We may receive your personal data when  you: participate in, access or sign up to any of our services, activities or online content – such as newsletters, competitions, live chats and webinars –  phone or email us, vote, pay money to CSA, reserve a place at an event, apply  for one of our programmes or create an account on our website. We will collect some or all of the following:

• your name, and contact information such as address, email address and telephone number, as well as your date of birth, country of domicile and your nationality
• your passport or national identity card details and where relevant your visa or biometric residence permit and immigration history (where applicable).
• information relating to your education and employment history, the school(s), sixth form college(s) and other colleges or universities you have attended and places  where you have worked, the courses you have completed, dates of study and examination results.
• records relating  to assessments of your work, details of examinations taken, your predicted and  actual examination grades and other information in your student record;
• details of your engagement with your course and the services we offer.
• your national insurance number (or other tax identification number) and bank details if you want to work for us during your studies
• data about how you use CSA mobile apps, websites or other CSA related online content, and the device(s) you use to access these services. This includes collecting unique online identifiers such as IP addresses, which are numbers  that can uniquely identify a specific computer or other network device on the  web. For more information, please see see the section on cookies within this policy.

Anyone taking part in CSA  activities that they may be photographed, filmed, videoed or otherwise captured in image form. Where possible and practical to do so, we will seeks written agreement  to image capture. Where this is not possible for practical reasons, unless express objections are received, individuals attending an event at CSA are deemed to have given their agreement by attending or remaining at the event. Any queries should be raised with the event host in the first instance.

Use of Sensitive Personal Data

This is defined by the General Data Protection  Regulation (GDPR) as data relating to racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life and sexual orientation and criminal convictions and offences.

We may process special categories of personal data  in the following circumstances where:

• we need to carry out our legal obligations or exercise rights in connection with your education.
• it is needed in the public interest
• it is needed in relation to legal claims.
• it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your agreement.
• we need to ensure meaningful equal opportunity monitoring and reporting
• we need to undertake data analysis to improves the services we provide, where possible your data will be anonymised.
• you have already made the data public.
• where you have given your explicit written consent.

Processing will be carried out in accordance our policy on processing special categories of personal data and the additional safeguards in place for such processing.

Updating and correcting your personal data

We aim to keep your data current and it is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. You can do this via Student Portal or email us at studentservices@caspianschool.ac.uk.

We may contact you by post, telephone or fax as well as by email, SMS and MMS. If you change your mind about being contacted in the future by any of these means you will be  given the option to change your preferences.

• From you when you make an application or enroll as a student, or from open day activities; and
• From third party organisations (this can include UCAS, Student Loans Company, Government Departments such as the Home Office or Department of Education, other institutions involved in the delivery of joint programmes). In using third party sources we will check to ensure they have a legal basis for providing us with your personal data.
• From you when you disclose your personal data, as a student, during the course of your relationship with us when accessing or using any of our services such as financial support, careers advice or counselling services.
• When you use CSA mobile apps, websites or other school-related online content, and the device(s) you use to access these services. For more information, please see see the section on cookies within this privacy notice.
• We may also obtain data from you if you use our QR (Quick Response) codes, attend open day activities, register as a student or apply for one of our courses.

The information we obtain from you is used to enter into a contract of education with you or to perform CSA’s obligations under your contract of education, to comply with a legal obligation imposed on CSA or where it is necessary for CSA’s legitimate interests or those of a third party, provided your interests and fundamental rights do not override them. For example:

• To perform all tasks associated with your admission and delivery of your education including, but not limited to, applications, student support services, residential services, library usage, attendance monitoring, sports facilities, and alumni services;
• To enable us to supply you with the services and information which you have requested;
• To ensure that content is presented in the most effective manner for you and for your computer;
• To analyse the data we collect so that we can administer, support and improve our services;
• To provide you with information, products or services that you request from us or which we feel may interest you, where you have agreed to be contacted for such purposes.
• To notify you about changes to our service.

We set out in the legal basis section of this policy all the purposes for which we may process your personal data, identifying the legal basis and those external parties to whom we may disclose that personal data.

Our use of your personal contact details

The School prefers to contact students through the email account we provide to you. However, there may be circumstances in which it is appropriate for us to contact you using the personal contact details we hold for you. This may include a personal email address, mobile number etc. Typically we would try and utilise your CSA email address in the first instance and if this proves unsuccessful we would look for alternatives. These circumstances are instances where the legitimate purpose for contacting you by these means would mean your consent would not be required, and may include (but not be limited to):

• Making you aware of information relevant to your studies in the post-registration period where the school is still setting-up IT accounts for new starters and therefore we can’t expect to reach all new students through their CSA email addresses.
• Where there is outstanding debt owed to the School by you.
• Where the School has been made aware of a cause for concern relating to your wellbeing and we need to establish whether you need support.
• Where there is urgent and important information we need to make you aware of to keep you safe; for example COVID-19, other public health measures, concerns about threats of harm against buildings (which affect users), groups or individuals, weather events or major incidents affecting safe travel etc.

For initiatives that are discretionary (i.e. it is entirely up to you whether or not you participate and they having no bearing on the duties we have as a School) we would typically ask for your consent to use your personal contact details for those purposes.

We may share your personal contact details if we are asked to do so for law enforcement enquiries, where the law permits us to do so.

We may share your details, or those of your declared alternative contacts, with other support providers in emergency circumstances where we have not been able to obtain your consent or your condition may prevent you from providing it but in our judgement it is urgently necessary for your wellbeing.

Authorised personnel within Caspian School and its partners will be able to access the personal data you provide to us. We may also disclose your data to other third parties who act for us for the purposes set out in the policy or for purposes approved by you.

Please note that where you nominate a third party or an agent to discuss your application/course with us or to make decisions on your behalf and you provide contact details for that third party/agent, you are agreeing for us to disclose data relating to your application/course to that third party/agent.

Please note that some data that is held about you will be sent to the Higher Education Statistics Agency (HESA). For further information on how this data will be used please visit the HESA website.

All our third-party service providers are required to take appropriate security measures to protect your personal data in line with our policies. We only permit a third-party service to process your personal data for specified purposes and in accordance with our instructions. We do not allow them to use your personal data for their own purposes.

Please note that countries outside the European Economic Area do not always have the same strong data protection laws. However, we will always take steps to ensure that your data is used by third parties in accordance with the terms of this Privacy Policy.

Unless required or permitted to do so by law, we will not otherwise share or distribute any of the personal data you provide to us without your agreement. We respect your personal data and will never sell it to third parties.

Your personal data will be held confidentially for as long as necessary to fulfill the purposes for which it was it collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. We retain personal data collected from applicants, students and alumni. In general terms most student data it is retained for 6 years after your last engagement with us but some personal data may be kept for longer so that we can verify your award if you apply for a job, or apply for another course of study.

The law provides for the following rights:

• To be informed
• To access your data
• To rectify (change, update or correct) your data
• To erase (remove, delete or destroy) your data
• To restrict our use of your data
• To data portability
• To object
• To not be subject to automated decision-making and profiling

To complain to the Information Commissioner’s Office (ICO): the ICO is the UK supervisory authority for data protection issues. For more information please visit the ICO website.

CSA is committed to holding your data securely and uses information security best practice to transmit personal data. Data is held in accordance with the Corporate Information Security Policy . For example, your personal data is accessible only by those authorised and who have a business need for access. When shared with third parties, your personal data is shared with encryption or in password protected files.

Where we have given you (or where you have chosen) a password that enables you to access our systems, you are responsible for keeping this password confidential. You must not share passwords with anyone.

Although we maintain a number of safeguards, fraudulent email requests are occasionally delivered to staff and students. We will never ask for your username or password by email. Any message that does so should be treated as a potential breach of security, no matter how legitimate it may appear. If you are in any doubt, do nothing until you have spoken to a member of the Student Services Team.

CSA have put in place procedures to deal with any suspected data security incident and will notify you and any applicable regulator where we are required to do so. If you have any concerns that personal data has been compromised please contact

The law requires us to let you know if we or our suppliers process your personal data outside the EEA (The European Union Member States plus Norway, Iceland & Lichtenstein) and what we have in place to make sure your rights in UK Data Protection law remain in place. We do use suppliers such as software providers, IT support providers and online learning module delivery providers as well as ad hoc IT project suppliers who either host our data or access data for support purposes in countries outside the EEA. We will at all times have in place, in our Agreements with these suppliers, features which protect your data rights as required by GDPR. These include: The relevant country has an ‘Adequacy decision’ in place (meaning UK law recognises its Data Protection laws as equivalent to our own), or the contract contains ‘EU Standard Contractual Clauses’ which are an approved mechanism to legally require suppliers to comply with UK law. We are monitoring the potential impact of Brexit on these EU arrangements and will take appropriate action if the law requires. At present our data processing outside the EEA meets the demands of UK law.

To learn more about how we use these and your choices in relation to these tracking technologies, please refer to our Cookie Policy.

Our Service may contain links to other websites that are not operated by us. This Privacy Policy does not address the privacy policy and other practices of any third parties, including any third party operating any website or service that may be accessible via a link on the Service. We strongly advise you to review the privacy policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

If you have any queries or concerns about the processing of your information that is available with us, you may email our Grievance Officer at Caspian School of Academics Ltd., Olympic House, 28 – 42 Clements Road, Ilford, email: info@caspianschool.ac.uk. We will address your concerns in accordance with applicable law.

Last updated: 24th August 2023