By using The Northern School of Art’s website, you consent to the collection, storage, use and transfer of your personal data by us under the terms of this Privacy Notice. “Personal Data” means personal information that identifies you as an individual or relates to an identifiable individual as defined under applicable European legislation (and in particular, the European General Data Protection Regulations 2016).

This Notice informs you of our practices from 25 May 2018 with respect to the collection, use and disclosure of Personal Data which you provide to us via our online platforms. We may ask you for this Personal Data so we can effectively provide our products and/or services to you. It also covers how we may use your Personal Data in relation to any promotions, competitions, offers or marketing campaigns we may undertake in whatever medium, or under our contractual obligations or other legitimate interests. There may be occasions where it may be reasonably necessary for us to contact you for administrative or operational reasons in relation to your registration or use of our online platforms, your potential employment with us or use of or access to our products and services.

The Data Controller is The Northern School of Art. We may collect your Personal Data in the following circumstances (this is not a definitive list): 1. Marketing and Promotions We may collect your Personal Data based on your consent or our legitimate business interests which include Marketing and Promotions: • when you receive communications in relation to aspects of our business as a customer/client; you or we think you may be interested in; when you register to attend an open event, or receive invitations to future events; • where that Personal Data is specifically and voluntarily provided by you when you visit our Platforms (see “Cookies”, below); • when you subscribe to our direct or indirect marketing lists (Marketing and Promotional communications may be provided to you by Social Media Channels, email, post or other communication channels); • if you have consented to receive Marketing or Promotions previously, for example through expressing an interest in our Products or Services; when you provide feedback and contributions to customer surveys, competitions or questionnaires. 2. Accessing, using or purchasing our products or services We may collect your Personal Data based on your consent or our legitimate business interest: • when you request specific materials or information from our online platforms, or by other media; • if you register to access secure or otherwise restricted parts of our Platforms e.g. to make an online application for a course; • through an ‘opt-in’ consent mechanism; • by submitting your details to ‘register your interest;’ form; or if you are an existing or potential customer, with information about Products or Services similar to those in which you have expressed an interest, e.g subscribing to our mailing list. 3. To perform our contractual obligations, which include: • Relevant Higher Education bodies (e.g. Education and Skills Funding Agency, Office for Students, UK Research and Innovation, Universities and Colleges Admissions Service, Office for Fair Access, Office of the Independent Adjudicator, the organisation(s) running the National Student Survey and other student and leaver surveys). • To administer the financial aspects of your relationship with us and any funders. • Monitor your progress and help you to achieve the best possible outcome from your study • To support you in your studies and provide medical or other assistance • Monitor how well individual programmes of study are performing • Local authorities (if we pass lists of undergraduate to Hartlepool Borough • Council on an annual basis to assist with the administration of students’ exemption from Council Tax). • On occasion and where necessary, auditors • whilst accepting our terms when registering for our Products or Services; including short courses and Saturday Clubs for children and young people. • to verify an identity for compliance purposes; or • to process a payment, communicate regarding a payment, and provide related customer • if you apply to work for The Northern School of Art; Otherwise in our legitimate business interests, which include: • if you contact us in respect of your Personal Data; • when we review and improve the accuracy of the Personal Data we hold; • when you contact us with queries so we can better help you; or • when we investigate any complaints received by you; • to analyse trends; • to track users webpage movements (see “Cookies”, below); • to help identify you; • to report any activity which we suspect breaches any relevant laws or regulations to the appropriate authority; and • to gather broad demographic information for aggregate use

Types of Personal Data Personal Data we ask for may include but is not limited to combinations of information about: • your name, postal address, email address (which may reveal your IP address), phone number, current/previous school/college and other contact information; • Sensitive Personal Data such as race or gender, when applying for a position with us – please see the Sensitive Personal Data section below; • where you heard about us; • any information you may voluntarily submit to us by completing any form on our online platforms; and, such as a “free text” boxes on our online platforms (i.e. blank spaces where you are free to insert comments) • your dealings with us including information regarding your personal or professional interests, needs or opinions, demographics, experiences with our Products or Services and contact preferences; • details of financial or accounting transactions carried out on our online platforms or otherwise, including credit/debit card information, billing information (if you pay for any short courses on our websites); and/or • information from other sources, such as, joint marketing partner e.g UCAS, social media platforms (including from people with whom you are friends or otherwise connected) and from other third parties; • technical information, including location information, the Internet Protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform. • your online browsing behaviour on our online platforms; including the Uniform Resource Locators (URL) clickstream to, through and from our online platforms or Social Media Channels (including date and time), download errors, lengths of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs) and methods used to browse away from the page; or • any devices you have used to access our Products and Services (including the make, model and operating system, IP address, browser type and mobile device identifiers) In some circumstances, we may request additional Personal Data to help us to provide you with the most appropriate response. If you do not provide the Personal Data where requested, your access to the service, or our ability to assist you, may be restricted. Special Category Data We will not ask for your Sensitive Personal Data (known as Special Category Data for GDPR) except as part of The Northern School of Art staff/ student recruitment and enrolment process. “Sensitive Personal Data” means Personal Data which may relate to: race or ethnic origin; political opinions; religious or other similar beliefs; trade union membership; physical or mental health; sexual life or criminal record. Where you do provide Sensitive Personal Data, we will ask you for explicit consent to The Northern School of Art to use that information solely in connection with the purpose for which it has been provided. Your Rights Under the European General Data Protection Regulations 2016, you have rights over your Personal Data in certain circumstances. Those rights may include for example the right to request we amend or delete your Personal Data; the right to withdraw consent; the right to know the purposes for which your Personal Data is being processed and the recipients to whom your Personal Data may be disclosed (subject to legal and regulatory requirements). If you do not agree to your Personal Data being used in accordance with this Notice please do not submit your Personal Data to us through the Platform or any other means. If you require further information on your rights or our use of your Personal Data, please contact us at dataprotection@northernart.ac.uk Right to Rectification of Personal Data We assume responsibility for keeping an accurate record of Personal Data once you have submitted the information, but not for confirming the on-going accuracy of your Personal Data if you do not update us. If you advise us that your Personal Data is no longer accurate, we will amend or update it (where practical and lawful to do so). Right to Erasure or Restriction of Personal Data You can ask us to delete or restrict your Personal Data in some circumstances such as where we no longer need it or you withdraw your consent (if consent is applicable). If we’ve shared it with others, where possible we’ll let them know about the erasure. Please note that in some circumstances we are contractually and legally obliged to retain certain data. Right to Withdraw Consent If, at any time, you have consented to us processing your Personal Data in the circumstances or purposes described above, and you no longer wish to have your Personal Data processed in this way, you may unsubscribe by contacting us or Opting Out by pressing unsubscribe on emails that we send to you. Right to Opt-Out of Marketing and Promotions You have the right to opt out of receiving direct Marketing and Promotions communications you have previously consented to, by: clicking on the relevant ‘unsubscribe’ link in the email; contacting us at dataprotection@northernart.ac.uk If you withdraw your consent to receive any further Marketing and Promotions communications from us, we will not contact you further for the purpose of direct marketing. However, we will not necessarily remove your Personal Data from our database(s) if we consider it is fair and necessary to retain the Personal Data for legitimate and legal reasons. This may include our obligations to comply with regulatory requirements. Right to Copies of Personal Data Where permitted by law, you may have the right to contact us to request a copy of Personal Data that we hold about you. Before responding to your request we may ask you to (i) verify your identity and (ii) provide further details so we can better respond to your request. Children’s Personal Data Our Platforms are not intended to target children under the age of 13. We will not knowingly collect or process Personal Data belonging to children via our online platforms. Third Party Goods and Services We will not send you information relating to third party goods and services from outside The Northern School of Art. Third Party websites Because we want your experience of our site to be as informative and useful as possible, we provide a number of links to websites operated by third parties (Third party websites). Please be aware that we do not control such third party websites and that such third party websites may send their own cookies to users, or otherwise collect data or solicit personal information. We assume no responsibility for the information gathering practices of third party websites that you are able to access through our site, and we encourage you to review each third party website’s privacy policy before disclosing any personally identifiable information. Our site includes the following which use cookies: • LiveChat – for chatting online with our recruitment team • Google Maps – for showing you our campus locations and providing directions • YouTube – for embedding videos • Issuu – for embedding documents and prospectuses Disabling these cookies will likely break the functions offered by these third parties. Some of our third party functions also use anonymous tracking cookies for advertising purposes. If you are concerned about third party cookies generated by advertisers, you can turn these off by going to the Your Online Choices site. Security of Personal Data Your Personal Data (and commercial information) will be kept as confidential and as secure as possible. We employ appropriate technical and organisational measures consistent with our legal obligations and standard industry practice. Further, as required by the European General Data Protection Regulations 2016 we follow strict security procedures in the storage and disclosure of Personal Data which you have given to us, to prevent unauthorised access as far as reasonably possible. We use industry standard practices to safeguard the confidentiality of your Personal Data, including “firewalls” and Secure Socket Layers (as of September 2018). We treat your Personal Data as an asset that must be protected against loss, alteration, destruction and unauthorised access and which our employees must keep confidential, and we use many different security techniques to protect your Personal Data from unauthorised access by users’ inside and outside of The Northern School of Art.

Third Parties Other than to Third Party Data Processors governed by a data processing agreement which replicates the terms of this Notice, as elsewhere provided for in this Notice, where it is necessary to involve a third party service provider for the performance of our contractual obligations or by operation of law, we will not transfer identifiable, non-aggregated Personal Data to third parties. Transfers outside the European Union Non-European countries may have data protection laws that are less protective than the legislation where you live. Where this is the case, (such as the United States), our transfers of data will be regulated by standard contractual clauses relating to the transfer of Personal Data outside of the European Union (or outside of jurisdictions deemed “adequate” for data privacy by the European Union). We will not transfer your data outside of the European Union for any other reason than described in this Notice, unless we are required to do so by operation of law. Retention of Personal Data If you have provided us with Personal Data, your Personal Data will be retained for the duration of your relationship with us, the length of time required by applicable legislation, or otherwise a reasonable period of time (and we or our third party data processors will amend or dispose of your Personal Data when no longer necessary).

What Cookies we use, why we use them, and how they impact you A cookie is a small text file, typically of letters and numbers (with an ID tag), which may be placed on your computer or mobile when you access our Platforms. Cookies generally allow a website to recognise your device and browsing activity if you return to it, or if you visit another website which recognises the same cookies. Different cookies perform different functions. Some help you navigate through pages, “storing preferences” information and generally making the website easier to use. Others identify products, goods or services you may be interested in and are used to provide you with tailored advertising When you visit our Platforms: Persistent cookies allow our website to recognise you when you return to our site another time. This provides us with useful analytics that help us optimise our website and your visits. Session cookies exist just for the life of your current visit whilst you have your browser open. They are not stored on your hard disk and are erased when you exit your web browser. For general information on cookies, please seedirect.gov.uk internet browser cookies page. Google Analytics We use this type of cookie to compile visitor statistics such as how many people have visited our website, what type of technology they are using, how long they spend on the site, what page they look at etc. This helps us to continuously improve our website. These so called “analytics” also tell us if , on an anonymous basis, how people reached this site (e.g. from a search engine) and whether they have been here before. Our user and data retention is currently 26 months and resets after this time. We use Google Analytics – read the Google Analytics privacy policy and opt-out Advertising Cookies Cookies are widely used in online advertising. Neither us, advertisers nor our advertising partners can gain personally identifiable information from these cookies. You can learn more about online advertising at YourOnlineChoices. You can opt-out of almost all advertising cookies here. It is also worth noting that opting out of advertising cookies will not mean you won’t see adverts, just simply that they won’t be tailored to you any longer. Remarketing Cookies You may notice that sometimes after visiting a site you see increased numbers of adverts from the site you visited. This is because advertisers, including ourselves pay for these adverts. The technology to do this is made possible by cookies and as such we may place a so called “remarketing cookie” during your visit. Don’t worry we are unable to proactively reach out to you as the whole process is entirely anonymous. You can opt out of these advertising cookies at anytime as explained above. Social buttons On many of the news posts of our websites you will see ‘social buttons’. These allow you to share or like pages on our site. Links to our social media pages are also on the footer of our website. Social media sites such as Twitter, Google, Facebook, and LinkedIn may collect information about your internet activity. They may record if you visit our Platforms and the specific pages you are on if you are logged into their services, even if you don’t click on the button. You should check the privacy and cookies policies of each of these sites to see how exactly they use your information and to find out how to opt out, or delete, such information. Further information FACEBOOK COOKIES > TWITTER COOKIES > GOOGLE COOKIES > LINKEDIN COOKIES > Manually managing cookies There are a number of ways you can manually manage cookies on your computer/device. Read more on https://www.aboutcookies.org/ If you access the Internet from more than one computer/device it is important to ensure each browser is configured to suit your cookie preferences. Do Not Track If you wish to block all cookies all the time you can set your browser to do this. It is important to note that blocking cookies may result in some parts of our site not working properly. This may affect your browsing experience. Our Platforms respect a DNT:1 signal as a valid browser setting communicating your preference. We also use third party persistent cookies from Google Analytics to track how you get to our site and your activity on the site so that we can improve our business processes. These are as follows: Cookie Name: _utma Purpose: Assigns a unique ID to track every new visitor Length Held: 2 years or until browser deletion Cookie Name: _utmb Purpose: Establish a user session on the website and updates on every new page view Length Held: 30 mins from creation/update Cookie Name: _utmc Purpose: Used historically in conjunction with _utmb to determine if a new session needs to be established Length Held: Expires on browser exit Cookie Name: _utmz Purpose: Stores the type of referral used by the visitor to reach your website i.e. website search, email hyperlink etc Length Held: 6 months from creation/update How does The Northern School of Art ask for Cookies consent? The Northern School of Art complies with applicable legislation on cookies. If you do not consent to cookies, you are free to disable cookies at any time through your browser’s settings (for more information on how to do this please see the “how to delete cookies” tab at allaboutcookies.org/cookies. If you choose to disable cookies, please be aware that some parts of our website may not work properly and it is likely that your online platform usage won’t be counted and measured as described above, so we won’t be able to take your actions into account when analysing data or when seeking to improve our service based on that analysis. Contact us Should you wish to make any comments, complaints, and enquiries or if you have any questions relating to this Notice, your rights, the Platform, our Marketing and Promotion materials or Products or Services we provide, you may contact The Northern School of Art Chief Data Privacy Officer by emailing the Privacy Office Email: dataprotection@northernart.ac.uk You may also contact the Data Protection Authority. The Northern School of Art’s governing Data Protection Authority is the UK Information Commissioner’s Office. Changes to this Notice This notice is subject to periodic review to ensure it is in line with applicable legislation. We retain all applicable ownership rights to information we collect. We reserve the right to change, modify, add or remove provisions of this Notice. Any changes to this Notice will be posted here, and we encourage you to check back from time to time. Applicable Law This Notice is governed and construed in accordance with English law.