Educate Preston privacy notice
How we use your information as part of Educate Preston
This privacy notice tells you what to expect us to do with your personal data when you engage with Educate Preston, which is a project run by the University of Lancashire (formerly the University of Central Lancashire), Cardinal Newman College and Preston College. Personal data (or personal information) is any information which relates to, and identifies, you. Data protection legislation (the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA)) set out how we should handle your personal data.
If you engage with Educate Preston, the University, Cardinal Newman College and Preston College will jointly consider the information you provide and determine how Educate Preston can advise you and refer your query to the relevant individual organisation. All three parties will have access to your information and will use it together for the purposes set out in this notice. This is because for the purposes of data protection legislation, the University, Cardinal Newman College and Preston College are joint controllers in relation to Educate Preston. This means that they are each are equally responsible for complying with data protection legislation and for ensuring your information is handled correctly when it is used for the purposes of Educate Preston. The University, Cardinal Newman College and Preston College collect and use your information for a common purpose to achieve the same outcomes. Any references in this notice to how personal data is used apply to how all three parties will jointly use that information.
Our contact details
The University of Lancashire (formerly the University of Central Lancashire) is the lead controller for the personal data processed for the purposes of Educate Preston, unless otherwise stated. It is registered with the Information Commissioner’s Office and its registration number is Z5512420. The University’s contact details can be viewed on its website.
Cardinal Newman College is registered with the Information Commissioner’s Office and its registration number is Z6281119.
Preston College is registered with the Information Commissioner’s Office and its registration number is Z4680485.
There are many ways you can contact the Educate Preston team. View our main contact details on our website: educatepreston.ac.uk.
You can also contact each of the joint controllers separately, if required, using the contact details on each controller’s website.
Our Data Protection Officer
The University’s Information Governance Manager & Data Protection Officer can be contacted on DPFOIA@uclan.ac.uk. Further information and contact details can be found on the University’s data protection web pages.
Cardinal Newman’s Data Protection Officer can be contacted on dataprotection@cardinalnewman.ac.uk
Preston College’s Data Protection Officer can be contacted on dallott@preston.ac.uk
What personal information will we use?
We will use information that you give to us when you submit an enquiry via the Educate Preston website. We will also use information that we collect during any engagement we have with you, or any feedback or views you give us via any other method.
We will usually collect the following information about you:
Name
Age (optional)
Gender (optional – for evaluation and reporting)
Ethnicity (optional – for evaluation and reporting)
Postcode (optional – for evaluation and reporting)
Email address
Phone number
Level of study interest
Enquiry (free text)
Information about where you heard about Educate Preston (optional)
Why do we use your personal data?
Administration and communication
We use your information to run and administer Educate Preston and keep records of how the project has operated and performed. We will consider your enquiry and the information you provide then decide which of the individual organisations (the University, Cardinal Newman College or Preston College) is best-placed to address your enquiry and provide any advice or information you have requested or would be relevant to you. Educate Preston will then refer your query to the relevant individual organisation, which will then contact you directly. When this referral process takes place, the individual organisation becomes the sole controller of your personal data that has been referred to them and they are individually responsible for complying with data protection legislation when they use it to respond to your enquiry.
If your enquiry is referred to the University, it will be handled as set out in its privacy notice for enquirers.
If your enquiry is referred to Cardinal Newman College, it will be handled as set out in its privacy notice.
If your enquiry is referred to Preston College, it will be handled within GDPR regulations. Contact Preston College for details of their privacy notice.
If you agree, we will use your information to communicate with you about the work of Educate Preston and send you information about events we run . We will also use your information to refer your enquiry to the University, Cardinal Newman College and/or Preston College so they can answer your queries and, if you agree, send you information about their courses and events. You can tell us that you no longer want to receive these communications at any time:
If your enquiry has already been referred on to the University, Cardinal Newman College or Preston College and they have contacted you about your enquiry, you will need to tell that partner directly by unsubscribing or contacting the email address provided on the communication.
If you have not yet heard directly from an organisation, you can opt out of Educate Preston communications, including communications from our partners, by emailing: educatepreston@lancashire.ac.uk
Monitoring, compliance, research and evaluation
We will use your information to ensure and monitor our compliance with legislation including laws relating to health and safety. We will also use your information to monitor our compliance with requirements set by the project’s external funders.
We will use your information to evaluate the project, to see how well it is has met its aims and objectives, and to report outcomes to the project’s external funder. We will also use your information for equality monitoring purposes to see if our work is effective at increasing equality of opportunity across groups of people of different ages, genders and ethnicities.
What is the lawful basis for this processing?
The three joint controllers rely on the following lawful bases from the UK GDPR to process information about you for the purposes set out in this notice:
Article 6(1)(c), which allows us to process personal data when it is necessary to comply with a legal obligation. We are legally required to monitor compliance with laws relating to health and safety and equality, among other things.
Article 6(1)(f), which allows us to process personal data where it is in our, or someone else’s, legitimate interests to do so and it does not unduly prejudice your rights and freedoms. We rely on this condition to, among other things:
Operate the Educate Preston project, including assessing your enquiry, referring it to an individual organisation, sending you information you have requested and keeping records of the project’s activity. It is in our legitimate interests to enable prospective students to see what life at the University, Cardinal Newman College or Preston College would be like, and to promote the respective organisation’s courses, events and services to those who are interested. This does not unduly prejudice your rights and freedoms because we will only use your information when you have asked us to.
Produce reports, research and statistics. It is in our legitimate interests to use these to evaluate, plan and assess how the project is operating and to make any changes that will benefit future projects and future potential students. It is in our external funder’s legitimate interests to know how the project has performed so it can determine how best to fund any future projects and justify the use of its funds. Your personal data will be used to produce our evaluation but will not be shared with the funder.
Where we process special category data (special category data is information about your race, ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used for ID purposes, health, sex life or sexual orientation) for the purposes set out in this notice, we rely on the following additional lawful bases from the UK GDPR and DPA:
Article 9(2)(g) UK GDPR, which allows us to process special category data if the processing is necessary in the substantial public interest and there is a basis to do so in law. The law which allows us to rely on Article 9(2)(g) is section 10 DPA by virtue of Schedule 1 DPA, which also provides the lawful basis for processing data about criminal convictions. The specific conditions from Schedule 1 DPA on which we rely for this type of processing are as follows:
Schedule 1(6), which allows us to process special category data to comply with a statutory or legal function. Such functions include the duties set out in the Equality Act 2010.
Schedule 1(8), which allows us to process special category data to monitor equality of opportunity or treatment.
When processing special category data or data about criminal convictions in reliance on the above conditions from Schedule 1 DPA the University must have an appropriate policy document, which can be read here: Data Protection: Processing special category data and criminal convictions data.
Article 9(2)(j) UK GDPR, which allows us to process special category data for archiving, scientific or historical research purposes or statistical purposes, where there is a basis to do so in law. The law which allows us to rely on this basis is section 10 DPA by virtue of Schedule 1(4) DPA.
Who will my personal information be shared with?
We share your information with a small number of external organisations and bodies, some of which are processing personal data on our behalf. We only share your personal data with another person or organisation where the law allows us to and we consider it to be appropriate under the circumstances. The external parties we will share information with include the following:
University of Lancashire, Cardinal Newman College and Preston College. Educate Preston will share your information with one or more of these organisations, depending on which one is best-placed to answer the enquiry you have submitted and/or provide any information you have requested.
Companies or organisations acting on our behalf: We use processors who are third parties who provide elements of services for us, such as those who provide IT services on our behalf. We have contracts in place with our processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will hold it securely and retain it for the period we instruct.
Sending your information outside the EEA
Occasionally we may need to send your personal information outside the UK and/or the European Economic Area (EEA) e.g. to communicate with you if you are based in another country; or to obtain a service from a processor. These transfers are usually carried out with your consent or because they are necessary for a task in the public interest. All transfers are carried out with appropriate safeguards in place to protect your information and ensure it remains secure. For example, we share information on the basis of the UK International Data Transfer Agreement or UK International Data Transfer Addendum when we share information with processors based outside the EEA. A copy of these Agreements can be obtained from the University on request.
How long will we keep your personal information?
The project is expected to end in April 2026. Educate Preston (via the University, Cardinal Newman College and Preston College) will keep your information for two years following the end of the project.
Your data protection rights
Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. Further information about each of these rights can be found on the Information Commissioner’s Office website. To make a request to exercise any of these rights, please contact the University’s Information Governance Manager & Data Protection Officer on DPFOIA@uclan.ac.uk. The University is the lead controller for the project; however you can contact any of the individual organisations directly, if you wish.
Your right of access
You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. For further information or to make a request, please see the data protection pages of the University’s website.
Your right to rectification
You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
Your right to erasure
You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing
You have the right to ask us to restrict the processing of your information in certain circumstances.
Your right to object to processing
You have the right to object to any processing we carry out, if we carry it out on the basis that it forms part of our public task or is in our legitimate interests. You also have the right to object to your personal information being used for direct marketing purposes.
Your right to data portability
This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information because we have your consent or because it is necessary for a contract you have signed up to, and the processing is automated.
Your right to complain
We work to high standards when it comes to processing your personal information. If you have queries or concerns or want to make a complaint, please contact the Educate Preston team or the University’s Information Governance Manager & Data Protection Officer and we will respond.
If you remain dissatisfied, you can make a complaint about the way we process your personal information to the Information Commissioner’s Office, which is the UK supervisory authority for data protection. Further information can be found on the data protection pages of the University’s website.
