Commercial Entities Privacy Notice

The information we hold about you comes from the way you engage with the college.  This includes:

• Details about you, including your full name or business name, date of birth;
• Contact details, including address and contact details, telephone number and email address;
• Information about your criminal record for Disclosure and Barring Services (DBS) purposes;
• Financial information, including payment information such as credit/debit card or direct debit details, and bank details for payment purposes;
• Marketing preferences;
• Details of your tenancy schedule if appropriate;
• Details of stock items if appropriate for the purpose of paying you.

Your activities whilst involved with the Chesterfield College Group will result in personal data being created.

The college collects this information prior to a tenancy agreement and or acceptance of supplier request form.  DBS checks are completed in line with our safeguarding requirements.  The College undertake annual declarations to ensure we are kept up to date with any cautions, convictions or declarations. In some cases, the college collects personal data about you from third parties, such as information from criminal records checks permitted by law.

For customers of a commercial service such as the Taste Restaurant or Lift Salon, the information an individual provides the College with, is used to deliver that service and will only be held and used for that purpose or other closely related purposes.

Business Enterprise Data is stored in third party platforms used for the purpose of bookings only as described.

Tenant Data is stored in a range of different places, including in your personnel file, in the college’s HR management systems and in other IT systems.

The college needs to process data to enter into:

• A tenancy agreement with you and to meet its obligations under your contract. For example, it needs to process your data to provide you with a tenancy agreement and to pay you in accordance with the contract; or
• Service reservation such as your restaurant booking; or
• Salon Service booking

In some cases, the college needs to process data to ensure that it is complying with its legal obligations. For example, it is required to comply with health and safety laws and carry out criminal records checks to ensure that individuals are permitted to contract within an educational setting. You can ask us to stop processing this data at any time.

We rely on the following lawful basis for processing your personal data under the GDPR:

• Article 6(1)(b) which relates to processing necessary for the performance of a contract.

Your information will be shared internally, including members of the Business Support function such as Human Resources, Finance, Estates, business enterprise areas to provide relevant services.   The college will not transfer your data to countries outside the United Kingdom.

The college takes the security of your data seriously. The college has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties.

We will not sell your personal data. The Chesterfield College Group is based in the UK and we will store your data within our business systems to collect and issue payments to you.

The personal data we collect is processed by our staff in the UK.  For the purposes of IT hosting and maintenance, this information may be located on servers within the European Union and, occasionally, trusted parties outside the EU may have access to certain parts of the data we collect.  No third parties have access to your personal data unless UK or EU law allows them to do so, or an official processing agreement is in place with the Chesterfield College Group.

The college will hold your personal data until the end of your contract of service or closure of your accounts record.  Business enterprise customers can unsubscribe at any time.

The Chesterfield College Group only use and store data for as long as it is required for the purpose it was originally collected or for legal and regulatory reasons.  The length of time information is stored depends upon the information in question and what it is being used for.  We continually review the information we hold and delete what is no longer required.  We never store card payment information on any of our systems.

You have the right to object to the use of your personal information, the right to see the personal information held and the right for it to be changed if it is wrong. You also have the right to ask us to restrict the processing of your personal information in certain circumstances. If you would like to exercise these rights, please contact the Data Protection Officer at dataprotection@chesterfield.ac.uk