Privacy Policy

Policy Statement London Professional College (hereinafter referred to as "LPC") acknowledges its statutory responsibilities and the importance of data protection and privacy in the digital age. As an institution dedicated to providing education and training, the College recognises its responsibility to safeguard the personal data of students, staff, and any individuals associated with its operations.

This policy outlines how LPC collects, uses, protects, and disposes of personal data to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Applies to all staff, contractors, and third parties handling personal data on behalf of LPC, including data related to students, staff, suppliers, partners and any other individuals whose data is dealt with during the College's activities.

LPC is committed to processing all personal data in a lawful, fair, and transparent manner. Data is collected only for specified, explicit, and legitimate purposes and is not further processed in a way that is incompatible with those purposes. The College ensures that only adequate, relevant, and limited data is collected, no more than is necessary for the intended purpose. All personal data is maintained accurately and, where necessary, updated promptly. It is retained only for as long as required and is stored securely to safeguard against unauthorised or unlawful processing, accidental loss, destruction, or damage. Finally, LPC acknowledges its responsibility to demonstrate compliance with these principles and maintains appropriate documentation and accountability mechanisms accordingly.

LPC ensures that all personal data is processed only when there is a clear and valid legal basis under the UK GDPR. Depending on the nature of the data and the context in which it is collected, the lawful basis may include obtaining the individual’s consent, fulfilling contractual obligations, complying with a legal duty, protecting someone’s vital interests, carrying out tasks in the public interest, or pursuing legitimate interests, provided these are not overridden by the rights and freedoms of the data subjects. The specific lawful basis for each processing activity is documented, and individuals are informed accordingly, particularly where consent is relied upon, ensuring that such consent is freely given.

Data Protection Lead (DPL): Appointed senior staff member responsible for overseeing data protection compliance and responding to data subject requests. At LPC, Arafat Hossain is the DPL.

All staff: Members of staff who handle personal data must handle it responsibly and adhere to this policy

LPC collects and processes personal data that is necessary to support its educational and administrative functions. This includes information provided during the admissions process, such as contact details, educational history, and proof of identity; academic records, including assessments, attendance, and progression data; employmentrelated data for staff, such as payroll, qualifications, and performance information; and communications or IT-related data that may arise from the use of college systems. The College ensures that all data collected is relevant, appropriate, and limited to what is necessary for the purposes for which it is processed.

LPC recognises and upholds the rights of individuals under the UK GDPR in relation to their personal data. These rights include the right to be informed about how their data is used, the right to access the data held about them, and the right to have inaccurate or incomplete data rectified. Individuals also have the right to request the erasure of their data when it is no longer necessary, to restrict or object to processing under certain circumstances, and to receive their data in a portable format where applicable. LPC ensures that all such requests are handled promptly and transparently, with appropriate verification measures in place to confirm identity. All requests should be directed to the Data Protection Lead, and responses will be provided within one calendar month, in line with legal requirements.

LPC is committed to ensuring the security of all personal data in its possession and takes appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse, or destruction. Personal data is stored using secure systems that include encrypted servers, restricted access controls, and secure backup solutions. Access to data is limited strictly to authorised personnel who require it for legitimate operational purposes, and these permissions are reviewed regularly. Staff receive training on best practices for secure data handling, and LPC conducts routine assessments to evaluate and enhance its data protection protocols. These measures help ensure that the confidentiality, integrity, and availability of data are consistently maintained across the organisation.

Data will be retained only as long as necessary. LPC follows a retention timeframe based on legal, regulatory, and operational needs. Data no longer required will be securely deleted or destroyed.

LPC only shares data with trusted partners when necessary, under data sharing agreements or contracts that include GDPR clauses and carries out due diligence before engaging with third parties. LPC does not sell personal data.

All suspected data breaches must be reported to the DPL immediately. Serious breaches will be investigated promptly, notify affected individuals if needed and reported to the ICO within 72 hours, where applicable.

All staff must complete basic data protection training annually. Additional support is provided as needed.

This policy is reviewed annually by the DPL / SMT or when significant changes in legislation or operations occur.

For concerns or to exercise your data rights, contact LPC’s Data Protection Lead at arafat.h@londonpc.org.uk

DPL: Arafat Hossain

Location: London Professional College First Floor, Moorfoot House 221 Meridian Pl, Marsh Wall London E14 9FJ

Phone: +44 (0) 20 4629 0122
Email: info@londonpc.org.uk
Web: lpc.ac.uk