College Websites

1. Statement and purpose of policy

1. Digital Operations Group is committed to ensuring that all personal data handled by us will be processed according to a legally compliant standard of data protection and data security.
   1. We confirm for the purposes of the data protection laws, that Jed Keenan is Data Controller for the personal data accessible to staff of Digital Operations Group. This results in the Data Controller determining the purposes and manner that all personal data of subscribers, staff and any third parties is processed.
2. The purpose of this policy is to help Digital Operations Group achieve its data protection and data security aims by:
   1. Notifying staff, subscribers and any third parties of the types of personal data that Digital Operations Group can hold about them, and what exactly is done with that information;
   2. Setting out the rules on data protection and the legal conditions that will be satisfied when collecting, receiving, handling, processing, transferring and storing personal data; and
   3. Clarifying the responsibilities and duties of staff in respect of data protection and data security, and ensuring staff understand legal standards.
3. This is a statement of policy only and does not form part of the contract of employment.
4. Digital Operations Group will amend this policy as and when required.
5. For the purposes of this policy:
   1. Data protection law means all applicable laws relating to the processing of Personal Data, including and for the period during that it is in force the General Data Protection Regulation (Regulation (EU) 2016/679).
   2. Data subject means the individual, be they a subscriber, staff member or a third party, to whom the personal data relates.
   3. Personal data means any information that relates to an individual who can be identified from that information.
   4. Processing means any use that is made of data, including collecting, storing, amending, disclosing, and destroying it.
   5. Special categories of personal data means information about an individual's gender, racial or ethnic origin, sexual orientation, disabilities, political opinions, religious or philosophical beliefs, trade union membership and biometric data.

2. Data protection principles 

1. Staff whose work involves using personal data relating to subscribers, employees and/or third parties will comply with this policy and with the following data protection principles that require that personal data is:
   1. Processed lawfully, fairly and in a transparent manner: Digital Operations Group will always maintain a lawful basis to process personal data, as set out in the data protection legislation. Personal data is processed as necessary to perform a contract with the Data Subject, to comply with a legal obligation that the data controller is the subject of, or for the legitimate interest of the Digital Operations Group or the party to whom the data is disclosed. The Data Subject is told who controls the information, the purposes the information is processed and, to whom it is disclosed.
   2. Collected only for specified, explicit and legitimate purposes: Personal data is not be collected for an original purpose and then used for any other purpose. When Digital Operations Group wants to change the way personal data is used, we will first inform the Data Subject.
   3. Processed only where it is adequate, relevant and limited to that necessary for the purposes of processing: Digital Operations Group will only collect personal data to the extent required for the specific purposes notified to the Data Subject.
   4. Kept accurate and that all reasonable steps to ensure that all inaccurate information is rectified or deleted without delay: Checks to personal data are made when collected and regular checks are made afterwards. Digital Operations Group makes reasonable efforts to rectify or erase inaccurate information.
   5. Kept only for the period necessary for processing: Information is not being kept longer than it is needed and all reasonable steps to delete information is taken when data is no longer required by Digital Operations Group. For guidance on how long particular information is kept see the Data Retention Policy and Record Retention Schedule, or contact the Data Protection Officer.
   6. Secure: Appropriate measures are adopted by the Digital Operations Group to ensure all data is stored securely.

3. Responsibility for data protection and data security

1. Maintaining an appropriate standard of data protection and data security is a shared task. This policy and the rules contained in it apply to all employees of Digital Operations Group, irrespective of seniority, tenure and working hours, including executive and non-executive directors and officers, consultants and contractors, agency staff, apprentices, trainees, homeworkers and any volunteers.
2. Questions about this policy, or requests for further information, are addressed by the Data Protection Officer.
3. All Staff have personal responsibility to ensure compliance with this policy, to handle all personal data consistently with the principles set out here, and to ensure that measures are undertaken to protect the data security. Managers have special responsibility for leading by example, compliance monitoring and any enforcement. The Data Protection Officer will be notified as soon as reasonably practicable when this policy has not been followed, or if it is suspected this policy has not been followed.
4. Any breach of this policy will be taken seriously and can result in disciplinary action up to and including dismissal. Significant or deliberate breaches, such as accessing Subscriber, Staff or Third Party personal data without authorisation or a legitimate reason to do so, constitutes gross misconduct and leads to dismissal without notice.

4. Personal data and activities covered by this policy

1. This policy covers personal data:
   1. That relates to individuals that can be identified either from that information in isolation or by reading it together with other information retained;
   2. Stored digitally or in paper records;
   3. In the form of statements of opinion as well as factual data;
   4. That relates to current, past or future Subscribers, Staff or Third Party whose personal data Digital Operations Group handle or control;
   5. That Digital Operations Group obtain, is provided to us, which we hold or store, organise, disclose or transfer, amend, retrieve, use, handle, process, transport or destroy.
2. This personal data is subject to the legal safeguards set out in the general data protection regulations.

5. Personal data processed regarding Staff

1. Digital Operations Group collects personal data about Staff that:
   1. Is provided by Staff, or that Digital Operations Group gathers before or during employment or engagement with Digital Operations Group;
   2. Is provided by third parties, such as references or information from suppliers or another party that Digital Operations Group does business with; or
   3. Is in the public domain.
2. The types of personal data that Digital Operations Group collects, stores and uses about Staff includes records relating to:
   1. The home address, contact details and those of the next of kin;
   2. Recruitment including the completed application form or curriculum vitae, references received, and details of qualifications;
   3. Pay records, national insurance number and details of taxes and any employment benefits such as pension;
   4. Telephone, email, internet, or instant messenger usage;
   5. Performance and any disciplinary matters, grievances, complaints or concerns that members of Staff are or have been involved.

6. Sensitive personal data

1. Digital Operations Group will from time to time need to process sensitive personal data; sometimes referred to as 'special categories of personal data'.
2. We will only process sensitive personal data when:
   1. We have a lawful basis for doing so, such as when it is necessary for the performance of the employment contract; and
   2. One of the following special conditions for processing personal data applies:
      1. The Data Subject has given explicit consent.
      2. The processing is necessary for the purposes of exercising the rights and obligations under employment law of the either Digital Operations Group or the Data Subject.
      3. The processing is necessary to protect the Data Subject's vital interests, and the Data Subject is physically incapable of giving consent.
      4. Processing relates to personal data manifestly made public by the Data Subject.
      5. The processing is necessary for the establishment, exercise, or defence or legal claims; or
      6. The processing is necessary for reasons of substantial public interest.
3. Before processing any sensitive personal data, Staff will notify the Data Protection Officer of the proposed processing, in order for the Data Protection Officer to assess whether the processing complies with the criteria noted above.
4. Sensitive personal data is not be processed until this assessment has taken place and the individual has been properly informed of the nature of the processing, the purposes it is being carried out and the legal basis for it.
5. Our Privacy Policy sets out the type of sensitive personal data that Digital Operations Group processes, what it is used for and the lawful basis for the processing.

7. Use of personal data

1. Digital Operations Group publicises the reasons for processing personal data, how this information is used and the legal basis for any processing in the Privacy Policy. Digital Operations Group does not process Staff personal data for any other reason.
2. In general Digital Operations Group will use information to carry out our business, to administer Staff employment or engagement and to deal with any problems or concerns, including, but not limited to:
   1. Staff Address List: To compile a list of home addresses and contact details, so that Staff can be contacted outside working hours.
   2. Sickness records:
      
      1. To maintain a record of Staff absence because of sickness and copies of any doctor's notes or other documents supplied in connection with health issues;
      2. To inform colleagues and others that Staff members are absent through sickness, only as reasonably necessary to manage any absence;
      3. To inform the Staff appraisal process purposes of sickness absence level;
      4. To publish internally aggregated, anonymous details of sickness absence levels.
   3. Monitoring IT systems: To monitor use of email, the internet, telephone, and other communications or IT resources.
   4. Disciplinary, grievance or legal matters: In connection with any disciplinary, grievance, legal, or regulatory matters or proceedings that involve Staff.
   5. Performance Reviews: To undertake performance reviews.
   6. Equal Opportunities Monitoring: To conduct monitoring for equal opportunities purposes and to publish aggregated and anonymised information about Digital Operations Group's workforce. 

8. Accuracy and relevance

1. Digital Operations Group will:
   1. Ensure that any personal data processed is up to date, accurate, adequate, relevant and, given the purpose it was collected, not excessive.
   2. Not process personal data obtained for a particular purpose for any other purpose, unless the Data Subject has agreed to this or, that this is reasonably expected to happen.
2. When Staff, Subscribers or Stakeholders consider that any information held about them is inaccurate or out of date, then they should tell the Data Protection Officer. If the Data Protection Officer agrees that the information is inaccurate or out of date, then it will be corrected promptly. If the Data Protection Officer does not agree with the correction, then they will note the the suggested changes. In either situation a reply explaining the response will be promptly supplied.

9. Storage and retention

1. Personal data, and sensitive personal data, will be kept securely in accordance with our this Policy.
2. The periods Digital Operations Group hold personal data are contained in the Record Retention Schedule.

10. Individual rights

1. Staff, Subscribers and Stakeholders have the following rights in relation to personal data.
2. Subject access requests:
   1. Staff and Subscribers have the right to make subject access requests. When a subject access request is submitted, the Data Subject is informed:
      1. Whether or not the Data Subject's personal data is processed and if so why, the categories of personal data concerned and the source of the data when it is not collected directly;
      2. To whom Data Subject's personal data is disclosed, including to recipients outside of the European Economic Area (EEA) and the safeguards that apply to such transfers;
      3. For how long Data Subject's personal data is stored, and or how that period is decided;
      4. Data Subject's rights of correction or erasure of data, or to restrict or object to processing;
      5. Data Subject's right to complain to the Information Commissioner's Office when the Data Subject believes that Digital Operations Group have failed to uphold data protection regulation; and
      6. Of the rational applied in any decisions.
   2. Digital Operations Group will provide Data Subjects with a copy of the personal data undergoing processing. This is normally in digital form, unless otherwise agreed.
   3. To make a subject access request, contact the Data Protection Officer at This email address is being protected from spambots. You need JavaScript enabled to view it.
   4. Digital Operations Group will need to ask for proof of identification before a request can be processed. We will let the Data Subject know when their Data Subject's identity needs verifying, and the documents required to do so.
   5. Digital Operations Group will normally respond to requests within 20 working days from the date that the request was received. In very rare instances, for example where there is a large amount of personal data being processed, the response will be within 40 working of the date the request is received. Digital Operations Group will reply in writing within 10 working days of receiving the original request when this is the case.
   6. Where a request is manifestly unfounded or excessive, Digital Operations Group are not obliged to comply with it.
3. Other rights:
   1. Staff, Subscribers and Stakeholders have a number of other rights in relation to personal data. Data Subjects can require Digital Operations Group to:
      1. Rectify inaccurate data;
      2. Stop processing or erase data that is no longer necessary for the purposes of processing;
      3. Stop processing or erase data where a Data Subject's interests override Digital Operations Group's legitimate grounds for processing the data, where Digital Operations Group rely on its legitimate interests as a reason for processing data;
      4. Stop processing data for a period of time where data is inaccurate or where there is a dispute about whether a Data Subject's interests override Digital Operations Group's legitimate grounds for processing the data.
   2. To request that Digital Operations Group take any of these steps, send the all requests to the Data Protection Officer.

11. Data security

1. Digital Operations Group will use appropriate technical and organisational measures to keep personal data secure, in particular to protect against unauthorised or unlawful processing and against all accidental loss, destruction or damage.
2. Maintaining data security means making sure that:
   1. Only Staff that are authorised to use the information are able to access it;
   2. All personal data is encrypted;
   3. Information is accurate and suitable for the purpose that it is processed; and
   4. Authorised Staff only access information when it is needed for authorised purposes.
3. By law, Digital Operations Group uses procedures and technology to secure personal data throughout the period that it is held or controlled, from obtaining to destroying the information.
4. Personal data is not transferred to any person to process, for example while performing services for Digital Operations Group or on its behalf. This is unless that person or their organisation has either agreed to comply with Data Security Procedures or that Digital Operations Group are satisfied that adequate alternative measures exist.
5. Security procedures include:
   1. All desks or cupboards containing confidential data are kept locked.
   2. Computer terminals are locked with strong passwords that are changed regularly.
   3. Unattended computer terminals are routinely logged out or turned off.
   4. When viewing personal data discretion will be used to ensure that it is not visible to others.
   5. Data stored on external drives will be encrypted and password protected, and securely stored when not being used.
   6. The Data Protection Officer approves cloud drives being used to store data, and this will also be password protected.
   7. Sensitive personal data will never be saved directly to any laptops, tablets or smartphones.
   8. All servers containing sensitive personal data is protected by security software.
   9. Servers containing personal data are located in a secure location, away from general office space.
   10. Data is regularly backed up in line with Digital Operations Group's Back-up Procedure.
6. Telephone precautions are of particular concern. Staff dealing with telephone enquiries will take serious consideration to avoid inappropriate disclosures. In particular:
   1. The identity of any telephone caller is verified before any personal data is disclosed;
   2. When the caller's identity cannot be verified satisfactorily they are asked to put their query in writing;
   3. Will not permit callers to bully them into disclosing information. In case of any issues or uncertainty, the Data Protection Officer is contacted
7. The method of disposal of personal data, whether on paper or on any external hard drives, will be their physical destruction. Paper documents are shredded and hard drives are rendered permanently unreadable.

12. Data impact assessments

1. Some of the processing that Digital Operations Group carries out can result in risks to privacy.
2. Where processing results in a risk to privacy, Digital Operations Group will carry out a Data Protection Impact Assessment to determine the necessity and proportionality of processing. This will include considering the purposes for which an activity is carried out, the risks for individuals and the measures that will be put in place to mitigate those risks.

13. Data breaches

1. Where there is discovery of a breach of personal data that poses a risk to the rights and freedoms of individuals, Digital Operations Group will report it to the Information Commissioner within 1 day of it's discovery.
2. Digital Operations Group records all data breaches regardless of their effect.
3. Where the breach is likely to result in a high risk to Data Subjects' rights and freedoms, Digital Operations Group will inform affected individuals of the breach and provide all information about the likely consequences of the breach and the mitigation measures we have taken and the required response by Data Subjects.

14. International data transfers

1. In the course of carrying out normal operations, Digital Operations Group will need to transfer personal data to a country outside the European Economic Area (EEA) including to all companies or individuals with whom Digital Operations Group have a business relationship.
2. Personal data is only transferred to a country outside of the EEA where there are adequate protections in place. To ensure personal data receives an adequate level of protection, Digital Operations Group have put in place appropriate procedures with all third parties that process personal data on its behalf so that personal data is treated by those third parties in a way that is consistent with and respects  eneral Data Protection Regulation.
3. For more information regarding international transfers of personal data, contact the Data Protection Officer.

15. Individual responsibilities

1. Staff are responsible for helping Digital Operations Group keep their personal data up to date.
2. Staff will let their manager know when personal data provided to Digital Operations Group changes, for example when moving residence or changing bank details.
3. Staff will have access to the personal data of other members of Staff and of Subscribers in the course of their employment. Where this is the case, Digital Operations Group relies on Staff to help meet its data protection obligations.
4. Individuals who have access to personal data are required:
   1. To access only personal data they have authority to access and only for authorised purposes;
   2. Not to disclose personal data except to individuals both inside or outside of Digital Operations Group who have appropriate authorisation;
   3. To keep personal data secure, for example by complying with rules on access to premises, computer access, including password protection, and secure file storage and destruction;
   4. Not to remove personal data, or devices containing or that can be used to access personal data, from Digital Operations Group's premises without adopting appropriate security measures including encryption and strong password protection, to secure the data and the device; and
   5. Not to store personal data on external hard drives or on personal devices that are used for work purposes.

Training

1. Digital Operations Group provides training to all Staff about their data protection responsibilities as part of the induction process and at regular intervals throughout their employment.
2. Staff whose roles require regular access to personal data, or who are responsible for implementing this policy or responding to subject access requests under this policy receive additional training to help them understand and appreciate their duties and to fully comply with these duties.

Contact us about this Policy

Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Phone: 020 8528 3135