We are The Access Project (TAP, We, Us), and We are based at The Dock, Tobacco Quay, Wapping Lane, London E1W 2SF. We are a Data Controller, and are committed to protecting your data in line with the General Data Protection Regulation (GDPR).
The central contact for data protection can be contacted through firstname.lastname@example.org.
Processing personal data
We process personal data relating to TAP students, tutors, staff, trustees, funders and business partners, in order to run the Access Project and keep people informed about any work that we are completing.
What personal data do we collect and how?
Funders and other partners – We may collect your data from publicly available sources, if you give it to us or if a mutual connection puts us in touch. Typically we collect your name, email address and telephone number financial and credit card information and personal descriptions.
Students – You, your school and parents/ guardians may provide us with your name, date of birth, email address, home address, UCAS applications and outcomes, target, predicted and actual grades and information relating to your Free School Meal status, Special Educational Needs status, whether you are in care or a care leaver, ethnicity data and relevant health information.
Non TAP Students – We may collect anonymised grades from students in the schools we partner.
Volunteer Tutors – We use volunteer websites such as do-it.org, Escape the City, Volunteering Brent, Reach Volunteering – these sites may capture an interested volunteer’s name and email address or phone number and pass this on to us to contact you. We also collect your data when you complete an online application form. Typically we collect your name, date of birth, email address and telephone number, education information and reference details.
What do we do with your data?
We look after your personal data by keeping it up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting it from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect it.
We store your data on the secure cloud based service Salesforce, and we use Gmail for email communications.
The reasons we use your data are as follows:
To determine your eligibility for commencing with TAP
- We use your grades, your application form answers and recommendations from your teachers as determinants for assessing your eligibility to participate in TAP.
- We prioritise students who are eligible for Free School Meals, Pupil Premium and in care/ care leavers.
- We use your postcode to determine whether people in your area are likely to go to university using The Office for Students POLAR higher education participation measure. In addition we also use postcode data to determine which category of ACORN neighbourhood our students come from. We use this data to establish eligibility for The Access Project, prioritising those from areas less likely to attend university, and for sharing with evaluation partners to determine the effectiveness of The Access Project.
To enable student-tutor pairings:
- personal data of tutors may be shared with parents and students; and
contact details of students may be provided to tutors.
For administrative purposes including:
- to maintain the passwords/user logins of registered users;
- to send you information which We feel may be of interest to you;
- to enable you to use any services that We may from time to time provide through Our website;
- to investigate and address your queries and questions including those you raise with Us contact us via email@example.com;
- where We have your permission to do so, to send you information about Our products and services; and
- for website administration (including to enable Us to respond to any comments on the website or feedback you may give Us).
- to establish the effectiveness of TAP in comparison to peers’ results.
- to process a donation you make.
We may also share your Personal Information with:
- schools, in order to inform a school about their pupils’ tutor pairings;
- a university, in order to inform that university about their volunteer tutor pairings;
- business partners, in order to allow them to monitor the impact of their company’s volunteer tutors;
- business partners, in order to allow them to monitor the impact of their school partnership and for visits to their organisation building;
- law enforcement agencies, regulators, courts or other public authorities where we are required to, or are authorised to by law;
- Student and tutor personal data is shared with our evaluation partners who will use it to conduct impact analyses of our programme.
- anonymised data is sometimes provided to third parties for purposes of statistical analysis to enable us to assess the impact of our work.
- We use a third party provider, Mailchimp to deliver our newsletters. You can find more information at https://mailchimp.com/legal/privacy/.
You can read more about how our main service providers comply with GDPR through the following links: https://kb.mailchimp.com/accounts/management/about-mailchimp-the-eu-swiss-privacy-shield-and-the-gdpr, https://cloud.google.com/security/gdpr/ , https://www.salesforce.com/uk/company/privacy/full_privacy.jsp
If we have a contract with another organisation to provide services on our behalf or if we share information with other parties as set out above, we’ll make sure that they also have appropriate security measures in place any only process your personal data in accordance with our instructions and not for any other purpose.
If you are not willing to provide your personal data then you will not be able to benefit from many of our services or participate in our programmes.
What is the legal basis for processing your personal data?
To process your data lawfully, we rely on the following grounds:
- Consent of the data subject – In regards to sending marketing emails and when processing special category data.
- Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract – This basis is used for processing data relating to staff, students on the programme and volunteer tutors who are part of the programme.
- Legitimate interests – We may process personal data where, when weighed against your rights as a data subject, it is in out legitimate interest to do so.
Specifically, The Access Project uses this basis in the following situations and for the following legitimate interests:
- receiving grades and university application information from schools and sharing student and tutor data with evaluation partners, in order to facilitate the efficient operation of The Access Project and provide students with effective tuition.
- providing parents with the name and place of work of the tutor their child is matched with, to keep them informed in the matching process.
If you object to us using your data where we are relying on our legitimate interests as explained above please contact firstname.lastname@example.org.
- Legal obligation – Where The Access Project needs to use your information in order to comply with a legal obligation, for example to report a concern about student wellbeing to Children’s Services when required. We may also have to disclose your information to third parties such as the courts, the local authority or the police where legally obliged to do so.
Special category data
We may, with your consent, process ‘special categories’ of personal data (sensitive personal data) for students and staff such as ethnicity data for equality and diversity purposes, and health information for medical purposes. We will never share this information without your consent.
We won’t do anything with your information you wouldn’t reasonably expect. If you have any queries regarding how we process your data, please contact us at email@example.com.
We will only hold your information for as long as is necessary in line with our retention policy, which is usually for as long as you have an active relationship with TAP or as long as the law requires.
Using Our Website (the Site)
Your personal data may be collected via the Site in two ways:
- web-server logs; and
- the entering of name, email addresses, mobile phone numbers.
In addition, we may gather personal data:
- from the personal data you provide to us; and
- from our suppliers who we appoint on our behalf to run campaigns on social media or other forums.
Web server logs
When you visit this Site, your visit is logged by Our web server as is the case with most websites. This log information is statistically analysed by Our staff to show trends in the use of the Site, such as the popularity of particular pages.
This log information does not identify you personally. It does not identify your email address. It may include the IP address and/or fully qualified domain name of the computer you use. You should be aware that this information might identify the company you work for (if you access the Site from your place of work), or your Internet Service Provider (ISP).
We may log clicks on the links to other websites that are included in Our Site. This is to help Us determine the popularity of such links. Since this link-logging is included in Our web logs, it will record the identity of the computer making the request but does not identify you personally.
If you access Our Site by way of a hardware firewall, a proxy server or any other kind of router (such as a dial-up modem connection at your ISP) then it is the address of the router that will appear in Our logs and not the address of your computer.
During the course of your use of the Site you may be requested to enter your email address and/or mobile phone number to use a service We provide. This information will only be used in accordance with the terms of this Privacy Notice. If you do not want to provide this information, you will not be able to use some of our services.
Hyperlinks to other websites
Your rights and your personal data
You have rights regarding your personal data. You can:
- request a copy of your data that We hold;
- request that We correct any personal data that is incorrect or out of date;
- request your personal data is deleted if it is no longer necessary for Us to process it;
- withdraw your consent to the processing at any time;
- request your personal data is transferred to another data controller (this is called data portability);
- request a restriction is placed on further processing your data; and
- object to how your personal data is processed.
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/ or other relevant supervisory authority.
This policy was last updated as of May 2018.