Privacy Policy - The Sutton Trust

General

Overview

In accordance with the General Data Protection Regulation (GDPR), we have implemented this privacy notice to inform you on the types of data we process about you. We also include within this notice the reasons for processing your data, the lawful basis that permits us to process it, how long we keep your data for and your rights regarding your data.

In this policy, references to ‘we’, ‘us’ or ‘our’ means the Sutton Trust of 9th Floor Millbank Tower, 21-24 Millbank, London SW1P 4QP. We are the data controller for the personal data relating to you that we collect and hold.

If you have any questions regarding our Privacy Notice and our use of your personal data or would like to exercise any of your rights, please get in touch via the following information:

Email us: [email protected]
Telephone us: 0207 802 1660
Write to us: The Sutton Trust, 9th Floor, Millbank Tower, 21-24 Millbank, London , SW1P 4QP
Data Protection Officer: Hope & May, Cobbs Wood Farm, Arrington, Hertfordshire SG8 0BP [email protected] – Helpline 0330 111 0013

If you are unhappy with the way we process your data, you can also make a complaint to the Information Commissioner’s Office (ICO) which regulates the use of information in the UK. They can be contacted by:

Telephone: 0303 123 1113
In writing: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Online: www.ico.org.uk/concerns

Data protection principles

Under GDPR, all personal data obtained and held by us must be processed according to a set of core principles. In accordance with these principles, we will ensure that:

processing is fair, lawful and transparent
data is collected for specific, explicit, and legitimate purposes
data collected is adequate, relevant and limited to what is necessary for the purposes of processing
data is kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay
data is not kept for longer than is necessary for its given purpose
data is processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction or damage by using appropriate technical or organisation measures
we comply with the relevant GDPR procedures for international transferring of personal data

Protecting your data

We take looking after your information very seriously. We have implemented appropriate physical, technical and organisational measures to ensure that your personal information is secure when under our control, both on and offline, from improper access, use, alteration, destruction and loss.

When we are provided with personal information about you, steps are taken to ensure that it is treated securely. All information we collect about you is stored securely in the offices in locked cabinets, the keys for which are also stored securely in a locked cabinet. Electronic data is stored on a secure server and is accessed via password-protected computers that are used only by our employees.

Any personal information that is shared with third parties mentioned in this privacy notices will be communicated via secure email systems. We have put appropriate systems in place to enable third parties to communicate information securely, and third parties are provided with information regarding how to do so. We cannot, therefore, be held accountable for the security of any personal information sent from a third party which is not sent via secure arrangements. Whilst we make every effort to protect your personal information we cannot guarantee the security of any information you transmit to the third parties, and you do so at your own risk.

Fundraising and marketing communications

Your contact details may be used to provide you with information about our services or our fundraising opportunities via:

Post

We may use your Consent or our Legitimate Interest to send you fundraising or marketing communications by post. If you prefer not to hear from us this way, please get in touch by using any of the contact details listed at the top of this notice.

Phone

If you have provided us with your telephone number or email address, we may contact you by phone with fundraising and marketing communication under our legitimate interest (unless you are enrolled to TPS or you told us not to do so).

Email, text or other electronic message

We will only send you fundraising and marketing communications by email, text or other electronic message if you have explicitly provided your consent or if you have been involved in a commercial transaction with us. You may opt-out of our fundraising and marketing communications at any time by clicking the unsubscribe link at the end of our marketing emails. Alternatively, you can get by using any of the contact details listed at the top of this notice.

When you give us consent to receive marketing and fundraising communications, we will monitor consent and ensure that you still wish to receive such communications by occasionally reaffirming your consent with us. Our approach is designed to uphold your privacy and information rights, to respect your choices, and to ensure we are not intrusive.

Data subjects' rights

You have the following rights in relation to the personal data we hold on you:

the right to be informed about the data we hold on you and what we do with it;
the right of access to the data we hold on you;
the right for any inaccuracies in the data we hold on you, however they come to light, to be corrected. This is also known as ‘rectification’;
the right to have data deleted in certain circumstances. This is also known as ‘erasure’;
the right to restrict the processing of the data;
the right to transfer the data we hold on you to another party. This is also known as ‘portability’;
the right to object – where we are relying on our legitimate interests to process your personal information, you are entitled, in certain circumstances to exercise your right of opposition to our use of your personal information
the right to regulate any automated decision-making and profiling of personal data – Automated decision making means making decision about you using no human involvement e.g. using computerised filtering equipment. No decision will be made about you solely on the basis of automated decision making (where a decision is taken about you using an electronic system without human involvement) which has a significant impact on you.
where you have provided consent to our use of your data, you also have the right to withdraw that consent at any time. This means that we will stop processing your data.

If you wish to exercise any of the rights explained above, please contact the Sutton Trust by getting in contact with any of the details listed at the top of this page.

We will consider all such requests and will acknowledge your request within 5 working days (and in any event within any time period required by law). Please note, however, that certain personal information will be exempt from such requests in certain circumstances. If an exception applies, we will tell you this when responding to your request. We may request that you provide us with information necessary to confirm your identity before responding.

Data security and accuracy

The Sutton Trust has an obligation under data protection legislation to keep the personal information it collects accurate and up to date. We encourage data subjects to actively update their information where they think it needs updating, however we take relevant and suitable additional steps to ensure that personal data is accurate and up to date, for example by reminding and prompting data subjects to update their personal information regularly.

We take the security of your data very seriously and ensure appropriate technical and organisational measures are in place to protect it against unauthorised or unlawful processing, and against accidental loss, destruction or damage. Your data will at a minimum always be password protected and the number of staff who can access this will be restricted to those for whom access is strictly necessary for the relevant processing. 

Transferring your information outside the UK

We may store your data outside of the UK. Where this is the case, we adhere to the UK data transfer regime. This means that if we store data in a country that is not adequate in accordance with the UK or the EU adequacy regime, we will ensure appropriate safeguards are in place. This may include but are not limited to the use of the UK Addendum in conjunction with EU Standard Contractual Clause (SCCs) or the UK International Data Transfer Agreement (IDTA). In both such cases will undertake Transfer Risk Assessments (TRAs).

Making a complaint

Privacy notice review

This privacy notice and the associated annexes are kept under regular review. If our practices change, or there are changes to the law, we may need to amend or update this privacy policy. Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email.

This privacy notice was last updated in August 2023. 

Privacy notice for applicants to Sutton Trust funded programmes

About the Sutton Trust programmes

The Sutton Trust programmes are run in partnership with universities and third-party organisations. This means the information you provide on your application form will be stored by both The Sutton Trust and the delivery partner you take the programme with, and the delivery partner may share any updates to your information with us for our records. The delivery partner you apply to may share their own data privacy notice with you as we act as separate Data Controllers of your data.

Throughout this privacy policy we use language which can be defined as: 

Programme: The Sutton Trust programme or activity that you have applied to for example, UK Summer School or Pathways to Law 
Delivery partner: Delivery partners are organisations that are involved in running the programme for example a university, additional service provider, work experience provider or corporate partner.
Evaluation partner: An evaluation partner is an organisation or individual whom The Sutton Trust contracts to evaluate the programme by looking at data including your application form and survey responses. Please see our list of evaluation partners under the section entitled Evaluation partners below.
Personal information or data: Any data relating to you which identifies you (such as your name) or could indirectly identify you (such as an online identifier).

Type of data held

Depending on your type of engagement with The Sutton Trust, we may process the following types of data:

Basic personal details (Name, date of birth, gender)
Contact details (Email address(es), physical addresses, phone number(s) 
Special categories of data (Ethnicity and data concerning health e.g. disabilities, medical history, special educational needs)
The Sutton Trust programme (Programme applied to, course applied to, programme engagement data e.g. sessions attended, engagement with Sutton Trust Online)
Education data (School, academic performance and academic interests)
Suitability for our programmes (School, postcode, first generation status, Free School Meal status, in care status)
Outcome data (Responses to surveys)
Destination data (University enrolment, financial aid details)
Media (Photographs, case studies, quotes from social media)
Impact data (see section 4 for more information)

How we collect your information, how we use it and lawful basis applied

In the following table, we explain the purpose for which we collect and use your personal information, and our legal basis for processing your personal information for that purpose, by reference to the categories of personal information which we (or third parties on our behalf) will collect. 

Please refer to section 3 to identify the relevant data categories. 

What we do	Data categories (see section 3)	Legal basis
We use the personal data you provide in your programme application form to process your application and access your eligibility for our programmes.	1, 2, 3, 4, 5, 6	Legitimate Interests: For other personal data you provide us for this purpose, we rely on our legitimate interests to provide you with the opportunity to gain a place on the programme and ensure we can provide adequate support. When processing special category of data, we rely on additional legal conditions to support our legitimate interest.
We use the personal data you provide to deliver the elements of the programme run by The Sutton Trust.	1, 2, 3, 4, 5, 6	Legitimate Interests: For other personal data you provide us for this purpose, we rely on our legitimate interests to deliver the elements of the programme run by us When processing special category of data, we rely on additional legal conditions to support our legitimate interest.
We use eligibility, outcome and impact data to produce reports to show who is on our programmes and the effect the programme has had. These reports will always be in aggregate form – we will not say anything in our reports that could identify you as an individual	4, 5, 6, 7, 8, 10	Legitimate Interests: Our legitimate interests are that The Sutton Trust needs to evidence the reach and effectiveness of its programmes to funders, donors and trustees. As a social mobility charity, The Sutton Trust also aims to demonstrate the impact of its programmes on social mobility over time
We will share your data with evaluation partners. We will have data sharing agreements in place that confirm that those third parties with whom we share your personal information will process your information in compliance with all data protection laws	1, 3, 4, 6	Legitimate Interests: For other personal data you provide us for this purpose, we rely on our legitimate interests to provide you with the opportunity to gain a place on the programme and ensure we can provide adequate support When processing special category of data, we rely on additional legal conditions to support our legitimate interest.
We, our evaluation or delivery partners, will ask you to complete surveys and will link these to the data you provide in this application	1, 2, 4	Legitimate Interests: Our legitimate interests are that The Sutton Trust needs to evidence the reach and effectiveness of its programmes to funders, donors and trustees. As a social mobility charity, The Sutton Trust also aims to demonstrate the impact of its programmes on social mobility over time
The Sutton Trust will share your name, date of birth, postcode, school and contact details with university partners for admissions purposes. This is so our university partners can identify if an individual has applied to that university to highlight their eligibility for contextual offers and bursaries Universities may then contact you to give you further information.	1, 2, 4, 5, 6	Legitimate Interest: We rely upon our legitimate interests to provide you with the opportunity to benefit for any contextual admissions you may be eligible for by participating in the Programmes
We use photographs, film and case studies to demonstrate impact and promote the programme, including reporting to donors, website publications, marketing material, social media and electronic newsletters. Images and case studies may also be shared with the local and national press as part of public relations exercises and press releases	1, 4, 9	Consent: We will only collect, store and use your image if you provide us with explicit consent. Consent can be withdrawn at any time
We will share your personal data with the partner delivering the programme for monitoring, selection and delivery purposes. We will have data sharing agreements in place that confirm that those third parties with whom we share your personal information will process your information in compliance with all data protection laws	1, 2, 3, 4, 5, 6	Legitimate Interests: Our legitimate interests are that The Sutton Trust and delivery partners need this information to make application decisions for the programme and ensure that we are providing the right support for you.
We monitor your engagement on the programme e.g. sessions attended	1,4	Legitimate Interests: Our legitimate interests are to monitor student engagement with the programme so that we can plan activities, ensure programme success and evaluate the programme effectively.
We look at where you go to university and what jobs you do in the future. We do this so that we can measure the impact that our programmes have on participants and ensure the programme is meeting its aims of increasing access to selective universities and careers (see section 4 for more information)	10	Legitimate Interests: Our legitimate interests are that The Sutton Trust needs to evidence the reach and effectiveness of its programmes to funders, donors and trustees. As a social mobility charity, The Sutton Trust also aims to demonstrate the impact of its programmes on social mobility over time

Who we share your data with

Delivery partners 

To deliver the programme, The Sutton Trust and delivery partner will share your full application, e.g. we will share with the university you have applied to or vice versa. We will also share your contact details and access needs with other delivery partners to deliver the programme. i.e. if your programme includes a work experience placement, we will share your information with the placement provider. 

Our delivery partners may assess your eligibility for the programme using their own systems and may share your data with funding and research bodies to demonstrate the impact and reach of the programme. They are responsible for compliance in storing and processing your data once The Sutton Trust has shared it as they also become a “controller”. They may be in touch to share their own procedures with you. 

Our delivery partners include for example universities, additional service providers, work experience providers or corporate partners.

Evaluation partners 

The Sutton Trust will share your data with our evaluation partners so they can evaluate the effectiveness of the programme. This will include: 

The programme criteria that you meet e.g. free school meal status, school performance, first generation, in care status 
Responses to surveys 
Name* 
Date of birth* 
Postcode* 
Gender 
Ethnicity

*This data will only be shared if it is needed to match your application to your survey responses. We will anonymise data sets, wherever practicable. 

Our evaluation partners will be under contract with us as a data “Processor”, meaning that they cannot use your data for their own purposes. They are appointed each year and will vary depending on the programme. 

Our evaluation partners include: Higher Education Access Tracker (HEAT), The Bridge Group, Institute for Employment Studies (IES), University and Colleges Admission Service (UCAS).

Impact data 

The Sutton Trust will look at where you go to university and what jobs you do in the future. We do this so that we can measure the impact that our programmes have on participants and ensure the programme is meeting its aims of increasing access to selective universities and careers. 

Impact data will be collected by the Higher Education Access Tracker (HEAT) or our evaluation partners and we will share the following information to access the data sets: 

Name 
Date of birth 
Postcode 
Programme attended 
The programme criteria that you meet e.g. free school meal status, school performance, first generation, in care status

Retention periods

The Sutton Trust will store your full application for 2 academic years following the completion of the programme to respond to queries that may arise during this period. Following this, The Sutton Trust will delete your application but will store the information needed to track your education outcomes, this includes your name, date of birth, school, postcode and contact details in order to send you surveys. We will also keep information on your eligibility for the programme. This data will then be stored based on the two categories below: 

Successful applicants 

If you gain a place on our programme, we will retain your name, date of birth, programme attended and educational outcomes under legitimate interests for lifelong alumni relations, please see the alumni programme privacy notice below. If you choose to stay on our alumni network, we will retain your contact information for these purposes. 

Unsuccessful applicants 

If you did not gain a place on our programme, we will delete all identifiable information we store after collection of your impact data and will retain an anonymised version of your eligibility for the programme and educational outcomes until we no longer have a legal basis to do so. 

The Sutton Trust may also keep your personal information, without processing it, as required to comply with applicable laws, for our legitimate charitable purposes and to establish, exercise or defend our legal rights.  

This privacy notice was last updated in August 2023.

Safeguarding policy

Sutton Trust Online

Terms of service

Thank you for visiting online.suttontrust.com (the “Sutton Trust Online Platform”). Sutton Trust Online (online.suttontrust.com) is a platform operated by Sutton Trust (“the Trust” / “we” / “our” / “us”). It can only be accessed if you have an account with us. 

The following terms and conditions (“Terms”) govern your use of Sutton Trust Online (STO) and you should read them carefully before using the platform. In particular, for details on the cookies we use and how to change your browser settings, please see our Sutton Trust Online Cookies Policy. 

Sutton Trust Online is delivered in partnership with three partners: Komensky, Causeway Education, and The Access Platform. 

To contact us, please email [email protected]. 

Who do these terms apply to?

These Terms apply to: 

“Visitor(s)” to Sutton Trust Online, i.e. someone who visits and/or uses Sutton Trust Online; 
“Student(s)” using Sutton Trust Online, i.e. someone who uses the Sutton Trust Online Platform to receive support with future options, exploring universities and apprenticeships, personal statement support and engaging with our university ambassadors and programme alums; 
“University or Delivery Partners(s)” using Sutton Trust Online, i.e. someone who uses Sutton Trust Online in a teaching or supervisory capacity, for example, to run your programme, send you information about your programme, speak at webinars; 
“Platform Partners”, i.e. someone who has been given administrative access rights to Sutton Trust Online and is using Sutton Trust Online to administer Students’ use of the Sutton Trust Online Platform and carry out necessary tasks.

Accessing Sutton Trust Online

By using Sutton Trust Online, you confirm that you accept these Terms of Use and that you agree to comply with them. 
If you do not agree to these Terms of Use, you must not use the Sutton Trust Online.

We may make changes to Sutton Trust Online

We may update and change the Sutton Trust Online from time to time to reflect changes to, for example, our users’ needs or technical, operational or other business priorities. 

We may suspend of withdraw Sutton Trust Online

We do not guarantee that Sutton Trust Online, or any content on it, will always be available or be uninterrupted. We may suspend or withdraw or restrict the availability of all or any part of Sutton Trust Online for business, technical and/or operational reasons. We will try to give you reasonable notice of any suspension or withdrawal. We will not be liable to you if, for any reason, Sutton Trust Online is unavailable at any time. 

You must keep your account details safe

If you choose, or you are provided with, a username, password or any other piece of information as part of our security procedures, you must treat such information as confidential. You must not disclose it to any third party. 

We have the right to disable your username or password, whether chosen by you or allocated by us, at any time, if in our reasonable opinion you have failed to comply with any of the provisions of these Terms of Use. 

If you know or suspect that anyone other than you know your user identification code, username or password, you must promptly notify us at [email protected]. 

Using material on Sutton Trust Online

How you may use material on Sutton Trust Online

The Sutton Trust, the platform partners and universities own or licence any and all intellectual property rights in Sutton Trust Online and in the material published on it. Those works are protected by copyright laws and treaties around the world. All such rights are reserved. 

Our status (and that of any identified contributors) as the authors of content on Sutton Trust Online must always be acknowledged. 

You must not copy or download any part of the content or materials on Sutton Trust Online for commercial purposes. 

If you print off, copy or download any part of Sutton Trust Online in breach of these Terms of Use, your right to use Sutton Trust Online will cease immediately and you must, at our option, return or destroy any copies of the materials you have made. 

We are not responsible for websites we link to

Where the Sutton Trust Online contains links to other sites and resources provided by third parties, these links are provided for your information only. We have no control over the contents of those sites or resources. 

We are not responsible for viruses, and you must not introduce them

We do not guarantee that Sutton Trust Online will be secure or free from bugs or viruses. You should use your own virus protection software. 

You must not misuse Sutton Trust Online by knowingly introducing viruses, trojans, worms, logic bombs or other material that is malicious or technologically harmful. You must not attempt to gain unauthorised access to Sutton Trust Online, the server on which Sutton Trust Online is stored or any server, computer or database connected to Sutton Trust Online. You must not attack Sutton Trust Online via a denial-of-service attack or a distributed denial-of service attack. By breaching this provision, you would commit a criminal offence under the Computer Misuse Act 1990. 

We will report any such breach to the relevant law enforcement authorities and we will co-operate with those authorities by disclosing your identity to them. In the event of such a breach, your right to use Sutton Trust Online will cease immediately. 

To the fullest extent permissible by law, we will not be liable to you for any loss or damage caused by a distributed denial-of-services attack, viruses, or other technologically harmful material that may infect your computer equipment, computer programs, data or other proprietary material due to your use of Sutton Trust Online or to your downloading of any material posted on it, or any website linked to it. 

Interacting on Sutton Trust Online

Interacting with our alumni community, university ambassadors, staff or employers

a) You may not post violent, nude, partially nude, discriminatory, unlawful, infringing, hateful, disturbing, pornographic, or sexually suggestive photos or other content via the chat feature on Sutton Trust Online, and you must not encourage or incite others to do so. We will not tolerate racism, sexism, homophobia or other forms of hate-speech, or contributions that could be interpreted as such. Criticising people on the basis of their race, religion, sex, gender, sexual orientation, disability or age is unacceptable and will not be tolerated in any context.

b) You may not defame, stalk, bully, abuse, harass, threaten, impersonate or intimidate people or entities and you must not post private or confidential information via the platform, including your or any other person’s credit card information, social security or alternate national identity numbers, non-public phone numbers or non-public email addresses.

c) You may not use the platform for any illegal or unauthorized purpose. You agree to comply with all laws, rules and regulations applicable to your use of the platform and your User Content, including copyright laws.

d) You must not interfere with, damage or disrupt the Network or servers or networks connected to the platform, including by transmitting any worms, viruses, spyware, malware or any other code of a destructive or disruptive nature. You may not access, without our authority, any part of the platform or any software used in its provision.

e) You must not create accounts with the platform through unauthorized means, including but not limited to, by using an automated device, script, bot, spider, crawler or scraper.

f) You must not attempt to restrict another user from using or enjoying Sutton Trust Online, and you must not encourage or facilitate violations of these Terms of Use.

g) We reserve the right to remove or edit any User Content we deem to be unreasonable in this respect, and to restrict or terminate the access of any user account that we deem (in our sole discretion) to be in breach of this provision.

h) You must not reproduce, duplicate, copy or re-sell any part of the platform in contravention of the provisions of our Terns of Use.

Complaints

You may submit a complaint about content that you believe violates our terms of service on Sutton Trust Online. To do this, please email [email protected] with a link to the relevant content and any details. We aim to respond within five working days.

If content is found to be offensive the user who posted the content will be contacted to let them know their post has been deleted, and to remind them about our community standards.

If you are not happy with our response you can follow our complaints procedure.

Prohibited uses

You may only use Sutton Trust Online for lawful purposes. You may not use Sutton Trust Online: 

in any way that breaches any applicable law or regulation; 
in any way that is unlawful or fraudulent, or has any unlawful or fraudulent purpose; 
for the purpose of harming or attempting to harm others in any way (including bullying, intimidating, abusing, threatening, harassing, defaming or violating any rights of another person, including students, staff, alums, university ambassadors or volunteers); 
to send, knowingly receive, upload, download, use or re-use any material; 
or to knowingly transmit any data, send or upload any material that contains viruses, Trojan horses, worms, time-bombs, keystroke loggers, spyware, adware or any other harmful programs or similar computer code designed to adversely affect the operation of any computer software or hardware.

You also agree not to: 

reproduce, duplicate, copy or re-sell any part of Sutton Trust Online in contravention of the provisions of our Terms of Use; access without authority, interfere with, damage or disrupt: 
any part of Sutton Trust Online; or any equipment or network on which Sutton Trust Online is stored; 
access Sutton Trust Online through accounts of other Students, or misrepresent the source, identity, or content of information transmitted via Sutton Trust Online or perform any other similar fraudulent activity; 
directly or indirectly transfer any data you receive from us to (or use such data in connection with) any social network or similar third party, even if a student, alum, member of staff, university ambassador or volunteer consents to such transfer;  
or sell or distribute any information or content provided by or related to us or modify, adapt, translate or create derivative works based on statements or material on Sutton Trust Online.

Breach of this policy

We will determine, in our discretion, whether there has been a breach of the provisions of this Acceptable Use Policy. When a breach has occurred, we may take such action as we deem appropriate. 

Failure to comply with the provisions of this Acceptable Use Policy, constitutes a material breach of our Terms of Use upon which you are permitted to use Sutton Trust Online, and may result in us taking any or all of the following actions: 
Temporary or permanent removal from Sutton Trust Online; 
disclosure of information to the police if we reasonably feel it is necessary. 
The responses described in this Acceptable Use Policy are not limited, and we may take any other action we reasonably deem appropriate.

Cookie policy

We collect information about your visits to STA website using cookies (the latter is anonymised). The information is invaluable to us to improve our website and ensure you are shown relevant content.

Essential cookies or essential tracking technology will not require your consent as they are necessary for the functionality of the platform. These also include cookies and tracking technology to allow the correct logging-in on the platform, keeping records of liked contents, keeping records of your progress on your personal statement (OSCAR section) and keeping records of messages sent and received via the Access Platform (STO chat).

Non-essential cookies will require your consent which you are able to grant via the banner visible on the online platform in compliance with data protection legislation’s requirements. The banner allows you to identify what non-essential cookies are available and for what functions, and choose which ones you are happy to consent to.

These terms of use were last updated in December 2023. 

Alumni

Alumni and The Sutton Trust Alumni (STA)

1. About the Alumni programme

As an alumnus of the Sutton Trust, you are important to us. We value our relationship with you and would like to send you relevant communications, offering beneficial services, thanking you for your support, sharing future opportunities for providing support which may be of interest to you, and measuring the impact of the programmes we run.

The online platform, “Sutton Trust Alumni (STA)”, is delivered in partnership with Komensky. They will have access to personal information stored on STA in their role as our IT service provider, but are not permitted to use your personal information for their own purposes, other than measuring the effectiveness of their services, and must only process your personal information in accordance with our instructions.

2. Type of data held

When engaging in our Sutton Trust Alumni programme, we may process the following information about yourself:

Basic personal details (Name, date of birth). Gender, disability and ethnicity may also be processed where relevant to the specific alumni bursary which require anonymised reports on demographic breakdown.
Contact details (Email address(es), physical addresses, phone number(s), LinkedIn and Facebook URL) 
The Sutton Trust programme (The programme itself (e.g. ‘Summer School’), the partner institution (e.g. the University of Bristol), and the year in which you did your programme
Your attainment (How you engage on your Sutton Trust programme, your engagement at university, your graduate destination)
Suitability for our programmes (School, postcode, first generation status, Free School Meal status, in care status)
Professional details (Where you work or have worked, the positions you have held, the industries you have worked in, the skills you have gained, and when you started or ended working in those roles) Volunteering preferences (Which volunteering roles you have indicated you are interested in)
Relationships (Your relationships to other alumni, supporters and relevant network)
Your support for the Sutton Trust (Your past donations and the details of any volunteering roles you have had)
Your engagement with the Sutton Trust and our programme partners (Your event attendance, your direct communications with us, your engagement with our communications, your use of Sutton Trust Alumni – for example the groups or events you join, or when you message other users)

3. How we collect your information

Most of the data we hold is from the information you provided to the Sutton Trust when you registered for your programme, or is information you provided when you created or edited your alumni profile (through our online platform, “Sutton Trust Alumni (STA)” or our previous digital software). You may also have provided information over email, via surveys, post, over the phone, or in conversation. Where relevant and feasible, and in a manner appropriate to the way in which the data is collected, at the point when Alumni Users update their data outside of Sutton Trust Alumni, for example over email or other digital means, over the phone, or in person, the following points will be made: that the Sutton Trust is collecting your personal information; the reasons for our collection of your data; your rights in relation to our collection of data ; and the location of our full privacy statement.

We sometimes obtain information about you from publicly available sources. For example, social networking sites, company websites, publications like Who’s Who, dedicated business websites (e.g. Companies House) or publications and articles in the media (e.g. Queen’s Honours List), and may use trusted external companies to do this on our behalf. If you choose to participate in a specific alumni programme run in partnership with an external organisation, we will share relevant data for your participation in the programme and they will share with us data about your engagement.

We also analyse personal data we collect about you to create additional information about you. For example, to assess your level of engagement, your likelihood and capacity to donate or volunteer and potential areas of interest for future communications. We use this information to help us to improve the alumni relations programme, including our fundraising programme.

4. How we use it and lawful basis applied

The personal information you provide to the Sutton Trust, including to STA, and via other means described in section 3 above, will be used in the ways described below.

Our use of your personal information	The categories of data we use	Our legal basis for processing your personal information
We use the categories of your Alumni Personal Information listed to design and deliver the network and services which make up the alumni relations programme (events, news, volunteering opportunities, messages from our partners, other opportunities). For example we may use your Alumni Personal Information to analyse the feasibility of holding events in a specific location by looking at your current city; or we might use your Alumni Personal Information to improve our alumni volunteering programme by sending targeted messages based on your previous support for us.	1 to 10	We are using your Alumni Data in this way because it is in our legitimate interest. We need to use this information to allow us to design and deliver the programme to suit the needs of the Trust’s alumni community, and to build greater engagement with our volunteering and fundraising opportunities. If you no longer wish to engage with our alumni programme, however, we will not process your information in connection with this purpose.
We use the categories of your Alumni Personal Information listed to give you access the services which make up the alumni relations programme (events, news, volunteering opportunities, other opportunities). We contact you with information about the various programs, which may include content from our partners. We will occasionally use your background information to send targeted messages to you – for example based on your interests or where you live.	1, 2, 3, 6, 7, 10	In order for you to attend events, volunteer, receive relevant messages related to the delivery of the alumni relation programs (e.g. event booking confirmations, correspondence related to volunteering opportunities you sign up for), be informed of opportunities or participate in our alumni fundraising programme, we need to use your Alumni Personal Information. We are using this information under our legitimate interest in order to provide you with the most relevant and timely communication, providing you with an improved experience. Profiling also allows us to target our resources effectively, which alumni consistently tell us is a key priority for them. Importantly, it enables us to engage the right people with the right activity to ensure more engagement in the most cost-effective way.
We use the categories of your Alumni Personal Information listed to enable you to access and utilise STA.	1 to 10	In order for you to activate your STA account, receive relevant messages, update your profile, and receive relevant messages related to your preferences and interests, we need to use your Alumni Personal Information. We are using this information under the basis of the contract that is enacted in order for you to use our services.
We use the categories of your Alumni Personal Information listed to develop, deliver and evaluate our fundraising programme.  This mainly involves our smaller regular giving campaigns. It also includes our work to identify donors who could make more substantial gifts. We will assess the feasibility that you may be able to make substantial gifts by assessing details such as your postcode, job title, and information from publicly available sources. This helps to ensure that communications and approaches are relevant and timely, it allows us to target our resources effectively, and it provides an improved experience for our supporters. Importantly, it enables us to raise more funds, sooner, and more cost-effectively, than we otherwise would, so that we can improve social mobility.	1, 2, 3, 6	We are using your Alumni Data in this way because it is in our legitimate interest. We need to use this information to allow us to design and deliver a fundraising programme, so that we can continue to work to improve social mobility in the United Kingdom. We also need to be able to evaluate our fundraising programmes using your data. If you no longer wish to engage with our fundraising programme, we will not process your information in connection with this purpose.
We use the categories of your Alumni Personal Information listed to evaluate and improve the Sutton Trust’s core and alumni relations programmes.	1, 2, 3, 6, 7, 10	This activity is in our legitimate interest in order to improve the effectiveness of our programmes to funders, donors and trustees. As a social mobility charity, The Trust also aims to demonstrate the impact of its programmes on social mobility over time.

5. Who we share your data with

Delivery partners

To deliver your programme, The Trust will have shared your full application with the university you applied to. We will occasionally need to share your contact details and access needs with other delivery partners to deliver events or opportunities within the alumni programme. i.e. a work experience placement provider or company hosting an event for alumni.

If you choose to interact with these partners, it will be necessary for us to share some of your personal information with them. This will include:

Your name
Your email address
Your current address
Any education history you have shared with us (degree, university, subject)

We do this in order to make the process of signing up for their services easier. In addition, our partners will tell us about your engagement with the opportunities and services they offer. This could include your attendance at events, the type of content you are interested in, or jobs you have applied for.

These partners will assess your eligibility for the programmes they run using their own systems. They will ask you for additional data, and are separately responsible for compliance in storing and processing the data The Trust has shared with them, in addition to any additional data you supply to them. They will be in touch to share their own procedures with you.

Our delivery partners are:

Connecthive (mentoring provider);
Current programme partners including JP Morgan Chase (for the Opportunity Bursary programme) and Bloomberg (for the Career Skills Bursary programme);
Fulbright Commission, current university partners

Sutton Trust programmes partners

As part of the alumni relations volunteering programme, some individuals who work for the partners who deliver our core programmes (for instance our Summer Schools) will also have accounts on STA. This group of partners will contact you on the STA portal regarding specific opportunities should you indicate that you are interested in hearing from them, either as part of the process of signing up to STA, by making changes to your personal profile, or by indicating by email, phone, or in conversation with them that you would be interested in those opportunities.

Our partners will assess your eligibility for the programmes they run using their own systems. They are responsible for compliance in storing and processing your personal information, and they will be in touch to share their own procedures with you.

Evaluation partners

The Trust will share your data with our evaluation partners so they can evaluate the effectiveness of the alumni relations programme, and the Sutton Trust’s core programmes (the programme to which you originally applied, for example a Summer School). Our evaluation partners are appointed each year and will vary depending on the programme. A list of the evaluation partners the Trust currently works with are included in Annex B.

We, or our partners, will ask you to complete surveys and will link these to the data you provide to us on STA. We will also link the data you provide to additional educational data sets to evaluate your future educational and career outcomes. This will include looking at where you go to university and what jobs you do in future. We do this so that we can measure the impact that our programmes have on participants and ensure the programme is meeting its aims of increasing access to selective universities and careers.

We will not say anything in our reports that could identify you and will not use your data in a way that would affect you individually. We have data sharing agreements in place to ensure that your data is protected and partner organisations will adequately protect your data.

Our evaluation partners include: Higher Education Access Tracker (HEAT), The Bridge Group,  Institute for Employment Studies (IES), University and Colleges Admission Service (UCAS). 

Other users of the Sutton Trust Alumni platform

STA is designed to foster connections between alumni of the Sutton Trust’s programmes. As such, many of the Alumni Personal Information you supply will be displayed to other users of the platform, including our partners who have access to the platform, as mentioned earlier. You have control over what information you would like to be shared and you can update this at any time by updating your personal profile (called ‘My Profile’), or by getting in touch with us.

6. Retention period

We hope that your relationship with the Trust will be a lifelong one, and in recognition of the lifelong nature of your relationship with the Trust, we will store and use your Alumni Personal Information for as long as you remain an alumnus of the Sutton Trust and we continue to run our alumni programme, or until we no longer have a basis upon which we can legally store or use your information (see section 4 for more information about the bases upon which we use your personal information).

You have certain rights in relation to your personal information, including the right to ask us to stop using information about you.  If you no longer wish to be a part of the Sutton Trust alumni programme, or a member of Sutton Trust Alumni, please contact us via the details provided below.

Please note that the personal information we collect in relation to Sutton Trust alumni is processed differently to how your student application data is processed. For more information on the latter, please view the appendix 4 of the Privacy notice – Programmes.

This privacy notice was last updated in Deecember 2023. 

Sutton Trust Alumni (STA) – Terms of Use

1. In brief

Please review these terms of use (“Terms of Use”) carefully prior to using our Sutton Trust Alumni platform.  

These Terms of Use are effective as of December 2023. 

By signing up to Sutton Trust Alumni you accept the full terms of use as detailed below. For your ease, we have summarised the main points: 

If you are unable to abide by the following requirements, you should not use Sutton Trust Alumni 
If you would like to get in touch with us, please email: [email protected], or call on +44 (0207) 802 1660 
These terms of use should be understood alongside our privacy policy and cookie policy. 
We may from time to time make changes to our terms of use 
We may from time to time make changes to Sutton Trust Alumni, and we cannot guarantee that the service will be available uninterrupted 
You agree to provide accurate information, and to be responsible for activity that occurs on your account. You must keep your password secure, and must notify us of any breach of your account. We may terminate your account should you violate these terms of use. 
The Trust owns the intellectual property for the content we create on Sutton Trust Alumni, you should not use this content for other ends, and you should treat the content as information only 
You own the intellectual property for content you create, and you should ensure that you have permission to share this content 
You should be careful of the content you post – it should not be offensive, as per the categories set out in section 8 of the terms of use. You should be sensitive of the way you treat others, and should not use Sutton Trust Alumni for any illegal purposes. You should not interfere with Sutton Trust Alumni, create unauthorised accounts, or attempt to restrict others from using it. You should not unreasonably financially or politically profit from Sutton Trust Alumni, and should not reproduce content. You should also be careful not to imply that the Trust endorses or is responsible for content you create. 
You are encouraged to report any inappropriate content to [email protected] immediately. 
You have read and understood how we use your details in accordance with our privacy policy. 
We do not seek to exclude or limit in any way our liability to you where it would be unlawful to do so
We can delete your account should you breach these terms of use, and we can also cease offering Sutton Trust Alumni should we decide to 
We do not endorse or accept responsibility for any third-party websites linked to 
You may not use the Sutton Trust name without our approval 
The full terms of use below are governed by English Law 
If any of these terms of use cannot be upheld, the other terms will still apply

2. What is in these Terms of Use? 

These Terms of Use set out the rules for using our platform, Sutton Trust Alumni, (the “Network”). Specific information on each section can be found below: 

By using the Network you accept these Terms of Use.
Who we are and how to contact us.
Other terms that apply to you.
Changes to these terms.
Changes to the Network.
Your user account on the Network.
Your use of our Content on the Network.
Prohibited uses of the Network.
Reporting prohibited conduct or User Content.
Privacy and Confidentiality.
Our liability to you.
Account Termination Policy.
Links to Other Networks.
Your use of our names and trademarks.
Governing Law.
General.

3. By using the Network you accept these Terms of Use 

By accessing or using Sutton Trust Alumni (the “Network”), or by logging into the site with your allocated User ID, you agree to be bound by these Terms of Use. 

Please review these Terms of Use carefully prior to using the Network.  If you do not agree with these Terms of Use, please do not use the Network. 

The Network comprises a suite of online services provided by the Sutton Trust, including but not limited to: 

A directory 
Events 
Groups 
Volunteering opportunities

These Terms of Use govern your use of each component of the Network. 

Users under the age of 18 will have different permissions. You are required to ensure that your birthday is accurate when activating your account. By using the Network, you acknowledge and agree that you are able to enter into and comply with these Terms of Use. 

4. Who we are and how to contact us 

The Network is owned and operated by the Sutton Trust (“We” or “Us“). We are a charity registered in England and Wales under charity number 1146244 and have our registered office at The Sutton Trust, Millbank Tower, 21-24 Millbank, London, SW1P 4QP. 

We are registered with and regulated by the Charity Commission. 

To contact us, please email [email protected], or  call us on 0207 802 1660. 

The Sutton Trust may contact you by email in relation to your participation, especially where an issue comes up in relation to these Terms of Use. Any advice we give/request we make should be adhered to, as we are responsible for enforcing the community standards and creating a constructive environment for everyone who is a member of the Network. 

5. Other terms that apply to you

These terms of use refer to the following additional terms, which also apply to your use of our site: 

Our Privacy Policy. Please see section 10 below for more information. 
Our Cookie Policy, which sets out information about the cookies on our site. 
Our safeguarding policy

6. Changes to these terms 

Please note that these Terms of Use are subject to change from time to time. Any changes will be posted to this page. Every time you wish to use our site, please check these terms to ensure you understand the terms that apply at that time. These terms were most recently updated December 2023. 

Your use of this Network or any Network Content after any changes have been made will constitute your agreement to the modified Terms of Use. 

7. Changes to the Network 

We may update and change the Network from time to time to reflect changes to our users’ needs and our priorities, and to help ensure that the Network remains relevant and useful to our users. We will try to give you reasonable notice of any major changes. 

However, the Network is made available free of charge and We do not guarantee that our Network, or any content on it, will always be available or be uninterrupted. We may suspend or withdraw or restrict the availability of all or any part of the Network for business and operational reasons. We will try to give you reasonable notice of any suspension or withdrawal. 

8. Your user account on the Network 

You agree to provide accurate and complete information when updating your account.  You are solely responsible for the activity that occurs on your user account, and you must keep your account password secure.  You agree to notify us immediately at [email protected] of any unauthorized use of your account or other breach of security.  You may not use another’s account without permission. 

User accounts may not be shared, transferred, or sold to other parties, nor are they to be used by or made available to any person or entity except the registered user. 

We may terminate your account if you violate any provision of these Terms of Use or fail to comply with requests concerning your account. 

9. Your use of our Content on the Network

9a) The Network and any data, text, files, information, usernames, images, graphics, photos, profiles, audio and video clips, sounds, works of authorship, applications, links, and other content or materials (collectively, the “Network Content”) belong to Sutton Trust and are protected by intellectual property laws. As between you and the Sutton Trust, the Sutton Trust owns all rights in the Network and the Network Content.

9b) You may use the Network and the Network Content only in the manner and for the purposes specified in these Terms of Use. Except as specifically permitted by these Terms of Use, you may not modify, transmit, produce, distribute, display, sell, license, broadcast, or otherwise make available in any form or by any means any part of the Network or the Network Content without our express written permission.

9c) The Network Content is provided for general information only. It is not intended to amount to advice on which you should rely. You must obtain professional or specialist advice before taking, or refraining from, any action on the basis of the Network Content. Although we make reasonable efforts to update the information on the Network, we make no representations, warranties or guarantees, whether express or implied, that the content on our site is accurate, complete or up to date.

10. Prohibited uses of the Network 

10a) You may not use the Network for any illegal or unauthorized purpose. You agree to comply with all laws, rules and regulations applicable to your use of the Network and your User Content, including copyright laws.

10b) You must not interfere with, damage or disrupt the Network or servers or networks connected to the Network, including by transmitting any worms, viruses, spyware, malware or any other code of a destructive or disruptive nature. You may not access, without our authority, any part of the Network or any software used in its provision.

10c) You must not attempt to restrict another user from using or enjoying the Network and you must not encourage or facilitate violations of these Terms of Use.

10d) You must not reproduce, duplicate, copy or re-sell any part of the Network in contravention of the provisions of our Terns of Use.

10e) Other prohibited activities include, but are not limited to:

use for the purposes of harming or attempting to harm minors; 
use that inaccurately implies endorsement, approval, or sponsorship by the Sutton Trust (or any individual officer or employee of the Sutton Trust); 
use that can be confused with official communications of the Sutton Trust or its officers or employees; and 
print or electronic mass mailings (sometimes known as “spamming”), solicitations for commercial Networks.

11. Reporting prohibited conduct or User Content 

You may submit a complaint about content that you believe violates our terms of service on Sutton Trust Alumni. To do this, please email [email protected] with a link to the relevant content and any details. We aim to respond within five working days.

If content is found to be offensive the user who posted the content will be contacted to let them know their post has been deleted, and to remind them about our community standards.

If you are not happy with our response you can follow our complaints procedure.

12. Privacy and Confidentiality 

12a) We agree to use your User Content in compliance with the privacy policy of the Network, together with any Network-specific data use policies, privacy statements and privacy notices (collectively, “Privacy Policies”).

12b) We will treat your User Content as confidential information in accordance with the Sutton Trust policies, and only use and disclose it in accordance with these Terms of Use and the Privacy Policies.

13. Our liability to you 

The Network and all its content are provided “as is” and without warranties of any kind, express or implied. 

We do not seek to exclude or limit in any way our liability to you where it would be unlawful to do so. 

If you are a business/commercial user or you use the Network for any commercial purposes, we will not be liable to you for any loss or damage, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, even if foreseeable, arising under or in connection with: (i) use of, or inability to use, the Network ; or (ii) use of or reliance on any content displayed on our Network; (iii) our termination or restriction of your access rights to use the Network. In particular, we will not be liable for any: loss of profits, sales, business, or revenue; business interruption; loss of anticipated savings; loss of business opportunity, goodwill or reputation; or any indirect or consequential loss or damage.

14. Account Termination Policy

The rights granted to you hereunder will terminate automatically upon any breach by you of these Terms of Use, unless the Sutton Trust otherwise specifically agrees in writing, but the other provisions of these Terms of Use will survive any such termination. 

We reserve the right at any time in our sole discretion to cease providing any Network Content, to change or discontinue any aspect or element of the Network, or to cease making the Network available.

15. Links to Other Networks 

The Sutton Trust may provide links to websites operated by third parties, including but not limited to, websites operated by the Sutton Trust, LinkedIn, or job sites as a convenience for our users.  The Sutton Trust does not endorse or accept responsibility for the content or the use of third-party websites.  If you use third-party sites, you do so solely at your own risk. Links do not imply that the Sutton Trust is affiliated or associated with any linked site.

16. Your use of our names and trademarks

Except as specifically permitted by these Terms of Use, you may not use or register any name, logo, trademark or insignia of the Sutton Trust or subdivisions for any purpose except with our prior written approval and in accordance with any restrictions required by the Sutton Trust.

17. Governing Law

Please note that these Terms of Use, their subject matter and their formation are governed by English Law. You and we both agree that the courts of England and Wales will have exclusive jurisdiction in relation to any claim or dispute that arises from or relates to your use of the Network, save that if you are a resident of Northern Ireland you may also bring proceedings in Northern Ireland, and if you are a resident of Scotland, you may also bring proceedings in Scotland. 

[If you are a business, these terms of use, their subject matter and their formation (and any non-contractual disputes or claims) are governed by English law. We both agree to the exclusive jurisdiction of the courts of England and Wales] 

18. Online Platform “Sutton Trust Alumni” – Cookie policy

We collect information about your visits to STA website using cookies (the latter is anonymised). The information is invaluable to us to improve our website and ensure you are shown relevant content.

Essential cookies or essential tracking technology will not require your consent as they are necessary for the functionality of the platform. These also include cookies and tracking technology to allow the correct logging-in on the platform, keeping records of completions of ‘learning episodes’ so that any progress you make on the platform is not lost.

19. General 

If any provision of these Terms of Use is held to be invalid or unenforceable, that provision, to the extent unenforceable, shall be struck, and shall not affect the validity or enforceability of the remaining provisions. 

Your rights under these Terms of Use are personal to you and may not be transferred to anyone else. 

Headings are for reference purposes only and in no way define or limit the scope or extent of any provision of these Terms of Use. 

The Sutton Trust ’s failure to act with respect to a breach by you or others does not waive our right to act with respect to subsequent or similar breaches. 

Except as otherwise expressly provided in these Terms of Use, nothing herein shall be deemed to confer any rights or benefits onto anyone else. 

These Terms of Use set forth the entire understanding and agreement between you and the Sutton Trust with respect to your use of the Network. 

These terms of use were last updated in December 2023. 

Teachers

Teachers privacy notice

1. What we collect 

The Sutton Trust holds data on teachers to deliver its programmes effectively. 

The Sutton Trust will be what is called the “Controller” of the personal information that we collect about teachers.

Category	Source	Specific data held
Basic personal details	Education Company database or student application	Name, job title
Contact details	Education Company database or student application	Work email address(es), school addresses, school phone number(s)
The Sutton Trust programme	Your reference	Your reference for the student, confirmation of your verification of the programme, any additional circumstances you provide

We collect teacher data in two ways: 

Through Education Company database: we pay a licence fee to access teacher data from the Education Company. This gives us permission to contact teachers about relevant opportunities for their students 
Students provide your details: we ask students applying to our programmes to nominate a teacher to verify their application

2. Why we collect it

We collect and process your data under the legal basis of legitimate interests. We collect and process your data for the following purposes: 

Verify student applications
Contact you to provide opportunities to your students
Contact you to provide teacher training opportunities and resources to share with students

3. What we do with your data 

What we do	Data categories	Legal basis
We will email you the details of any student who has nominated you as their referee. We will ask you to verify the information the student has provided	1,2,3	Our legitimate interests are to ensure that we verify student applications to our programmes
We contact you about programmes relevant to you and for your students to market the programmes	1,2	We only contact you if we have obtained your data through a licenced company (Education Company) or via the student that has nominated you. We rely on our legitimate interest to share this information with you in your professional capacity and at any point you have the option to opt-out.

4. Where we keep it 

We take the security of your data very seriously and ensure appropriate technical and organisational measures are in place to protect it against unauthorised or unlawful processing, and against accidental loss, destruction or damage. Your data will at a minimum always be password protected and the number of staff who can access this will be restricted to those for whom access is strictly necessary for the relevant processing. 

5. How long we keep it 

The Trust will store your information for a minimum of five years. If after five years, there has been no engagement from yourself (e.g. no student has further nominated you or you have not participated to one of our events or opened our updates newsletter) your data will be deleted from our system.

This privacy notice was last updated in December 2023. 

Other Privacy Notices

HR privacy notice

This section applies to freelancers, job applicants and current and former employees, trustees and volunteers.

1. Collecting your data

You provide several pieces of data to us directly during the recruitment period and subsequently upon the start of your employment/engagement.

In some cases, we will collect data about you from third parties, such as employment agencies or former employers when gathering references.

Personal data is kept in files or within the Company’s HR and IT systems. In particular, Equal opportunities information and data for the application and interview process is stored within the Sutton Trust’s Applicant Tracking System (ATS), powered by Teamt Tailor. See our recruitment site for the separate ATS privacy notice.

Where possible we advise against keeping hard copies of recruitment data, however if this is necessary (for example printing application forms for use during an interview) then all copies are destroyed after the process is complete. We may also store data in an external application tracking system; data protection agreements will be in place and access restricted to relevant parties only.

2. Types of data held

We keep several categories of personal data on our employees/freelancers/job applicants/trustees and volunteers in order to carry out effective and efficient processes. We keep this data in a personnel file relating to each individual and we also hold the data within our computer systems, for example, our holiday booking system.

Specifically, depending on your type of engagement with The Sutton Trust, we may process the following types of data:

a/ personal details such as name, address, phone numbers

b/ name and contact details of your next of kin/emergency contacts

c/ your photograph, your gender, marital status

d/ footage of the organisation events where you may appear

e/ information of any disability or other medical information you have disclosed

f/ right to work documentation

g/ information gathered via the recruitment process such as that included in a CV, cover letter or application form

h/ references from former employers

i/ details on your education and employment history etc

j/ National Insurance number

k/ bank account details

l/ tax codes

m/ criminal convictions (only if the role involves a DBS check)

n/ information relating to your employment with us, including:

i/ job title and job descriptions

ii/ your salary

iii/ your wider terms and conditions of employment

iv/ details of formal and informal proceedings involving you such as letters of concern, disciplinary and grievance proceedings, your annual leave records, appraisal and performance information, complaints information

v/ internal and external training modules undertaken

vi/ information on time off from work including sickness absence, family related leave etc

o/ IT equipment use including telephones and internet access

p/ your biography for the website (if applicable).

We may also process special categoryies of data which include health information, sexual orientation, race, ethnic origin, political opinion, religion, trade union membership, genetic and biometric data. We may also process criminal records information if the role involves DBS check.

As a social mobility charity, we are committed to considering the context of candidates’ achievements; information on contextual recruitment is available here. Therefore, we may collect information related to social mobility during the your employment/engagement with us. At time of recruitment, we give candidates the option to include any additional information they would like the recruitment panel to be aware of, such as parental education and Free School Meals eligibility. Disclosing such information does not guarantee preferential treatment or progression through the process but allows our panel to consider the wider context of candidates’ applications.

3. How we use your information

We are required to use your personal data for various legal and practical purposes for the administration of your contract of employment or your volunteer/trustee agreement, without which we would be unable to employ you. Holding your personal data enables us to meet various administrative tasks, legal obligations or contractual/agreement obligations.

We carry out processing activities using special category data:

a/ for the purposes of equal opportunities monitoring

b/ in our sickness absence management procedures

c/ to determine reasonable adjustments

d/ for the purpose of safe recruitment

4. Lawful basis for processing

We mainly uses ‘contractual obligation’ as a lawful basis for processing your personal data for employees, job applicants and free lancers. We mainly use ‘legitimate interest’ for trustees and volunteers. We may also have legal obligation in order to process and share your data, for example we need to share salary information to HRMC or use some of your data to enrol a new employee on a pension scheme. When processing special category of data, we may use your consent, for example when gathering data in order to monitor equality and diversity in the Sutton Trust.

Where Special Category data is processed, we may also undertake a Data Protection Impact Assessment (DPIA).

We may rely on our legitimate interest for processing activity such as keeping supervision and appraisal records; using your image, bio and videos/pictures of the organisations’ events where you may appear on our website or marketing/fundraising materials to promote the charity. When relying on legitimate interest, we may undertake a balancing test to ensure your rights are upheld.

When processing criminal records (for example, in order to perform DBS check at time of recruitment and during the employment), the organisation relies on the lawful basis of legitimate interest, and Condition 10 from Schedule 1, DPA 2018, (“preventing or detecting unlawful acts”). We will only collect criminal conviction data where it is appropriate given the nature of your role and where the law permits us. We use criminal conviction data to determine your suitability, or your continued suitability for the role. We use uCheck to manage Disclosure and Barring Service (DBS) checks; their privacy notice is available here. Where a DBS check is required, employees will be asked to input their details to the uCheck portal and undergo an ID check during the interview process. The data we retain on our own system is stored with our employee files and includes: name, type and date of check, certificate number and decision made. In exceptional situations, we may also obtain an overseas police check, for example, if a candidate had not spent sufficient time in the UK to warrant performing a DBS check.

5. Failure to provide data

Your failure to provide us with data may mean that we are unable to fulfil our requirements for entering into a contract of employment with you. This could include being unable to offer you employment, or administer contractual benefits. However, some of the data that you provide is voluntary, such as any data submitted through the Equal Opportunities Monitoring form, or any disclosures made during the application process. Please note that providing criminal conviction data may be a condition of the role (see section 4).

6. Confidentiality – who we share your data with

Employees within our company who have responsibility for recruitment, administration of payment and contractual benefits and the carrying out performance related procedures will have access to your data which is relevant to their function. All employees have been trained in ensuring data is processing in line with UK GDPR and the Data Protection Act (2018).

Data collected for monitoring equality and diversity is not accessible by hiring managers and other staff members involved in shortlisting, interviews, or any decision making throughout the recruitment process. During the employment/engagement this information are only accessed by HR. We reserve the right to involve external search firms when recruiting roles at a Director level or for example if it is not possible to appoint a candidate using the standard recruitment process.

Data is shared with third parties for the following reasons: for the administration of payroll, pension, HR functions (for example the online holiday booking system or to receive support and advice on best practice), administering other employee benefits and with the building security team for the issuing of you building access pass.

The following are some examples of when we share the data and with who:

HMRC – when adding an employee or Trustee as authorised or responsible person on the account for Gift Aid and/ or VAT purposes; when processing Gift Aid claims in relation to donations received by the Trust;
NatWest bank – when adding an employee as a credit card holder or a signatory on one of the bank accounts, also if making online expense payments via BACS;
CAF Bank – when adding an employee as a card holder, signatory or authorised contact on the bank account. For more details about how CAF Bank use the data please visit https://www.cafonline.org/navigation/footer/privacy.
Nationwide – when adding an employee as signatory or authorised contact on the bank account. For more details about how Nationwide use the data please visit: Ensuring data privacy | Nationwide
Companies House – when appointing a new trustee. For more details about how Companies House use the data please visit https://www.gov.uk/government/organisations/companies-house/about/personal-information-charter
Charity Commission – when appointing a new trustee. For more details about how the Charity Commission use the data please visit https://www.gov.uk/government/organisations/charity-commission/about/personal-information-charter#privacy-notice—how-we-use-your-personal-information
Rawlinson and Hunter – as our appointed auditors;

We may also share your data with third parties as part of a Company sale or restructure, or for other reasons to comply with a legal obligation upon us. We have a data processing agreement in place with such third parties to ensure data is not compromised. Third parties must implement appropriate technical and organisational measures to ensure the security of your data.

Website

We have a page on our website where we can upload the name, photo and a short bio for each of our employees to inform the general public about our team and help to direct enquiries.

7.Retention Periods

We only keep your data for as long as we need it for, which will be at least for the duration of your employment/engagement with us though in some cases we will keep your data for a period after your employment/engagement has ended. If you’ve applied for a vacancy but your application hasn’t been successful, we will keep your data only for 12 months or potentially longer is consent has been granted by the unsuccessful candidate.

Some data retention periods are set by the law. For example, if we have a contract in place with you, we will keep the data related to the performance of the contract for 6 years.

Equal Opportunities data will be kept indefinitely in aggregate form to assist with monitoring and reporting, however individual lines of data will be deleted after one year.

Retention periods can vary depending on why we need your data. Please get in touch by contacting us [email protected] if you want to know more about retention period.

Data is destroyed or deleted in a secure manner as soon as the retention date has passed.

This privacy notice was last updated in October 2023. 

Fundraising

We are committed to protecting your personal information and being transparent about what we do with it. This Privacy Notice sets out the information that we collect about you in respect of our fundraising programme, why and how we use that information in relation to fundraising activities, the legal basis upon which we process that information, your rights regarding that information and how you can update it.

We respect your right to privacy and will only process personal information you provide to us in accordance with applicable UK data protection law such as the UK’s version of the UK General Data Protection Regulation (“UK GDPR“) and the UK’s Data Protection Act 2018. 

For the purposes of UK Data Protection law, Sutton Trust is a Data Controller and Registered with the regulator of information rights in the UK, The Information Commissioner’s Office. (ICO). If you have any concerns about the way, we handle your data you may complain to the ICO. For further details please go here: https://ico.org.uk/make-a-complaint/.

How we use your personal information

We use your personal information to:

provide you with the service or information you’ve requested;
handle the administration of your gift or donation;
handle the administration of Gift Aid and Gift Aid declaration forms;
provide you with useful information via newsletters about events and conferences.

We may also use publicly available data to assess your interest in and capacity to support our work prior to your supporting us. Where we undertake such processing activities, we will ensure that it is not intrusive, and that the individual’s privacy is respected.

We only contact you where we have legitimate interest to do so with appropriate communications or requests for support. We will only do so where necessary and reasonably expected to ascertain potential funding. Wherever we may use our Legitimate Interest to process your data, you may object to such processing. We may use other lawful bases to process the personal data. These may include but are not limited to where we have a contractual or legal obligation, where we have the individual’s consent or where we may need to safeguard an individual. Where the latter is the case, we may rely upon an exemption to the law and where this may be the case, we have an Appropriate Policy Document in force.

2. What personal information do we hold?

We only ask you to supply information that we need in order to provide the service you have requested. We will normally ask you to provide us with:

Your name
Your contact details

We may request or collect other information where it’s appropriate and relevant, for example:

Your bank details
Your reasons for supporting the Sutton Trust
Your profession
How you would like us to contact you
Your background details relevant to our work and your potential support which may include but is not limited to your career, interests and charitable support, where this information is in the public domain.

3. How we obtain your data

We collect personal information about you in several ways:

via our website
when you contact our staff team by mail, phone, email or live chat.
when you donate to us through Just Giving. Using JustGiving means you’ll be covered by JustGiving’s privacy policy
when using our Alumni Network. Using our alumni network means you will be covered under our Alumni Privacy Policy.
when assessing your interest in and capacity to support our work, we may obtain information about you from publicly available sources. (See section 4 for more information on this).

We also collect anonymised information about your visits to our websites using cookies. The information is invaluable to us to improve our website and ensure you are shown relevant content. More information about how we use cookies and how you can prevent this can be found in our Cookie Policy.

4. What background information we gather

We carry out background research into potential supporters to ensure communications are relevant and timely, to target our resources effectively, and to provide an improved experience for our supporters. These activities allow us to understand the background of people who support us and help us to make appropriate requests to supporters who may be able and willing to give more than they already do. Importantly, it enables us to raise more funds, sooner, and more cost-effectively, than we otherwise would, so that we can improve social mobility.

Such information is compiled using publicly available data about you, for example from social networking sites such as LinkedIn or Twitter, company websites, publications like Who’s Who, dedicated business websites (e.g. Companies House) or publications and articles in the media (e.g. Queen’s Honours List), listed directorships or typical earnings in a given area. Such processing activities are strictly limited to the personal data we require to understand prospective donor’s interests in supporting the charity.

5. Who we share your data with

We do not share or sell your data to any other charity or company for marketing purposes. We may share your personal data where we have a legal obligation to do so or in our legitimate interest.

6. How we store your information

We hope that your relationship with the Trust will be a lifelong one, and in recognition of the lifelong nature of your relationship with the Trust, we will store and use some of your personal information indefinitely, or until we no longer have a basis upon which we can legally store or use your information (see section 1 for more information about the bases upon which we use your personal information). In certain circumstances we have a statutory obligation to keep your personal information for a set period of time (normally six to seven years) and this mainly concerns financial information regarding your donations or Gift Aid contributions. Furthermore, we wish to keep a historic record of donors to the Sutton Trust in order to recognise this contribution and to manage relationships appropriately in the future.

You have certain rights in relation to your personal information, including the right to ask us to stop using information about you. There is more information about your rights in section 8 of this policy (below).

The data we collect about you via our cookies is retained in accordance with our Cookie Policy.

7. How we keep your personal information up to date

The Sutton Trust has a legal obligation under data protection legislation to keep the personal information it collects accurate and up to date. We keep your information accurate as follows:

By giving you the opportunity at any time to contact us to correct or change your information;
By using information publicly available to us;
If you contact our team we may ask you to confirm certain details;
When we receive undelivered mail or email.

8. Your rights

You have certain rights in relation to your personal information. You have the right to request that we:

provide access to any personal information which we hold about you;
update any of your personal information which is out of date or incorrect;
delete any personal information which we hold about you;
restrict the way that we process your personal information (including the right to prevent us making automated decisions using your personal information, and the right to request that we stop processing your information for marketing purposes);
provide your personal information to a third-party provider of services;
provide you with a copy of any personal information which we hold about you; or
consider any valid objections which you have to our use of your personal information.
inform you of the purpose for processing your data

We will consider all such requests and will try to respond to your request within 5 working days (and in any event within any time period required by law). Please note, however, that certain personal information will be exempt from such requests in certain circumstances. If an exception applies, we will tell you this when responding to your request. We may request you provide us with information necessary to confirm your identity before responding to any.

If you would like to exercise any of your rights in relation to your personal information, please email [email protected]. We do not apply a charge for providing you with your personal information or responding to your requests.

If we do hold information about you we will:

give you a description of it.
tell you why we are holding it.
tell you who it could be shared with.
let you have a concise and clear copy of the information.

We want to make sure that your personal information is accurate and up to date and we will be happy to correct or remove information you think is inaccurate.

If you have any concerns about the processing or use of data for these purposes or would like a copy of the data you have supplied directly to us, requests should be made in writing to [email protected].

If you decide in the future that you no longer want your information to be used in any evaluation, please contact the Sutton Trust by e-mailing [email protected] or phoning 020 7802 1660.

The Sutton Trust also has a Data Protection Officer, who can be contacted at:

Hope & May Limited  

Cobbs Wood Farm  

Old Wimpole  

Arrington  

Royston  

Hertfordshire  

SG8 0BP

Email: [email protected]  

Tel: 0330 111 0013

If you have any complaints about the way your data has been handled you can contact the supervisory authority in the UK, the Information Commissioner’s Office, on 0303 123 1113. They are open Monday to Friday between 9am and 5pm.

9. Changes to legislation

If our practices change, or there are changes to the law, we may need to amend or update this privacy policy. Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email.

10. Contact us

The Sutton Trust, 9th Floor, Millbank Tower, 21-24 Millbank, London SW1P 4QP

Phone: +44 (0)20 7802 1660

Email: [email protected]

Web: https://www.suttontrust.com

Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated September 2022.

Research

We also commission research from third parties using administrative datasets to improve public policy in education. This includes:

National Pupil Database from the Department for Education
The Higher Education Statistics Agency (HESA) Student Record – HESA
The Individualised Learner Record – ESFA at the Department for Education

Information on data handling for the Sutton Trust’s MP research project can be found here.

Website and Cookie Policy

Overview

1. Social Media

Our websites include social media features, such as the ‘Facebook Like’ button. These features may collect information about your IP address and which page you are visiting on our website, and they may set a cookie to make sure the feature functions properly. Social media features and widgets are either hosted by a third party or hosted directly on our website.

We also maintain presences on social media platforms including Facebook, X, LinkedIn and Instagram. We use a third-party provider, Buffer to manage our social media interactions. You can find more information on Buffer’s privacy policy.

Any information, communications, or materials you submit to us via a social media platform is done at your own risk without any expectation of privacy. We cannot control the actions of other users of these platforms or the actions of the platforms themselves. Your interactions with those features and platforms are governed by the privacy policies of the companies that provide them.

2. Links to third-party websites

Our Websites include links to other websites, whose privacy practices may be different from ours. If you submit Personal Information to any of those sites, your information is governed by their privacy policies. We encourage you to carefully read the privacy notice of any website you visit.

3. Cookies Policy

We use cookies, which are small files of letters and numbers that we store on your browser or the hard drive of your computer or other electronic device if you agree. Cookies contain information that is transferred to the hard drive of your computer or electronic device.  When visiting the website, the user can view the cookies via the pop-up banner and give their consent to non-essential cookies if they wish to do so.

This privacy notice was last updated in January 2024. 