1. Who We Are and How to Contact us

South Hampshire College Group (“SHCG”, “we”, “our”, “us”) is the data controller for the personal data we collect about visitors, suppliers, contractors and other external individuals who interact with our organisation.

Data Protection Officer: Email: [email protected]. If you have any questions about how we use your personal information, please contact our Data Protection Officer.

2.0 Data Protection Principles

We will comply with data protection law, which means that the personal data collected as an employee will be:

• Used lawfully, fairly and in a transparent manner
• Collected only for valid purposes that are clearly explained to you, and not used in any way which is incompatible with those purposes
• Relevant to the purposes we have told you about and limited only to those purposes • Accurate and kept up to date
•  Kept only as long as necessary for the purposes which we have told you about
•  Kept securely

3.0 The Personal Data We Collect

The information we collect depends on your interaction with us but may include:

Visitors

• Name, contact details, organisation
• Visit logs (date/time, host, purpose of visit)
• CCTV images for safety and security
• Vehicle registration (if using onsite parking)

Suppliers / Contractors

• Name and business contact details
• Role/occupation
• Professional credentials/CV (where applicable)
• Bank details (for payment)
• Contract documentation
• Records of goods/services supplied
• Any information also collected from visitors (where you attend our premises)

Other External Individuals

• Enquiry details
• Correspondence records
• Information required for events, partnerships or statutory reporting

4.0 Special Category Data

We do not routinely collect special category data from visitors or suppliers. Where such information is provided (e.g., accessibility requirements), we process it only where necessary and lawful.

5.0 How We Obtain Your Personal Data

We collect information:

• Directly from you when you visit our sites, make an enquiry, or supply goods/services
• From your employer (if you are representing a company)
• Through CCTV and site-security systems
• Through financial or procurement processes

6.0 Why We Process Your Personal Data (Purposes of Processing)

We use your information in order to: Visitors

• Manage safe access to our campuses
• Maintain site security
• Support health, safety and safeguarding requirements
• Manage events or meetings you attend Suppliers / Contractors
• Procure goods and services • Administer contracts and payments
• Verify identity and credentials • Maintain financial and audit records
• Comply with statutory obligations (e.g., tax, health & safety)

General external interactions

• Respond to enquiries
• Maintain organisational records
• Meet our compliance, audit and insurance requirements

7.0 Legal Bases for Processing

We rely on the following lawful bases under UK GDPR:

• Legitimate interests
  • Managing safe and secure operations
  • Managing safe and secure operations Engaging and managing suppliers
  • Maintaining records and ensuring service delivery
• Contract
  • Where processing is necessary for us to enter into or perform a contract with you (e.g., supplier payments)
• Legal obligation
  • Maintaining accounting records
  • Health, safety and safeguarding obligations
  • Providing information to law-enforcement or regulatory bodies
•  Consent
  • Only where required (e.g., optional marketing or event photography)

8.0 Data Sharing: Who We Share Your Information With

We may share personal data with approved third parties including:

• HMRC and other government bodies (where legally required)
• Emergency services when necessary for safety
• Professional advisers (auditors, accountants, legal advisers)
• Approved service providers such as IT, finance, or cloud-hosting providers
• Other suppliers where references or assurances are required

We do not sell your personal data.

9.0 International Data Transfers

If any of our systems transfer data outside the UK, we ensure that appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses, in line with UK GDPR. For more information review the data retention and transfer policy.

10.0 Data Retention – How Long We Keep Your Information

We only keep your data for as long as necessary and in line with our internal retention schedule. Where statutory, legal or safeguarding rules require longer retention, we follow those obligations. For more information, please see SHCG’s data retention and transfer policy.

11.0 Security of Your Data

We have implemented appropriate technical and organisational measures to protect your personal data from accidental or unlawful destruction, loss, alteration, or unauthorised disclosure. In addition, we limit access to your personal data to those trusted third parties who have a business need to know.

12.0 Your Data Protection Rights

You have the following rights under the UK GDPR:

• Access to your personal data
• Rectification of inaccurate data
• Erasure (“right to be forgotten”) in certain circumstances
• Restriction of processing
• Objection to processing based on legitimate interests
• Data portability (where applicable)
• Right not to be subject to automated decision-making SHCG does not make automated decisions about visitors or suppliers. To exercise any of the above rights, email: [email protected]

13.0 CCTV and Site Security

We use CCTV across our campuses to maintain a secure environment and protectstaff, students, visitors and assets. Recordings may be shared with police or emergency services where necessary. No automated facial recognition systems are used.

14.0 Concern or Complaints

If you are concerned about how we handle your personal data, please contact the College in the first instance so we can try to resolve your concern.

If you remain dissatisfied, you can complain to the ICO:

Online: ico.org.uk/make-a-complaint

Helpline: 0303 123 1113

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF