​​This privacy notice explains how Esher College collects, uses and shares your personal data, and your rights in relation to the personal data we hold.​

You can find out more about your rights under data protection legislation from the Information Commissioner's Office website: https://www​.ico.org.uk.

Last upda​ted: 26/03/2018 Version C:20183:2 FINAL

Open all


What information do we collect about you?

​As well as the information you provide us on the enrolment form, we also collect the following,

  • Payment information
  • Your attendance
  • Feedback from you about our courses and tutors
  • CCTV footage when you are on the College campus

Why we collect and use your information

The information you provide, and the additional information we collect is used to administer and provide the course you have enrolled on.

We may use some of your information to generate statistics that help us plan future courses and marketing strategies, and to monitor the quality of our courses.

CCTV footage is captured to ensure the security and safety of the College campus and its community.  This includes, the prevention, investigation, detection and prosecution of criminal offences.


How long we keep your information

​If you opt in to receiving marketing emails, we will store your contact details and the courses you attended for 2 years from the end of your last course. Otherwise, your information will be deleted 1 month after the end of your course.

If your course is externally verified then your contact details and the courses you attended will be stored for 5 years so that we can provide references and assist you in obtaining replacement certificates.

Any medical information you provide will be deleted from our systems 1 month after the end of your course.

Payment information will be stored for 6 years in order to comply with our legal obligation in respect to financial reporting, auditing and tax law.

We keep CCTV footage for up to 30 days, unless a specific incident has occurred and the images are saved for an investigation. In this situation, the images may be stored for up to 6 years.


The lawful basis on which we use your information

​Under data protection legislation, we can lawfully process your personal data to fulfil our contractual obligations to you, or to take steps in order to enter into a contact with you.  By enrolling on a course, you are entering into a contract with us, and as such, this is the lawful basis on which we rely for processing the majority of your personal information.

We rely on your consent to process the medical information requested on the enrolment form. 

Your consent to receive marking emails is collected to fulfil our legal obligation under data protection legislation.

CCTV footage is processed lawfully to fulfil our legal obligations, as well as the College's legitimate interests.


Who we share your information with

​We do not share your information with any third parties, unless your course is externally verified, in which case we will share your personal details with the relevant exam board, or awarding organisation.


Transferring your data outside of the European Union

​We do not transfer your information outside of the European Union.



​The College takes the security of your personal data very seriously. We have implemented strong organisational and technical security safeguards to prevent unauthorised disclosure or access to your information.

Strong encryption is used when sharing your personal data with exam bodies and awarding organisations.

The College complies with all relevant data protection legislation.


Contacting us

​If you have any queries about this privacy notice or how we process your personal data, we would ask you to raise your concern with us in the first instance by talking to the Adult Education Department, or by contacting the College's Data Protection Officer:

The Data Protection Officer Esher College
Weston Green Road
Thames Ditton
​ KT7 0JB

Email: dataprotectionofficer@esher.ac.uk

Telephone: +44 208 398 0291

If you are not satisfied with how we process your personal data, or how we have handled your query, you can make a complaint to the Information Commissioner. (https://ico.org.uk/concerns)


Access to your information

​You have the right to request a copy of the information that we hold about you.  Usually we will provide this information to you free of charge and within 30 days.


Transferring your data

​You have the right to request a copy of your personal data in a commonly used machine-readable format such as CSV or Microsoft Excel XLSX so that you can transfer your data another organisation.  We have to provide this to you free of charge and process your request within 30 days.  You can also ask us to send your data directly to another organisation. 


Correcting mistakes

​You have the right to request we update any information we hold about you if you think, it is incorrect, incomplete or out of date. 


Objecting to how we process your data

​Where we rely on Legitimate Interests or Public Interest as the legal basis for processing your personal data, you have the right to object, on grounds relating to your particular situation, if you feel the processing has a disproportionate impact on your rights.


Withdrawing consent

​Where we have obtained your consent to use your data you have the right to withdraw consent at any time and ask us to stop processing your data.


The right to be forgotten

​You can ask us to erase your personal data in the following situations:

  • The data is no longer necessary in relation to the purpose for which it was originally collected.
  • You have withdrawn consent.
  • You have objected to us processing the data and there is no overriding legitimate interest for us to continue the processing.
  • Your personal data was unlawfully processed.
  • Your personal data has to be erased in order to comply with a legal obligation.

We may in some circumstances refuse to erase your personal data. If we do this we will explain why, and our legal basis for doing so.


Restricted processing

​In the following situations, you can tell us to stop or restrict the processing of your personal data.  We will continue to store the data, but we will only be able to use it in the ways you specify:

  • You have asked us to update your data, and you want us to stop using it until we have updated it.
  • You have objected to the way in which we process your data and you want us to stop using it until we have finished evaluating your objection.
  • We processed your data unlawfully and you want us to restrict access to the data instead of deleting it.
  • We no longer need the data, but you require it to establish, exercise or defend a legal claim.