We are South Yorkshire Apprenticeship hub (“we”, “our”, “us”) a subsidiary of The Sheffield College. We are the data controller of personal information about you. Our Data Protection Officer is Seb Smith. If you have any questions about this policy or the ways in which we use your personal information, please contact: DPO@sheffcol.ac.uk

Data Protection Officer, The Sheffield College, Granville Road, Sheffield S2 2RL

We are registered with the Information Commissioner’s Office under number: Z667180X.

We process data for a number of categories of data subjects. Please view the appropriate section below to read more.

Who are you?

By staff we mean individuals who are employed by, have applied to work for or who have previously been employed by us. Please visit: https://www.sheffcol.ac.uk/data-protection/privacy-notice for information on how we process your data.

Who are you?

By Apprentices we mean individuals who have been supported directly or through their employer for the purposes of starting an apprenticeship.

How we collect personal data

We collect data directly from you in a number of ways including:

• when you apply to be an apprentice

• when you become an apprentice

• when you register on or use the talent pool service

• when you participate in social events

• when you contact us

We collect data indirectly from a variety of sources including from:

• employers or training providers

• results from training provider qualifications

• system logs that contain online identifiers such as IP addresses and cookie-related information

• photos and videos when we engage marketing agencies or otherwise collect images at events

We create information that can identify you in a number of ways including:

• your unique identifier number that can indirectly identify you in conjunction with other personal information

• details about your progress and targets

We aim to always ensure that you know we are processing your personal information except where it is disproportionately difficult to do so or when doing so would defeat our legitimate purpose (i.e. in the detection of fraud).

Special category data processing

Additional rules apply to the processing of special category data and, where we process this data, we need to tell you the additional lawful basis for processing.

If the College determines it is necessary, we will share personal data that you have disclosed to us to the police, local authorities or youth services.

• Our lawful basis for processing in these cases is the ‘Safeguarding of children and of individuals at risk’ basis within the Data Protection Act 2018.

We process special category data such as disability, health and ethnicity in order to support diversity and equality in our workforce and in order to support our colleagues with disabilities whilst working for the College.

• Our lawful basis for processing in these cases is the 'equality of opportunity or treatment' basis within the Data Protection Act 2018. More information regarding our processing of special category data can be found at privacy.sheffcol.ac.uk

Our purpose and lawful basis for processing

We use your personal information to:

• process your application and enrolment

• manage and administer your apprenticeship

• meet our legal obligations

• perform tasks as a public authority

This includes but is not limited to:

• processing your application

• putting together reports

• making arrangements for visits

• considering whether special provision or assistance is required for visits

With your permission (consent), we use your personal information to:

• Communicate with you, including for marketing purposes

Who we share it with

We share your personal information with:

• anyone who works for us when they need it to do their job

• emergency contacts, Local Authorities and youth services

• third party organisations that provide services to the college

• any organisation when we have a legal obligation/legitimate interest to do so

• organisations who provide services to us/you based on your consent or you opting in to these services

• anyone who you give us explicit permission to share it with

• Digital Marketing Service Providers

Our carefully selected partners and service providers may process personal information about you on our behalf, as described below:

We periodically appoint digital marketing agents to conduct marketing activity on our behalf, which may involve the compliant processing of personal information. Our appointed data processors include: (i) Prospect Global Ltd (trading as Sopro), Reg. UK Co. 09648733. You can contact Sopro and view their privacy policy here: http://sopro.io. Sopro is registered with the ICO (Reg: ZA346877), and their Data Protection Officer can be reached at dpo@sopro.io.

Who are you?

By individuals who are neither staff or apprentices we mean individuals that visit or interact with the college, either in person or online.

How we collect personal data

We collect data directly from you in a number of ways including:

• when you fill out a webform, contact us online, via telephone or in person

We collect data indirectly from a variety of sources including from:

• online identifiers such as IP addresses and cookie-related information

More information regarding our processing of special category data can be found at privacy.sheffcol.ac.uk.

Our purpose and lawful basis for processing

We use your personal information:

• to meet our legal obligations

• to perform tasks as a public authority

• in a way that you would reasonably expect, based on our legitimate interest

This includes but is not limited to:

• to effectively manage and administer apprenticeships

• for analysis and monitoring the performance of the website

• to respond to queries

Who we share it with

We may share your personal information with:

• anyone who works for us when they need it to do their job

• emergency contacts, Local Authorities and youth services

• any organisation when we have a legal obligation/legitimate interest to do so

• anyone who you give us explicit permission to share it with

Sharing personal data

In order to effectively operate, we need to share personal data from time to time. We only share the minimum amount of information required and where a lawful basis for us to do so has been identified.

We will only appoint data controllers and data processors who can provide sufficient guarantees that the requirements of the UK GDPR will be met and your rights will be protected.

Where we store your data

We do not store personal data outside the UK however we may use organisations to process data on our behalf that do so. We only allow data to be stored in countries that the UK has deemed to have adequate data protection regulations.

Where this is not possible, a legal safeguard will be in place to facilitate the transfer of data.

How long we keep your data

The storage of your personal data will be kept to a minimum, and personal data will not be stored for longer than required for the purpose of which it was collected.

The amount of data stored, and the retention period for that data, is limited to the requirements of the business, contractual, legal or regulatory purposes as specified in our Record of Processing Activity.

Your data belongs to you; and your rights as the owner of your data are enforced by data protection legislation. A brief summary of your rights is presented below:

Access your data: You can access the information we hold on you at any time, by making a Subject Access Request. There are some exemptions to this right, which means you may not always receive all the information we process.

Rectify your data: You can ask us to correct or complete any information we hold about you that is inaccurate. In some circumstances you can do this yourself via a self-service portal.

Request erasure: You have the right to ‘be forgotten’ in certain circumstances. This right is not absolute.

Request the restriction of processing: You may ask us to suspend the processing your data under certain circumstances. This right is not absolute.

Request the transfer of your data: In some cases, you can ask us to transfer the data you originally provided to us to you or to another company.

Object to the processing of your data: You can object to us processing your data. This right is not absolute.

Object to automated decision-making: You can object to us processing of your personal information where profiling is being used to make assumptions about your behaviours or preferences. The College does not undertake any automated decision-making.

Your right to lodge complaints with the data privacy supervisory authority

If you want to complain about any issues relating to your personal information, you can email or write to us using the address provided above.

You can also complain to the Information Commissioner’s Office, who can be contacted by telephone at 0303 123 1113, by email using the form at the following web link Contacting the ICO, or in writing to:

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

The Sheffield College is registered with the Information Commissioner’s Office under Registration number: Z667180X.

Changes to this privacy notice

We keep our privacy notice under regular review. Our data practices may change from time to time. If and when our data practices change, we will notify you of the changes via this page where the current version of the Privacy Notice will be published. Where appropriate, we will notify you of changes usually by email, but occasionally in another more appropriate format such as letter. We also encourage you to check this page frequently.

Manage cookies