Privacy Policy

Higher Horizons+ is committed to protecting the privacy and security of the personal information we collect. This privacy policy explains how we collect and use your personal information when you visit our website or take part in any of our activities, in accordance with the General Data Protection Regulation (GDPR). It applies to all learners, teachers and advisors and parents who take part in our activities, and visitors to our website.

Higher Horizons+ will be what is known as the ‘Data Controller’ of the personal data we hold about you. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy policy. We may update this notice at any time.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

Section 1 – The information we collect

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). There are “special categories” of more sensitive personal data which require a higher level of protection.

Learners taking part in our activities

We may collect, store, and use the following categories of personal information about you:

  • Full name
  • Postal address
  • Name of school or college you attend
  • Date of Birth
  • Gender
  • Next of kin and emergency contact details

We may also collect, store and use the following ‘special categories’ of more sensitive personal information:

  • Your ethnicity
  • Details of disability or relevant medical condition
  • Care status
  • Young carer status

This data can be collected through a number of different routes, please see Section 2 for further detail.

Teachers and advisors attending our activities

We may collect, store, and use the following categories of personal information about you:

  • Full name
  • School or college you work at
  • Relationship to attending learners, or job title
  • Email address used for work purposes

Parents and carers attending our activities

We may collect, store, and use the following categories of personal information about you:

  • Full name
  • Postcode
  • School or college your child attends

Current students at our partner institutions engaged on casual contracts as Student Ambassadors

We may collect, store and use the following categories of personal information about you:

  • Full name
  • Sex
  • Date of birth
  • University and personal email addresses
  • Personal telephone number
  • University you study at
  • Course and year of study

Visitors to our website

We may collect, store, and use the following categories of personal information about you:

  • Full name
  • Postcode
  • School or college you are affiliated with
  • Email address

We may also collect, store and use the following ‘special categories’ of more sensitive personal information:

  • Your nationality

 

Section 2 – How we collect personal information

Learners taking part in our activities

We collect personal data about you through the following routes:

  • Completion of evaluation forms at the activities you take part in
  • Completion of EMWPREP forms (see section 2a) before activities you take part
  • Completion of additional information forms for taking part in certain events, such as residential events (staying over at one of our universities), or where there may be photographs or film footage taken of you. These will be signed by your parents if you are aged 16 or under
  • From your communication with Higher Horizons+, for example if you contact us by email or telephone, or via social media
  • Directly from the school or college you attend

Teachers and advisors attending our activities

We collect personal data about you through the following routes:

  • Completion of evaluation forms at the activities you attend
  • From your communication with Higher Horizons+, for example if you contact us by email or telephone, or via social media

Parents and carers attending our activities

We collect personal data about you through the following routes:

  • Completion of evaluation forms at the activities you attend
  • From your communication with Higher Horizons+, for example if you contact us by email or telephone, or via social media
  • Completion of additional information forms allowing your child to attend certain events, such as residential events (staying over at one of our universities), or where there may be photographs or film footage taken of your child

Current students at our partner institutions engaged on casual contracts as Student Ambassadors

We collect personal data about you through the following routes:

  • Applications to the Higher Horizons+ Central Team (based at Keele University) to become a Higher Horizons+ Ambassador
  • From your communication with Higher Horizons+, for example if you contact us by email or telephone, or via social media

Visitors to our website

We collect personal data about you through the following routes:

  • When you sign up to our newsletter through the website
  • When you use the ‘Get answers, fast’ or ‘Ask a question’ forms on our website
  • When you use the ‘Book activities’ section of our website
  • From your communication with Higher Horizons+, for example if you contact us by email or telephone, or via social media

 

Section 2a – EMWPREP

As a condition of our funding, we use the EMWPREP monitoring and evaluation database to track the education journey of the learners we work with, and to use as a tool to evaluate our work.

Higher Horizons+ are required to comply with the data protection policies put in place by EMWPREP.

The full EMWPEP privacy policy can be found here: http://www.emwprep.ac.uk/schools-parents/gdpr/

The EMWPREP data sharing policy can be found here: www.emwprep.ac.uk/data-sharing-policy

 

Section 3 – How we use the personal information we collect

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

  • To prove to our funders, the Office for Students and Department for Education, that we are working with the people that our funding is provided for
  • To prove the impact of the work we are doing
  • To track the educational journey of the learners we work with, to measure the impact of the activities they take part in
  • To ensure the safety of learners when attending certain activities, such as residential events (staying over at one of our universities)
  • Where you have explicitly agreed to a particular use of your data (consent)
  • To communicate effectively with you by email or phone, where you have agreed to be contact, including the distribution of relevant newsletters and evaluation forms
  • In the case of current students who apply to become Higher Horizons+ Ambassadors, we may use your data to confirm with the partner institution you attend that you are a current student engaged on a casual contract there
  • For current students who have been accepted as Higher Horizons+ Ambassadors, we may share your details with third parties delivering activities you are engaged to work on

Legal basis for processing

Higher Horizons+ collect and process personal information under the legal basis of Public Interest. This means that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (Office for Students and Department for Education).

If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to allow you or your child to take part in certain activities.

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Automated decision making

Automated decision making takes place when an electronic system uses personal information to make a decision without human intervention. Higher Horizons+ do not use automated decision making.

 

Section 4 – Data sharing

We may have to share your data with third parties, including third-party service providers. We require third parties to respect the security of your data and to treat it in accordance with the law.
Your data will not be transferred, stored or processed outside of the EU.

We may share the personal information we collect and process with one or more of the following receiving organisations:

  • The Office for Students, and Department for Education (who fund our activities)
  • Our partner universities and colleges
  • The schools and colleges that the learners we work with attend
  • The Local Authorities of the schools and colleges that the learners we work with attend
  • Third party activity providers working in association with Higher Horizons+
  • The national evaluators of our programme, CFE Research
  • Companies or organisations providing specific services to or on behalf of Higher Horizons+, including but not limited to
    • Google (Keele University uses Google G-Suite for email and cloud storage services
    • SurveyGizmo (Higher Horizons+ use this service to input and store evaluation data)
    • EMWPREP
    • Glasscubes (Higher Horizons+ use this service to securely transfer data)
    • (For Student Ambassadors )we may share your name, email address, course studied and year of study with our online mentoring platform Brightside (whose privacy notice can be found here)

 

Section 5 – Data retention

How long will you use my information for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Details of retention periods for different aspects of your personal information are available in our retention policy which is available here.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Once we no longer need the personal data we have collected, or have reached the date of deletion as outlined in our Records Retention Schedule, it will be securely destroyed in accordance with the Records Retention Schedule.

 

Section  6 – Data breaches

Higher Horizons+ are committed to protecting the privacy and security of the personal information we collect and process, and take this responsibility very seriously. We have a robust data breach reporting process in place, of which all Higher Horizons+ staff members are aware.

We also have the following security measures in place to avoid data breaches from occuring:

  • Personal data is saved on restricted access drives only, and can only be accessed by those who need access to the data
  • Personal data is not transferred outside of the EU
  • Any personal data being transferred must be encrypted
  • Records Retention Schedule sets out the length of retention and method of secure destruction and deletion of personal data
  • Risk Register which is updated regularly, monitoring any risks to data processing

Any data breaches or suspected data breaches will be inspected and reported appropriately to the ICO within 72 hours of discovery. Where the data breach relates to individuals, we will do our best to notify those involved.

 

Section 7 – Your rights

Under GDPR, all individuals have the following eight rights:

The right to be informed

  • This means you have the right to be given information about how and why your data is being processed
  • When you provide your information directly to Higher Horizons+, you will be informed at that time how it will be used. This will include the purpose of processing, how long it will be held, and details of any recipients of your data (who it may be shared with)

The right of access

  • You have the right to receive confirmation that your data is being processed and to access it by request
  • You can access your personal data by submitting a Subject Access Request to Higher Horizons+ and, after your identity has been verified, you will receive a response within one month
  • You can submit a Subject Access Request by emailing us at ncop@keele.ac.uk

The right to rectification

  • You have the right to correct your personal data if it is inaccurate or incomplete.
  • Higher Horizons+ will respond to requests for rectification within one month or, in the case of a complex request, up to three months. If your data has been shared with a third party, Higher Horizons+ will inform them of the rectification where possible.
  • You can request a rectification by emailing us at ncop@keele.ac.uk

The right to erasure

  • You have the right to request that your personal data is removed, so long as there is no compelling reason for it to continue to be processed.
  • This does not mean that you have an absolute right ‘to be forgotten’, but that you can have personal data erased or prevent its processing in the following circumstances:
    • Where your personal data is no longer necessary for the purpose for which it was originally collected/processed
    • When you object to the processing and there is no ‘legitimate interest’ for Higher Horizons+ to continue the processing
    • Where your personal data was unlawfully processed
    • When your personal data has to be erased in order to comply with a legal obligation
  • Higher Horizons+ can refuse a request for erasure for the following reasons:
    • To exercise the right of freedom of expression and information
    • To comply with a legal obligation or for the performance of a public interest task or exercise of official authority
    • For public health purposes in the public interest
    • For archiving purposes in the public interest, scientific research, historical research, or statistical purposes
    • The exercise or defence of legal claims
  • If your data has been shared with a third party, the University will inform them of the erasure where possible.
  • You can make a request for erasure by emailing us at ncop@keele.ac.uk

The right to restrict processing

  • You have the right to restrict the processing of your personal data so that it may continue to be held but no longer processed
  • Higher Horizons+ will restrict processing in the following circumstances:
    • If you contest the accuracy of the data
    • Where you have objected to the processing of personal data where Higher Horizons+ has a legitimate interest
    • When processing is unlawful but you oppose erasure and request restriction instead
  • If your data has been shared with a third party, Higher Horizons+ will inform them of the restriction of processing where possible
  • You will be informed when Higher Horizons+ decides to lift a restriction on processing
  • You can make a request to restrict the processing of your personal data by emailing ncop@keele.ac.uk

The right to data portability

  • You have the right to obtain your personal data in an easily transferable format to reuse for your own purposes
  • This right only applies:
    • To personal data you provided to Higher Horizons+;
    • Where processing is based on your consent or for the performance of a contract; and
    • When processing is carried out by automated means
  • Higher Horizons+ will respond to requests within one month or, in the case of a complex request, up to three months
  • You can make a request of data portability by emailing ncop@keele.ac.uk

The right to object

  • You have the right to object at any time to the processing of your personal data for the purposes of direct marketing; processing based on ‘legitimate interests’ or; processing for research or statistical purposes. Please note, Higher Horizons+ will not use your personal data for direct marketing purposes.
  • This right relates only to the following specific purposes for processing, there is no right to object to processing in general:
    1. Processing based on legitimate interests – you must have grounds relating to your particular situation in order to object to your personal data being processed for this purpose. Higher Horizons+ must stop processing your data unless it can demonstrate compelling legitimate grounds which override your interests, rights and freedoms as an individual
    2. Processing for research or statistical purposes – you must have grounds relating to your particular situation in order to object to your personal data being processed for this purpose. If the research being conducted requires the processing of your personal data for the performance of a public interest task, Higher Horizons+ is not required to comply with an objection
  • You can make an objection by emailing ncop@keele.ac.uk

Rights in relation to automated decision making and profiling

  • You have the right not to be subjected to a decision that is based on automated processing which results in a legal impact upon you
  • In such a circumstance Higher Horizons+ must ensure that you are able to have human intervention in the decision, express your views and receive an explanation of the decision so that you may challenge it
  • This right does not apply if a decision does not have a legal effect on you, or if a decision:
    • Is necessary for entering into, or performance of, a contract between the data subject and Higher Horizons+
    • Is authorised by law, for example for the purpose of fraud prevention
    • Is based on your explicit consent
  • The right to erasure and the right to portability do not apply when the legal basis for processing is public interest.

 

Section 8 – Data Protection Officer details

Higher Horizons+ is based at Keele University, and is required to comply to data protection policies put in place by Keele University. Therefore, our Data Protection Officer is based at and works for Keele Univeristy. You can contact the Data Protection Officer at dpo@keele.ac.uk

Full details of the Keele University Information Governance and Security Policy to which we are required to adhere can be found here:

https://www.keele.ac.uk/informationgovernance/informationgovernanceforthepublic/

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. ICO contact details : www.ico.org.uk

 

Section 9 – Website Cookies

The Higher Horizons+ website collects and stores some cookies when you visit it. You can opt in or out to these cookies at any time. Details of the cookies we store are found below:

Name of cookie Expires Purpose for the cookie
cookies_allowed 100 days Used by the site to determine selected cookie consent option.
_ga 2 years Google Analytics – Used to distinguish users.
_gat 1 min Google Analytics – Used to throttle request rate.
_gid 24 hours Google Analytics – Used to distinguish users.
find_activities_school_name 1000 days Used by the site to determine what school name has previously been selected.
find_activities_postcode 1000 days Used by the site to determine what post code has previously been selected.
results_activities When session ends Used by the site to store selected activities until an enquiry is submitted.

You can accept or reject cookies, even if you have previously selected a different option, using one of the buttons below:

If you have any questions or want advice on our sessions you can get in touch.