The Data Protection Act 2018 (DPA) (incorporating the European General Data Protection Regulation GDPR from 25th May 2018) protects the rights of individuals by setting out certain rules as to what organisations can and cannot do with information about people. A key element to this is the principle to process individuals’ data lawfully and fairly. In order to meet the fairness part of this we need to provide information on how we process personal data.
TAA takes its obligations under the Data Protection Act very seriously and will always ensure personal data is collected, handled, stored and shared in a secure manner. Our Full Data Protection Policy can be accessed here...
The following statement will outline what personal data we collect, how we use it and who we share it with. It will also provide guidance on your individual rights and how to make a complaint to the Information Commissioner’s Office, the regulator for data protection in the UK.
The College’s official contact details are:
College Information Officer
The Acupuncture Academy
54 High Street
The largest volume of personal data the College processes is in relation to students, at both undergraduate and postgraduate level. The primary purposes we process information about these individuals include:
The College also processes personal data in relation to staff, both academic and non-teaching. This is undertaken to facilitate recruitment activity and to administer the requirements the College must meet as an employer in line with UK law. In addition, it is used to facilitate operational activity within the relevant professional service.
Personal data is also collected for practitioners attending CPD seminars, to allow for communications relating to the administration of the seminar and for marketing purposes.
Finally, the College processes personal data as part of research activity and for the purposes of healthcare, in relation to patients and clients.
The College collects personal data from individuals interested in studying here and registered students at various stages. The volume and nature of the personal data collected is outlined below:
Additional personal data may be collected by the College where relevant in relation to professional body requirements, extenuating circumstances applications, appeals/complaints/disciplinary cases and any further optional student services.
The College collects the following information from academic and non-teaching staff which is outlined below:
Additional personal data is collected for employees to comply with statutory requirements:
Personal data collected for CPD seminar participants captured from initial sign-up:
Personal data is held for patients and clients, consisting of:
The College is required to share personal data with certain other organisations in order to meet statutory requirements or to provide services to students. Sharing will always be undertaken in line with the requirements of data protection law, either through the consent of the individual, or another relevant legal gateway. The personal data that is actually shared will always be limited precisely to what the other organisation needs to meet its requirements or deliver its services.
The information below outlines the key partners with whom the College shares personal data with on a periodic basis:
The College takes its obligations under the DPA very seriously in terms of not holding onto personal data for any longer than is necessary. The College has a retention schedule in place for the different categories of data it holds.
In some cases, there are good reasons as to why the College needs to retain data about students and other individuals for a significant period of time. The most important reasons are outlined below:
Data Retention periods
|Reason for retaining data||Data retained||Period|
|in order that student awards can be verified in the long-term;
to produce transcripts and references
|Student name, date of birth, College student ID, contact details, award and module marks, course period, Photo, copies of any reference written||Indefinitely|
|for alumni services and ongoing relations with the College||Student name, Contact details, Photo||Indefinitely or until individual asks to be removed|
|to deal with complaints, appeals and disciplinary cases including if they are taken to the Office of the Independent Adjudicator (OIA)||Documentation relating to complaint or appeal||18 months after complaint or appeal raised|
|for statutory reporting purposes and in order to complete statutory surveys such as the Graduate Outcomes from Higher Education Surveys||Student name, course, contact details||Period set by OfS Designated Data Body, plus additional period for audit by DDB|
|Marketing||Student testimonial, video clip, student name and photo, accommodation providers contact details||Indefinitely or until individual asks to be removed|
|References for past employees and staff members||Student testimonial, video clip, student name and photo, accommodation providers contact details||Indefinitely or until individual asks to be removed|
|In order to meet pension obligations||Name, contact details, pension details||Indefinitely|
|Statutory purposes||Employee sick and maternity pay||3 years following the tax year of payment|
|Patient or client health record||Patient name and contact details, clinical notes||7 years or until a child reaches 25 (or 26 if attendance in clinic ends when they are 17)|
An individual has the right to ask the College what personal data we hold about them, and to ask for a copy of that information. This is called making a Data Protection Subject Access Request.
A Subject Access Request should be submitted in writing via email to the college Administrator or in hard copy to the postal address provided above. The College reserves the right to ask you to provide proof of identification and for you to clarify your request if it is unclear in the first instance. You will receive a reply no longer than one calendar month from the date you make the request in writing.
If you are unhappy with the initial response you can ask the College to undertake a further search if there is specific information you have good reason to believe exists but that hasn’t been provided.
You also have the right to complain to the UK Regulator the Information Commissioner’s Office (ICO) if you believe you request has not been dealt with properly or you have a complaint to raise against the College for any other data protection related issue. A complaint can be raised via the ICO’s website or write to the following address:
The Office of the Information Commissioner
You also have the right to withdraw consent from the processing of your personal data by the College at any time, if your consent was sought initially to use your personal data.
If you believe the College holds information about you that is factually incorrect please email TAA’s Administrator (firstname.lastname@example.org) and one of the Principals (email@example.com or firstname.lastname@example.org) providing the correct information, and we will update it within one month.
All students, staff and any other relevant individual who handles personal information which the College holds is responsible for following the requirements of the Data Protection Policy.