Privacy Policy

We collect personal data from you in various contexts, including when you:

• Enquire about our courses or programmes
• Apply for admission
• Enroll as a student
• Participate in teaching, learning and assessment
• Use our online platforms or attend classes
• Engage with our library services
• Participate in work placements or internships
• Receive welfare or student support services
• Use our facilities or visit our premises
• Apply for employment or work with us
• Receive our marketing communications

Categories of Personal Data We Collect:

• Identity and Contact Data: name, address, email, phone, date of birth
• Education Data: enrolment, attendance, grades, transcripts, qualifications
• Employment Data: CV, references, employment records, PPSN
• Financial Data: invoice and payment records, fee status
• Health and Welfare Data: medical certificates, welfare information
• Assessment Data: exam scripts, coursework, marks and feedback
• Website Data: IP address, device information, cookies

We collect only the personal data necessary for the purposes outlined below.

We process your personal data for the following purposes:

A. Education and Student Services

• Processing applications and managing enrolment
• Delivering course content and assessing progress
• Recording attendance and grades
• Managing work placements and internships
• Providing student support and welfare services
• Ensuring academic quality and regulatory compliance

B. Finance and Administration

• Billing and processing student fees and payments
• Processing refunds and managing outstanding balances
• Maintaining student records and issuing certificates

C. Employment (for staff and job applicants)

• Processing job applications, interviews and Garda vetting where required
• Maintaining employment records and processing payroll
• Managing health and safety and occupational health matters
• Recording training and performance appraisals

D. Marketing and Communications

• Promoting programmes to prospective students
• Engaging with alumni through newsletters and events
• Improving our website and digital services

E. Security, Compliance and Legal Obligations

• Campus security (CCTV monitoring)
• Complying with Irish and EU legal obligations
• Responding to data protection requests and managing complaints
• Safeguarding students and staff

Under GDPR, we must have a lawful basis for processing personal data. We process your data under the following legal bases:

• Contract: to fulfil our agreement with you as a student or employee
• Legal Obligation: to comply with Irish and EU law (tax, education regulation, health and safety, safeguarding)
• Legitimate Interests: for college operations (marketing, campus security, service improvement)
• Consent: for optional services (marketing emails, photo/video use) which you can withdraw at any time
• Vital Interests: to protect safety in emergency situations

For special category data (health, disability information), we process under Article 9 GDPR for purposes such as providing reasonable adjustments, occupational health management and safeguarding.

Your personal data may be shared with:

• College Staff: on a need-to-know basis for their role
• Service Providers: Microsoft 365, Learning Management Systems, Salesforce, payroll systems, email platforms, CCTV providers
• Funding Bodies and Regulators: QQI, and other funding bodies (for compliance)
• Government Bodies: Revenue, Department of Social Protection, Health and Safety Authority
• Placement Employers: name and contact details for work placement coordination
• Legal and Insurance Advisers: where required for incident investigation or legal matters
• Other Educational Institutions: for limited purposes (transfers of credits, collaboration)

All service providers are required to maintain confidentiality and security through Data Processing Agreements.

We do not sell your personal data to commercial third parties.

Most personal data is processed and stored in Ireland and the EU. Some service providers may store data outside the EEA.

Where data is transferred outside the EEA, we implement appropriate safeguards including Standard Contractual Clauses and Transfer Impact Assessments to ensure equivalent protection.

We retain personal data only for as long as necessary. Standard retention periods are:

• Student Academic Records: indefinitely (core awards); supporting documents 7 years
• Exam Scripts and Coursework: 1 year after completion
• Employment Records: 6–7 years after employment ends
• Payroll Records: 6 years (for tax compliance)
• Marketing Data: 1–3 years from last contact
• CCTV Footage: 28 days (general); incident footage 6–12 months
• Website Analytics: 12–26 months

After the retention period expires, personal data is deleted or anonymised unless we are required by law to retain it longer.

Under GDPR, you have the following rights in relation to your personal data:

A. Right of Access (Article 15)

You have the right to request a copy of the personal data we hold about you.

How to exercise this right:

• Email: [email protected]
• Provide: your name and student/staff ID
• Response: within 1 month (free of charge)
• Format: available as Excel, PDF or other portable format

Exceptions: We may refuse if disclosure would prejudice someone else’s rights, privacy or investigation of criminal conduct.

B. Right to Rectification (Article 16)

You have the right to correct or update personal data that is inaccurate or incomplete.

How to exercise this right:

• Specify the information that needs correcting
• We will update your records promptly

C. Right to Erasure (‘Right to be Forgotten’) (Article 17)

You have the right to request deletion of personal data in certain circumstances.

You can request erasure when:

• The data is no longer necessary for the original purpose
• You withdraw consent that was the basis for processing
• You object to processing with no legal reason to retain the data
• The data was collected unlawfully

You cannot request erasure when:

• The data is needed to fulfil the education contract (e.g. exam results, certificates)
• We are required by law to keep the data (e.g. tax or payroll records for 6 years)
• The data is needed for legal claims or safeguarding purposes

D. Right to Restrict Processing (Article 18)

You have the right to restrict how we use your personal data in certain circumstances.

You can request restriction when:

• You believe the data is inaccurate
• The processing is unlawful but you don’t want it deleted
• We no longer need the data but you need it kept for legal claims
• You have objected to processing while we consider your objection

Effect: We will store the data but restrict its active use.

E. Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, machine-readable format (such as CSV or Excel) and transfer it to another organisation.

This right applies to:

• Data you provided to us directly
• Data processed based on your consent or contract
• Does not apply to inferred data (e.g. grades calculated from assessments)

F. Right to Object (Article 21)

You have the right to object to certain types of processing.

Marketing communications:

• Click “unsubscribe” in any marketing email, or
• We will stop marketing within 1 month

Legitimate interests processing:

• You can object to processing based on our legitimate interests (analytics, alumni engagement)
• We will stop unless we have compelling legal reasons to continue

Automated decision-making: You can object to automated decisions that significantly affect you (CCD do not involve such profiling)

G. Rights Relating to Automated Decision-Making and Profiling (Article 22)

You have the right not to be subject to decisions based solely on automated processing that produce legal or significant effects.

Our use of automation:

• We do not use fully automated decision-making for admission, assessment or disciplinary outcomes
• We use automation for administrative functions (e.g. scheduling, attendance flagging)
• Humans review any automated recommendations before final decisions
• You have the right to explanation and human review of any significant automated decision

H. Right to Lodge a Complaint with the Data Protection Commission (Article 77)

You have the right to lodge a complaint with the Irish Data Protection Commission.

Data Protection Commission (DPC)

• Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
• Phone: +353 (0)761 104 800
• Email: [email protected]
• Website: www.dataprotection.ie

You can lodge a complaint at any time. You do not need to contact us first, but we encourage you to try to resolve issues directly.

How to Exercise Your Rights

Contact: [email protected]

Provide: your name, student/staff ID, and specify which right you wish to exercise

Timeframe: we aim to respond within 1 month (up to 3 months for complex requests)

Fees: free in most circumstances; we may charge for manifestly unfounded or repetitive requests

Subject Access Request (SAR) Form 

Download the form here

Cookies

Our website uses cookies and tracking technologies for:

• Strictly Necessary: website security and core functions
• Preferences: language and accessibility settings
• Analytics: understanding website usage
• Marketing: targeted advertising and campaigns

You can control non-essential cookies via our cookie banner or Preference Centre.

Website Analytics

We use Google Analytics to understand how visitors use our website. Analytics data is pseudonymised and collected at country level only, not precise location.

External Links

Our website may contain links to external websites. We are not responsible for their privacy practices.

We implement appropriate technical and organisational security measures to protect your personal data, including:

• Encryption in transit (HTTPS/TLS) and at rest
• Access controls (passwords and multi-factor authentication for sensitive systems)
• Regular security testing and vulnerability assessments
• Staff data protection training
• Documented incident response procedures
• Strict vendor security requirements
• Physical security for paper records and servers

While we implement strong protections, no system is 100% secure. We are not responsible for unauthorised access due to factors beyond our reasonable control.

If we discover that your personal data has been compromised, we will:

• Investigate the breach
• Notify you by email or phone if it poses a high risk to your privacy
• Notify the Data Protection Commission where required

We may update this Privacy Notice to reflect changes in our data processing practices or legal requirements.

We will notify you of material changes by posting the updated notice on our website and by email notification where changes significantly affect you. Your continued use of our services constitutes acceptance of the updated notice.