Who we are

The Royal Welsh College of Music & Drama is a public authority under the Freedom of Information Act 2000.

About this notice

The College takes the protection of all personal information (data) seriously and is fully committed to the protection of the rights and freedoms of all individuals in relation to the processing of their personal data. The processing of all personal information will be in compliance with data protection laws. This is done in accordance with:

• The General Data Protection Regulation
• Associated legislation
• Case law and the spirit of the Regulation
• The College’s notification as a data controller with the UK Information Commissioner (Reference No: Z9702162), which sets out the purposes for which the College holds and processes personal data about employees, students, graduates and others

The purpose of this notice is to give you a general overview of how we use the information we collect from you directly and from third parties.

Your personal information

Why we need it:

The Royal Welsh College of Music & Drama will be known as the “controller” of the personal information you provide to us. We only collect the minimum amount of personal information about you required to provide the service you have requested. This does however include name, address, email etc.

In specific circumstances it may be required for the College to collect information which has been classified as sensitive such as:

• your racial or ethnic origin
• political opinions
• religious beliefs or other beliefs of a similar nature
• whether you are a member of a trade union
• your physical or mental health or condition
• your sexual orientation
• the commission or alleged commission by him of any offence, or any proceedings for any offence committed or alleged to have been committed by you, the disposal of such proceedings or the sentence of any court in such proceedings

The College takes information privacy very seriously and we will only ask for information which is absolutely necessary either as a legal requirement or to process an application you have submitted to us for services such as disability support plans. Where sensitive information is optional, the decision to supply it will be down to you, we will clearly state you have a right to withhold the information at the time we ask.

What we do with your information:

All the personal information we collect is processed by our staff in the UK and only for the purposes it was collected for. If there is a change of use to your information we will seek consent from you for this to occur.

Some of your information may be located on systems within the European Union. On rare occasions, your information may be located on systems outside of the European Union, where this occurs the information stored is minimal such as name and email address. No sensitive information is stored outside of the European Union.

How do you keep my information secure?

The College has an Information Governance policy to oversee the effective and secure processing of your personal information. Only approved College staff and administrators of the IT systems have access to your personal information. All information within the College is classified in to four categories: public, restricted, confidential and highly confidential. Each category has specific control measures in place to ensure the information is secure. IT systems also have to adhere to a security policy to ensure they are fit for purpose. Further information regarding information governance is available from the Data Protection Officer.

How long do you keep my information?

Personal information collected is only kept for the duration set out in the College’s Information Retention Schedule.

Your rights

If at any point you believe the information we process on you is incorrect you are entitled to request to see this information and have it corrected or deleted. You also have a right to object to the processing of your personal information, to rectify, to erase, to restrict and to port your personal information.

If you wish to raise a complaint on how we have handled your personal information, you can contact our Data Protection Officer who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal information not in accordance with the law you may complain to the Information Commissioner’s Office (ICO). The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
ico.org.uk

Legal basis

There are three basis’s under which we may process your data:

Contractual purposes

When you study or apply to study at the College, make a purchase from us or make a donation to us, you are entering into a contract with us. In order to perform this contract we need to process and store your information. For example we may need to contact you to by email or telephone in the case of cancellation of a show, in the case of problems with your payment or to process your application to study.

Legitimate business interests

In certain situations we collect and process your personal information for purposes that are in our legitimate organisational interests. However, we only do this if there is no overriding prejudice to you by using your personal information in this way.

With your explicit consent

For any situations where the two areas above are not appropriate, we will instead ask for your explicit consent before using your personal information in that specific situation.

Health and support

The College may collect personal information with regards to health and support for the following purposes:

• Administering finance (e.g. fees, scholarships and bursaries)
• Providing student/employee support services
• Safeguarding and promoting the welfare of students/employees
• The administration of student/employee casework

What is our legal basis for processing?

In processing data for the purposes listed above the College relies upon the following legal basis as appropriate:

• Processing is necessary for the performance of a contract with the individual.
• Processing is necessary for the performance of a task carried out in the public interest.
• Processing may also be necessary to protect the vital interests of the individual or another person.
   

What is our legal basis for processing special category personal data?

• For reasons of substantial public interest, on the basis of Union or Member State law (Article 6(1)(e)).
• For the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law (Article 9(2)(h)) or pursuant to contract with a health professional and subject to conditions and safeguards
• With the explicit consent of the individual.

Who are the recipients or categories of recipients?

Where necessary personal information will be shared internally within the relevant departments across the College.  Such sharing will be subject to confidentiality protocols and access restrictions (e.g. Health, counselling and mental health case notes will only be visible to staff within those services).

The College works with the NHS’s Mental Health University Liaison Service (MHULS) and where necessary students may be referred to their teams.  Any referral will be discussed with the student in the first instance and will only be made with their agreement.

Where consent (and where appropriate explicit consent) has been obtained, personal data may be shared with those individuals specified within any agreement.

In certain circumstances personal information may be disclosed without consent under the following circumstances:

1. If the College has good reason to believe that someone may be at serious risk of harm. Unless the situation is an emergency, or it is considered otherwise inappropriate, efforts will always be made to discuss the matter with the individual beforehand.
2. The College may be legally bound to disclose personal information on certain occasions e.g. under a Court Order, as part of safeguarding responsibilities and prevention of terrorism.

Third parties

There are certain circumstances under which we may disclose your personal information to third parties. These are as follows:

To our own service providers who process data on our behalf and on our instructions (for example our ticketing system software provider). In these cases we require that these third parties comply strictly with our instructions and with data protection laws, for example around security of personal data.

Where we are under a duty to disclose your personal information in order to comply with any legal obligation (for example to government bodies or law enforcement agencies).

To specific named visiting companies whose performances you have attended. In these cases we will always ask for your explicit consent before doing so.

Cookies

A cookie is a small file placed on your computer when you visit a website. They are used to do lots of different things, such as storing your preferences or knowing that you have visited a site before.

We use a service called Google Analytics and our website will place cookies on your computer in order to make the service work. The cookies collect information in an anonymous form, allowing Google Analytics to compile reports on how our website is being used, such as the number of visitors and the pages they visited.

If you purchase tickets from our website, we use cookies to keep track of your shopping basket.

We sometimes embed content from third-party websites such as YouTube and Twitter. When you visit a page on our website that contains such content, these third-party websites may also place cookies on your computer.

Most web browsers allow you to control what cookies are used and provide you with tools to manage and delete them. To find out more, visit the Information Commissioner’s Office website.