The Northern School of Art Privacy Notice
(March 2026)
WHAT DOES THIS NOTICE DO?
The Northern School of Art is required to retain certain information about its employees, learners and other users in order to facilitate the monitoring of performance, achievements, and health and safety. It is also necessary to process information so that staff can be recruited and paid, courses organised and legal obligations to funding bodies and government complied with.
To comply with the law, information must be collected and used fairly, stored and disposed of safely, and not disclosed to any other person unlawfully. To do this, The Northern School of Art must comply with the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018
In summary, these state that personal data shall:
- be obtained and processed fairly and lawfully and shall not be processed unless certain conditions are met;
- be obtained for a specified and lawful purpose and shall not be processed in any manner incompatible with that purpose;
- be adequate, relevant and not excessive for those purposes;
- be accurate and kept up to date;
- Not to be kept for longer than is necessary for that purpose;
- be processed in accordance with the data subject’s rights;
- be safe from unauthorised access, accidental loss or destruction;
- not be transferred to a country outside the European Economic Area, unless that country has equivalent levels of protection for personal data.
GDPR defines 6 lawful bases for data collection and processing these are set out here:
- Consent: the individual has given clear consent for you to process their personal data for a specific purpose;
- Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract;
- Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations);
- Vital interests: the processing is necessary to protect someone’s life.
- Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law;
- Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks).
WHAT PERSONAL DATA DO WE COLLECT?
Types of Personal Data
Personal Data we ask for may include but is not limited to combinations of information about:
- your name, postal address, email address (which may reveal your IP address), phone number, current/previous school/college and other contact information;
- where you heard about us;
- any information you may voluntarily submit to us by completing any form on our online platforms; and, such as “free text” boxes on our online platforms (i.e. blank spaces where you are free to insert comments);
- your dealings with us including information regarding your personal or professional interests, needs or opinions, demographics, experiences with our products or services and contact preferences;
- details of financial or accounting transactions carried out on our online platforms or otherwise, including credit/debit card information, billing information (if you pay for any short courses on our websites); and/or
- information from other sources, such as joint marketing partners e.g., UCAS, social media platforms (including from people with whom you are friends or otherwise connected) and other third parties;
- technical information, including location information, the Internet Protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
- your online browsing behaviour on our online platforms; including the Uniform Resource Locators (URL) clickstream to, through and from our online platforms or Social Media Channels (including date and time), download errors, lengths of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs) and methods used to browse away from the page; or
- any devices you have used to access our Products and Services (including the make, model and operating system, IP address, browser type and mobile device identifiers) In some circumstances, we may request additional Personal Data to help us to provide you with the most appropriate response. If you do not provide the Personal Data where requested, your access to the service, or our ability to assist you, may be restricted;
- Sensitive Personal Data such as race or gender, when applying for a position with us – please see the Sensitive Personal Data section below.
Special Category Data
We will not ask for your Sensitive Personal Data (known as Special Category Data for GDPR) except as part of The Northern School of Art staff/student recruitment and enrolment process.
“Sensitive Personal Data” means Personal Data which may relate to: race or ethnic origin; political opinions; religious or other similar beliefs; trade union membership; physical or mental health; sexual life or criminal record. Where you do provide Sensitive Personal Data, we will ask you for explicit consent to The Northern School of Art to use that information solely in connection with the purpose for which it has been provided.
HOW DO WE COLLECT PERSONAL DATA & WHY?
Consent for Marketing and Promotions
We may ask you for personal data so that we can effectively provide our products and services to you, manage your registration or use of our online platforms, administer applications, fulfil contractual obligations, and comply with legal or regulatory requirements.
We may also process your personal data for marketing and promotional purposes. Depending on the circumstances, we will rely on either your consent or our legitimate interests as our lawful basis.
Where we rely on legitimate interests, this may include communicating with existing students, applicants, alumni or professional contacts about courses, events or services that we believe are relevant to them. In such cases, we will ensure that our interests do not override your rights and freedoms and will carry out a legitimate interests assessment where appropriate.
Where processing involves email marketing to prospective students, the use of advertising cookies, audience matching, customer match lists, lookalike audiences, or the disclosure of personal data to third-party advertising platforms, we rely on your explicit consent under the Privacy and Electronic Communications Regulations (PECR) and UK GDPR. You may withdraw your consent at any time:
- when you receive communications in relation to aspects of our business as a customer/client that we think you may be interested in;
- when you register to attend an open event or receive invitations to future events;
- where that personal data is specifically and voluntarily provided by you when you visit our platforms (see “Cookies”, below);
- when you subscribe to our direct or indirect marketing lists (marketing and promotional communications may be provided to you by social media channels, email, post or other communication channels);
- if you have consented to receive marketing or promotions previously, for example through expressing an interest in our products or services; when you provide feedback and contributions to customer surveys, competitions or questionnaires.
Accessing, using or purchasing our products or services
We may collect your personal data based on your consent or our legitimate business interest:
- when you request specific materials or information from our online platforms, or from other media;
- if you register to access secure or otherwise restricted parts of our platforms e.g., to make an online application for a course;
- through an ‘opt-in’ consent mechanism;
- by submitting your details to the ‘register your interest;’ form; or if you are an existing or potential customer, with information about products or services similar to those in which you have expressed an interest, e.g., subscribing to our mailing list.
To perform legal, and contractual obligations, which include:
- providing information to relevant Higher Education bodies (e.g. Education and Skills Funding Agency, Office for Students, UK Research and Innovation, Universities and Colleges Admissions Service, Office of the Independent Adjudicator, the organisation(s) running the National Student Survey and other student and leaver surveys);
- to administer the financial aspects of your relationship with us and any funders;
- monitoring your progress and help you to achieve the best possible outcome from your study;
- to support you in your studies and provide medical or other assistance;
- monitoring how well individual programmes of study are performing;
- providing information to local authorities (e.g., we may pass information about students to Hartlepool Borough Council to assist with the administration of students’ exemption from Council Tax);
- providing information on occasion and where necessary to auditors;
- whilst accepting our terms when registering for our products or services, including short courses and Saturday Clubs for children and young people;
- to verify an identity for compliance purposes, to process a payment, or communicate regarding a payment, and provide related customer services;
- if you apply to work for The Northern School of Art;
- if you contact us in respect of your personal data;
- when we review and improve the accuracy of the personal data we hold;
- when you contact us with queries so we can better help you; or when we investigate any complaints received by you;
- to analyse trends;
- to track users' webpage movements (see “Cookies”, below);
- to help identify you;
- to report any activity which we suspect breaches any relevant laws or regulations to the appropriate authority; and
- to gather broad demographic information for aggregate use.
to provide information to the Department for Education (DfE).
How the Government uses your data
The student data that we lawfully share with the Department for Education (DfE) through data collections support ‘longer term’ research and monitoring of educational policy (for example how certain subject choices go on to affect education or earnings beyond school). To find out more about the data collection requirements placed on us by the Department for Education (DfE) go to:
Sharing by the Department for Education (DfE)
The DfE will only share students’ personal data where it is lawful, secure and ethical to do so. Where these conditions are met, the law allows the Department for Education (DfE) to share students’ personal data with certain third parties, including:
schools and local authorities
researchers
organisations connected with promoting the education or wellbeing of children in England
other government departments and agencies
organisations fighting or identifying crime (Organisations fighting or identifying crime may use their legal powers to contact the Department for Education (DfE) to request access to individual-level information relevant to detecting that crime).
For information about which organisations the Department for Education (DfE) has provided student information, (and for which project) or to access a monthly breakdown of data share volumes with the Home Office and the Police please visit the following website: https://www.gov.uk/government/publications/dfe-external-data-shares
How to find out what personal information the Department for Education (DfE)holds about you
Under the terms of the UK GDPR, you are entitled to ask the Department for Education (DfE):
if they are processing your personal data
for a description of the data they hold about you
the reasons they’re holding it and any recipient it may be disclosed to
for a copy of your personal data and any details of its source
If you want to see the personal data held about you by the Department for Education (DfE), you should make a ‘subject access request’. Further information on how to do this can be found within the Department for Education’s (DfE) personal information charter that is published at the address below:
or
To contact the Department for Education (DfE):
https://www.gov.uk/contact-dfe
Your Rights
You have rights over your personal data in certain circumstances. Those rights may include for example the right to request we amend or delete your personal data; the right to withdraw consent; the right to know the purposes for which your personal data is being processed and the recipients to whom your personal data may be disclosed (subject to legal and regulatory requirements).
If you do not agree to your personal data being used in accordance with this notice please do not submit your personal data to us through the platform or any other means.
If you require further information on your rights or our use of your personal data, please contact us at dataprotection@northernart.ac.uk
Right to Rectification of Personal Data
We assume responsibility for keeping an accurate record of personal data once you have submitted the information, but not for confirming the on-going accuracy of your personal data if you do not update us.
If you advise us that your personal data is no longer accurate, we will amend or update it (where practical and lawful to do so).
Right to Erasure or Restriction of Personal Data
You can ask us to delete or restrict your personal data in some circumstances such as when we no longer need it or you withdraw your consent (if consent is applicable). If we’ve shared it with others, where possible we’ll let them know about the erasure. Please note that in some circumstances we are contractually and legally obliged to retain certain data.
Right to Withdraw Consent
If, at any time, you have consented to us processing your personal data in the circumstances or purposes described above, and you no longer wish to have your personal data processed in this way, you may unsubscribe by contacting us or opting out by pressing unsubscribe on emails that we send to you.
Right to Opt-Out of Marketing and Promotions
You have the right to opt out of receiving direct marketing and promotions communications you have previously consented to, by clicking on the relevant ‘unsubscribe’ link in the email; contacting us at dataprotection@northernart.ac.uk
If you withdraw your consent to receive any further marketing and promotions communications from us, we will not contact you further for the purpose of direct marketing. However, we will not necessarily remove your personal data from our database(s) if we consider it is fair and necessary to retain the personal data for legitimate and legal reasons. This may include our obligations to comply with regulatory requirements.
Right to Copies of Personal Data
Where permitted by law, you may have the right to contact us to request a copy of personal data that we hold about you. Before responding to your request, we may ask you to (i) verify your identity and (ii) provide further details so we can better respond to your request.
Children’s Personal Data
Our platforms are not intended to target children under the age of 13. We will not knowingly collect or process personal data belonging to children via our online platforms.
Third Party Goods and Services
We will not send you information relating to third party goods and services from outside The Northern School of Art.
Third Party websites
Because we want your experience of our site to be as informative and useful as possible, we provide a number of links to websites operated by third parties (third-party websites). Please be aware that we do not control such third-party websites and that such third-party websites may send their own cookies to users, or otherwise collect data or solicit personal information. We assume no responsibility for the information-gathering practices of third-party websites that you can access through our site, and we encourage you to review each third-party website’s privacy policy before disclosing any personally identifiable information. Our site includes the following applications which use cookies:
LiveChat – for chatting online with our recruitment team;
Google Maps – for showing you our campus locations and providing directions;
YouTube – for embedding videos;
Issuu – for embedding documents and prospectuses.
Disabling these cookies will likely break the functions offered by these third parties. Some of our third-party functions also use anonymous tracking cookies for advertising purposes. If you are concerned about third party cookies generated by advertisers, you can turn these off by going to the Your Online Choices site.
Security of Personal Data
Your personal data (and commercial information) will be kept confidential and as secure as possible. We employ appropriate technical and organisational measures consistent with our legal obligations and standard industry practice.
We use industry-standard practices to safeguard the confidentiality of your personal data, including “firewalls” and Secure Socket Layers (as of September 2018). We treat your personal data as an asset that must be protected against loss, alteration, destruction and unauthorised access and which our employees must keep confidential, and we use many different security techniques to protect your personal data from unauthorised access by users inside and outside of The Northern School of Art.
TRANSFER OF PERSONAL DATA
Third Parties
Other than to Third Party Data Processors governed by a data processing agreement which replicates the terms of this Notice, as elsewhere provided for in this Notice, where it is necessary to involve a third-party service provider for the performance of our contractual obligations or by operation of law, we will not transfer identifiable, non-aggregated personal data to third parties except where necessary for the purposes described in this Notice and subject to appropriate contractual and data protection safeguards.
Transfers outside the UK (and where applicable, the EEA)
Some countries outside the UK may not provide the same level of data protection as UK law. Where we transfer personal data outside the UK (and where applicable, the European Economic Area), we ensure that appropriate safeguards are in place in accordance with UK data protection legislation.
These safeguards may include:
transfers to countries that have been deemed to provide an adequate level of protection under UK law; or
the use of UK-approved Standard Contractual Clauses (including the UK Addendum where applicable).
We will not transfer your personal data outside the UK (and where applicable, the EEA) other than as described in this Notice unless we are required to do so by law.
Retention of Personal Data
If you have provided us with personal data, your personal data will be retained for the duration of your relationship with us, the length of time required by applicable legislation, or otherwise a reasonable period of time (and we or our third-party data processors will amend or dispose of your personal data when no longer necessary).
COOKIES
What Cookies do we use, why do we use them, and how do they impact you?
A cookie is a small text file, typically of letters and numbers (with an ID tag), which may be placed on your computer or mobile when you access our platforms. Cookies generally allow a website to recognise your device and browsing activity if you return to it, or if you visit another website which recognises the same cookies.
Different cookies perform different functions. Some help you navigate through pages, “storing preferences” information and generally making the website easier to use. Others identify products, goods or services you may be interested in and are used to provide you with tailored advertising.
When you visit our Platforms
Persistent cookies allow our website to recognise you when you return to our site another time. This provides us with useful analytics that help us optimise our website and your visits. Session cookies exist just for the life of your current visit while you have your browser open. They are not stored on your hard disk and are erased when you exit your web browser.
For general information on cookies, please see direct.gov.uk internet browser cookies page.
Google Analytics
We use this type of cookie to compile visitor statistics such as how many people have visited our website, what type of technology they are using, how long they spend on the site, what page they look at etc. This helps us to continuously improve our website. These so-called “analytics” also tell us, on an anonymous basis, how people reached this site (e.g. from a search engine) and whether they have been here before. Our user and data retention period is currently 26 months and resets after this time.
We use Google Analytics – read the Google Analytics privacy policy and opt-out
Advertising Cookies
Cookies are widely used in online advertising. Neither we, advertisers nor our advertising partners can gain personally identifiable information from these cookies.
You can learn more about online advertising at Your Online Choices. You can opt out of almost all advertising cookies here. It is also worth noting that opting out of advertising cookies will not mean you won’t see adverts, just simply that they won’t be tailored to you any longer.
Remarketing Cookies
Remarketing cookies enable us to show you advertisements based on your previous interactions with our website. These cookies involve the processing of personal data and require your consent under the Privacy and Electronic Communications Regulations (PECR) and UK GDPR.
You can opt out of these advertising cookies at any time as explained above.
Targeted Advertising and Audience Matching
We may use limited personal data, such as your email address, to show you relevant advertisements about our courses, events and services on third-party platforms including Meta (Facebook and Instagram) and Google.
This activity may involve creating “custom audiences” or similar audience groups, which allow us to:
show advertisements to individuals who have previously interacted with us (for example, by registering for an event, submitting an application or enrolling on a course);
create audiences of individuals with similar characteristics to those who have already shown an interest in our courses or services.
Where we carry out this activity:
your email address is converted using the SHA-256 hashing algorithm before being uploaded to the relevant advertising platform, in line with platform requirements;
the relevant platform matches the hashed data against user accounts it already holds in order to display our advertisements;
we receive only aggregated and anonymised campaign performance statistics and do not receive information about your activity on those platforms.
When we use audience-matching tools provided by platforms such as Meta and Google, those platforms act as independent data controllers in relation to the matching and advertising services they provide. They may combine the hashed data we upload with personal data they already hold, in accordance with their own privacy policies.
This processing constitutes profiling under UK GDPR. However, this profiling is used solely to tailor advertising content and does not produce legal or similarly significant effects on you.
Hashed email lists used for audience matching are retained by us only for as long as valid consent remains in place and for the duration necessary to operate the relevant advertising campaign. We periodically review and delete audience lists where consent has been withdrawn or is no longer valid. Advertising platforms may retain matched audience segments in accordance with their own retention policies.
Audience matching may involve transferring hashed data to countries outside the UK, including the United States. Where this occurs, appropriate safeguards such as the UK Addendum to Standard Contractual Clauses or other approved transfer mechanisms are in place.
This processing is not anonymous and constitutes the use of personal data under UK GDPR.
Lawful Basis
We rely on your explicit consent to use your personal data for audience matching and targeted advertising purposes.
Where we rely on consent, we will seek it separately for:
receiving marketing communications;
the use of your data for audience matching and targeted advertising;
the placement of advertising cookies or similar tracking technologies.
These consents are independent, and you may give or withdraw any of them without affecting your ability to apply for, enrol on, or access our courses or services.
Your Choices
You can withdraw your consent at any time by:
• contacting us at dataprotection@northernart.ac.uk;
• adjusting your marketing or cookie preferences where available.
If you withdraw consent, your personal data will no longer be used for audience-matched advertising audiences, although you may still see non-targeted advertisements from us.
Social buttons
On many of the news posts on our websites, you will see ‘social buttons’. These allow you to share or like pages on our site. Links to our social media pages are also on the footer of our website.
Social media sites such as X (formally Twitter), Google, Facebook, and LinkedIn may collect information about your internet activity. They may record if you visit our platforms and the specific pages you are on if you are logged into their services, even if you don’t click on the button.
You should check the privacy and cookies policies of each of these sites to see how exactly they use your information and to find out how to opt-out or delete, such information.
Further information
FACEBOOK COOKIES >
X COOKIES >
GOOGLE COOKIES >
LINKEDIN COOKIES >
Manually managing cookies
There are a number of ways you can manually manage cookies on your computer/device. Read more at https://www.aboutcookies.org/
If you access the Internet from more than one computer/device it is important to ensure each browser is configured to suit your cookie preferences.
Do Not Track
If you wish to block all cookies all the time you can set your browser to do this. It is important to note that blocking cookies may result in some parts of our site not working properly. This may affect your browsing experience.
Our Platforms respect a DNT:1 signal as a valid browser setting communicating your preference.
We also use third-party persistent cookies from Google Analytics 4 (GA4) to track how you get to our site and your activity on the site so that we can improve our business processes. These are as follows:
Cookie Name: _ga
Purpose: Assigns a unique ID to each visitor to distinguish users
Length Held: 2 years from creation/update
Cookie Name: _ga_XXXXXX (where XXXXXX is a unique identifier for our property)
Purpose: Used to persist session state and distinguish users for GA4 reporting
Length Held: 2 years from creation/update
Cookie Name: _gid
Purpose: Assigns a unique ID to track user activity within a 24-hour period
Length Held: 24 hours
Cookie Name: _gat
Purpose: Throttles request rate to limit data collection on high-traffic sites
Length Held: 1 minute
Cookie Name: gac
Purpose: Contains campaign-related information for analytics purposes
Length Held: 90 days
How does The Northern School of Art ask for Cookies consent?
The Northern School of Art complies with applicable legislation on cookies. If you do not consent to cookies, you are free to disable cookies at any time through your browser’s settings (for more information on how to do this please see the “how to delete cookies” tab at allaboutcookies.org/cookies.
If you choose to disable cookies, please be aware that some parts of our website may not work properly and it is likely that your online platform usage won’t be counted and measured as described above, so we won’t be able to take your actions into account when analysing data or when seeking to improve our service based on that analysis.
Contact us
Should you wish to make any comments, complaints, or enquiries or if you have any questions relating to this Notice, your rights, the platform, our marketing and promotion materials or products or services we provide, you may contact The Northern School of Art, Data Protection Officer by emailing the Privacy Office Email: dataprotection@northernart.ac.uk
You may also contact the Data Protection Authority. The Northern School of Art’s governing Data Protection Authority is the UK Information Commissioner’s Office.
Changes to this Notice
This notice is subject to periodic review to ensure it is in line with applicable legislation.
We retain all applicable ownership rights to the information we collect. We reserve the right to change, modify, add or remove provisions of this Notice. Any changes to this Notice will be posted here, and we encourage you to check back from time to time.
Applicable Law
This Notice is governed and construed in accordance with English law.