Privacy policy

Cardiff and Vale College relates to all provision within the College, Element Skills Training, CF10, ICAT limited and ATA which are governed by the Cardiff and Vale College Corporation.
This Privacy Notice describes what Cardiff and Vale College does with the personal information you provide it with.

It applies to information the Cardiff and Vale College collects about:

  • Visitors to the College’s websites
  • People who use or may use the College’s services. This includes for example:Individuals who request information from the College.
  • Individuals who undertake a course of study through the College:
    - Cardiff and Vale College Alumni
    - Employers who purchase training from the College
    - Employers who take a student on work experience or placement
    - Employers who employ an Apprentice
    - Members of the College workforce
    - College Governors
    - Individuals who are customers of the Cardiff and Vale College’s business operations

If you are asked to provide personal information to us, it will only be used in the ways described in this Privacy Notice.
If you have any questions about this policy, please contact the Evan Davies, Data Protection Office

The categories of the information that the College collects, holds and shares includes, but is not limited to:

  • Personal information (such as name, student number, address, date of birth, national insurance number)
  • Contact information (which may include phone number, email and postal address)
  • Educational Information (including qualifications, predicted grades, learning support needs, attendance information – number of absences and reasons and individual achievements)
  • Characteristics (such as gender and if the same as at birth, age, ethnicity, first language, nationality, country of birth and free school meal eligibility)
  • Financial information (bank details)
  • Information about personal preferences and interests
  • Company information, (financial, staff, professional development records)
  • Website usage data.
  • Staff contract information (start dates, hours worked, post, roles and salary information, annual leave entitlement, employment history and professional development).
  • We use CCTV at our buildings for the purposes of crime prevention, security and health and safety and, accordingly, will capture imagery of visitors to the College.

How we use this data

Your personal information will be used for purposes relating to education, training, employment, general advice services, well-being and research.  The College may share non-sensitive personal information about you with other organisations as follows:

  • For our Welsh based learners - Most of the information is passed to the Welsh Government (including but not limited to the Department for Education and Skills) to meet funding arrangements.   
  • For our English based learners - Most of the information is passed to Government agencies (including but not limited to the Education and Skills Funding Agency) to meet funding arrangements.    Where necessary it is also shared with the Department for Education (DFE)
  • The information is used for the exercise of functions of these Government departments and to meet statutory responsibilities, including under the Apprenticeships, Skills, Children and Learning Act 2009. It is also used, in collaboration with the appropriate organisations, to create and maintain a unique learner number (ULN) and a Personal Learning Record (PLR).

It is used by the Cardiff and Vale College to:

  • to process applications, enrolments and workforce development programmes and contracts
  • for the College’s own internal records so that it can provide you with a high quality service
  • to contact individuals in response to a specific enquiry
  • to customise the College’s services so they work better for individuals
  • to contact individuals about services, products, offers and other things provided by the College which it thinks may be relevant
  • to contact individuals via e-mail telephone or mail for research purposes.
  • at no time will the College assume permission to use information that is provided for anything other than the reasons stated here.

The information provided may be shared with other organisations for purposes of administration, the provision of career and other guidance and statistical and research purposes, relating to education, training, employment and safeguarding. This will only take place where the sharing is in compliance with the Data Protection Act 2018.

Individuals may be contacted after they have completed their programme of learning to establish whether they have entered employment or gone onto further training or education.

Individuals may be contacted by the European Social Fund (ESF) Managing Authority, or its agents, to carry out research and evaluation to inform the effectiveness of the programme. Information may be passed to the ESF for this purpose.

We do not store or transfer your personal data outside Europe.

Cardiff and Vale College has identified that it meets a number of lawful basis for processing (as set out in Article 6 of the GDPR). In summary:

  • For processing enquiries and applications to the College the lawful basis is legitimate interest.
  • For processing information relating to and individuals programme of study the lawful basis is legitimate interest and may also be linked to a contract.
  • For gathering information about the destination of an individual once they have left the College the lawful basis is legitimate interest
  • For contact individual who have completed a course at the College the lawful basis is consent.


The College will hold personal information securely.

To prevent unauthorised disclosure or access to personal information, it has strong organisational and technical security safeguards.

If information is shared with another organisation (reasons for this are given in the section below) it will ensure an Information Sharing Agreement is in place.

The College follows stringent procedures to ensure it processes all personal information in line with the Data Protection Act 2018.

Information sharing and disclosure

The College does not sell or rent personal information.

Information may by necessity be disclosed to appropriate staff members of Cardiff and Vale College and to government bodies (as previously outlined).

Organisations that Cardiff and Vale College may share personal information with includes:

  • Awarding Bodies
  • Companies House
  • Welsh Government
  • Department for Education and Skills
  • Department for Education
  • Education and Skills Funding Agency
  • Employers
  • HMRC
  • Higher Education Institutions
  • Local authorities      
  • Mailchimp
  • Estyn
  • Pension Service
  • Police
  • Schools
  • Sub-contractors
  • UCAS

Information may be shared with third parties if it is in connection with the service being provided to individuals, for example, the College might share information with market research companies contracted to undertake work on its behalf to assess satisfaction with the College’s service. When the College does this it will always ensure an Information Sharing Agreements in place.

If, as part of the entry requirements for a course or if an individual is applying for a job with Cardiff and Vale College, the College needs to take up a reference or obtain ‘disclosure’ from the Disclosure and Barring Service, it will inform you beforehand.

Parental consent is not required. There may be exceptions with regards to students with severe learning difficulties, school link students and those who are otherwise unable to decide for themselves.

The College has found that it is very beneficial to the young person’s progress as a student if the College is able to engage with the parents (or guardian/carer). Therefore, it is very important that we have the parents’ details recorded on its systems.

When a student is in Further Education, parents/carers/guardians (or any other third party) are not automatically entitled to the student’s information. The College can only release information about its students if it has their consent for this recorded on the College system. 

Students are asked for their consent to share information with parents/others on the enrolment form or when enrolling face-to-face. Students can also inform the College later on of who the College may discuss with about their College matters. Students may withdraw their consent the same way in which they gave it.

How long do we keep data?

In general we will hold most of your personal data for the duration of your engagement with us. The periods for which your personal data is held during and after the end of engagement are set out in our retention periods document which can be found on the College Website.

Visitors to the website

When someone visits the College collect standard internet log information and visitor details of behaviour patterns. It does this to find out things such as the number of visitors to the different parts of the site. It collects the information in a way which does not identify anyone. If it does want to collect personally identifiable information through its website it will be up front about this and will make the purpose clear.


A cookie is a small file placed on a computer’s hard drive. It enables the College’s website to identify a computer as individual’s views different pages on its website.

Cookies allow websites and applications to store preferences in order to present content, options or functions that are specific to individuals. They also enable the College to see information like how many people use the website and what pages they tend to visit.

All cookies used by this website are used in accordance with the current Privacy and Electronic Communications (EC Directive) Regulations 2003 as amended by the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011.

Cookies do not provide the College with access to an individuals’ computer or any information about them, other than that which they choose to share.

Individuals can use their web browser’s cookie settings to determine how the College’s website uses cookies. If an individual does not want the College website to store cookies on their computer or device, they should set their web browser to refuse cookies. However, please note that doing this may affect how the College’s website functions. Some pages and services may become unavailable to the individual.

Unless an individual has changed their browser to refuse cookies, the College’s website will issue cookies when it is visited.

Social Website Cookies

We embed content from third party websites such as YouTube, Facebook and Twitter, thus you can easily "Like" or "Share" our content on social sites such as Facebook and Twitter.

This will however involve third party cookie information, whose privacy will vary from social network site to social network site as well as the privacy settings you have chosen for those networks.

For more information see the relevant privacy policies:


Visitor Statistics Cookies:

We use cookies to analyse visitor statistics such as:

  • How many people have visited our website
  • Which browser technology the visitor is using
  • Which page the vistor visits
  • How visitors were directed to our websites

Controlling information about individuals

When individuals fill in a form or provide their details on the College’s website, there may be one or more tick boxes allowing them to:

  • opt in to receive marketing communications from the College by e-mail, telephone, text message or post
  • opt in to receive marketing from third party partners by e-mail telephone, text message or post
  • if individuals have agreed that the College can use their information for marketing purposes, individuals can change their mind easily, via one of these methods:
    - unsubscribe by clicking the link in each email;
    - send an e-mail to
    - write to us – The Data Protection Officer, Cardiff and Vale College, City Centre Campus, Dumballs Road, Cardiff CF10 5FE

Any individual can request that the College delete their personal data. This request for erasure can be made by e-mailing the Data Protection Officer at Whilst the Data Protection Act 2018 doesn’t provide an absolute right to have your personal information deleted by an organisation (for example they do not need to delete personal information if they are obliged to keep it by law or have another legitimate reason to keep it) the College will review each request and erasure will be assessed on a case by case basis.

Links from the College website

The College website may contain links to other websites. Please note that the Cardiff and Vale College have no control of websites outside of If an individual provides information to a website to which the College links, it is not responsible for its protection and privacy. Individuals are advised to read the privacy policy or statement of other websites prior to using them.

People who use the College's services

The College hold the details individuals provide in order to deliver programmes of study, Apprenticeships, workforce development programmes and other services which meet specific needs.

It only uses these details to provide the service an individual has requested and for other closely related purposes. For example, it might use information about people who have enquired about a course to carry out a survey to find out if they are happy with the level of service they have received, or it might use information about an employer offering a student work experience to contact them about a new Apprenticeship scheme or grant.

Information may by necessity be disclosed to appropriate staff members of the Cardiff and Vale College and to government bodies [to fulfil the College’s statutory responsibilities] such as the, Welsh Governments Department for Education and Skills, Estyn, and auditors or to local partners.

People who use the College's Business Enterprise

If someone is a customer of a commercial service of the College e.g. The Classroom; Glamorgan Suite; urbasba. The information an individual provides the College with to enable them to deliver that service will only be held and used for that purpose or for other closely related purposes.

People who request information from Cardiff and Vale College

If an individual requests information from the College by letter, telephone, email, submitting an enquiry card or from a sales appointment, the College will make a record of that enquiry and will use the information to provide the individual with a response. It will only use the information for these purposes and to provide a follow up service to ensure that it provided the individual with what they asked.

Accessing your own personal information

Individuals have the right to ask for a copy of any of their personal information held by Cardiff and Vale College. They can make a ‘subject access request’ under the Data Protection Act 2018.

The easiest way to make a request is email the Data Protection Officer at

Requesting to delete personal data

One of the key principles which underpins the GDPR is the right of an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing. This is also known as the right to be forgotten.

The easiest way to make a request is email the Data Protection Officer at

Any requests from individuals to:

  • have inaccurate personal data rectified (right to rectification),
  • restrict or suppress of their personal data (right to restrict processing),
  • obtain and reuse their personal data for their own purposes across different services (right to data portability),
  • object to how their personal data is used,

should be made directly to the Data Protection Officer at

Complaints and Queries

If there are any questions about the College’s collection and use of personal data, please contact the Data Protection Officer at They are happy to provide additional information if it is required.

If you have a concern about the way Cardiff and Vale College has handled or is handling your personal information, or you wish to make a complaint because we have not complied with our obligations, you can make a complaint to the Information Commissioners Office (ICO).  You should raise your concerns with within three months of your last meaningful contact with the College.  Details of how to do this are on the Information Commissioners Office website: 

By post: If your supporting evidence is in hard copy, you can print out the form and post it to the ICO (with your supporting evidence) to:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane

Changes to this privacy notice

The College will keep this Privacy Notice under regular review and reserve the right to change it as necessary from time-to-time or if required by law. Any changes will be immediately posted on the website.