Plymouth College (“we”, “us”, “our”) maintains this website at www.plymouthcollege.com (“the Site”). Plymouth College is the Data Controller and is registered with the Information Commissioner’s Office. This Privacy Notice explains how we collect, use, store and protect personal data when you visit or interact with the Site, and sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

Disclaimer

Whilst Plymouth College takes care to ensure the accuracy of content on the Site, to the extent permitted by law, Plymouth College assumes no legal liability and does not warrant that information contained on this website is accurate or complete, or that these web pages will be free from errors or that availability will be uninterrupted. Plymouth College excludes all liability to any person for any loss or damage caused by any errors or omissions, whether such errors or omissions result from negligence, accident or any other cause. This disclaimer is without prejudice to any claims for fraudulent misrepresentation, personal injury or death caused by negligence.

Restrictions on Use of Content

The content of this website and all copyright and other intellectual property rights therein belong to Plymouth College or its content providers. You are hereby granted permission to access the Site and print a copy of content as a record of your visit. All other use of the Site and its content — including modification, publication, transmission, creation of derivative works, incorporation into another website, or reproduction by linking, framing or any other method — is not permitted without Plymouth College’s prior express written consent.

1. Information We Collect

Personal Data

By visiting or using the Site, we may collect the following categories of personal data you provide to us: name; title; email address; postal address; phone number (including mobile phone number); children’s names; job role; marketing responses; admissions follow-up information; and other information you may provide about yourself or to which you give us access via third-party platforms.

We do not proactively collect special category personal data (as defined in Article 9 of the UK GDPR — for example, health-related or racial or ethnic origin data) through the Site. If you voluntarily include such information in a free-text field, we will treat it with the additional protections required by law.

If you are an existing Plymouth College family, we may combine information submitted through the Site with information we already hold about you and use it for the purposes described in this Notice.

Device Information

When you visit the Site or open communications from us (such as emails), some information is automatically collected from devices used to access the Site — including, but not limited to, operating system, access times, browser type, language and history, settings and other device data (“device information”). We also collect information about your usage and activity on the Site using cookies and similar technologies (see Section 5 below).

Location Information

We may receive your approximate location (such as city or region) inferred from your IP address when you use the Site. We may use and store this information to provide and improve features of the Site — for example, to tailor content to your region and to provide more relevant information about Plymouth College.

Children’s Data

Plymouth College’s website is a public-facing admissions and information site that may be accessed by children under 18. We comply with the ICO’s Age Appropriate Design Code (Children’s Code) and take additional care when personal data of children is involved. Our enquiry and contact forms are intended for use by parents, guardians or adult prospective candidates. We do not knowingly solicit personal data from children directly through the Site. If you believe we have inadvertently collected a child’s personal data without appropriate authority, please contact our Data Protection Officer immediately.

2. Lawful Basis for Processing

UK GDPR Article 6 requires us to identify a lawful basis for each processing activity. The table below sets out the lawful basis we rely on for personal data collected through the Site.

Where we rely on legitimate interests as our lawful basis, you have the right to object to that processing. See Section 8 (Your Rights) for further details.

3. How We Share Your Information

We do not sell your personal data. We may share your information in the following limited circumstances:

Service providers: We share information with third-party service providers who assist us in operating the Site and delivering our services — such as web hosting providers, analytics platforms, email service providers and payment processors — where they act as data processors under a written agreement with us. We require all processors to process data only on our instructions and to implement appropriate security measures.

Payment processors: Third-party payment processors handle credit or debit card transactions on or through the Site. These processors act as independent data controllers for card account information; they are subject to PCI DSS standards and their own privacy policies. Plymouth College does not itself store card account information.

Legal and regulatory authorities: We may disclose information to regulatory authorities, courts, government agencies and other third parties where required or permitted by law, or where necessary to protect the rights, interests or property of Plymouth College or others, or to respond to emergencies.

Social media and third-party platforms: The Site may allow you to connect with or share information via third-party platforms, including social media channels on which Plymouth College has a presence. Those platforms’ privacy practices are governed by their own policies, which we are not responsible for. Please contact those services directly to understand how they handle your personal data.

With your consent: We may otherwise share your information as you direct or as you consent to at the time of collection.

4. Security of Your Information

Plymouth College takes commercially reasonable technical, administrative and physical security measures designed to protect your personal data from loss, misuse, unauthorised access, disclosure, alteration and destruction. These include encryption of data in transit (TLS) and at rest, access controls, and regular review of our information security practices. You can verify that the Site uses encryption by checking the padlock icon in your browser’s address bar.

Any credit or debit card transactions on or through the Site are processed by our third-party payment processors under PCI DSS standards. Plymouth College does not itself store card account information.

No method of transmission over the internet is completely secure, and whilst we strive to protect your personal data we cannot guarantee absolute security. You play an important role in keeping your information safe: please do not share your username, password or other security information for any Plymouth College account with anyone. If we receive instructions using your login credentials, we will consider that you have authorised those instructions.

5. Cookies and Other Tracking Technologies

Cookies are small text files placed on your device when you visit the Site. We use cookies and similar technologies (such as web beacons) to support the operation of the Site, remember your preferences, and understand how the Site is used.

Under the Privacy and Electronic Communications Regulations 2003 (PECR), we may store strictly necessary cookies on your device without consent. For all other categories of cookie — including analytics, preference and marketing cookies — we require your prior consent, which we collect through the cookie consent tool on the Site.

Categories of cookies we use:

• Strictly necessary: essential for the Site to function (e.g. session management, security). These do not require consent.
• Preference / functionality: remember choices you make (e.g. language settings). These require consent.
• Analytics / statistics: help us understand how visitors use the Site (e.g. page views, referral sources). These require consent.
• Marketing: used to deliver relevant content or measure the effectiveness of marketing. These require consent.

You may withdraw or change your cookie preferences at any time using the cookie settings tool on the Site, or by adjusting your browser settings. Withdrawing consent for non-essential cookies does not affect the lawfulness of any processing carried out before withdrawal.

Third-party services embedded in the Site — such as social media plugins, map widgets or video players — may set their own cookies. These are governed by those third parties’ own privacy policies.

6. International Transfers of Personal Data

Plymouth College’s hosting operations are based in the United Kingdom. Where we or our service providers transfer personal data outside the UK, we ensure that appropriate safeguards are in place as required by UK GDPR Chapter V. The mechanisms we rely on include:

• Transfers to countries or territories recognised as adequate by the UK Secretary of State (including EEA countries under UK adequacy regulations);
• International Data Transfer Agreements (IDTAs) — the UK-specific contractual mechanism — or the UK Addendum to EU Standard Contractual Clauses; or
• The UK-US Data Bridge for transfers to participating US organisations.

Some of our social media channels and analytics providers are operated by US-based companies. Where those providers participate in the UK-US Data Bridge or have signed IDTAs with us, transfers to the USA are made in compliance with UK GDPR. You can obtain a copy of the relevant transfer safeguards by contacting our Data Protection Officer (see Section 11).

7. Retention of Your Personal Data

We will retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. In determining appropriate retention periods we consider:

• Whether the purpose for which the data was collected has been fulfilled;
• Any legal, regulatory or contractual obligations requiring retention;
• Our legitimate interest in retaining contact information for a reasonable period following an enquiry (typically up to three years for admissions enquiries that do not proceed to an application); and
• The sensitivity and volume of the data held.

Our full Records Retention Schedule is available from the Data Protection Officer on request. When personal data is no longer required it is securely deleted or anonymised.

8. Your Rights

Under UK GDPR you have the following rights in relation to your personal data. To exercise any of these rights, please contact our Data Protection Officer using the details in Section 11. We will respond within one month of receipt of your request. For complex or multiple requests, we may extend this by a further two months; where we do so, we will notify you within the first month and explain the reason for the extension.

Right of access (Article 15): You may request a copy of the personal data we hold about you, together with information about how we process it, free of charge in most cases.

Right to rectification (Article 16): You may request correction of personal data that is inaccurate, out of date or incomplete.

Right to erasure (Article 17): You may request that we delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other lawful basis applies.

Right to restriction of processing (Article 18): You may request that we restrict our processing of your personal data in certain circumstances — for example, while the accuracy of the data is contested.

Right to data portability (Article 20): Where processing is based on your consent or on a contract, and is carried out by automated means, you may request your personal data in a structured, commonly used and machine-readable format, and ask us to transmit it to another controller where technically feasible.

Right to object (Article 21): Where we rely on legitimate interests as the lawful basis, you may object to processing for reasons connected to your particular situation. We must stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. You have an unconditional right to object to processing for direct marketing purposes at any time.

Rights related to automated decision-making (Article 22): You have the right not to be subject to a decision made solely by automated processing, including profiling, which produces legal or similarly significant effects. We do not currently carry out such processing.

Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Right to lodge a complaint (Article 77): You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you consider that our processing infringes UK GDPR. See Section 11 for ICO contact details.

Marketing Communications

You have an unconditional right to stop receiving direct marketing from us at any time. You may unsubscribe from marketing emails by clicking the “unsubscribe” link in any marketing email, or by contacting us directly. Opting out of marketing communications will not prevent us from sending essential service-related messages (such as event confirmations or security notices).

9. Links to Other Websites

The Site may contain links to third-party websites or services not owned or controlled by Plymouth College. This Privacy Notice applies only to personal data collected through this Site. We have no control over, and accept no responsibility for, the privacy practices or content of third-party websites. We encourage you to read the privacy policy of any third-party site you visit.

10. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our information practices, legal requirements or the services we offer. We will post the updated Notice on the Site with a revised “Last Updated” date. Where changes are material, we will take reasonable steps to bring them to your attention. Continued use of the Site after an updated Notice has been posted constitutes your acknowledgement of the changes. If you do not agree with the updated Notice, please discontinue use of the Site.

11. Contact Us

If you have any questions about this Privacy Notice, or wish to exercise any of your rights, please contact our Data Protection Officer:

What to do if you are not satisfied

In the first instance, please raise any concern directly with us so that we can try to resolve it. If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Last Updated: August 2026  |  Version 1.1