Privacy Policy

Last updated: December 2025

Croydon Metropolitan College ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.croydonmet.org.uk or interact with our services.

1. Information We Collect

1.1 Information You Provide

We collect information you voluntarily provide when you:

• Complete our enquiry form (name, email, phone number, enquiry details)
• Apply for courses or programmes
• Subscribe to newsletters or updates
• Contact us via email or telephone

1.2 Automatically Collected Information

When you visit our website, we may automatically collect:

• IP address and approximate location
• Browser type and version
• Device type and operating system
• Pages visited and time spent on site
• Referring website address

2. How We Use Your Information

We use the information we collect to:

• Respond to your enquiries and provide requested information
• Process course applications and enrolments
• Send important updates about our programmes and services
• Improve our website and user experience
• Comply with legal obligations
• Protect against fraudulent or unauthorised activity

3. Legal Basis for Processing (GDPR)

Under UK GDPR, we process your personal data based on:

• Consent: When you submit an enquiry form or opt-in to communications
• Contract: When processing is necessary for course enrolment
• Legitimate Interests: For website analytics and security
• Legal Obligation: When required by law or regulation

4. Cookies and Tracking

Our website uses minimal cookies for essential functionality:

• Essential Cookies: Required for the website to function (session management)
• Service Worker: Enables offline access and faster page loads

We do not use advertising cookies or third-party tracking for marketing purposes.

5. Data Sharing

We do not sell your personal information. We may share data with:

• Service Providers: Form processing (Formspree), web hosting (IONOS)
• Exam Boards: When required for examination registration
• Legal Authorities: When required by law

6. Data Retention

We retain personal information for:

• Enquiries: 2 years from last contact
• Student Records: 7 years after completion of studies
• Financial Records: 7 years as required by law

7. Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate information
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we use your data
• Portability: Receive your data in a portable format
• Object: Object to certain processing activities
• Withdraw Consent: Withdraw previously given consent

To exercise these rights, please contact us using the details below.

8. Data Security

We implement appropriate security measures including:

• HTTPS encryption for all website traffic
• Secure form submission processing
• Access controls and authentication
• Regular security reviews

9. Children's Privacy

We collect information about students under 18 only with parental or guardian consent. Parents may request access to, correction of, or deletion of their child's information.

10. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated revision date. Continued use of our website after changes constitutes acceptance.