Data Processing Statement
This Data Processing Statement (‘DPS’) concerns the Conservatoire’s obligations as Data Controller for the purposes of processing your personal data in accordance with the Data Protection Act 2018 (‘DPA’) and the General Data Protection Regulations 2018 (‘GDPR’).
The Conservatoire for Dance and Drama (‘Conservatoire’) comprises six legally autonomous member schools (‘Schools’). The Conservatoire and each School are each a ‘Data Controller’ of outreach and widening access activity participant data. Each holds and otherwise processes ‘personal data’ for their own, separate purpose(s). Such data may include ‘Special Category personal data’ (as defined in the GDPR) about outreach and widening access activity participants that is provided to them by you or by third parties. For this outreach and widening access work, the processing of this data is necessary.
The Conservatoire needs to process (that is, collect, use, store and ultimately destroy) personal information about you to meet out conditions of registration to the Office for Students (OfS) under Section 29 of the Higher education and Research Act 2017 (HERA), to prove evidence our work towards meeting commitments set out in our Access and Participation Plan and to monitor the effectiveness of our outreach and widening access programmes. The Conservatoire is also obliged in some cases to collect information in line with legal requirements (for example to provide details of your attendance to the OfS).
Legal Basis for processing your information
Processing of your information for outreach and widening access activities is necessary for one or more of the following reasons:
- the data subject has given consent to the processing of his or her personal data for one or more specific purposes (GDPR Article 6(1)(a));
- compliance with a legal obligation (GDPR Article 6(1)(c))
- to protect the vital interests of a data subject or another person (GDPR Article 6(1)(d));
- for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (GDPR Article 6(1)(e));
- for the purpose of legitimate interest pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject (GDPR Article 6(1)(f))
Processing of special categories of personal data for outreach and widening access activities is necessary for one or more of the following reasons:
- the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject (GDPR Article 9(2)(a))
- carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law (GDPR Article 9(2)(b))
- archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject (GDPR Article 9(2)(j))
Questions, Comments and Complaints
If you have questions or comments about how your data is used by the Conservatoire or by your School, you can put them in writing to:
Conservatoire for Dance and Drama
The Energy Centre
Bowling Green Walk
London N1 6AL
Or by e-mail at email@example.com
If you think there is a problem with the way the Conservatoire or your School is handling your data, you have the right to complain to the Information Commissioner’s Office: ico.org.uk/
The Conservatoire will only use your data fairly and lawfully in accordance with its obligations under the DPA and GDPR. Any use by the Conservatoire of your data must also be covered by its registration with the Information Commissioner. This is available on the Information Commissioner’s Office website and describes in a general way how the Conservatoire processes personal data about students and other individuals.
The Data Protection Act requires the Conservatoire to keep your data secure. This means that your confidentiality will be respected, and all appropriate measures will be taken to prevent unauthorised disclosure. Only members of staff who need access to relevant parts or all of your data will be authorised to do so. Information about you in electronic form will be subject to security restrictions, while paper files will be stored in secure areas with controlled access.