Privacy Notice

Privacy notice

How we use your information

This privacy notice tells you what to expect when City College Southampton collects personal information. It applies to information we collect about:

  • People who apply for a course with us
  • Job applicants and our current and former employees
  • Visitors to our websites
  • Complainants and other individuals in relation to a data protection or freedom of information complaint or enquiry
People who apply for a course with City College Southampton

The categories of this information that we collect, process, hold and share include:

  • personal information (such as student name, address, email and telephone details)
  • emergency contact information such as phone numbers and email details and next of kin
  • characteristics (such as ethnicity, language and free college meal eligibility)
  • assessment information related to prior exam performance
  • relevant medical information
  • special educational needs information
  • academic performance and pastoral support data created during your time at college including tutorial notes and marks in college and national examination assessments
  • attendance data at college and while on work placement
  • careers information and future plans for progression
  • wider interests to help us prepare references and provide enrichment activities
  • student photographs for ID badges, payment systems, and for marketing and publicity materials

Why we collect and use this information

We use student, parent and young person’s data to:

  • To support our students learning
  • To monitor and report on student progress
  • To provide appropriate pastoral care
  • To assess the quality of our service
  • To comply with the law regarding data sharing
  • To safeguard students and staff and keep the college secure
  • To demonstrate evidence of students eligibility for funding to the Education and Skills Funding Agency (ESFA) as part of our contract to deliver education
  • To derive statistics which inform decisions such as the funding of the college
  • To assess performance and to set targets for the college
  • To prepare our students for progression after their time at college
  • To provide efficient means of payment for college services, trips and visits

The lawful basis on which we use this information

We hold the legal right to collect and use this personal information relating to students and young people and their parents and guardians and we may also receive information shared from their previous school, LA and or the Department for Education (DfE)/ ESFA.   We collect and use personal data in order to meet legal requirements and legitimate interests set out in the GDPR and UK Law including:  

  • Article 6, and Article 9 of the GDPR
  • The Education Act 1996
  • The Further and Higher Education Act 1992
  • The Apprenticeships, Skills Children and Learning Act 2009
  • The terms and conditions of funding imposed upon the college by the ESFA

Further information about why the ESFA requires the college to collect personal data can be found at ESFA Privacy Notice (new window).  

Collecting this information

Whilst the majority of student, parental and young person’s information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the data protection legislation, we will inform you whether you are required to provide certain information to us or if you have a choice in this. 

As an example during enrolment we will ask for consent to be given to share photographs for marketing and publicity materials however we will also insist upon a photograph being taken for an ID Card to help with security and safeguarding.  So you may opt out of giving photos for marketing but a photograph is required for your ID Card.

Storing this information

We hold student, parental contact and young person’s data as follows: 

For students who apply but do not enrol with the college your records will be deleted after one year.  For students under 19 years of age we, or your local authority, may contact you to ensure that you have made alternative plans for alternative education or education with training as this is a statutory duty.

For students who attend college after enrolment – we are contractually required to keep your records for a minimum of six years after your time at college has come to an end to meet funding and audit requirements of the DfE via the ESFA.


Who we share this information with

We routinely share students and young person’s information with:

  • The Education and Skills Funding Agency (ESFA) as part of our contractual funding agreement as an education provider
  • The Department for Education (DfE) - on a statutory basis under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013. For example so that data on student performance can be published
  • Youth support services and Careers services – under section 507-8 of the Education Act 1996, to enable them to provide information regarding training and careers as part of the education or training of 13-19 year olds
  • Local Authorities where students live so that they can ensure education with training is provided to all students age 16-19. (Education Act 1996 Sections 13 + 15)
  • Social Services / NHS and other support agencies where a student or young person has safeguarding, care or welfare needs (Working Together to safeguard children 2015)

The National Pupil Database (NPD)

The NPD is owned and managed by the DfE and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.

The law requires us to provide information about our students to the DfE as part of statutory data collections. Some of this information is then stored in the NPD to show how pupils progress as 16-18 students at key stage 5. The legislation that requires this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the NPD, go to National Pupil Database (new window).

The DfE may share information about our students from the NPD with third parties who promote the education or well-being of children in England by:

  • conducting research or analysis
  • producing statistics
  • providing information, advice or guidance

The DfE has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

  • who is requesting the data
  • the purpose for which it is required
  • the level and sensitivity of data requested: and
  • the arrangements in place to store and handle the data

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, Please visit: DfE - How we collect data (new window)

For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: DfE_NPD_Contacts (new window)

To contact DfE: Contact DfE (new window)

Job applicants, current and former City College employees

When individuals apply to work at City College Southampton, we will use the information they supply to us to process their application, manage the recruitment process and to monitor recruitment statistics. We will use contact details to contact individuals as necessary as part of the recruitment process.

Applicant data will be stored on secure servers hosted by City College and also made available in hard copy for short-listing purposes. All hard copy documents are held securely and treated confidentially.

Personal information about unsuccessful candidates will be held for 6 months after the recruitment exercise has been completed, it will then be destroyed or deleted. We retain anonymised statistical information about applicants to help inform our recruitment activities.

Where we need to disclose information to a third party, for example where we wish to take up a reference or obtain a ‘disclosure’ from the  Disclosure and Barring Service we will not do so without informing them beforehand unless the disclosure is permitted by law (i.e  the Barred List Check).

  • If a person takes up employment with City College Southampton, we will compile a file relating to their employment. We will collect and process a range of information about them in addition to that obtained in the application form. This will include:
  • Terms and condition of employment
  • Qualification details and certificates and previous employment history
  • Bank account and national insurance number
  • Marital status next of kin and emergency contacts
  • Entitlement to work in the UK
  • Criminal record
  • Details of periods of absence and the reasons for this
  • Details of disciplinary and grievance correspondence
  • Information about medical or health conditions including whether or not a disability is declared
  • Equal opportunities monitoring information about ethnic origin, sexual orientation, religion or belief. This is to carry out our obligations and specific rights in relation to employment.

The information contained in this will be kept securely and will only be used for internal purposes directly relevant to that person’s employment. In addition to the personal file data will be stored in a range of different place including the organisation HR management systems, payroll systems and in other IT systems (including the organisation e-mail, access, timetabling and student record systems).

City College will process this data to enter into an employment contract with an individual and to meet its obligations under the contract i.e. to pay them in accordance with contractual terms.  In some cases we are processing the data to ensure legal complaint i.e. your right to work in the UK, deduct tax, comply with health and safety or statutory returns. In other cases, City College has a legitimate interest in process personal data before during and after the employment relationship allowing us to run recruitment and promotion processes, provide references, respond to and defend legal claims

Once employment with City College Southampton has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it.

Visitors to our websites

When someone visits we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

Use of cookies by City College Southampton

You can read more about how we use cookies on our Cookies page.

Event registration

We use a third party provider, Eventbrite, to register your attendance for our open events. We gather this information to register attendees as they arrive at our events and to keep them informed of future events and courses that might be of interest to them. This information will be retained for two years and will not be shared with any other organisations. For more information, please visit: Eventbrite Privacy Notice (new window)

People who contact us via social media

We use a third party providers to facilitate our social media interactions.

The college provides communication access via numerous social media platforms. If you send us a private or direct message via social media the message and data may be used by the respective organisations listed below;

Facebook Privacy (new window)

Twitter Privacy Policy (

Youtube Privacy Policy (new window)

Google Privacy Policy (new window)

LinkedIn Privacy Policy (new window)

People who email us

Any email sent to us, including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with office policy.  Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.

People who make a complaint to us

When we receive a complaint from a person we create a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.

We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We do compile and publish statistics showing information like the number of complaints we receive, but not in a form which identifies anyone.

We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for two years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.

Complaints or queries

City College Southampton tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

This privacy notice does not provide exhaustive detail of all aspects of City College’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.

Access to personal information

City College Southampton tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a ‘subject access request’ under the General Data Protection Regulations. If we do hold information about you we will:

  • give you a description of it;
  • tell you why we are holding it;
  • tell you who it could be disclosed to; and
  • let you have a copy of the information in an intelligible form.

To make a request to City College Southampton for any personal information we may hold about you, individuals can submit a request in writing which we would prefer was sent via, or in writing to the address provided below marked for the attention of the Data Protection Officer.

Individuals can also request information verbally however, the college will seek to confirm the request in writing to ensure we have understood the request correctly. This will be for our mutual benefit.

If we do hold information about you, you can ask us to correct any mistakes by, once again, contacting the Data Protection Officer.

Disclosure of personal information

In many circumstances we will not disclose personal data without consent. However when we investigate a complaint, for example, we will need to share personal information with the organisation concerned and with other relevant bodies. Further information is available in our Information Charter about the factors we shall consider when deciding whether information should be disclosed.

You can also get further information on:

  • agreements we have with other organisations for sharing information;
  • circumstances where we can pass on personal data without consent for example, to prevent and detect crime and to produce anonymised statistics;
  • our instructions to staff on how to collect, use and delete personal data; and
  • how we check that the information we hold is accurate and up to date.

Links to other websites

This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated on 11 May 2021.

How to contact us

If you want to request information about our privacy policy you can email the DPO 

or write to:

Data Protection Officer
City College Southampton
St Mary Street
SO14 1AR