Please ensure Javascript is enabled for purposes of website accessibility

General Privacy Notice – COVID-19 NHS Track & Trace

About this privacy notice

HSDC (“we” “us”, or “our”) recognises the importance of protecting personal and confidential information in all that we do. Individuals have the right to be informed about the collection and use of their personal data and is a key transparency requirement under the GDPR.

This privacy notice is intended to inform you how we use your personal data that you have provided to us. It applies to personal data provided to us by individuals and supplements the following wider HSDC privacy notices, which can be found here.

We keep this Privacy Notice under regular review. It was last updated on 01/09/2020.

HSDC, a Further Education College, is the entity that determines how and why your personal data is processed. This means that HSDC is the ‘controller’ of your personal data for the purposes of data protection law.

You may be asked to provide some basic information and contact details to HSDC. HSDC will disclose your information to NHS Test & Trace if you have agreed to share it with them.

HSDC will collect the following personal data:

Information about staff:

  • the names of staff who work at HSDC
  • a contact phone number for each member of staff
  • the dates and times that staff are at work

Information about customers and visitors:

  • the names of all customers or visitors, or if it is a group of people, the name of one member of the group
  • a contact phone number for each customer or visitor, or for the lead member of a group of people
  • date of visit and arrival and departure time
    • In addition, if a person/group only interacts with one member of staff during their visit, the name of the assigned staff member will be recorded alongside that information.
    • HSDC will only request these records where it is necessary for NHS Test and Trace.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

  • To manage attendance in HSDC’s buildings as part of our COVID-19 mitigation measures
  • Where requested by the NHS as part of its Test and Trace service

You can find details on how NHS Test and Trace uses personal data on the NHS Test and Trace website.

Your personal data will be collected and processed primarily by our staff and HSDC (access to your personal information is limited to staff who have a need-to-know need to see it for the purpose of carrying out their job at HSDC.). We may have to share your personal data with the parties set out below for the purposes outlined in section 4:

  • NHS Test and Trace

Data Protection Legislation requires that we meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a “lawful basis” for the processing. The basis for processing will be as follows:

  • Public task. The processing of your personal data may be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Article 6(1)(e) of GDPR).

We do not transfer your personal data outside the European Economic Area (EEA).  

Information collected as part of this contact-tracing initiative will be stored securely and lawfully, and by NHS Test and Trace (if passed to them), in line with the requirements of the GDPR and Data Protection Act 2018.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Your data that is collected for NHS Test and Trace will be retained locally for 21 days after your visit, at which point it will be deleted or destroyed.

Where your data is passed to NHS Test and Trace in the case of a suspected outbreak, your information will be kept for up to eight years, as part of the standard contact-tracing retention period set out by PHE.

Under certain circumstances, you may have the following rights under data protection legislation in relation to your personal data:

  • Right to request access to your personal data;
  • Right to request correction of your personal data;
  • Right to request erasure of your personal data;
  • Right to object to processing of your personal data;
  • Right to request restriction of the processing your personal data;
  • Right to request the transfer of your personal data; and
  • Right to withdraw consent.

If you wish to exercise any of these rights, please contact the Data Protection Office at

You can contact HSDC by telephoning 023 9387 9999 or by writing to:

Alton Campus: Old Odiham Rd, Alton GU34 2LX
Havant Campus: New Road, Havant, Hampshire, PO9 1QL
South Downs Campus: College Road, Waterlooville, Hampshire, PO7 8AA

Please note that HSDC has appointed a Data Protection Officer. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact our Data Protection Officer using the details set out below:

Data Protection Officer:

If you wish to complain about our use of personal data, please send an email with the details of your complaint to the Data Protection Officer so that we can look into the issue and respond to you.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) (the UK data protection regulator). For further information on your rights and how to complain to the ICO, please refer to the ICO website.

Need some help? Our advisors are here to help you

Contact us