Privacy Policy

London South East Colleges Website Privacy and Cookie Policy 

1. Introduction

London South East Colleges ("we", "us", or "our"'The College') is a trading name of Bromley College of Further and Higher Education, a Further Education College incorporated under the Further and Higher Education Act 1992, (the ‘College’).

The College is committed to protecting your privacy and handling your personal information responsibly and in accordance with UK data protection legislation, including the UK General Data Protection Regulation and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, submit an enquiry, register for an event, apply for a course, or interact with our online services.

  • 2. Who We Are

    Data Controller: London South East Colleges

    If you have any questions about this Privacy Policy or how we handle your personal information, please contact the Data Protection Officer This email address is being protected from spambots. You need JavaScript enabled to view it.

  • 3. Information We Collect

    We may collect the following information:

    Information you provide directly

    • Name
    • Email address
    • Telephone number
    • Postal address
    • Date of birth
    • Course interests
    • Event registrations
    • Enquiry details
    • Marketing preferences

    Information collected automatically

    When you visit our website, we may collect:

    • IP address
    • Browser type and version
    • Device information
    • Pages visited
    • Referring website
    • Time spent on our website
    • Cookie and analytics information

  • 4. How We Use Your Information

    We may use your information to:

    • Respond to enquiries
    • Process applications and registrations
    • Manage event bookings
    • Provide information about courses and services
    • Improve website performance and user experience
    • Monitor website usage and security
    • Comply with legal and regulatory requirements
    • Send marketing communications where you have consented or where another lawful basis applies

  • 5. Legal Basis for Processing

    We process personal data where:

    • It is necessary for the performance of a contract.
    • We have a legitimate interest in providing and improving our services.
    • We have obtained your consent.
    • We are required to comply with legal obligations.
    • It is necessary for an education provider to carry out tasks in the public interest.

  • 6. Marketing Communications

    We may contact you about courses, events, apprenticeships and services that may be of interest to you.

    You can withdraw consent or unsubscribe from marketing communications at any time by following the instructions in our communications or contacting us directly.

  • 7. Website Chatbot

    London South East Colleges uses a third-party AI service provider (OpenAI) to power the website chatbot. Users are not asked for personal information within the chat itself, but message content is not filtered, so any personal data a user chooses to type may be transmitted to the provider. This transfer is covered by a signed Data Processing Addendum with OpenAI, which incorporates Standard Contractual Clauses (and the UK Addendum), providing an appropriate safeguard for the transfer outside the UK in accordance with the College's policy on restricted transfers. OpenAI retains message data for up to 7 days and does not use it to train its models.

    Contact details (first name, last name, email address) provided by users to save or return to a chat, or to opt in to marketing, are collected and stored separately from the AI provider, on a UK-based server operated by London South East Colleges' website/chatbot provider. This data does not leave the UK and is never sent to the AI provider."

    Chatbot Retention Periods

    Information

    Retention Period

    Contact details provided through chatbot

    Until consent is withdrawn or deletion requested

    Conversation content processed by AI provider

    Maximum 7 days

    Conversation content stored by chatbot provider

    Up to 3 years

  • 8. Sharing Information

    We may share data with:

    • Government agencies and funding bodies were required
    • Software and technology providers acting on our behalf
    • Professional advisers and auditors
    • Regulatory authorities
    • Website hosting and analytics providers
    • We do not sell personal information.

  • 9. International Transfers

    Where personal information is transferred outside the UK, we will ensure appropriate safeguards are in place in accordance with UK data protection legislation.

  • 10. Data Security

    We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure.

  • 11. Your Rights

    Under UK GDPR you may have the right to:

    • Access your personal data
    • Correct inaccurate information
    • Request deletion of data
    • Restrict processing
    • Object to processing
    • Withdraw consent
    • Request data portability
    • Lodge a complaint with the Information Commissioner's Office (ICO)
    • Members of the public can make requests by contacting the Data Protection Officer.

  • 12. Changes to This Policy

    We may update this policy from time to time. Any significant changes will be published on this website.