Privacy Policy

Our Data Protection Officer is Tim Williams.  If you have any questions about this policy or the ways in which we use your personal information, please contact our Data Protection Officer at DPO@hca.ac.uk

This privacy notice has been prepared in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act 2018.
The privacy notice detailed below relates to personal data for external contacts who are introduced to Hereford College of Arts through this website, at events that representatives of Hereford College of Arts attends to promote the college (such as careers fairs), make a personal visit to Hereford College of Arts, or contact us directly via telephone or email.

For students – both applicants and enrolled students – please follow the menu links to our Student Privacy Notice.

The personal information we collect includes:

• Name
• Contact information (including address, telephone numbers, email addresses)
• Study and/or employment history
• Demographic information (such as postcode classification, and protected group status)
• We use CCTV on our campuses for the purposes of crime prevention, security and health and safety and, accordingly, will capture imagery of visitors to the college.
• Photography of people at events (with the permission of those being photographed)
• If you complete surveys for Hereford College of Arts or give us feedback, we will also record information you volunteer about your experiences and preferences as a student, prospective student, other visitor, or other college contact.

We use information to:

• To interact with individuals to answer queries, provide information about relevant courses and events (including posting prospectuses), and facilitate applications to study at HCA. NB please see Student Privacy Notice for further details on how personal data of applicants is handled.
• To book interested parties onto our Open Days.
• To record and manage other visits to HCA for the purposes of safely operating the college.
• To issue relevant news and updates about courses, events, and HCA activity.
• For market research so that we can better understand the needs of different categories of people that we engage with (such as prospective students and their parents/carers, current students and their parents/carers, other business and industry contacts of HCA ) and sub-categories thereof.
• To maintain relationships with alumni so that we can continue a mutually beneficial relationship with students after they have finished studying with us.
• To deliver outreach activities to prospective students and the wider community.
• To engage with external contacts such as visiting lecturers, employers, industry bodies, and other supporters of the college who can enrich students’ experience at HCA.

We will keep your Personal Information only as long as necessary for the purposes for which we collected it and to comply with applicable law.

As we are an education provider, legal and regulatory requirements apply to the retention of personal information for regulatory purposes and public interest tasks.

As an educational organisation, also classified as a public authority, we provide a service (education) which is in the public interest but we use a variety of legal bases for processing personal data.

• To interact with individuals to answer queries, provide information about relevant courses and events (including posting prospectuses), and process and facilitate applications to study at HCA – we process data via legitimate interest.
• To book interested parties onto our Open Days – we process data via legitimate interest.
• To record and manage other visits to HCA for the purposes of safely operating the college – we process data via legitimate interest and performance of contract.
• To issue relevant news and updates about courses, events, and HCA activity – we process data via legitimate interest, and via consent for digital marketing communications via email and SMS.
• For market research so that we can better understand the needs of different categories of people that we engage with (such as prospective students and their parents/carers, current students and their parents/carers, other business and industry contacts of HCA ) and sub-categories thereof – we process data via legitimate interest, and also public interest where objectives such as widening participation are involved.
• To maintain relationships with alumni so that we can continue a mutually beneficial relationship with students after they have finished studying with us – we process data via legitimate interest, and via consent for digital marketing communications via email and SMS.
• To deliver outreach activities to prospective students and the wider community – we process data via legitimate interest, and via public interest where widening participation objectives are involved, and via consent for digital marketing communications via email and SMS.
• To engage with external contacts such as visiting lecturers, employers, industry bodies, and other supporters of the college who can enrich student’s experience at HCA – we process data via legitimate interest, and via consent for digital marketing communications via email and SMS.

More information about the legal rules in place for processing personal data can be found on the Information Commissioner’s Office Website: ico.org.uk/

We will use appropriate procedures and reasonable security measures to try to protect your personal data and prevent unauthorised access.

HCA use a MailChimp, an email campaign platform from a company based in the USA, as a Data Processor to create, dispatch and manage email campaigns.  An EU Data Processing Addendum is in place between HCA and The Data processor, who is certified under the EU-US Privacy Shield Program for Data Processors outside of the EEA.
HCA may invite you to participate in an online survey that uses SurveyMonkey, from a company based in the USA who act as Data Processor when we create, manage and analysis the results of these online surveys.  SurveyMonkey are certified under the EU-US Privacy Shield Program for Data Processors outside of the EEA.
In limited circumstances we will share personal information with third parties:

• Name and address details are occasionally shared with approved print and mailing house contractors who print and dispatch named and addressed mailings.  HCA require these contractors to operate under careful GDPR guidelines and personal data is deleted as soon as the job has been fulfilled.
• Data might be shared with Statutory Bodies if there was a legal obligation, vital interest, or public interest, such as reporting a Health and Safety incident, or to aid a police investigation.

Under data protection law, you have a number of rights over your personal information.  These include: the right to request your information, the right to request that any errors are corrected, and the right (under certain circumstances) to request that your information be erased or anonymised.

To request your records, you will need to put your request in writing and provide proof of identification to The Data Protection Officer, Hereford College of Arts, Folly Lane, Hereford, HR1 1LT or DPO@hca.ac.uk.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO) about the handling of your personal data or a data request; for further details see ico.org.uk/