Privacy notice

Medway Adult Education is funded by the Education and Skills Funding Agency (ESFA) and the Department for Education (DfE).

To enrol on one of our courses you're agreeing to share your details with the above agencies. You cannot enrol on one of our courses unless you agree to this data sharing.

Find out more about how your data is used by:

Medway Adult Education privacy notice

This privacy notice provides information on how Medway Council's Adult Education Service uses your personal information to provide you with high quality adult education courses. Medway Council’s Adult Education Service is funded by the Education and Skills Funding Agency (ESFA) on behalf of the Department of Education (DfE). The ESFA contractually define the data which is required to enable services to be provided by us. This data is shared with the ESFA. Please view their privacy notice below.

By 'use' we mean the various ways your personal information may be processed including storing and sharing the information.

How do we use your personal data?

We use your personal information primarily to manage the Medway Council's Adult Education Service including:

  • Enrolling learners onto courses
  • Communicate service information and changes to services you are signed up to (for example cancellations or change of venue)
  • Providing further support to learners, both financial and in classroom
  • Compiling and processing Learner Agreements
  • Obtaining funding from Central Government via the ESFA or DfE
  • Provision of awards and certificates through the respective awarding bodies
  • We also use this information to assess the quality of our services and evaluate and improve our policies and procedures.

What personal data we collect and use about you?

We collect and use your:

  • Personal information (such as name, date of birth, unique pupil number, contact details and language)
  • Financial information to enable the processing of course payments and evidence towards claiming concessions for courses if applicable
  • Attendance information (such as sessions attended, number of absences, absence reasons and reason for withdrawal)
  • Curriculum assessment results
  • Destination and progression information (such as details about current and future employment or education)
  • Evidence of income, such as bank statement for fully funded provision
  • Previous or current education or employment information
  • Prior attainment and qualifications.

We also collect information about the following which is classed as "special category data" under the GDPR. 

  • Racial or ethnic origin
  • Health data including physical and learning disabilities; mental health; occupational health; and transport needs

Who provides this information

The information we hold is information you have provided to us.

We may also receive information from The Learner Record Service, which holds data on your previous and current education history. Their privacy notice is below.

We may share your personal information with:

  • Our funding body, the Education and Skills Funding Agency
  • Government department or agency, for example, Department for Education
  • Ofsted
  • Qualification award bodies
  • The Learner Records Service.

We have legal grounds to process special category data under GDPR article 9(2)(g) - Reasons of substantial public interest. We rely on the 'equality of opportunity or treatment' and 'safeguarding of children and individuals at risk' purpose

Any information which is shared will only be shared on a need to know basis, with appropriate individuals. Only the minimum information for the purpose will be shared.

Your personal information may also be given to third parties contracted by Medway Council to provide a service to Medway Council’s Adult Education Service. These service providers are known as data processors and have a legal obligation under GDPR and to Medway Council to look after your personal information and only use it for providing that service. We have entered into a contract with West March Systems for the TERMS Evolution learner database. This database will be the central point your information will be processed. We also use Zoom to deliver online lessons.

How the law protects you and the legal basis for processing your information

The lawful grounds to process your information is under GDPR article 6(1)(e) Public Task, because “Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

We have legal grounds to process special category data under GDPR article 9(2)(g) - Reasons of substantial public interest. We rely on the 'equality of opportunity or treatment' and 'safeguarding of children and individuals at risk' purpose conditions from Schedule 1 of the Data Protection Act 2018 when relying on Article 9(2)(g) to process your special category data.

How long will we keep your personal information for

We keep your data in line with ESFA guidance, this is currently 6 financial years since you were last a learner with us as long as you do not have an outstanding financial debt.

How we keep your information

The information is stored electronically securely within the TERMS database server which is in London UK with a fall back in Manchester, UK. We also store information electronically on the Medway Council SharePoint site. Access to this data is granted to authorised personnel only, and strictly for the duration of their job role.

We do not process your information outside of the UK.

June 2024

Education and Skills Funding Agency privacy notice

This privacy notice is issued by the Education and Skills Funding Agency (ESFA) on behalf of the Secretary of State for the Department of Education (DfE) to inform learners about the Individualised Learner Record (ILR) and how their personal information is used in the ILR. Your personal information is used by the DfE to exercise our functions under article 6(1)(e) of the UK GDPR and to meet our statutory responsibilities, including under the Apprenticeships, Skills, Children and Learning Act 2009.

Our lawful basis for using your special category personal data is covered under Substantial Public Interest based in law (Article 9(2)(g)) of GDPR legislation. This processing is under Section 54 of the Further and Higher Education Act (1992).

The ILR collects data about learners and learning undertaken. Publicly funded colleges, training organisations, local authorities, and employers (FE providers) must collect and return the data to the ESFA each year under the terms of a funding agreement, contract or grant agreement. It helps ensure that public money distributed through the ESFA is being spent in line with government targets. It is also used for education, training, employment, and well-being purposes, including research.

We retain your ILR learner data for 20 years for operational purposes (e.g. to fund your learning and to publish official statistics). Your personal data is then retained in our research databases until you are aged 80 years so that it can be used for long-term research purposes. For more information about the ILR and the data collected, please see the ILR specification.

ILR data is shared with third parties where it complies with DfE data sharing procedures and where the law allows it. The DfE and the English European Social Fund (ESF) Managing Authority (or agents acting on their behalf) may contact learners to carry out research and evaluation to inform the effectiveness of training.

For more information about how your personal data is used and your individual rights, please see the DfE Personal Information Charter and the DfE Privacy Notice.

If you would like to get in touch with us or request a copy of the personal information DfE holds about you, you can contact the DfE in the following ways:

  • Using our online contact form
  • By telephoning the DfE Helpline on 0370 000 2288
  • Or in writing to: Data Protection Officer, Department for Education (B2.28), 7 & 8 Wellington Place, Wellington Street, Leeds, LS1 4AW

If you are unhappy with how we have used your personal data, you can complain to the Information Commissioner’s Office (ICO) at: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You can also call their helpline on 0303 123 1113 or visit their website.

Learning Record Service privacy notice

The information you supply is used by the Learning Records Service (LRS). The LRS issues Unique Learner Numbers (ULN) and creates Personal Learning Records across England, Wales, and Northern Ireland, and is operated by the Department for Education (DfE) in England. This privacy notice explains how we use your personal information. For the purposes of relevant data protection legislation, the DfE is the data controller for personal information processed.

Who we are?

The LRS supports the DfE by collecting learner information from training providers and awarding organisations. For the purposes of relevant data protection legislations, the DfE is the data controller for personal information we process.

How we will use your information

We receive your personal data from:

  • schools, colleges, local authorities, and training/learning providers
  • accredited achievement data supplied by awarding organisations.

The aims of LRS are to:

  • create a trusted and verified record of learning for citizen across England, Wales, and Northern Ireland
  • enable education organisations to access these records when required to support individuals with enrolment to education and careers advice, ensuring they get access to the correct education and government funding
  • issue you with a Unique Learner Number (ULN)
  • create your Personal Learning Record (PLR)
  • collect entries and results data that is used to create national statistical publications.

The nature of your personal data that LRS will process

The categories of personal data that can be processed in LRS includes:

  • personal contact details
  • data related to an individual’s learning
  • data and information about your learning, including courses and qualifications you are taking or have taken.

To ensure that our records are accurate, it may be necessary for training providers to collect further personal information from you. This information will be used to identify the correct learner where their personal information is similar to other learners (e.g. name(s) and date of birth):

  • where further information is required to distinguish between learners, the following personal information is deemed as mandatory:
    • last known post code
    • date of birth
    • gender.

Why our use of your personal data is lawful

For our use of your personal data to be lawful, we need to meet one (or more) conditions in the data protection legislation. For LRS, the relevant conditions are:

  • Article 6(1)(e) UK General Data Protection Regulations (GDPR), to perform a public task as part of our function as a department
  • We also rely on legitimate interests, where we may need to collect additional personal information, to distinguish you from another individual. This is:
  • Article 6(1)(f) of the UK General Data Protection Regulations.

Who we will make your personal data available to

We sometimes need to make personal data available to other organisations. These might include contracted partners (who we have employed to process your personal data on our behalf) and/or other organisations (with whom we need to share your personal data for specific purposes).

Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. For LRS we share your personal data with the following:

  • schools, colleges, local authorities, and training/learning providers when you enrol onto a course
  • awarding bodies to record achievement/attainment information such as exam or course grades
  • permitted organisations such as Federation for Industry Skills & Standards (FISSS) and Universities and Colleges Admissions Service (UCAS) to record or verify individual’s qualifications.

How long we will keep your personal data

The PLR is a lifetime record of achievement for all learners.

All data in LRS will be retained until a learner is 80 years old and has not engaged with a learning provider for 7 years.

Your data protection rights

You have specific rights under data protection law. You can request a copy of all information relating to you held by the DfE. You can do this by making a Subject Access Request using the DfE Contact Form.

 

How DfE: Multiply (non-substantive activities) use your data

This privacy notice explains how the DfE uses personal information as part of Multiply. This includes information you give to us, or information that we may collect about you.

Multiply is a government-funded programme to help adults improve their numeracy skills.

Non-substantive activity is a provision targeted at those in the local area who would benefit from Multiply funded learning. This is likely to be a more informal and innovative activity and not typically classroom-based.

Why we collect your personal data

When we collect and use this information, we need to follow the law. The main laws are the Data Protection Act (DPA) and the UK GDPR.

The DfE is the data controller for your personal data. We must have a reason to collect your personal data. This is called a 'lawful basis'. Our lawful basis for processing your personal data is covered under 'public task'. This is when we need your personal data to do our work, to provide or fund education.

What data we need

We'll collect the following types of personal data about you, from organisations that we are providing funding to, in order to deliver Multiply on our behalf: 

  • name 
  • date of birth 
  • postcode.

Why we need this data and what we do with it 

We collect and process your personal information in order to monitor the impact of Multiply funding, on non-substantive activity. We'll use it to monitor your progress to further learning, through the ILR.

How long we keep this data

The Multiply programme will only keep your personal information for as long as we need it. We decide how long to keep your personal information based on the needs of the department and the law. 

We'll keep your information for up to 7 years so we can evaluate the success of the Multiply programme. We'll take necessary steps to keep your information safe. It will then be securely destroyed when it is no longer needed. 

Data processors

A data processor is an organisation that processes your information on DfE’s behalf.

We only use data processors to evaluate the impact of Multiply funding on non-substantive activity.

Transferring your personal information overseas

When DfE stores personal information outside the UK, we'll make sure we keep your personal data safe. We follow the data protection law. We also use extra security measures, contracts and data sharing agreements. 

Sharing your personal information

If the law allows it, we might share your personal information with other parts of DfE including the ESFA, and with other government departments. 

We'll share your personal information with:

  • organisations who work for us under a contract
  • organisations that request information to help prevent and detect crime or fraud, where it is lawful to do so. 

DfE may share your personal information in order to evaluate the success of the Multiply programme 

See the DfE Personal Information Charter to find out more about how we use your personal information.

Your rights

You have rights about how and why your information is collected and used. 

These include: 

  • the right to see the personal information we have about you - this is called 'right of access'
  • the right to ask us to change any information you think is not accurate or complete - this is called 'right to rectification'
  • the right to ask us to delete your personal information - this is called 'right to erasure'
  • the right to ask us to stop using your information - this is called 'right to restriction of processing'
  • your 'right to object to processing' of your information.

More about your rights on the Information Commissioner’s Office (ICO) website

Finding out what information we have 

You have the right to ask for access to your personal information. This is known as a subject access request (SAR). 

To make a SAR, you can use the DfE contact form or post your request to the Data Protection Office.

Include as much information as you can about:

  • the information you need
  • the years you need the information for
  • which part of the department holds the information (if known).

You’ll also need to tell us your telephone number and address. 

We may need to check your identity and your right to access the information you’re requesting. To check your identity, we may ask for a copy of your passport, photo driving licence or proof of your address. 

We’ll try to respond to your request within 1 month. If your request is complex, this could take a further 2 months, but we’ll tell you if this is the case. 

More about what a SAR is on the ICO website

If you're unhappy with how DfE have used your personal data, you can complain to the Information Commissioner’s Office (ICO) at: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You can also call their helpline on 0303 123 1113 or visit the ICO website.

Contact DfE

If you would like to get in touch with the DfE or request a copy of the personal information DfE holds about you, you can contact them by:

  • using the DfE online contact form
  • phoning the DfE Helpline: 0370 000 2288
  • writing to: Emma Wharram, Data Protection Officer, Department for Education (B2.28), 7 & 8 Wellington Place, Wellington Street, Leeds, LS1 4AW.