Confetti Media Group – Privacy notice for Confetti ICT website users

Confetti Media Group is committed to protecting the privacy and security of your personal information. This Privacy Notice provides important information about how Confetti Media Group (CMG) and its associated entities (“CMG”, “Confetti”, “we”, or “us”), which includes Confetti Constellations Ltd; Nova Centric Ltd; Notts TV Ltd; Confetti Institute of Creative Technologies (“CICT”); Constellations; Antenna; Spool; Denizen; and Nottingham Trent University (“NTU”), identifies and manages its Data Protection responsibilities in accordance with its legal and regulatory obligations. CMG is a wholly owned subsidiary of NTU, and as parent company, NTU’s Privacy Notice has been adopted, with additions to reflect local business practice.

Confetti encourages you to review the privacy statements of any websites you choose to navigate to from our website (or navigate from to our website) or digital services that we provide links to, so that you can understand how those websites collect, use and share your information as well. Any third party sites that you can access through the website are not covered by this Privacy Notice and we accept no responsibility or liability for these sites.

Who we are

Confetti is a “data controller” which means we are responsible for deciding how we hold and use personal information about you.
This Privacy Notice applies to all Confetti students (“you” or “your”) or services that link to it (collectively, our “Services”). Occasionally, a Service will link to a different Privacy Statement that will outline the particular privacy practices of that Service (e.g. Access Creative, for further education students; Nottingham Trent University Students, for higher education students; website and cookies).

Please read this Privacy Notice carefully and contact our Data Protection Officer if you have any questions about our privacy practices or your personal information choices.

Attn: Data Protection Officer
Confetti Media Group
6-10 Convent Street
Nottingham, NG1 3LL
Email: DPO@confettimediagroup.com

We may need to update this Privacy Notice from time to time. If changes made to this Privacy Notice are considered to be material, we will notify you of the changes.

Personal information

Confetti is committed to the responsible handling and protection of personal information. Personal Data, or personal information, means any information about an individual from which that person (a “Data Subject”) can be identified. It does not include data where the identity has been removed (anonymous data). The information will be Personal Data if a person can be identified either directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. For example personal data may include names, addresses, email addresses and telephone numbers; it may also include images in photographs or films and recorded telephone conversations.

Why we process your data
We collect, use, disclose, transfer, and store personal information to provide Services to you and for our operational and business purposes as described in this Privacy Notice. We want to be clear about our privacy practices so that you are fully informed and can make choices about the use of your information, and we encourage you to contact us at any time with questions or concerns. DPO@confettimediagroup.com

The types of personal information we collect

We collect personal information from you, for example, if you register for an event, request course information, study or use any of our Services. The categories of personal information that we may collect, store and use about you include (but are not limited to)

• Name, address, telephone number, email;
• Your country of birth, nationality and date of entry to the UK;
• Date of birth and gender;
• Passport details, national insurance number;
• Any disability/access requirements or medical issues;
• Any information you provide to access specialist support / services at Confetti;
• Your course details, attendance records and academic records;
• School records and qualifications;
• Communications relating to decision we make;
• Bank details and/or payment card details;
• Visual images / photographs (including CCTV);
• Computing and email information including login details, network access and library usage;
• For International students, we will collect additional information on visa details and date of entry to the UK and or government-issued identification number.

In some circumstances, we may, during the course of your application to study with us, also collect, store and use the following the “special categories” of more sensitive personal information which may include (but are not limited to) racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual orientation, biometric or genetic data, and Personal Data relating to criminal offences and convictions we have asked you to declare.

We may process special category personal information in the following circumstances:

• In limited circumstances, with your explicit written consent;
• Where we need to carry out our legal obligations or comply with relevant legislation;
• Where it is needed in the public interest, such as for equal opportunities monitoring and reporting or to carry out Criminal Record background checks;
• Where it is needed to assess your capacity to study on health grounds, to enable us to offer you the support, for example through Student Support Services such as access requirements if you have a disability or other medical condition, subject to appropriate confidentiality safeguards;
• Where it is needed to investigate student behaviour (under our code of conduct);
• To help you arrange finance (e.g. sponsorship, grants or loans);
• To manage our relationship with awarding bodies (e.g. exam concessions)
• Where the processing is necessary for archiving purposes in the public interest, or for scientific or historical research purposes, or statistical purposes, subject to further safeguards for your fundamental rights and interests specified in law.

How we collect your data

Not all of the personal information Confetti holds about you will always come directly from you. Apart from the data that you provide to us, we may also process data about you from a range of sources, which include (but are not limited to):

• Data that we and our staff generate about you, such as during tutorials, lectures, recruitment fairs, open days, seminars, workshops and information in connection with your attendance and progress at Confetti;
• Your school, previous establishments, or employers, if they have supplied references to us;
• Through interactions you have with individual Services at Confetti.
• Fellow students, family members, friends, visitors to Confetti and other contacts who may provide us with information about you when they contact us, or vice versa;
• Through third parties such as Access Creative, NTU, UCAS and the Student Loans Company, or from Sponsors;
• Through our Digital Services: which are the Confetti website at www.confetti.ac.uk and any other Confetti authorised internet services, websites, products, social media, mobile phone apps and/or software applications that enable you to use, access, view, listen to and/or download Confetti content or to interact with us online (or through any other digital means) on any device. We collect information that you provide to us by filling out forms on the website or by corresponding with us through the Digital Services. It includes information that you provide when you participate in
  discussion boards or other social media functions within the Digital Services, enter a competition, promotion or survey, and when you report a problem with the Digital Services;
• Email or telephone correspondence you have with Confetti or instant messaging.

If you pay or contribute to Services from Confetti, we will collect payment information, such as financial or bank card information, and other information necessary for us to process the transaction.

Our servers, logs, and other technologies automatically collect certain information to help us administer, protect, and improve our Services; analyse usage; and improve users’ experience.

We receive and store certain types of information whenever you interact with us. This includes the use of “cookies”. Please refer to our website policy for further information regarding our use of cookies. We may also automatically record visits to our website for the purposes of improving our services. These recordings may record mouse clicks, mouse movements, page scrolling and any text keyed into website forms. Information collected by cookies or session recordings is stored and is used for aggregated and statistical reporting.

Confetti uses CCTV around campus, and will collect and store information. For full details of our CCTV use, please refer to our CCTV Policy.

How we use data about you

We use your personal information for the following purposes:

• For the administration of your studies, including administration of examinations, the issue of results and certificates, recording of academic and other relevant achievements, and (where applicable) the provision of information to your employer or other sponsor/corporate sponsor about your attendance and performance on a course. We retain a permanent record of all awards at Confetti;
• To provide you with information on products or services that you may request from us, or which we feel may be of interest to you. This will include disclosing personal data to the Students’ Union, employability services, accommodation providers, student health providers and other third parties, such as appointed service providers, from time to time;
• To enable all financial transactions to and from us, including payments, grants and benefits;
• The administration of your student ID card;
• The administration of pastoral and support / welfare advice and guidance;
• The administration of bursaries, scholarship and hardship funds;
• The administration of advice in relation to Student Finance;
• To collect payment for study, accommodation and additional fees and for the collection of debt;
• To carry out our contractual obligations with you which will include the operation and delivery of any services you have requested, deal with requests and enquiries;
• Where it is necessary to comply with a legal obligation;
• The recording of lectures and presentations for later access as part of our learning resource;
• To provide management statistics through research using student data which may be used by us to enhance the student experience;
• For security, safety and disciplinary purposes (through the use of CCTV and information to support our student code of behaviour);
• To ensure that content from our website or Services is presented in the most effective manner for you and for your computer or device by gathering aggregate information about our users, using it to analyse the effectiveness and efficiency of communications;
• Where you have agreed for the purpose of consulting, informing and gauging your opinion about our products and services, for example; surveys or alumni activities
• To ensure we meet our statutory obligations, including those related to diversity and equal opportunity;
• Photographs of classroom situations or general activity in common areas of Confetti as part of general marketing materials, for example in our annual report, prospectus or course materials. Personal data alongside photographs will only be used with explicit consent;
• To ensure compliance with the Prevent Duty under the Counter Terrorism & Security Act 2015;
• If you access/use facilities provided by Student Support Services, the Library and NTU Sport (Higher Education only);
• To notify you about changes to our Services;
• Following graduation to provide you with information about our Alumni services.

Marketing Purposes

• Progressive profiling – we may use your personal information to better personalise communications to you;
• Analysing web behaviour – we may use your personal information to recognise web visitors on and off our Digital Services to improve experiences, analyse marketing activities, understand audiences, and personalise content for our Digital Services, applications and advertising;
• Targeting advertising – using data collected automatically on and off our Digital Services to target and tailor advertising and analyse marketing activities (e.g. retargeting users from a Confetti website, or using anonymous data segments created by trusted partners who may collect your data);
• Internal data matching – to enable us to merge certain types of data collected by Confetti to identify known and unknown users and map interactions with Confetti’s Digital Services to CRM (Customer Relationship Management) platforms and applications, for purposes of personalising content, understanding audiences, analysing marketing performance and targeting advertising; and
• External data matching – to match customer lists with online platforms (e.g. through applications such as Facebook Custom Audiences and Google Customer Match) to target and tailor advertising, understand audiences and analyse marketing activities.

Who we share your data with

Confetti shares or discloses personal information when necessary to provide Services or conduct our business operations. When we share personal information, we do so in accordance with data privacy and security requirements. We may occasionally share non-personal, anonymised or pseudonymised, and statistical data with third parties.

Confetti is required to collect and process certain information about you to certain external agencies, through it’s Lead Provider and parent company. These bodies include, but are not limited to: Education and Skills Funding Agency (ESFA), the Higher Education Statistics Agency (HESA), Student Loan Company (SLC), The United Kingdom Visas and Immigration Authority (UKVI), grant awarding bodies, course relevant professional standards and registration bodies or awarding bodies, government agencies, police and the emergency services for legitimate purposes. Confetti may also be asked by the Office for Students (OFS) or HESA to provide student data collected by us to other bodies acting on their behalf such as National Student Surveys, Higher Education Achievement Record (HEAR), and Graduate Outcome Survey. We will also share certain data with our associated entities of Confetti.

We may share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legal requirement or legitimate interest in doing so. Third parties will only process your personal data on our instructions and where they have agreed to treat that information confidentially and to keep it secure.

Below are the parties with whom we may share personal information and why;

• Within Confetti: Associated entities or services around the world are provided data by a variety of teams and functions, and personal information will be made available to them if necessary for the provision of Services, account administration, marketing, student support and technical support, for instance.
• Our business partners: We occasionally partner with other organisations to deliver co-branded courses, provide content, or to host events, conferences, and seminars. As part of these arrangements, you may be a student of both Confetti and our partners, and we and our partners may collect and share information about you. Confetti will handle personal information in accordance with this Privacy Notice, and we encourage you to review the privacy statements of our partners to learn more about how they collect, use, and share personal information.
• Our third-party service providers: We partner with and are supported by service providers both in the UK around the world. Personal information will be made available to these parties only when necessary to fulfill the services they provide to us, such as registering, required pre-course information, direct marketing services; advertising; data analytics, eJournals/eBooks, and delivery. Our third-party service providers are not permitted to share or use personal information we make available to them for any other purpose than to provide services to us.
• Cloud – service providers: We use third party cloud service providers based outside the UK to store personal data. Where we transfer personal data to cloud service providers based in a country which does not have adequate privacy protection, we will put in place a contract with the third party that includes the standard international data transfer contractual terms approved by the ICO. Where we use providers based in the US, we may transfer data to them if they are a part of UK-US data Bridge.
• Placement providers.
• Debt collection agencies and payment service providers.
• We may be required to use and retain personal information for legal and compliance reasons, such as the prevention, detection, or investigation of a crime; loss prevention; fraud or safeguarding.
• If you use the Legal Advice Centre Services and facilities;
• Where you join sports clubs we may share with external coaching providers;
• External scholarship/funding providers;
• We may also use personal information to meet our internal and external audit or governmental requirements, information security purposes, and as we otherwise believe to be necessary or appropriate.
  (a) Under applicable law, which may include laws outside your country of residence;
  (b) To respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include such authorities outside your country of residence;
  (c) To enforce our terms and conditions; and
  (d) To protect our rights, privacy, safety, or property, or those of other persons.

If you register as a user of e-registration Services in order to apply for Higher Education, your personal information, including any sensitive personal information you provide, will be made available to the organisation to which you have applied. In order to consider an application fully, your personal information may be forwarded on to respective institutions.

We are also required to provide, under Section 72 of the Education and Skills Act 2008 relevant student information to contracted local authorities.

We may share information with third parties for marketing and advertising purposes. This may include such activities as activating Google Analytics Advertising Features, creating customer audiences via Facebook, Twitter, Snapchat and Google. We have implemented the following Google Analytics Features: Create Remarketing Audiences (based on specific behaviour, demographic, and interest data and we will share those lists with AdWords and use demographic and interest data in your Google Analytics reports) and Create Segments based on demographic and interest data. Please refer to NTU’s Cookies Policy for further details regarding our use of cookies. You can opt-out of the Google Analytics Advertising Features that we use including through Ad Settings (including Ad Setting for mobile apps) and any other available means (for example, the Network Advertising Initiatives consumer opt-out available at http://optout.networkadvertising.org/#!/). For further information please refer to https://tools.google.com/dlpage/gaoptout/.

How long we keep your data for

We will not store your personal information for longer than is necessary. Confetti will ensure that our trusted partners and selected third parties with whom we share your personal information in accordance with this Privacy Notice will delete your personal information when they no longer require it.

In determining data retention periods, Confetti takes into consideration local laws, contractual obligations, and the expectations and requirements of our data subjects. When we no longer need personal information, we securely delete or destroy it.

How we secure your data

We have in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business requirement to know.

Confetti takes data security seriously, and we use appropriate technologies and procedures to protect personal information.
For example:

• Policies and procedures – measures are in place to protect against accidental loss and unauthorised access, use, destruction, or disclosure of data.
• Business Continuity and Disaster Recovery strategies that are designed to safeguard the continuity of our service to our clients and to protect our people and assets.
• Appropriate restrictions on access to personal information.
• Monitoring and physical measures, to store and transfer data securely.
• Data Privacy Impact Assessments (DPIA) in accordance with legal requirements and our business policies.
• Periodic training on privacy, information security, and other related subjects for employees and contractors.
• Vendor risk management.
• Contracts and security reviews on third-party vendors and providers of services.

How we keep your data secure in other countries

Your personal information may be transferred by us or our trusted partners outside of the European Economic Area (the “EEA”). The trusted partners that may do this are organisations who process data for analysis or marketing purposes, including a marketing automation hub where the email address of recipients will be logged and a record of email delivery, opening, click-through and bounce-backs will be kept. Our partner uses Microsoft’s Windows Azure data centres located in East US (Virginia), West Europe (Netherlands), and Australia East (New South Wales).

Confetti and NTU, has networks, databases, servers, systems, and support located throughout the world. NTU collaborates with third parties such as cloud hosting services, suppliers, and technology support located around the world to serve the needs of the NTU, workforce, and students. Your personal information may be shared with record matching and customer targeting partners, including Google, Facebook, Snapchat and LinkedIn. Some of these partners process personal data in Canada and the United States of America.

Confetti and NTU takes appropriate steps to ensure that personal information is processed, secured, and transferred according to applicable law. In some cases, we may need to disclose or transfer your personal information within NTU or to third parties in areas outside of your home country.

Confetti and NTU shall ensure that your personal information transferred to countries outside of the EEA is adequately protection by transferring the personal information on terms of the standard data protection clauses adopted by the European Commission.

This means, your rights and protection remain with your data, i.e.: we use approved contractual clauses, multiparty data transfer agreements, intragroup agreements, and other measures designed to ensure that the recipients of your personal information protect it. If you would like to know more about NTU’s data transfer practices, please contact NTU’s Data Protection Officer.

Your rights

We respect your right to access and control your information, and we will respond to requests for information and, where applicable, will correct, amend, or delete your personal information.

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of personal information that we hold about you. This enables you to ask us to correct any incomplete or inaccurate information we hold about you.
• Request erasure of your personal information in limited circumstances. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are processing your personal information on the basis of our legitimate interest (or that of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction or suspension of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Object to any direct marketing (for example, email marketing or phone calls) by us, and to require us to stop such marketing.
• Object to any automated decision-making about you which produces legal effects or otherwise significantly affects you.
• Request the transfer of your personal information to another party.

How to contact us

If you are concerned about an aspect of your learning experience, you can use the complaints procedure for students to bring your concerns to the attention of relevant staff. The procedure enables investigation of the concerns with the aim of satisfactory resolution, and is available to students who are enrolled on Confetti courses. Students who are studying at franchised centres should follow the centre’s procedures in the first place.

Please contact us with any requests related to your personal information, or with any questions or queries you may have about this statement.

Our DPO contact is:
DPO@confettimediagroup.com.

If you are not satisfied with how Confetti manages your personal data, you have the right to make a complaint to a data protection regulator.

The ICO contact details are: https://ico.org.uk/global/contact-us/