Privacy Policy

This privacy policy explains how London Vesta College Limited collects and uses personal data. It covers our website, enquiries, applications, apprenticeship and training delivery, employer services, funding and compliance activity, learner support, marketing, and complaints.

This policy reflects the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and changes introduced by the Data (Use and Access) Act 2025 that are in force or being phased in during 2025 and 2026. ICO guidance on some Data (Use and Access) Act changes is still being updated, so we will review this policy when relevant guidance changes.

Who we are

London Vesta College Limited is the controller for personal data we decide to collect and use for our own purposes.

• Company: London Vesta College Limited
• Company number: 05394126
• Address: London Vesta College, 'Montefiore Centre', Hanbury Street, London E1 5HZ, United Kingdom
• Data protection contact: [email protected]
• General contact: [email protected]
• Phone: 0207 377 0731 / 07767 115 842

Some apprenticeship and funded-learning records are also processed by the Department for Education (DfE) as an independent controller. Where DfE controls that data, its own privacy information also applies.

The main ways we collect data

We collect personal data when you:

• visit or use the website;
• use search, filtering, videos, social sharing, cookie preferences, or other website features;
• submit the contact form;
• submit the application form;
• contact us by email, phone, post, mailto links, social media, or in person;
• ask about apprenticeships, adult learning, employer services, or funding;
• apply for a programme or start enrolment;
• become a learner, apprentice, employer partner, staff member, contractor, supplier, or visitor;
• take part in initial assessment, learning support, progress reviews, safeguarding, complaints, surveys, testimonials, or alumni activity;
• are named by an applicant, learner, apprentice, employer, parent, guardian, emergency contact, referee, mentor, line manager, or public body.

We may also receive personal data from employers, schools, colleges, referral partners, DfE services, awarding organisations, end-point assessment organisations, subcontractors, support providers, publicly available sources, and professional advisers where the law allows it.

Website capabilities and data capture

The website is a static Next.js site hosted on Cloudflare Pages with Cloudflare Pages Functions for form handling. The current website form flow does not intentionally store contact or application submissions in a website database. Form submissions are validated and then sent by email to our admissions team through Resend. Separate mailboxes, email delivery providers, Cloudflare logs, analytics tools, and any later enrolment systems may retain records under their own retention settings and our internal procedures.

Browsing and security logs

When you visit the website, our hosting and security providers may process technical data such as:

• IP address;
• approximate location derived from IP address, such as country;
• browser type, device type, operating system, language, and user agent;
• page URLs requested, referrer URL, date and time, response status, and diagnostic data;
• security events, bot signals, and firewall or rate-limiting data.

We use this data to deliver the site, keep it secure, troubleshoot issues, prevent abuse, monitor performance, and understand service availability.

Contact form

The contact form collects:

• full name;
• email address;
• phone number if provided;
• subject;
• message;
• marketing consent choice;
• Cloudflare Turnstile token if bot protection is enabled.

We use this data to respond to your enquiry, route it to the right team, keep a record of the conversation, and send you an acknowledgement email. If you include sensitive information in the message, we will use it only where needed to respond, support you, meet legal duties, or protect someone's vital interests.

Where practical, we provide a short privacy notice and link to this policy at the point you submit the form. Please do not include special category or criminal-offence data in a general enquiry unless we have asked for it or it is necessary in the circumstances.

Application form

The application form collects:

• first name and last name;
• email address and phone number;
• date of birth;
• address, city, and postcode;
• programme type, preferred start date, and specific programme if provided;
• highest qualification;
• how you heard about us;
• additional information you choose to provide;
• confirmation that the applicant has read the privacy notice, and any optional marketing preferences;
• Cloudflare Turnstile token if bot protection is enabled.

We use this data to assess and manage your application, contact you about next steps, check eligibility, discuss funding, arrange interviews or assessments, match you with suitable opportunities, and start enrolment if your application progresses.

Some information is mandatory because it is needed to process an application, verify eligibility for funded learning, or take steps at the applicant's request before enrolment. Where information is required, we will say so at the point of collection. If it is not provided, we may be unable to process the application or confirm eligibility.

Cloudflare Turnstile

Where Turnstile is enabled, our forms load Cloudflare's Turnstile script and send the Turnstile token, and sometimes your IP address, to Cloudflare for bot and abuse prevention. This helps us protect forms from spam and automated misuse.

Email delivery through Resend

When you submit the contact or application form, the form content is sent through Resend to our admissions mailbox. Resend may process email addresses, sender and recipient details, message content, delivery status, timestamps, and technical metadata so the email can be delivered and monitored.

Search and programme filtering

The website uses Pagefind for site search. Searches are run in the browser against a static search index served from our own site. Search terms are used to show results and are not intentionally submitted to our servers by the Pagefind search feature.

Programme filters, audience tabs, and similar controls are used in the browser to change what you see on the page. They do not normally identify you unless combined with separate analytics or server log data.

Cookies, local storage, analytics, and marketing tags

The website includes a cookie preference banner. It stores your preference in browser local storage under cookie-consent, with choices for necessary, analytics, and marketing storage.

The current website source uses necessary local storage for cookie preferences, Cloudflare Pages and security services, Pagefind search, interface scripts, a Google Maps location iframe on the contact page, YouTube thumbnail requests and youtube-nocookie.com playback, outbound social links, Resend email delivery after form submission, and Cloudflare Turnstile on forms where Turnstile is configured.

We have not identified active Google Analytics, Google Ads, Google Tag Manager, Meta/Facebook Pixel, LinkedIn Insight Tag, TikTok Pixel, Hotjar, custom session cookies, custom CSRF cookies, or browser session storage in the current website source.

Necessary storage is used to remember your cookie choice and support website security and functionality. Analytics and marketing storage should only be enabled where you have given the required consent, unless a specific PECR exception applies and the implementation has been assessed and documented.

You can read more in our Cookie Policy.

Google Maps, YouTube videos, and external media

The contact page includes a Google Maps iframe showing the London Vesta College location. Google may receive data such as your IP address, device details, page URL, referrer information, map requests, and map interactions.

Some pages include YouTube videos using the youtube-nocookie.com embed domain. Video thumbnails may be loaded from YouTube or Google before playback, and the video iframe is loaded when you choose to play the video. YouTube or Google may receive data such as your IP address, device details, page URL, thumbnail request, and playback interactions.

Some images may be served from third-party image or asset domains, including Cloudflare Images or Contentful asset domains, where these are configured.

Social links and sharing

The website links to social media platforms and may provide share links for Facebook, LinkedIn, X/Twitter, Instagram, YouTube, and other services. If you click those links, the relevant third party may receive data about your visit and process it under its own privacy policy.

Redirect monitoring

The website includes an optional redirect-log endpoint intended for monitoring legacy URL redirects. If used, it can log the old path, new path, timestamp, user agent, referrer, IP address, and country to Cloudflare logs.

Email, phone, and mailto links

If you click an email, phone, or mailto link, your browser, device, email provider, phone network, or app may process related metadata. We receive the personal data you choose to send in the message or call.

Data we process for learners, apprentices, and applicants

If you apply for or enrol on an apprenticeship or training programme, we may process:

• identity and contact data, such as name, date of birth, address, email, phone, Unique Learner Number, National Insurance number, and learner reference numbers;
• eligibility and funding data, such as residency, right to study, employment status, prior attainment, qualifications, learning aim, programme type, start and end dates, funding source, and employer details;
• application and admissions data, including interviews, initial assessments, diagnostics, English and maths information, career goals, additional support requests, and communications;
• learning records, including attendance, progress reviews, targets, portfolio evidence, assignments, assessment results, endpoint assessment preparation, completion status, withdrawal reasons, and outcomes;
• employer and workplace data, including employer contact names, job role, workplace location, mentor or line-manager details, reviews, off-the-job training, and apprenticeship agreement information;
• finance and contract data, including funding evidence, payment records, grant or contract evidence, and audit records;
• equality, inclusion, safeguarding, wellbeing, and support data, where relevant and lawful.

Not every data item applies to every learner or programme.

Data we process for employers and business contacts

For employer enquiries, apprenticeship recruitment, workforce development, and account management, we may process:

• business contact names, job titles, work email addresses, phone numbers, and organisation details;
• vacancy, role, workplace, funding, levy, and training-needs information;
• apprentice supervision, mentor, line-manager, review, and workplace evidence records;
• contracts, due diligence, payment, funding, compliance, and audit records;
• communications, meeting notes, feedback, complaints, and service history.

Special category and sensitive data

Some data needs extra protection under UK GDPR. This may include health information, disability or learning difficulty information, ethnicity, sex, safeguarding information, care status, support needs, or other equality and inclusion data.

We only process special category data where we have an Article 9 condition and, where required, a Data Protection Act 2018 Schedule 1 condition. Depending on the purpose, this may include explicit consent, substantial public interest, employment, social security and social protection law, legal claims, vital interests, health or social care, safeguarding, equality monitoring, or education and training support.

We may process criminal offence data only where the law allows it, for example where needed for safeguarding, suitability, regulatory compliance, legal claims, or protecting people from harm.

Why we use personal data and our lawful bases

We only use personal data where we have a lawful basis under UK GDPR.

If we rely on legitimate interests, we balance our interests against your rights and expectations. You can object to processing based on legitimate interests.

If we rely on consent, you can withdraw consent at any time. Withdrawal does not affect processing that happened before you withdrew consent.

Apprenticeship data, DfE, and the ILR

Publicly funded further education and apprenticeship providers must collect and return Individualised Learner Record (ILR) data under the relevant funding agreement, contract, or grant agreement.

DfE uses ILR data to fund learning, monitor delivery, assess quality and value for money, publish official statistics, and support education, training, employment, wellbeing, and research purposes. For 2026 to 2027 apprenticeship records, the ILR field list includes learner identity, contact, date of birth, postcode, sex, ethnicity, LLDD and health problem indicators, National Insurance number where required, employment status, employer identifiers, funding fields, learning delivery records, learning support, achievement and completion information, and related monitoring fields.

DfE's ILR Privacy Notice for 2026 to 2027 says DfE retains ILR learner data for 20 years for operational purposes and then retains personal data in research databases until the learner is aged 80. DfE's retention and use of ILR data is separate from our own retention periods.

Training providers should ensure learners see the relevant ILR privacy notice as part of enrolment. We will provide or signpost the applicable DfE privacy information during enrolment and where otherwise appropriate.

Useful DfE notices:

• DfE ILR Privacy Notice 2026 to 2027
• DfE privacy information for key stage 4, key stage 5 and adult education
• DfE Personal Information Charter

Learning Records Service (LRS), Unique Learner Number (ULN) and Personal Learning Record (PLR)

We may share relevant learner data with the Department for Education's Learning Records Service (LRS) so that a Unique Learner Number (ULN) can be issued or verified and a Personal Learning Record (PLR) can be created or accessed where permitted. The Department for Education is the controller for LRS processing, and we will provide or signpost the relevant LRS privacy notice during enrolment and where otherwise required.

Useful LRS notices:

• LRS privacy notice
• Using the Learning Records Service for learning providers and local authorities

Adult learning, Kent Adult Learning and other publicly funded provision

If you enquire about or enrol on adult-learning or other publicly funded provision, we may collect information needed to confirm eligibility and funding rules, such as age, date of birth, address, postcode, residency or right-to-study evidence, prior attainment, employment status, benefit or fee-remission evidence, and documents or declarations needed for funding assurance.

Where a programme is delivered with or commissioned by a public authority or funder - for example Kent County Council / Community Learning and Skills, the Department for Education, the Greater London Authority, or another public funder, as applicable - we will tell you whether that organisation acts as an independent controller, joint controller, processor, or recipient of your information, and we will signpost the relevant privacy information where required.

Who we share personal data with

We share personal data only where needed and lawful. Recipients may include:

• DfE, apprenticeship services, and successor bodies to ESFA functions;
• Ofsted, awarding organisations, end-point assessment organisations, qualification bodies, and auditors;
• employers, prospective employers, workplace mentors, line managers, and apprenticeship partners;
• schools, colleges, local authorities, careers services, referral partners, and support providers;
• safeguarding agencies, emergency services, health or wellbeing services, and local authority services where needed;
• IT, hosting, email, security, form, CRM, MIS, e-portfolio, learning platform, assessment, analytics, and communication providers;
• Cloudflare, Resend, Google/YouTube, social media platforms, and similar digital service providers where their services are used;
• banks, payment providers, insurers, accountants, auditors, legal advisers, and other professional advisers;
• courts, regulators, law enforcement bodies, and public authorities where required or permitted by law;
• parents, guardians, emergency contacts, or nominated representatives where you have asked us to, where you are under 18 and it is appropriate, or where safeguarding or law requires it.

Where another organisation processes personal data for us, we use contracts and controls designed to protect the data and restrict use to authorised purposes.

International transfers

Some providers we use may process personal data outside the UK. Where this happens, we will use an appropriate transfer mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses, or another lawful safeguard.

How long we keep personal data

We keep personal data only for as long as needed for the purpose collected, including legal, funding, audit, safeguarding, regulatory, complaint, and accounting requirements.

Typical retention periods are:

• website security and diagnostic logs: usually short periods unless needed for investigation or legal compliance;
• contact form and general enquiry records: up to 2 years after the last meaningful contact, unless the enquiry becomes an application, complaint, contract, or learner record;
• unsuccessful or withdrawn applications: up to 2 years after the application decision or last contact, unless a longer period is needed for complaints, safeguarding, audit, or legal reasons;
• marketing consent and suppression records: while you remain subscribed, and suppression records after opt-out so we do not contact you again;
• learner, apprentice, enrolment, progress, assessment, funding, and employer records: usually at least 6 years after the end of the relationship or funding/audit period, and longer where funding rules, contracts, safeguarding, certification, complaints, or law require;
• financial and accounting records: usually 6 years plus the current financial year;
• signed contracts and formal agreements: usually 6 years after they end, or up to 12 years where executed as a deed or where a longer limitation period applies;
• safeguarding and wellbeing records: for as long as necessary to protect individuals, meet statutory guidance, handle claims, and evidence decisions.

DfE and other independent controllers may keep their own copies for different periods.

Your rights

Depending on the lawful basis and the circumstances, you may have the right to:

• ask for access to your personal data;
• ask us to correct inaccurate or incomplete data;
• ask us to erase data in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to processing in certain circumstances;
• ask for data portability where applicable;
• withdraw consent where we rely on consent;
• complain to us and to the Information Commissioner's Office (ICO);
• not be subject to solely automated decisions that have legal or similarly significant effects, unless lawful safeguards apply.

Your right to object: You have the right to object to processing based on legitimate interests and to object to direct marketing at any time. If you object to direct marketing, we will stop using your data for that purpose.

How to make a data rights request

Email [email protected] with the subject line "Data protection request" or "Subject access request".

Please describe the right you want to exercise and provide enough information for us to identify you. We may ask for proof of identity or clarification where needed.

We will respond without undue delay and normally within one month. If a request is complex or you have made several requests, the law allows us to extend this by up to two further months. We will tell you if an extension is needed.

Complaints

If you are unhappy with how we use your personal data, you can make a data protection complaint by emailing [email protected] with the subject line "Data protection complaint" or by using the data protection complaint route in our Complaints Policy and Procedure.

We will acknowledge receipt of your complaint promptly. We will investigate your complaint and provide a substantive response without undue delay and, in any event, within one month of receipt, where possible. We will keep you appropriately informed of the progress of our investigation and will notify you of the outcome. If you remain dissatisfied, you can complain to the Information Commissioner's Office (ICO).

You can also complain to the ICO:

• Website: https://ico.org.uk/make-a-complaint/
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Direct marketing

We will only send marketing emails, texts, or similar electronic messages where PECR allows it. This usually means we have your consent or, for existing customers or people negotiating for similar services, we can meet the soft opt-in requirements. We will identify ourselves and give you a clear way to opt out.

You can opt out of marketing at any time by using the unsubscribe method in the message or by contacting [email protected].

Service messages about your application, enrolment, learning, funding, safeguarding, or employer account are not marketing and may still be sent where needed.

Children and young people

Some applicants and apprentices may be aged 16 or 17. We take extra care with young people's data. We aim to use clear notices, collect only what is needed, apply appropriate safeguards, involve parents or guardians only where appropriate or required, and make decisions with suitable human oversight.

Automated decisions

We do not use the website search, programme filters, application form, or enquiry form to make solely automated decisions with legal or similarly significant effects. Applications, eligibility checks, learner support decisions, and safeguarding decisions are reviewed by people.

Data accuracy and security

Please keep us informed if your contact details or learner records change.

We use technical and organisational measures to protect personal data. These include access controls, staff guidance, validation of form submissions, anti-spam checks, secure hosting practices, email and system controls, audit activity, and contractual protections with service providers.

No website, email system, or online service is completely risk-free. If we identify a personal data breach, we will assess it and notify affected individuals and the ICO where the law requires.

Changes to this policy

We may update this policy to reflect changes in our services, website features, funding rules, legal obligations, regulator guidance, or suppliers. The latest version will be published on this page.