OCA preloader logo
Privacy Policy - The Open College of the Arts | Distance Learning Degrees and Courses

Privacy Policy

This page sets out what you can expect us to do with your data when you contact us or use one or more of Open College of the Arts (OCA)’s services. We will tell you why we are able to process your information, and why we do it, whether you need to provide information, how long we will keep it for, who we will share this information with if appropriate, whether we will transfer it abroad, or if we do any automated decision making or profiling.

  • OCA is the controller of information we process, unless otherwise stated.


    Our postal address is:

    Open College of the Arts

    Michael Young Arts Centre

    Room 301, DMC 02

    County Way


    S70 2AG


    You can contact us by email at [email protected], phone at 0800 731 2116 or post to us at the above address.

  • Our Data Protection Officer is Natalie Holt, Head of HR and Compliance. They can be contacted at [email protected], or via post. Please mark all queries to ‘Data Protection Officer’.

  • Most of the personal information we process is provided to us directly by you for one of the following reasons:

    • You have made use of one or more services that we provide.
    • You subscribe to our e-newsletter.
    • You have made an enquiry or complaint to us.
    • You have applied for a job or secondment with us.

    We also receive personal information indirectly, in the following scenarios:

    • A complainant refers to you in their complaint correspondence.
    • From other partners as detailed in their data privacy notices.
    • From other regulators or law enforcement bodies.
    • An employee of ours gives your contact details as an emergency contact or a referee.

    If it is not disproportionate or prejudicial, we’ll contact you to let you know we are processing your personal information. ​

    As part of the Open College of the Arts statutory and corporate functions, we process special category data and criminal conviction data. Please read the ICO Safeguards Policy – special categories of personal data and criminal convictions here.

  • The information we collect is varied and what is collected depends upon its intended use.

    We use cookies on our website to track website usage and to ensure that the website experience runs smoothly, assisting with navigation, ability to provide feedback, and assist with our promotional and marketing efforts. Some of these cookies are required for the website to function, including remembering which courses are in your cart, and where you are in the enrolment process.

    Other functions are not required but optimise the experience for you; you can manage these through Cookie Settings.

    We use Crazy Egg to help us improve website user experience through data tracking. We use the Crazy Egg Service to collect, store, and analyze Visitor Information, on our behalf as the Controller of such Visitor Information, on Crazy Egg’s servers, as the Processor of such Visitor Information. Such  Visitor Information is transmitted in encrypted form, and pursuant to applicable data transfer provisions further described below. The Service may process such Visitor Information on our behalf , to perform analyses and produce reports. The interactions that may be recorded or analyzed (“Recorded Interactions”) may include mouse scrolls and clicks by a Site Visitor; and/or pages viewed or visited by a Site Visitor, including the duration of such visits. Recorded Interactions may also include images of the Site that are recorded during the Site Visitor’s interactions with such Site, such as, by way of example, images of forms displayed or populated by the Site Visitor on the Site, or other multimedia content that may be posted by Site Visitors. Such Visitor Information may also include Device Information and/or Referral Information from the Site Visitor. Visitor Information is provided to us in the form of aggregated reports and/or statistics that identify the collective behavior of Visitors to our Site. OCA will also have access to Recorded Interactions through the Service.


    To subscribe to OCAs e-bulletin we ask you to to provide us with your email address. This information is supplied to MailChimp. You can edit your profile with further information, however we only require an email address. You can amend the information we have or unsubscribe from the list at any time.


    To process an enrolment to an OCA degree course we ask for your name, date of birth, address, contact details (phone number and email address), previous qualifications, information on disabilities, your gender, your ethnicity, your religious beliefs, if you are a care leaver, your legal nationality, and your last job and area of work. In addition we also collect certain financial information to collect payment, and/or setup as payment plan. This is a mix of personal, sensitive, and financial information that we need to setup your profile as a student. Some of this information will be provided to external partners as detailed below. This information is supplied to MailChimp and updates your record so that we can send you communications relevant to your enquiry or order with OCA.

    If you submit an enquiry to us, we ask for your name, date of birth, address, contact details (phone number and email address), and what course you are interested in.

  • Under EU data protection legislation, you have certain rights to your information which we must publish. The rights available to you depend upon our reason for processing your data.

    Right of access – you have the right to ask for copies of the information we hold about you. This right always applies. There may be exceptions to this, where you may not receive all information that we process; you can read about this here –  Your Right of Access.

    Right to rectification – you have the right to ask us to rectify information that we hold on you where you believe this is inaccurate. This also includes the right to ask us to complete information you believe is incomplete. This right always applies. You can read about this here – Your right to get your data corrected

    Right to erasure – you have the right to ask is to remove certain information in certain circumstances. You can read about this here – Your right to get your data deleted.

    Right to restriction of processing – you can ask us to restrict the processing of your personal data in certain circumstances. You can read about this here – Your right to limit how organisations use your data.


    Right to object to processing – you have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests. You can read about this here – The right to object to the use of your data.


    Right to data portability – this right only applies to information you have directly given us. You have the right to ask us to transfer information to another organisation, or for information to be transferred to you. This only applies where your express consent has been given to process that data. You can read about this here – Your right to data portability.

  • As a UK body in receipt of public funding, we have a legal duty to comply with the Equality Act (2010).


    Among the requirements this stipulates, is a stipulation to make reasonable adjustments for anyone who contacts us to eliminate barriers to access our services. Our legal basis for processing this information is article 6(1)(c) of the General Data Protection Regulation (GDPR) as we have a legal obligation to provide this. Our processing of special category data, such as health information you give us, will be based on article 9(2)(a), which means we need your consent.


    We’ll create a record of your adjustment requirements. These will give your name, contact details and type of adjustment required, along with a brief description of why it is required. Relevant staff can access this to ensure they are communicating with you in the required way.

    We will keep this information for the period listed in our retention schedule.

    You have a right to withdraw consent at any time. Please contact us if you need any information.

  • We will not share your information with anyone for the purposes of direct marketing.


    In some circumstances we share data with third parties to deliver specific services. In all such cases we have contracts with these third parties. This means that they cannot do anything with your personal information unless we give explicit permission, will not share it with any other organisation, and will hold it for the period that we instruct.


    As a public sector body we have legal obligations to comply with, which can in certain circumstances involve sharing data. In all circumstances, before supplying data, we will ensure that there is a legal basis to do so.


    We may also share your information in the event of the non-payment of fees for services provided. If the debt remains outstanding after the specified timeframe for payment, no payment plan is in place or an agreed payment plan is not being adhered to, we may initiate formal proceedings to recover the full amount of the unpaid penalty. As a result the OCA will share personal data with the litigation and recovery specialists it instructs in order for them to identify assets and undertake recovery action through the courts.

  • The Open University (OU) – The OU, as the college’s awarding University and in preparation for becoming the awarding University, employees’ and students’ personal and sensitive data is shared with The OU for the purposes of providing and setting up The OU-hosted services, and providing data for The Open University’s HESA submission as part of statutory requirements. Data shared between OCA and The OU is held under The OU’s Data Protection Policy.

    University for the Creative Arts (UCA) – as the college’s outgoing awarding University, employees’ and students’ personal and sensitive data is shared with UCA for the purposes of providing UCA-hosted services and providing data for the University’s HESA submission as part of statutory requirements until OCA’s transition to the OU has been completed. Data shared between OCA and UCA is held under UCAs Data Protection Policy.


    Higher Education Statistics Agency (HESA) – we have a legal requirement to provide information to HESA about people who enrol onto degree and masters course with OCA. This information is first sent to The Open University and UCA where this information is brought together as a joint OU/OCA and UCA/OCA submission. The information provided is both personal and sensitive. Please see the HESA Data Protection Policy for information.


    OCA Tutors – in order to provide our services and allocate you a personal tutor for your course we share certain information, including name and contact details to our tutors. In all cases we have a contracted relationship with our tutors which covers data sharing.


    Mailchimp – by signing up to one of our Mailing Lists (e.g. the Weekly E-bulletin), your data (first name, surname, Email address) will be shared with Mailchimp, a USA-hosted service which is signed up to the Privacy Shield Agreement. In addition, if you submit an enquiry or enrolment order to study with OCA, additional information including your preferences, and order information will be shared with MailChimp in order for us to send you communications relevant to your enquiry or order. You may unsubscribe from these lists at any time through links in the Email footers, or by emailing OCA at [email protected], however doing so would mean you could miss out on important information relating to your studies.


    Tidio.com – this is a live chat service; if you fill in the live chat form, that data is processed by Tidio.com to allow our staff to converse with you through the website.


    Google – Traffic on this site is monitored through Google Analytics through use of Cookies which track your activity throughout this website.


    Crazyegg.com – To improve the User Experience on this website, we periodically employ the services of Crazy Egg to anonymously track user activity, enabling us to improve the website experience.


    Worldpay – By making payment using a debit or credit card on this website, your sensitive card data will be shared with our E-Merchant provider, Worldpay. All payment information is securely encrypted.


    Splitpixel – Splitpixel host our website.

  • We do our best to ensure that the information presented here, on this website, and how we process and manage your personal information is done to the highest standards. If you have any queries please contact us at [email protected] and we will be happy to respond.


    If for any reason you are dissatisfied with the service we have provided, including in the way we process your personal information, you can make a complaint using OCAs complaints policy.

  • Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.

  • We do not provide services directly to people under the age of 16 or proactively collect their personal information. However, we are sometimes given information about children who attempt to enrol on OCA courses or purchase other services provided. The information in the relevant parts of this notice applies to children as well as adults.

    This privacy notice has been designed to be understood by persons under the age of 16. A person with a reading age of at least 14 should be able to follow its main points.