Sora Privacy Notice
All personal data collected by Sora is collected in line with the requirements of the GDPR.
The Data Protection Officer is responsible for ensuring that this notice is made available to data subjects prior to Sora collecting/processing their personal data.
Sora staff who interact with data subjects are responsible for ensuring that this notice is drawn to the data subject’s attention and their consent to the processing of their data is secured.
In order for Sora to provide you with a training and education service, we need to collect personal data. We are committed to ensuring that the information we collect and use is appropriate for this purpose, and does not constitute an invasion of your privacy.
The personal data we collect from can include:
- personal details (Name, address, date of birth)
- education and employment details
- visual images (videos, photographs)
- physical or mental health details
- racial or ethnic origin
- religious or other beliefs
- offences and alleged offences
- criminal proceedings, outcomes and sentences
The personal data we collect will be used for the following purposes:
- Student Records Management
- Examinations and Achievement
- Funding Claims
- Student Support
- Student Learning IT Systems (e-learning)
- Marketing and Publicity
We sometimes need to share the personal information we process with other organisations. Where this is necessary we are required to comply with all aspects of the GDPR. What follows is a description of the types of organisations we may need to share some of the personal information we process with for one or more reasons.
Where necessary or required we share information with:
- Current, past or prospective employers
- Educators and examining bodies
- Press and the media
- Police forces, prison and probation services, courts and tribunals
- Suppliers and service providers
Sora processes data in order to fulfil contractual obligations such as
- Education and Skills Funding Agency (ESFA)
- Exam Boards (OCR, AQA, City and Guilds, Pearson, Edexcel, AAT, Certa, NCFE, CIPS)
- Further Education Colleges
By consenting to this privacy notice you are giving us permission to process your personal data specifically for the purposes identified.
Consent is required for Sora to process both types of personal data, but it must be explicitly given. Where we are asking you for sensitive personal data we will always tell you why and how the information will be used.
We may pass your personal data on to third-party service providers contracted to Sora in the course of dealing with you. Any third parties that we may share your data with are obliged to keep your details securely, and to use them only to fulfil the service they provide you on our behalf. When they no longer need your data to fulfil this service, they will dispose of the details in line with their procedures. If we wish to pass your sensitive personal data onto a third party we will only do so once we have obtained your consent, unless we are legally required to do otherwise.
The following third parties will receive your personal data:
|Gateshead College||Qualification funding and management|
|Sunderland College||Qualification funding and management|
|Awarding organisation (Skills First, EAT, ETA, Highfield, NCFE, Innovate)||Qualification award|
|PICs||Student record management|
|Smart Assessor||E-learning system|
Sora will process personal data for whilst you are a student and will store the personal data for a number of years. The retention period for different classifications of personal data has been established in line with information management guidelines. Please refer to Sora’s Information Asset Register.
Your rights as a data subject
At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:
- Right of access – you have the right to request a copy of the information that we hold about you.
- Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
- Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
- Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
- Right of portability – you have the right to have the data we hold about you transferred to another organisation.
- Right to object – you have the right to object to certain types of processing such as direct marketing.
- Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
- Right to judicial review: in the event that Sora refuses your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined in the section below.
All of the above requests will be forwarded on should there be a third party involved in the processing of your personal data.
In the event that you wish to make a complaint about how your personal data is being processed by Sora (or third parties as described in 3.4 above), or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority – (https://ico.org.uk/concerns/) and Sora’s Data Protection Officer- firstname.lastname@example.org