1. Who We Are and What This Notice Covers

This Privacy Notice explains how UCA alongside our Higher Education partner institutions, Canterbury Christ Church University (CCCU), University of Kent (UoK) and University of Greenwich collects, uses, stores, and shares personal data for the Kent and Medway Partnership Federation (KMPF).

Each partner institution acts as an Independent Data Controllerunder UK Data Protection Laws for the personal data processed as part of this collaboration.

2. Why We Collect and Process Your Data

The KMPF project aims to widen participation in Higher Education (HE) by identifying perceived and actual barriers experienced by students and providing activities, events, and outreach support to encourage academic achievement.

We collect and process personal data to:

  • Organize, deliver, and manage outreach events, workshops, and activities.
  • Evaluate the success and impact of outreach initiatives over time.
  • Track student educational progression and outcomes into Higher Education.
  • Collate statistical research and meet reporting requirements for educational funding bodies (such as the Office for Students).
  1. What Personal Data We Collect

We collect only the minimum necessary personal data required for these activities, which may include:

  • Personal & Contact Details: Name, date of birth, gender, home postcode, email address, school/college, and year group.
  • Educational Information: Academic attainment data (e.g., Key Stage results), attitude towards learning, and future career or education plans.
  • Demographic & Background Data: Ethnicity, care experience status, service child status, or whether you are from a family with no prior HE history.
  • Special Category Data (where necessary): Health, dietary, or disability information to ensure safety, accessibility, and reasonable adjustments during events.

4. Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, our legal bases for processing personal data are:

  • Public Task (Article 6(1)(e)): Processing is necessary for the performance of a task carried out in the public interest (widening access to Higher Education and promoting equal opportunities).
  • Substantial Public Interest (Article 9(2)(g)): For processing Special Category Data (e.g., health or ethnicity data), under the condition of Equality of Opportunity or Treatment (Schedule 1, Data Protection Act 2018).
  • Consent / Parental Consent: For children under the age of 13, parental consent is sought for participation in activities, alongside information about data collection.

5. How Your Data Is Shared

To evaluate and deliver the KMPF project effectively, personal data may be shared securely between:

  1. KMPF Partner Universities: CCCU, UoK, Greenwich, and UCA.
  2. Higher Education Access Tracker (HEAT): Personal data is uploaded to the HEAT database (hosted securely on University of Kent servers) for long-term monitoring and statistical analysis.
  3. Official Educational & Research Bodies: Data in HEAT may be linked with administrative datasets held by organizations such as the Higher Education Statistics Agency (HESA), Department for Education (DfE), Office for Students (OfS), and UCAS.

Note: Your personal data will never be sold or used for direct marketing or commercial purposes.

6. Data Storage & International Transfers

  • Personal data stored in HEAT is held securely on servers maintained by the University of Kent in the UK.
  • Data shared via collaborative tools (such as Microsoft SharePoint) is restricted to authorized personnel.
  • Personal data is not transferred outside the UK or European Economic Area (EEA) without appropriate safeguards and compliance with Data Protection Laws.

7. How Long We Keep Your Data

  • Outreach & Tracking Data: Personal data recorded on HEAT is retained to evaluate long-term educational progression (typically up to 15 years post-Higher Education entry or until age 30).
  • Once the retention period expires, data is permanently anonymized for secondary research purposes, meaning individuals can no longer be identified.

8. Your Data Protection Rights

Under UK Data Protection Law, you (or your parent/guardian) have the right to:

  • Access the personal data held about you.
  • Rectify inaccurate or incomplete data.
  • Request erasure or restriction of your personal data.
  • Object to the processing of your data.

To exercise any of these rights, or if you have questions about how your data is used, please contact the Data Protection Officer at the relevant institution:

If you remain unsatisfied with how your data is handled, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk.