Party Software Suppliers | The College’s website host is Squarespace and an associated provider, JotForm, hosts our application process. All our third-party service providers are required to take appropriate security measures to protect your data in line with the College’s policies and we do not allow them to use your data for their own purposes. BNU, as the College’s validating partner, may release information to third party organisations that host University data (e.g. Blackboard for the provision of the Virtual Learning Environment and TurnitinUK for their anti-plagiarism software, which could involve some personal data being released to other HE institutions for comparison purposes). BNU also share personal identifiable information with third party suppliers (eg Microsoft and Unit4) for licence compliance, audit and support purposes. |
| Clinical Placement Providers | The College will share personal data about the student on placement with the Clincial placement provider. It is very important that both parties make sure that this data sharing meets mandatory legal standards in place at the time of the placement. |
The College will not release data to any unauthorised third party except where you ask us to. This means that we will not release data to banks, friends, relatives (including parents) etc, without your agreement. You should provide the College with written consent if you want us to release data on your behalf in these circumstances.
Sometimes to achieve the purposes for which we are processing your personal data, we may need to share your personal data with other organisations based within the European Union or outside of it in countries that have comparable levels of protection.
When it is necessary to share your data with organisations outside of the European Union, we will ensure that there are appropriate safeguards in place.
How long do we keep your personal data?
We will keep your personal data for only as long as necessary for the purposes for which it was collected. Information about students is retained and disposed of in accordance with the College’s records retention schedules, which are detailed in the Records Lifecycle Management Scheme. Some information may be archived for long-term historical preservation. Data will be securely destroyed when no longer required.
What is the legal basis for processing your data?
The College relies on various legal bases (including the following legal bases from the UK GDPR) to process information about you for the purposes set out in this notice.
As an enquirer, the legal basis for processing your data includes:
Article 6(1)(a) allows us to process personal data where you have provided your consent. Where we rely on your consent, we will ensure your consent is freely given, and that you can withdraw it at any time.
Article 6(1)(f) allows us to process personal data where it is in our, or someone else’s legitimate interests to do so and it does not unduly prejudice your rights and freedoms. We rely on this, for example, to respond to your enquiry and keep a record of your enquiry and our response. Communicate some types of messages with you, produce internal reports, research and statistics and administer and operate physical and virtual events enabling prospective students to see what the College life is like
As an applicant, the legal basis for processing your data includes:
Article 6(1)(b) allows us to process personal data when it is necessary for the performance of a contract or for steps taken before entering into a contract such as when you accept an offer of a place (the student contract). It also includes the assessment of an application which includes the assessment of any criminal convictions you declare. We require you to provide any information we reasonably request for the purposes of your applications, otherwise we cannot assess your application with a view to making an offer and putting your student contract in place.
Article6(1)(c) allows us to process personal data when necessary to comply with a legal obligation, such as reports and statistics to external agencies.
Article 6(1)(e) allows us to process personal data where it is in our, or someone else’s legitimate interests to do so and does not unduly prejudice your rights or freedoms. We rely on this to communicate marketing messages to you (unless you opt out) or produce internal reports, research and statistics to evaluate, plan and assess how the College is operating.
We will also process some information only if you provide your consent where the information is special category data (eg information about your race, ethnic origin, religious beliefs, or sexual orientation). It will be clear where we are relying on your consent to collect and use your information. Consent can be withdrawn at any time. This applies to Articles 6(1)(a) and 9(2)(a).
Article 9(2)(g) and Section 10 DPA by virtue of section 1 DPA allows us to process special category data if the processing is necessary in the public interest and there is a basis to do so in law such as data about criminal convictions to comply with a statutory or legal function. This also includes special category data to monitor equality of opportunity or threat.
As a student, the legal basis for processing your data includes:
Article 6(1)(b) allows us to process personal data when it is necessary for the performance of a contract. You enter into a contract with us when you accept an offer of a place (the student contract). Under this student contract, we deliver and administer your studies, and finances, operate the College’s regulations, and procedures, communicate with you and deliver facilities and services.
Article6(1)(c) allows us to process personal data when necessary to comply with a legal obligation. Such as reports and statistics to external agencies, as well as compliance and monitoring.
Article 6(1)(e) allows us to process personal data where it is necessary to perform a task in the public interest. Research and teaching, reporting, monitoring and auditing, and the provision of student support is carried out as part of our public tasks.
Article 6(1)(f) allows us to process personal data where it is in our, or someone else’s legitimate interest to do so and it does not unduly prejudice your rights and freedoms. We rely on this to communicate marketing messages to you (unless you opt out), and deliver services to you such as careers advice and the alumni programme, provide security service and CCTV monitoring, as well as produce reports, research, and statistics to evaluate, plan and assess how the College is operating, and finally share information with third parties for your benefit, or where it is in their interests, for example, if your employer, or a donor is paying for your course and enquires about your attainment.
We will also process some information only if you provide your consent where the information is special category data (eg information about your race, ethnic origin, religious beliefs, or sexual orientation). It will be clear where we are relying on your consent to collect and use your information. Consent can be withdrawn at any time. This applies to Articles 6(1)(a) and 9(2)(a).
Article 9(2)(g) Section 10 DPA by virtue of section 1 DPA allows us to process special category data if the processing is necessary for the public interest and there is a basis to do so in law, such as data about criminal convictions to comply with a statutory or legal function. This also includes special category data to monitor equality of opportunity or threat.
What are your rights as a data subject?
Under the UK’s data privacy legislation you have the right to:
withdraw consent where that is the legal basis of our processing;
access your personal data that we process;
rectify inaccuracies in personal data that we hold about you;
be forgotten, so that your details are removed from the systems we use to process your personal data;
restrict the processing in certain ways;
obtain a copy of your data in a commonly used electronic form; and
object to certain processing of your personal data by us
If you wish to request a copy of the personal data held by the College about you or to correct any information the College holds about you, contact the Registry Team in the first instance. If you have any further concerns about the accuracy of your personal data as held by the College or you want to submit a data subject request, contact the College’s Data Protection Officer.
Please see the Information Commissioner’s Office web site (https://ico.org.uk) for further information about your data privacy rights. You may also contact the Data Protection Officer for further information.
You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. Please see https://ico.org.uk.
How do you unsubscribe from unwanted communications?
We will communicate with you by email, post, telephone and SMS. Please contact the Registry Team if you want to unsubscribe from these communications, change the method of communication that we use or are concerned about their content (e.g. unwanted marketing information). Contact the Data Protection Officer, if you are unsuccessful in unsubscribing from our communications and/or remain concerned.
Website
We use Cookies (that will collect your personal data) on our web pages. The College’s website privacy statement explains how data may be gathered about users of our website. The College’s privacy notices do not cover the links within our website that link to other external websites.
Changes to our Privacy policy
We regularly review the College’s privacy notices. We will communicate final changes to this notice to enquirers, applicants, and students via the most effective channels.
What should you do if you have concerns about the way we process your personal data?
If you have any concerns with regards to the way your personal data is being processed or have a query with regard to this Notice, please contact our Data Protection Officer, [named person], at [email address].
Our general postal address is:
124a Raeburn Place, Edinburgh, EH4 1HQ
Our telephone number is: 0131 322 1978
Our ICO data controller registration number: ZB540812
You also have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF. Tel: 0303 123 1113. Email: https://ico.org.uk.