This notice sets out what you can expect us to do with your data when you contact us or use one or more of Open College of the Arts (OCA)’s services. We will tell you why we are able to process your information, and why we do it, whether you need to provide information, how long we will keep it for, who we will share this information with if appropriate, whether we will transfer it abroad, or if we do any automated decision making or profiling.
OCA is the controller of information we process, unless otherwise stated.
Our postal address is:
Open College of the Arts
Unit 1B Redbrook Business Park
You can contact us by email at email@example.com, phone at 0800 731 2116, live chat on our website, or post to us at the above address.
Our Data Protection Officer is Lyndsey Woodger. They can be contacted at firstname.lastname@example.org, or via post. Please mark all queries to ‘Data Protection Officer’.
Most of the personal information we process is provided to us directly by you for one of the following reasons:
- You have made use of one or more services that we provide.
- You subscribe to our e-newsletter.
- You have made an enquiry or complaint to us.
- You have applied for a job or secondment with us.
We also receive personal information indirectly, in the following scenarios:
- A complainant refers to you in their complaint correspondence.
- From other partners as detailed in their data privacy notices.
- From other regulators or law enforcement bodies.
- An employee of ours gives your contact details as an emergency contact or a referee.
If it is not disproportionate or prejudicial, we’ll contact you to let you know we are processing your personal information.
As part of the Open College of the Arts statutory and corporate functions, we process special category data and criminal conviction data. Please read the ICO Safeguards Policy – special categories of personal data and criminal convictions here.
The information we collect is varied and what is collected depends upon its intended use.
Other functions are not required but optimise the experience for you; you can manage these through Cookie Settings. These functional cookies will track the pages you visit on this site via Google Analytics, track your movements between pages through the Hotjar service, remember which courses you have recently viewed, and if you wish to use the ‘social’ buttons, those social networks will set a temporary cookie to allow you to make a post from this website.
To subscribe to OCAs e-bulletin we ask you to to provide us with your email address. This information is supplied to MailChimp. You can edit your profile with further information, however we only require an email address. You can amend the information we have or unsubscribe from the list at any time.
To process an enrolment to an OCA degree course we ask for your name, date of birth, address, contact details (phone number and email address), previous qualifications, information on disabilities, your gender, your ethnicity, your religious beliefs, if you are a care leaver, your legal nationality, and your last job and area of work. In addition we also collect certain financial information to collect payment, and/or setup as payment plan. This is a mix of personal, sensitive, and financial information that we need to setup your profile as a student. Some of this information will be provided to external partners as detailed below.
If you submit an enquiry to us, we ask for your name, date of birth, address, contact details (phone number and email address), and what course you are interested in.
Under EU data protection legislation, you have certain rights to your information which we must publish. The rights available to you depend upon our reason for processing your data.
Right of access – you have the right to ask for copies of the information we hold about you. This right always applies. There may be exceptions to this, where you may not receive all information that we process; you can read about this here – Your Right of Access.
Right to rectification – you have the right to ask us to rectify information that we hold on you where you believe this is inaccurate. This also includes the right to ask us to complete information you believe is incomplete. This right always applies. You can read about this here – Your right to get your data corrected
Right to erasure – you have the right to ask is to remove certain information in certain circumstances. You can read about this here – Your right to get your data deleted.
Right to restriction of processing – you can ask us to restrict the processing of your personal data in certain circumstances. You can read about this here – Your right to limit how organisations use your data.
Right to object to processing – you have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests. You can read about this here – The right to object to the use of your data.
Right to data portability – this right only applies to information you have directly given us. You have the right to ask us to transfer information to another organisation, or for information to be transferred to you. This only applies where your express consent has been given to process that data. You can read about this here – Your right to data portability.
As a UK body in receipt of public funding, we have a legal duty to comply with the Equality Act (2010).
Among the requirements this stipulates, is a stipulation to make reasonable adjustments for anyone who contacts us to eliminate barriers to access our services. Our legal basis for processing this information is article 6(1)(c) of the General Data Protection Regulation (GDPR) as we have a legal obligation to provide this. Our processing of special category data, such as health information you give us, will be based on article 9(2)(a), which means we need your consent.
We’ll create a record of your adjustment requirements. These will give your name, contact details and type of adjustment required, along with a brief description of why it is required. Relevant staff can access this to ensure they are communicating with you in the required way.
We will keep this information for the period listed in our retention schedule.
You have a right to withdraw consent at any time. Please contact us if you need any information.
We will not share your information with anyone for the purposes of direct marketing.
In some circumstances we share data with third parties to deliver specific services. In all such cases we have contracts with these third parties. This means that they cannot do anything with your personal information unless we give explicit permission, will not share it with any other organisation, and will hold it for the period that we instruct.
As a public sector body we have legal obligations to comply with, which can in certain circumstances involve sharing data. In all circumstances, before supplying data, we will ensure that there is a legal basis to do so.
We may also share your information in the event of the non-payment of fees for services provided. If the debt remains outstanding after the specified timeframe for payment, no payment plan is in place or an agreed payment plan is not being adhered to, we may initiate formal proceedings to recover the full amount of the unpaid penalty. As a result the OCA will share personal data with the litigation and recovery specialists it instructs in order for them to identify assets and undertake recovery action through the courts.
University for the Creative Arts (UCA) – when you enrol to a degree with OCA we share information with the University for the Creative Arts to register you with them. OCA is a part of the University for the Creative Arts and they validate all OCA degrees. The information provided is both personal and sensitive.
Higher Education Statistics Agency (HESA) – we have a legal requirement to provide information to HESA about people who enrol onto degree and masters course with OCA. This information is first sent to UCA where this information is brought together as a joint UCA/OCA submission. The information provided is both personal and sensitive.
OCA Tutors – in order to provide our services and allocate you a personal tutor for your course we share certain information, including name and contact details to our tutors. In all cases we have a contracted relationship with our tutors which covers data sharing.
Mailchimp – by signing up to one of our Mailing Lists (e.g. the Weekly E-bulletin), your data (first name, surname, Email address) will be shared with Mailchimp, a USA-hosted service which is signed up to the Privacy Shield Agreement. You may unsubscribe from these lists at any time through links in the Email footers, or by emailing OCA at email@example.com.
Tidio.com – this is a live chat service; if you fill in the live chat form, that data is processed by Tidio.com to allow our staff to converse with you through the website.
Hotjar.com – To improve the User Experience on this website, we periodically employ the services of Hotjar to anonymously track user activity, enabling us to improve the website experience.
Worldpay – By making payment using a debit or credit card on this website, your sensitive card data will be shared with our E-Merchant provider, Worldpay. All payment information is securely encrypted.
Splitpixel – Splitpixel host our website.
We do our best to ensure that the information presented here, on this website, and how we process and manage your personal information is done to the highest standards. If you have any queries please contact us at firstname.lastname@example.org and we will be happy to respond.
If for any reason you are dissatisfied with the service we have provided, including in the way we process your personal information, you can make a complaint using OCAs complaints policy.
Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.
We do not provide services directly to people under the age of 16 or proactively collect their personal information. However, we are sometimes given information about children who attempt to enrol on OCA courses or purchase other services provided. The information in the relevant parts of this notice applies to children as well as adults.
This privacy notice has been designed to be understood by persons under the age of 16. A person with a reading age of at least 14 should be able to follow its main points.