Christie Education Privacy Policy

Privacy Policy (July 2023)

Christie Education respects your right to privacy. This Privacy Policy sets out details of the information that we may collect from you and how we may use that information; this forms part of our responsibilities in terms of the General Data Processing Regulations (UK GDPR). Please read this document carefully.

  1. About us 

  • In this Privacy Policy, references to ‘Christie Education’, ‘the School of Oncology’, ‘the School’, ‘we’ or ‘us’ are to The Christie NHS Foundation Trust, whose registered office is at The Christie Hospital, Wilmslow Road, Manchester, M20 4BX, who will be the controller of any personal data processed as described in this Privacy Statement.

  1. Context 

  • This Privacy Policy is a general statement on how Christie Education uses your personal data, and your rights as a data subject.
  • Individual services within Christie Education may have different privacy policies, as they relate to the UK GDPR. These services include, but are not restricted to: Christie Proton School, Digital Learning Team, Education Events, GatewayC, Maguire Communication Skills Team and PET CT Academy.

  1. How do we obtain your personal data?

  • Christie Education obtains data from a number of sources. These may include:
    • personal data in respect of staff, students, trainees, volunteers, and others, where there is a specific contractual relationship
    • personal data obtained as part of the registration processes for learning activities, including, study days, online learning, seminars and conferences
    • personal data supplied by organisations with whom we have a contractual arrangement, this may include Higher Education Institutions and other organisations for whom The Christie provides placements
    • personal data held within human resources services at The Christie NHS Foundation Trust;
    • personal data from third party companies for whom Christie Education is providing services.

  1. What personal information do we process?

  • Christie Education may collect, maintain and use personal data relating to or about you. This may include:
    • personal contact details such as name, job title, employer details, telephone numbers, and work and/or personal email addresses
    • special categories of personal data, including (but not restricted to) race, ethnic origin, gender
    • bank account details where required
    • a record of the details you provided on your registration documentation
    • information about you and your activities within Christie Education
    • information on any assessment/activities as part of a formal placement

  1. Who will my personal information be shared with?

  • Your personal information is shared with relevant Christie Education staff as required. In addition, it is shared as permitted or required by law, on a considered and confidential basis, with a range of external organisations or third parties, including the following:
    • The providers of any external/collaborative learning, training, work and other placements, this may include (but is not restricted to) Higher Education Institutions
    • Relevant UK Government Departments e.g. NHS England
    • Organisations with whom we have a specific contractual relationship, e.g. Cancer Research UK
    • Companies or organisations providing specific services to, or on behalf of, Christie Education under contract (a data processor)
  • Other than as set out above, we will not normally publish or disclose any personal information about you to other external enquirers or organisations unless you have requested it or consented to it, or unless it is in your vital interests to do so (e.g. in an emergency situation).

  1. Collection of information

  • When your data is processed within Christie Education we collect, store and use your personal information in line with this policy.
  • We will aim to ensure that the data we collect from you is necessary for the stated purpose.

  1. Storage of information

  • We aim to ensure that all information directly collected within Christie Education, and statutory organisations (including Higher Education Institutions) is held on secure servers, based in the UK.
  • For some third-party services, servers may be held outside the UK. This includes organisations including (but not restricted to) SurveyMonkey and Eventbrite where data is held in the United States.
  • We will aim to ensure that third parties comply with data protection requirements. This will be managed through The Christie NHS Foundation Trust Data Protection Impact Assessment (DPIA) process.

  1. Legal basis for processing your information

  • Our legal basis for collecting and using the personal information described above will depend on the information concerned and the specific context in which we collect it.
  • The lawful bases for processing are set out in Article 6 of the UK GDPR. At least one of these must apply whenever we process personal data:
    • (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
    • (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
    • (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
    • (d) Vital interests: the processing is necessary to protect someone’s life.
    • (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
    • (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)
      See the Information Commissioner's Office (ICO) guide to lawful basis for more. (accessed 7 July 2023)
  • Christie Education will normally collect personal information from you under Article 6 of the UK GDPR as follows: (i) where we have your consent to do so, (ii) where we need the personal information to perform a contract with you/on your behalf via a third party purchaser or (iii) where the processing is in our legitimate interests and not overridden by your rights.
  • For some services within Christie Education, you will be required to give your consent for your data processing; this includes data used for marketing purposes.
  • For other services, your data may be collected as part of a formal agreement for your training and development, these organisations may include NHS England and Higher Education Institutions. Your formal consent may not be required, as data sharing may be a contractual requirement of training or employment.
  • For staff at The Christie NHS Foundation Trust we may collect data, including sensitive personal data, which does not require your consent. This includes data which is required to comply with employment legislation, and also where external funding organisations, i.e. NHS England, require this to monitor our service delivery to ensure equitable access. Staff privacy management is outlined in the Staff Privacy Notice – held on the staff intranet HIVE.
  • Christie Education may also include third party systems that process data as part of delivering a service. Examples of such organisations include, but are not restricted to: Goldvision, Eventbrite and SurveyMonkey. You should consult those other parties’ privacy policies as appropriate and applicable.

  1. Disclosure of your information

  • We may disclose your personal information to third parties when required/permitted by legislation as outlined above.

  1. Data retention

  • We retain personal information we collect from you where we have an ongoing legitimate need to do so (for example, to provide you with a service you have requested, to comply with contractual requirements or to comply with accreditation by external bodies).
  • When we have no ongoing legitimate need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

  1. Your rights

  • You have rights under the UK GDPR. These include:
    • Right to be informed: You have the right to be informed about the collection and use of your personal data.
    • Right of access: You have the right to request a copy of any personal data that Christie Education collects, and how this data is used, retained and shared. There are some exemptions to this right.
    • Right to rectification: You have the right to correct, update or complete data which is inaccurate, out of date or incomplete. There are circumstances when this right does not apply, including compliance with a legal obligation.
    • Right to erasure (can also be known as the ‘right to be forgotten’): You can request that your personal data is erased or destroyed. 
    • Right to restriction: You can request that the use of your data is restricted.
    • Right to data portability: You have the right to receive your personal data in a structured and commonly used format.
    • Right to object: You have the right to object to the use or storage of your personal data. 
    • Automated individual decision making: You have the right not to be subject to automated processing, including profiling.
  • Information on your individual rights is available at The Information Commissioner’s Office (ICO).

  1. Cookies

  • Christie Education may use cookies in the collection of some information. Cookies are small files stored on your computer’s hard drive which are used to collect your personal information. You may choose to refuse cookies but, if you do so, some of the functionality of systems may no longer be available to you

  1. Research

  • Partner institutions which support various services within Christie Education may carry out research using your personal data. Where consent is required for processing, then you will be informed of the reasons for data collection.

  1. Updating this privacy statement

  • We may update or amend this Privacy Policy from time to time, to comply with law or to meet our changing service requirements. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

  1. Contacting Christie Education

  • If you have any questions, comments or complaints about this Privacy Policy, please contact us using the details below:
    Miss Friday Knight
    Head of Education Business Development
    Christie Education
    Wilmslow Road
    Manchester
    M20 4BX
    E-mail: friday.knight1@nhs.net

Last updated: November 2023

© 2024 The Christie NHS Foundation Trust