Privacy notice – The Access Project

Who we are

We are The Access Project (TAP, We, Us), and we are based at Canopi, 82 Tanner Street, London, SE1 3GN. We are a Data Controller and are committed to protecting your data in line with the UK General Data Protection Regulation (UK GDPR).

This privacy notice provides you with information regarding your rights and our obligations, and explains how, why and when we process your data.

The central contact for data protection can be contacted through DPO@theaccessproject.org.uk.

Processing personal data

We process personal data relating to The Access Project students, volunteers, tutors, staff, trustees, funders and business partners, in order to run the Access Project and keep people informed about any work that we are completing.

We will never collect any unnecessary personal data from you and do not process your information in any way, other than as specified in this notice.

What personal data do we collect and how do we collect it?

Personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

The type of data we collect is as follows:

Funders and other partners – We may collect your name, email address and telephone number, financial and credit card information, and personal descriptions. We may collect your data from publicly available sources, if you give it to us or if a mutual connection puts us in touch.

Student applicants – Data collected includes your name, pronouns, date of birth, gender, email address, home address, postcode, parent(s)/ guardian(s) name(s) and contact details, the school you attend, University choices, target, grades, school year group, recommendations from your teachers, Free School Meals/ pupil premium status, Special Educational Needs information, whether you are in care or a care leaver, the main languages spoken by your carers, whether your immediate family have attended university, health/medical information, ethnicity data, your feelings on your studies and your feelings about the project. Information on student applicants may be collected from students themselves via an application form and follow up communication from the project, their school and, once selected to the programme, their parents/ guardians.

Non-TAP Students – We may collect anonymised demographic information and grades for students in the schools we partner from staff within the schools.

Alumni Students – We may collect your full name, pronouns, gender, email address, phone number, date of birth, ethnicity, special educational needs data, school you attended, university and region, whether your family members attended university, course, and details of your experience. We collect your data from you directly via the university transition programme sign up form and via follow up communication such as surveys completed whilst on the programme.

Volunteers – Typically we collect your name, date of birth, gender, pronouns, email address and telephone number, education information, health data for reasonable adjustments and reference details. We collect your data through our volunteer registration process, either directly from you when you are completing an online application form or through follow up communication such as surveys, or through the references you will be asked to provide. We may sometimes collect additional information from third parties including business, universities, and social media searches such as LinkedIn. We use volunteer websites such as do-it.org, Escape the City, Volunteering Brent, Reach Volunteering – these sites may capture an interested volunteer’s name and email address or phone number and pass this on to us to contact you.

Adults and Students during Online sessions – We record your image in sessions with students occurring online through our Learning Management System, “The Access Hub” hosted by the company Accipio for safeguarding purposes. Their privacy policy can be found on the Accipio website.

Employees – We collect your name, date of birth, email address, telephone number, nationality, next of kin name and contact details, National Insurance number, bank account details, personal references, ID document details (e.g. passport/driving license), employment and educational history, a photo of employees for the company website. We also collect special category data with consent (such as health/medical information). This data is collected from submitted application forms directly from candidates and employees. We may also receive applicant information from recruitment agencies.

Adults working with children at The Access Project – We collect your five-year address history, history of name changes, birthplace details, ID documents and information relating to any unspent criminal convictions via the DBS processing company UCheck to process your DBS checks. Their privacy policy can be found on the UCheck website.

What do we do with your data?

We, and any other organisations that we trust to work with us, will look after your personal data by keeping it up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting it from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect it. We will never disclose, share or sell your data without your consent; unless required to do so by law. We only retain your data for as long as is necessary and for the purposes specified in this notice.

We store your data on the secure cloud-based service Salesforce, we store employee data on the HR platform BambooHR, we use Outlook for email communications, we use a third party provider, Mailchimp, to deliver our newsletters, Me-Learning for safeguarding training, Defense.com for data protection training, Perkbox for employee benefits, Paycircle for payroll, and all online sessions are held within The Access Hub platform or organisational Zoom cloud storage.

The reasons we use your data are as follows:

To determine student eligibility for The Access Project

We use your postcode to determine whether people in your area are likely to go to university using The Office for Students POLAR higher education participation measure. In addition, we also use postcode data to determine which category of CACI ACORN and ONS IDACI neighbourhood our students come from. We use this data to establish eligibility for The Access Project, prioritising those from areas less likely to attend university, and for sharing with evaluation partners to determine the effectiveness of The Access Project. 
We will ask your school to tell us about student demographic information including your postcode, Free School Meal status, any Special Educational Needs, your university choices and your grades, and they will also make recommendations for students to be on the programme. We will use this to decide if you are eligible for The Access Project and to support you throughout your time on the programme.
We prioritise students who are eligible for Free School Meals, Pupil Premium and in care/care leavers.

To run the Access Project:

For eligible students, we use their data to enable participation in the project, to monitor progress on the project, and to send necessary communications while taking part in The Access Project. 
We will ask you and your parents to tell us about your health, Special Educational Needs and dietary requirements, so that we can meet your needs during all Access Project activities. We will share relevant information about students with the person/people they are matched with and vice versa.
For online sessions we will record your image via webcam for safeguarding and quality purposes. Staff members of The Access Project will conduct regular spot checks of videos and will also drop in on live sessions. 
to establish the effectiveness of The Access Project in comparison to peers’ results.
With your consent, to feature your image or quotes in our promotion work.  
We will ask you for some special categories of data (such as your ethnicity data) to monitor equality and diversity at The Access Project.

To run our University Transition Programme:

To provide support for alumni students once they leave school and make sure you have the tools to succeed at university.
To contact you to be given access to resources to support you with the transition to university and opportunities to boost your CV.
To track how The Access Project alumni are getting on at university, so that we can understand your experience and learn about how we can improve The Access Project, and where alumni most need support.

To meet requirements as an employer:

We process employee personal data in the performance of a contract as your employer:
- To ensure that we meet our legal employer obligations and the requirements of employment law.
- To enable us to recruit, employ and train you in the course of your employment with us.
- As part of our legal obligation for business accounting, payroll and tax purposes.

We process special category data about employees as part of our employment obligations, to ensure that any disabilities and health conditions are known.

For the safe recruitment of staff and volunteers working with children:

To ensure adequate references are in place
To process DBS checks
To sign you up to our online safeguarding training

For administrative purposes including:

to maintain the passwords/user logins of registered users;
to send you information which We feel may be of interest to you if you have opted in for marketing information;
to enable you to use any services that We may from time to time provide through Our website;
to investigate and address your queries and questions including those you raise with Us via info@theaccessproject.org.uk;
where We have your permission to do so, to send you information about Our products and services; and
for website administration (including to enable Us to respond to any comments on the website or feedback you may give Us).

to process a donation you make.

We may share your Personal Information with:

schools, in order to inform a school about their pupils’ pairings, any relevant safeguarding information and progress with The Access Project;
universities, in order to inform that university about their volunteer pairings or volunteer sign ups from their alumni members. Some university partners may record student data in the Higher Education Access Tracker (HEAT) in order to track long-term outcomes including university progression. You can read more about this on the Queen Mary University of London website.
business partners, in order to allow them to monitor the impact of their company’s volunteers, their school partnership and for visits to their organisation building;
law enforcement agencies, regulators, courts or other public authorities where we are required to, or are authorised to by law;
tutoring programmes and their business administrators, in order to facilitate them providing high-quality tutoring to help pupils whose education has been affected by the COVID-19 pandemic;
student and volunteer personal data is shared with our evaluation partners (e.g. UCAS Outreach Evaluator, FFT Education Datalab) who will use it to conduct impact analyses of our programme.
- Evaluation partners may link this data to other data held in the National Pupil Database, which is managed by the Department for Education.
anonymised data is sometimes provided to third parties for purposes of statistical analysis to enable us to assess the impact of our work.
If we have a contract with another organisation to provide services on our behalf or if we share information with other parties as set out above, we’ll make sure that they also have appropriate security measures in place to only process your personal data in accordance with our instructions and not for any other purpose.

What is the legal basis for processing your personal data?

To process your data lawfully, we rely on the following grounds:

Consent of the data subject – In regard to sending marketing emails, processing student media data, and when processing special category data.
Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract – This basis is used for processing data relating to staff, students and schools who are part of the programme and any business or university partnerships.
Legitimate interests – We may process personal data where, when weighed against your rights as a data subject, it is in our legitimate interest to do so.

Specifically, The Access Project uses this basis in the following situations and for the following legitimate interests:
- receiving student demographic information, grades and university application information from schools to determine student eligibility for the programme.
- keeping parents and guardians informed of their child’s progress and involvement in The Access Project.
- receiving grades and university application information from schools and sharing student and volunteer data with evaluation partners and universities, in order to facilitate the efficient operation of The Access Project, track long-term outcomes including university progression and provide students with effective tuition.
- contacting members of staff at potential partner schools for the purposes of reaching schools and students who meet our eligibility requirements and could benefit from a social mobility perspective by engaging with the programme.
- share student names, dates of birth, postcode and school name with universities visited on trips for Higher Education Access Tracker (HEAT) analysis of the success of widening participation events.
- using staff bios and a photo supplied by them on our website.
- contacting potential volunteers to complete their application form to sign up to the programme.
- processing your information when it is essential for us to run The Access Project, for example setting you up as a volunteer, sending you important volunteering updates/ safeguarding reminders and, for some volunteers, sharing your contact details with your student partner
- recording training sessions for quality assurance purposes. If you object to us using your data where we are relying on our legitimate interests as explained above, please contact DPO@theaccessproject.org.uk.

Legal obligation – Where The Access Project needs to use your information in order to comply with a legal obligation, for example to report a concern about student wellbeing to Children’s Services when required, we may also have to disclose your information to third parties such as the courts, the local authority or the police where legally obliged to do so.
Vital Interests – We will share information to prevent someone from coming to serious harm.

Special category data

We may, with your consent, process “special categories” of personal data (sensitive personal data) for students and staff such as ethnicity data for equality and diversity purposes, and health information for medical purposes. We will never share this information without your consent.

How long we keep your data

We will only hold your information for as long as is necessary in line with our retention policy, which is usually for as long as you have an active relationship with The Access Project or as long as the law requires.

Transfers outside of the EEA

We may share personal information to third parties outside of the European Economic Area (EEA). Any personal information transferred will only be processed on our instruction and we ensure that information security at the highest standard would be used to protect any personal information as required by the Data Protection laws. Where personal data is transferred outside of the EEA to a country without an adequacy decision, we will ensure appropriate safeguards are in place prior to the transfer. These could include Standard Contractual Clauses

Using Our Website (the Site)

Your personal data may be collected via the Site in two ways:

web-server logs; and
the entering of name, email addresses, mobile phone numbers.

In addition, we may gather personal data:

from the personal data you provide to us; and
from our suppliers who we appoint on our behalf to run campaigns on social media or other forums.

Web server logs

When you visit this Site, your visit is logged by Our web server as is the case with most websites. This log information is statistically analysed by Our staff to show trends in the use of the Site, such as the popularity of particular pages.

This log information does not identify you personally. It does not identify your email address. It may include the IP address and/or fully qualified domain name of the computer you use. You should be aware that this information might identify the company you work for (if you access the Site from your place of work), or your Internet Service Provider (ISP).

We may log clicks on the links to other websites that are included in Our Site. This is to help Us determine the popularity of such links. Since this link-logging is included in Our web logs, it will record the identity of the computer making the request but does not identify you personally.

If you access Our Site by way of a hardware firewall, a proxy server or any other kind of router (such as a dial-up modem connection at your ISP) then it is the address of the router that will appear in Our logs and not the address of your computer.

Email

During the course of your use of the Site you may be requested to enter your email address and/or mobile phone number to use a service We provide. This information will only be used in accordance with the terms of this Privacy Notice. If you do not want to provide this information, you will not be able to use some of our services.

Cookies

Our site uses cookies and other tracking technologies. To read how cookies and tracking technologies work and what they are used for on this site and to see a list of the companies that use these cookies and technologies and how they use them please read our Cookie Policy. Please continue to use this site as normal if you are happy with the current cookie settings. You can change your cookies preferences or disable cookies via your browser.

Hyperlinks to other websites

This Site contains hyperlinks to websites owned and operated by third parties. These websites have their own privacy policies and terms of use, and We urge you to review them. They will govern the use of personal data you submit whilst visiting these websites. The Access Project does not accept any responsibility or liability for the privacy practices of such third-party websites and your use of such websites is at your own risk.

Hotjar

We use Hotjar in order to better understand our users’ needs and to optimise this service and experience. Hotjar is a technology service that helps us better understand our users experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback.

Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices (in particular device’s IP address (captured and stored only in anonymised form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our website). Hotjar stores this information in a pseudonymised user profile. Neither Hotjar nor we will ever use this information to identify individual users or to match it with further data on an individual user. For further details, please see Hotjar’s privacy policy. You can opt-out to the creation of a user profile, Hotjar’s storing of data about your usage of our site and Hotjar’s use of tracking cookies on other websites by following this opt-out link.

Your rights

You have the following rights relating to your personal data:

The right to request a copy of your personal data that We process;
The right to ask Us to correct any personal data that is incorrect or out of date;
The right to ask Us to erase your personal data if it is no longer necessary for Us to process it;
The right to withdraw your consent to the processing at any time;
The right to request that your personal data is transferred to another data controller (this is called data portability);
The right to request a restriction is placed on further processing your data; and
The right to object to how your personal data is processed.

You are not obliged to provide your information to The Access Project; however, we may not be able to enable you to participate in the project or employ you if you do not provide us with certain information. You have the right to stop us and our partners from using your personal information at any time, but this would mean that you can no longer participate in The Access Project.

We take the responsibility for protecting your privacy very seriously and we will ensure your data is secured in accordance with our obligations under the Data Protection laws. We have in place technical and organisational measures to ensure personal information is secured and to prevent your personal data from being accessed in an unauthorised way, altered or disclosed. The processing of your personal data will only take place subject to our instruction.

We have policies and procedures to handle any potential data security breaches and data subjects, third parties and any applicable regulators will be notified where we are legally required to do so.

We have ensured that all employees have had information security and data protection training.

Lodging a complaint

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us by contacting DPO@theaccessproject.org.uk, or directly to the Information Commissioner’s Office or other relevant supervisory authority.

We won’t do anything with your information you wouldn’t reasonably expect. If you have any queries regarding how we process your data, please contact us at DPO@theaccessproject.org.uk.