Higher Horizons (HH) is committed to protecting the privacy and security of the personal information we collect. This privacy policy explains how we collect and use your personal information when you take part in our activities and events, or when you visit our website, in accordance with the UK General Data Protection Regulation (UK GDPR).

Higher Horizons is what is known as the ‘Data Controller’ of the personal data we hold about you. This means that we are responsible for deciding how we hold and use the personal information we hold. We are required under data protection legislation to notify you of the information contained in this privacy policy.

This privacy policy is reviewed on a regular basis and may be updated at any time. This page will always contain the latest version of our privacy policy.

This version was last updated on 23rd October 2024.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

Section 1 – The data we collect

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

Special category data is more sensitive personal data, which requires a higher level of protection.

We may collect, store, process and share the following categories of personal information about you:

Learners

• Full name
• Postal address
• Name of school or college you attend
• Date of Birth
• Gender
• Next of kin and emergency contact details
• Email address
• Quotes; which may be taken by hand or with use of an audio recordings; but only where prior consent has been given by you (or your parent/carer)
• Your current or past eligibility for Free School Meals
• Whether your parents/carers have served in the Armed Forces

We may also collect, store and process the following ‘special categories’ of more sensitive personal information:

• Your ethnicity
• Details of disability or relevant medical condition
• Care status
• Young carer status
• Your residential status

Teachers and advisors

• Full name
• Name of school or college you work at
• Relationship to attending learners, and job title
• Email address used for work purposes
• Quotes; which may be taken by hand or with use of an audio recordings; but only where prior consent has been given by you

Parents and carers

• Full name
• Postcode
• Name of school or college your child/dependent attends
• Email address, only where you have agreed for your child/dependent to take part in certain research such as focus groups, and you have given consent for us to contact them in the future regarding that or related studies

Visitors to our website (when using the ‘Chat now’, ‘Ask a Question’ or ‘Ask us Anything’ functions)

• Full name
• Nationality
• Email address
• School or College you are affiliated with
• Postcode

The ‘Chat now, ‘Ask a Question’ or ‘Ask us Anything’ functions hosted on our website are powered by The Ambassador Platform. Data collected at sign up is held by The Ambassador Platform and shared with Higher Horizons under an appropriate Data Sharing Agreement, and is held and processed under this Privacy Policy and The Ambassador Platform’s Privacy Notice.

The online survey system we subscribe to, Alchemer, automatically collects the following geographical and individual response data for security purposes:

• IP address of the device used to submit a survey response
• Location: City, Country, and Postcode (Outcode only) from which the survey response originates
• Latitude and longitude coordinates of the device used to submit a survey response

This data is only collected when a digital version of our evaluation form is completed directly by a participant; or when a data collection form of another kind is directly completed by a participant. This data will not be accessed or used by Higher Horizons for any purpose other than safeguarding, should this be required.

Section 2 – How we collect personal data

Most of the personal data we collect and process is provided to us directly by you through one of the following methods:

Learners

• Completion of physical (paper-based) evaluation forms at the activities you take part in;
• Completion of digital evaluation forms when taking part in remote activities or accessing activities or resources through our website or a Higher Horizons funded platform. In this case data is collected via a weblink to a secure Alchemer account controlled by Higher Horizons, and data will only be collected, accessed, and processed by Higher Horizons. Any third parties distributing the weblink on our behalf will have no access to your data at any point during or after this process, unless instances where there is an appropriate Data Sharing Agreement in place;
• Completion of paper or digital EMWPREP data collection forms (see Section 2a) before or during activities you take part in. This will be completed by your parent/guardian if you are aged 16 or under;
• Completion of additional information forms for taking part in certain events, such as residential events, or where there may be photographs or film footage taken of you. These will be completed by your parent/guardian if you are aged 16 or under;
• From your communication with Higher Horizons, for example if you contact us by email, telephone, or via social media;
• Directly from the school or college you attend where an appropriate Data Sharing Agreement is in place;
• When taking part in a focus group or case study interview, which may include audio recordings of your voice, when you (or your parent/carer) have given prior consent to be involved.

Teachers and advisors

• Completion of physical (paper-based) evaluation forms at the activities you attend;
• Completion of digital evaluation forms when taking part in remote activities or accessing activities or resources through our website or a Higher Horizons funded platform. In this case data is collected via a weblink to a secure Alchemer account controlled by HH, and data will only be collected, accessed and processed by Higher Horizons. Any third parties distributing the weblink on our behalf will have no access to your data at any point during or after this process, unless instances where there is an appropriate Data Sharing Agreement in place;
• From your communication with Higher Horizons, for example if you contact us by email, telephone, or via social media.
• Completion of ad hoc digital surveys produced by Higher Horizons, which may seek your opinion or knowledge on appropriate subjects, to help inform our support offering and practice. This may include cases where we ask for your consent to contact you in the future.
• When taking part in a focus group or interview, which may include audio recordings of your voice, when you have given prior consent to be involved.

Parents and carers

• Completion of physical (paper-based) evaluation forms at the activities you attend;
• Completion of digital evaluation forms when taking part in remote activities or accessing activities or resources through our website or a Higher Horizons funded platform. In this case data is collected via a weblink to a secure Alchemer account controlled by Higher Horizons, and data will only be collected, accessed and processed by Higher Horizons. Any third parties distributing the weblink on our behalf will have no access to your data at any point during or after this process, unless instances where there is an appropriate Data Sharing Agreement in place;
• From your communication with Higher Horizons, for example if you contact us by email, telephone, or via social media;
• Completion of additional information and consent forms allowing your child/dependant to attend certain events, such as residential events, or where there may be photographs or film footage taken of your child/dependent.
• Completion of consent forms allowing your child/dependent to take part in focus groups or case study interviews.

Visitors to our website

• Completion of the sign-up form when using the ‘Chat now’, ‘Ask a Question’ or ‘Ask us Anything ’ functions on our website;
• From your communication with Higher Horizons, for example if you contact us using the ‘Contact us’ function on our website, by email, telephone, or via social media.

In certain cases, we also receive personal information indirectly, from the following sources in the following scenarios:

Learners

• From the third-party platform The Ambassador Platform, where data is collected on our behalf on sign up to the ‘Chat now’, ‘Ask a Question’ or ‘Ask us Anything’ functions hosted on our website; or following an activity or event you have attended; and an appropriate Data Sharing Agreement is in place.
• From the school/college you attend, where an appropriate Data Sharing Agreement is in place.

Section 2a – East Midlands Widening Participation Research and Evaluation Partnership (EMWPREP)

As a condition of our funding, we use the EMWPREP monitoring and evaluation database to track the educational journey of the learners we work with, and as a tool to evaluate our work.

You may be asked to complete an EMWPREP data collection form before or at an activity you take part in, or your parents/guardians may be asked to do so on your behalf if you are under 16. We may also ask for this data to be provided directly by your school or college, where an appropriate Data Sharing Agreement is in place.

Higher Horizons is required to comply with the data protection policies put in place by EMWPREP: EMWPREP Privacy Notice; EMWPREP Data Sharing Policy.

Section 3 – How we use the personal data we collect

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• To prove to our funders, the Office for Students and Department for Education, that we are working with the people that our funding is provided for;
• To prove the impact of the work we are doing;
• To track the educational journey of the learners we work with, and to measure the impact of the activities they take part in;
• To ensure the safety of learners when attending certain activities, such as residential events (staying over at one of our universities), or events where we take learners away from their school or college;
• Where you have explicitly agreed to a particular use of your data (consent);
• To communicate effectively with you by email or phone, where you have agreed to be contacted, including but not limited to the distribution of relevant newsletters and evaluation forms.

Legal basis for processing

Higher Horizons collect and process personal information under the legal basis of Article 6 (1) (e) Public Interest; and special category data under Article 9 (2) (j) Research purposes, Article 9 (2) (g) reasons of substantial public interest. This means that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (Office for Students and Department for Education).

If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to allow you or your child/dependent to take part in certain activities.

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Automated decision making

Automated decision making takes place when an electronic system uses personal information to make a decision without human intervention. Higher Horizons do not use automated decision making.

Incentives

From time to time, Higher Horizons may offer learners incentives to complete surveys relating to activities they have taken part in, or resources they have accessed. Where this is the case, learners will be informed before completing a survey. This will not affect any of their rights as outlined in Section 7 of this notice.

Learners may be given the opportunity to enter competitions and will have the choice to enter or not. Entrants’ contact with Higher Horizons will be through their school or college, and winners will be contacted through their school or college. Entrants’ data will not be used for any other purpose. This will not affect any of their rights as outlined in Section 7 of this notice.

Section 4 – Data sharing

We may have to share your data with third parties, including third-party service providers. We require third parties to respect the security of your data and to treat it in accordance with the law.
Your data will not be transferred, stored or processed outside of the EU, in accordance with the UK GDPR.

We may share the personal information we collect and process with one or more of the following receiving organisations:

• The Office for Students, and Department for Education (who fund our activities);
• Our partner universities and colleges;
• The schools and colleges that the learners we work with attend;
• The Local Authorities of the schools and colleges that the learners we work with attend;
• Selected third party activity and service providers working in association with Higher Horizons;
• The national evaluators of our programme, CFE Research, and Transforming Access and Student Outcomes in Higher Education (TASO);
• Companies or organisations providing specific services to or on behalf of Higher Horizons, including but not limited to:
  • Google (Through the institutional use of Google apps for email and cloud storage services);
  • Microsoft (Higher Horizons uses Microsoft for email and cloud storage services, and to securely transfer data within our network);
  • Alchemer (Higher Horizons uses this secure service to input and store evaluation data);

Section 5 – Data storage and retention

How do you store my data?

Your data is securely stored as follows:

Physical data (paper-based):

• locked filing cabinets in secure access-controlled buildings at one of our partner institutions. Access to physical data is restricted only to those who need access.

Electronic data:

• stored on secure, restricted-access institutional drives; or on institutionally owned and controlled cloud services such as Microsoft OneDrive, Microsoft SharePoint and Google Drive.

How long will you use my data for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Details of retention periods for different aspects of your personal information are available in our retention policy which is available here.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Once we no longer need the personal data we have collected or have reached the date of deletion as outlined in our Records Retention Schedule, it will be securely destroyed in accordance with the Records Retention Schedule.

Section 6 – Data breaches

Higher Horizons is committed to protecting the privacy and security of the personal information we collect and process and take this responsibility very seriously. We have a robust data breach reporting process in place, of which all Higher Horizons staff members are aware.

We also have the following security measures in place to avoid data breaches from occurring:

• Personal data is saved on restricted access drives only, and can only be accessed by those who need access to the data;
• Personal data is not transferred outside of the EU;
• Any personal data being transferred must be encrypted;
• Records Retention Schedule sets out the length of retention and method of secure destruction and deletion of personal data;
• Risk Register, which is updated regularly, monitoring any risks to data processing.

Any data breaches or suspected data breaches will be inspected and reported appropriately to the ICO within 72 hours of discovery. Where the data breach relates to individuals, we will do our best to notify those involved.

Section 7 – Your rights

Under the UK GDPR, all individuals have the following eight rights:

1. The right to be informed

• • This means you have the right to be given information about how and why your data is being processed.
  • When you provide your information directly to Higher Horizons, you will be informed at that time how it will be used. This will include the purpose of processing, how long it will be held, and details of any recipients of your data (who it may be shared with).

2. The right of access

• • You have the right to receive confirmation that your data is being processed and to access it by request.
  • You can access your personal data by submitting a Subject Access Request to Higher Horizons and, after your identity has been verified, you will receive a response within one month.
  • You can submit a Subject Access Request by emailing us at ncop@keele.ac.uk

3. The right to rectification

• • You have the right to correct your personal data if it is inaccurate or incomplete.
  • Higher Horizons will respond to requests for rectification within one month or, in the case of a complex request, up to three months. If your data has been shared with a third party, Higher Horizons will inform them of the rectification where possible.
  • You can request a rectification by emailing us at ncop@keele.ac.uk

4. The right to erasure

• • You have the right to request that your personal data is removed, so long as there is no compelling reason for it to continue to be processed.
  • This does not mean that you have an absolute right ‘to be forgotten’, but that you can have personal data erased or prevent its processing in the following circumstances:
    • Where your personal data is no longer necessary for the purpose for which it was originally collected/processed;
    • When you object to the processing and there is no ‘legitimate interest’ for Higher Horizons to continue the processing;
    • Where your personal data was unlawfully processed;
    • When your personal data has to be erased in order to comply with a legal obligation.
  • Higher Horizons can refuse a request for erasure for the following reasons:
    • To exercise the right of freedom of expression and information;
    • To comply with a legal obligation or for the performance of a public interest task or exercise of official authority;
    • For public health purposes in the public interest;
    • For archiving purposes in the public interest, scientific research, historical research, or statistical purposes;
    • The exercise or defence of legal claims.
  • If your data has been shared with a third party, Higher Horizons will inform them of the erasure where possible.
  • You can make a request for erasure by emailing us at ncop@keele.ac.uk

5. The right to restrict processing

• • You have the right to restrict the processing of your personal data so that it may continue to be held but no longer processed.
  • Higher Horizons will restrict processing in the following circumstances:
    • If you contest the accuracy of the data;
    • Where you have objected to the processing of personal data where Higher Horizons has a legitimate interest;
    • When processing is unlawful but you oppose erasure and request restriction instead.
  • If your data has been shared with a third party, Higher Horizons will inform them of the restriction of processing where possible.
  • You will be informed when Higher Horizons decides to lift a restriction on processing.
  • You can make a request to restrict the processing of your personal data by emailing ncop@keele.ac.uk

6. The right to data portability

• • You have the right to obtain your personal data in an easily transferable format to reuse for your own purposes.
  • This right only applies:
    • To personal data you provided to Higher Horizons;
    • Where processing is based on your consent or for the performance of a contract; and
    • When processing is carried out by automated means.
  • Higher Horizons will respond to requests within one month or, in the case of a complex request, up to three months.
  • You can make a request of data portability by emailing ncop@keele.ac.uk

7. The right to object

• • You have the right to object at any time to the processing of your personal data for the purposes of processing based on ‘legitimate interests’ or; processing for research or statistical purposes. Please note, Higher Horizons will never use your personal data for direct marketing purposes.
  • This right relates only to the following specific purposes for processing, there is no right to object to processing in general:
    • Processing based on legitimate interests – you must have grounds relating to your particular situation in order to object to your personal data being processed for this purpose. Higher Horizons must stop processing your data unless it can demonstrate compelling legitimate grounds which override your interests, rights and freedoms as an individual.
  • Processing for research or statistical purposes – you must have grounds relating to your particular situation in order to object to your personal data being processed for this purpose. If the research being conducted requires the processing of your personal data for the performance of a public interest task, Higher Horizons is not required to comply with an objection.
  • You can make an objection by emailing ncop@keele.ac.uk

8. Rights in relation to automated decision making and profiling

• • You have the right not to be subjected to a decision that is based on automated processing which results in a legal impact upon you.
  • In such a circumstance Higher Horizons must ensure that you are able to have human intervention in the decision, express your views and receive an explanation of the decision so that you may challenge it.
  • This right does not apply if a decision does not have a legal effect on you, or if a decision:
    • Is necessary for entering into, or performance of, a contract between the data subject and Higher Horizons;
    • Is authorised by law, for example for the purpose of fraud prevention;
    • Is based on your explicit consent.

The right to erasure and the right to portability do not apply when the legal basis for processing is public interest.

Section 8 – Contact and Data Protection Officer details

You can contact Higher Horizons directly with any queries relating to this notice, using the details below:

Name: Katie Coombe-Boxall

Email address: ncop@keele.ac.uk

Higher Horizons is based at Keele University and is required to comply with data protection policies put in place by Keele University. Therefore, our Data Protection Officer is based at and works for Keele University. You can contact the Data Protection Officer at dpo@keele.ac.uk

Full details of the Keele University Information Governance and Security Policy to which we are required to adhere can be found here.

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. ICO contact details: www.ico.org.uk

Section 9 – Website Cookies

The Higher Horizons website uses cookies when you visit it. You can opt in or out of these cookies at any time. Details of the cookies used can be found below: