Data Protection and GDPR Policy

1. Purpose and Scope

Horton Honours Ltd is committed to protecting the personal data of all learners, staff, and stakeholders in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy sets out how the organisation collects, uses, stores, shares, and disposes of personal data, and the rights of individuals whose data we hold.

This policy applies to all staff, tutors, assessors, internal quality assurers, and any third parties acting on behalf of Horton Honours Ltd who handle personal data in connection with EduQual-regulated programmes.

2. Data Protection Principles

Horton Honours Ltd processes personal data in accordance with the following UK GDPR principles. All personal data must be:

Processed lawfully, fairly, and transparently in relation to the data subject

Collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes

Adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed (data minimisation)

Accurate and, where necessary, kept up to date

Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which it is processed

Processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage

3. Lawful Basis for Processing

Horton Honours Ltd will only process personal data where there is a lawful basis for doing so. The lawful bases we rely upon include:

Contractual necessity – processing is necessary to fulfil our obligations under the learner enrolment agreement

Legal obligation – processing is required to comply with our regulatory obligations to EduQual and other awarding bodies

Legitimate interests – processing is necessary for the purposes of our legitimate educational and administrative interests

Consent – where we rely on consent, individuals have the right to withdraw it at any time

4. Types of Data Collected

Horton Honours Ltd may collect and process the following categories of personal data:

Learner identification data: full name, date of birth, address, contact details, and identification documents

Academic records: assessment submissions, grades, feedback, certificates, and achievement records

Financial data: payment records and funding information where applicable

Special category data: disability, health information, or other sensitive data provided to support reasonable adjustments (processed only with explicit consent or as required by law)

Communications: emails and correspondence between learners and staff

5. Data Storage and Security

All personal data held by Horton Honours Ltd will be stored securely using appropriate technical and organisational measures. Specifically:

Electronic records are stored in password-protected systems with access restricted to authorised personnel only

Paper records, where held, are stored in locked cabinets and disposed of securely via shredding

Staff are trained to handle personal data securely and not to share data with unauthorised parties

Access to learner data is granted on a need-to-know basis and reviewed regularly

Any third-party systems used to store or process data (e.g. cloud platforms) must meet UK GDPR standards and have appropriate data processing agreements in place

6. Data Retention

Personal data will not be retained for longer than is necessary for the purpose for which it was collected. Horton Honours Ltd will retain learner data in line with EduQual requirements and applicable legislation. As a guide:

Assessment records and certification data will be retained for a minimum of three years following programme completion, or as directed by EduQual

Financial records will be retained for a minimum of six years in line with HMRC requirements

Data no longer required will be securely deleted or destroyed in a manner appropriate to the sensitivity of the information

7. Sharing Personal Data

Horton Honours Ltd will only share personal data with third parties where there is a lawful basis to do so. Data may be shared with:

EduQual and other awarding organisations for the purposes of registration, certification, and quality assurance

External examiners or moderators as required for assessment quality assurance

Regulatory or statutory bodies where we are legally required to disclose information

Data will not be sold, rented, or otherwise disclosed to commercial third parties for marketing purposes

Where data is shared with processors, a written data processing agreement will be in place

8. Learner Rights Under UK GDPR

All learners have the following rights in relation to their personal data:

Right of access – to request a copy of personal data held about them (Subject Access Request)

Right to rectification – to request correction of inaccurate or incomplete personal data

Right to erasure – to request deletion of personal data in certain circumstances (‘right to be forgotten’)

Right to restriction of processing – to request that processing of their data is restricted in certain circumstances

Right to data portability – to receive their data in a commonly used, machine-readable format

Right to object – to object to processing based on legitimate interests or direct marketing

Rights in relation to automated decision-making and profiling

To exercise any of these rights, learners should submit a written request to the Head of Centre. Requests will be responded to within one calendar month in line with UK GDPR requirements.

9. Data Breach Procedure

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Horton Honours Ltd takes the following approach to managing data breaches:

Any suspected or actual data breach must be reported immediately to the Head of Centre

The Head of Centre will assess the severity of the breach and take immediate steps to contain it

Where a breach is likely to result in a risk to the rights and freedoms of individuals, the Information Commissioner’s Office (ICO) must be notified within 72 hours

Where a breach is likely to result in a high risk to individuals, those affected will be notified without undue delay

All breaches, regardless of severity, will be recorded in the organisation’s data breach log

10. Responsibilities

The Head of Centre (Laura Horton) is responsible for ensuring the organisation’s compliance with this policy and with UK GDPR

All staff are responsible for handling personal data in accordance with this policy and for reporting any suspected breaches immediately

New staff will receive data protection training as part of their induction

This policy will be reviewed annually or following any significant change in legislation or organisational practice

11. Complaints

If a learner or member of staff believes their data protection rights have not been respected, they may raise a complaint with the Head of Centre in the first instance. If they remain unsatisfied, they have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

Document	Data Protection and GDPR Policy
Organisation	Horton Honours Ltd
Approved by	Laura Horton
Version	1.0
Review Date	March 2027

Education Policy Portal