Privacy Notice
Privacy Notice
Explains how personal information is collected, used and protected.
1. Who We Are
The data controller is The Ark Education Centre Ltd, trading as The Ark Specialist College, registered in England and Wales with company number 16593007. Our registered address is 15A Wedge Street, Walsall, WS1 2HQ.
We are registered with the Information Commissioner's Office (ICO) as a data controller. Queries relating to data protection may be directed to info@thearkcollege.com.
2. What Data We Collect
We collect and process personal data in order to operate the college and to provide support to our learners. The categories of personal data we may hold include:
- Learner data: name, date of birth, address, contact details, EHCP details, education and assessment records, health and medical information, attendance records, progress data, photographs and safeguarding records
- Family and carer data: name, address, contact details, relationship to learner
- Staff and volunteer data: name, contact details, employment history, qualifications, DBS check information, payroll and pension data
- Website visitor data: IP address, browser type, pages visited — collected via cookies (see our Cookie Policy)
- Enquiry and referral data: names, contact details and information about a young person provided during the admissions or referral process
3. How We Use Your Data
We use personal data for the following purposes:
- To deliver educational provision and support to learners
- To fulfil our legal obligations as an EHCP-funded further education provider
- To communicate with families and carers about their young person's progress and wellbeing
- To manage admissions, referrals and placements
- To maintain safeguarding records and comply with statutory reporting requirements
- To manage staff employment and comply with employment law
- To respond to enquiries and complaints
- To produce statistical and compliance reports for Ofsted, local authorities and other bodies
4. Legal Basis for Processing
| Purpose | Legal Basis |
|---|---|
| Providing education and support | Public task / legitimate interests |
| EHCP-related processing | Legal obligation (Children and Families Act 2014) |
| Safeguarding | Legal obligation / vital interests |
| Health data | Explicit consent / substantial public interest |
| Employment records | Contract / legal obligation |
| Marketing communications | Consent (can be withdrawn at any time) |
5. Sharing Your Data
We may share personal data with:
- Local authorities and commissioning bodies involved in the young person's EHCP
- Health professionals, therapists and support services involved in the learner's care
- Ofsted and other regulatory bodies
- External agencies where required by law (e.g. police, social services, LADO)
- Software providers and data processors who support our college systems — all bound by data processing agreements
We do not sell personal data. We do not share personal data for commercial marketing purposes.
6. Retention Periods
| Data Type | Retention Period |
|---|---|
| Learner education records | Until learner's 25th birthday or 7 years after leaving, whichever is later |
| Safeguarding records | Until learner's 25th birthday (or longer if required by statute) |
| Staff employment records | 7 years after employment ends |
| Admissions / referral enquiries (unsuccessful) | 2 years |
| Financial records | 7 years |
| Website/contact form data | 2 years from last contact |
7. Your Rights
Under UK GDPR you have the following rights in relation to your personal data:
- Right of access — to request a copy of the personal data we hold about you (Subject Access Request)
- Right to rectification — to request that inaccurate data is corrected
- Right to erasure — to request deletion of data in certain circumstances
- Right to restrict processing — to ask us to limit how we use your data
- Right to data portability — to receive your data in a machine-readable format
- Right to object — to object to processing based on legitimate interests
- Rights related to automated decision-making — we do not use automated decision-making that produces legal effects
To exercise any of these rights, contact us in writing at info@thearkcollege.com. We will respond within one calendar month. If you are unsatisfied with our response, you have the right to complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.
8. Security
We take data security seriously. Personal data is stored securely, access is restricted to authorised staff, and we maintain appropriate technical and organisational measures to prevent unauthorised access, disclosure, loss or destruction of personal data. In the event of a data breach, we will notify the ICO and affected individuals in accordance with our legal obligations.