personal as a Data Controller on the Data Protection
Register Registration Number: ZA149841
https://ico.org.uk/ESDWebPages/Entry/ZA149841
The categories of student information that we collect, hold and share include
The categories of parent/Next of kin information that we collect is limited to name and contact information (phone numbers, address and email etc.). Any additional information disclosed to us is held only if it is relevant to the support of their child (16-18 olds).
We use the student and parent/Next of kin data:
We collect and use student and parent/Next of kin information under Articles 6 and 9 of the General Data Protection Regulation. In particular, we process information where that processing is
For special category data we collect and use student information where the processing is necessary for the reasons of substantial public interest, respects the essence of the right to data protection and provides for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
Whilst the majority of student and parent/Next of kin information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain student information to us or if you have a choice in this.
We do not share information about our students or parent/Next of kin with anyone without consent unless the law and our policies allow us to do so.
In specific circumstances, we may share student information with these organisations:
We share students’ data with the Department for Education (DfE), ESFA, Home Office, Lottery and Local Authorities on a statutory basis. This data sharing underpins Train2Work Academy funding and educational attainment policy and monitoring. We are required to share information about our students with the DfE under regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013.
We share student and parent/Next of kin personal data with Pro-Suite when necessary to correct ILR submissions.
We share student personal data with TFL to enable them to obtain travel discounts, at their request.
We share student personal data with exam boards to facilitate legal obligation to provide examinations.
We share student personal data with Train2Work Academy enrichment providers engaged in providing school trips / visits in order for them to process travel arrangements and may include sensitive medical information in order to keep students safe whilst on organised trips / visits.
We use email and IT services to enable the Train2Work Academy to administer communication both internally and externally and facilitate the smooth running of the Train2Work Academy. Where necessary external IT suppliers will access systems to provide support and fix issues. In all instances there will be a data protection agreement in place to safeguard information on the systems they are accessing.
To find out more about the data collection requirements placed on us by the Department for Education and ESFA (for adult students) go https://www.gov.uk/government/publications/privacy-information-key-stage-4-and-5-and-adult-education
We will also share certain information about students aged 16+ with our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 16-19 year olds under section 507B of the Education Act 1996. This enables them to provide services as follows:
The NPD is owned and managed by the Department for Education and contains information about students in England. It provides evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including Train2Work Academy, local authorities and awarding bodies. We are required by law to provide information about our students to the DfE as part of statutory data collections such as the Train2Work Academy. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.
To find out more about the NPD, go
https://www.gov.uk/guidance/apply-for-department-for-education-dfe-personal-data .
Subject matter of the Processing
The subject matter is the personal data of Learners on education or training programmes administered by the ESFA that are subject to this Agreement as defined in the ESFA privacy notice and ILR specification and its appendices.
https://www.gov.uk/government/collections/individualised-learner-record-ilr
Duration of the Processing
The duration of the Processing covers the academic year data returns to the ESFA as defined in Appendix A of the ILR specification to enable funding and audit of the learning programmes defined in this Agreement.
https://www.gov.uk/government/collections/individualised-learner-record-ilr
Nature and purposes of the Processing
The nature and purposes of the processing is defined in the ESFA privacy notice.
https://www.gov.uk/government/publications/privacy-information-key-stage-4-and-5-and-adult-education
The processor will be required to submit the data to the ESFA as set out in Clause 16 Submission of Learner Data of the Contract.
The personal data to be processed is defined in the ILR specification.
https://www.gov.uk/government/collections/individualised-learner-record-ilr
Categories of data subject
The data subjects are Learners on education or training programmes administered by the ESFA that are subject to this Agreement.
Description Details
Retention and destruction of the data once the processing is complete UNLESS requirement under union or member state law to preserve that type of data Information on how the data must be supplied to the ESFA is detailed in the ILR specification and its appendices.
https://www.gov.uk/government/collections/individualised-learner-record-ilr
For the purposes of the DfE as a data controller of the data, providers are required to retain the data for the funding and audit purposes 6 years from the end of the financial year in which the last payment is made under the Contract for the specific student.
For the purposes of the Department for Work & Pensions as a data controller, where Learner data is used as match on the 2007-13 ESF programme, the data must be retained securely until at least 31 December 2022 and where Learner data is used as match on the 2014-20 ESF programme, the data must be retained securely until 31st December 2030.
The Contractor (and any other data controller) is responsible for determining any further need to process the data, including its retention, prior to secure destruction.
Under data protection legislation, parent/Next of kin and students have the right to request access to information about themselves. To make a request for your personal information, or be given access to your child’s educational record, contact Suad Abdirahman, Data Protection Officer (suadabdirahman@train2workacademy.org).
You also have the right to:
Concerns
If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office
https://ico.org.uk/make-a-complaint/
Contact
If you would like to discuss anything in this privacy notice, please contact us below:
Review and Update
This privacy notice is reviewed annually. It was last updated in 18/04/2025