Privacy Notice for Learners


This Privacy Notice is made available to learners of Carlow College, St Patrick’s (hereinafter Carlow College) in order to inform you  about categories of learner data processed by the College, what we use the data for, who we share the data with, how long we retain the data, and your rights. The College is subject to the General Data Protection Regulation (hereinafter GDPR) and the Data Protection   Acts 1988 to 2018. Carlow College is the controller of learner data. We respect your right to privacy and take every appropriate measure to secure data  processed by the College. This Privacy Notice applies to prospective, applicant, current and former learners of Carlow College. We and us refer to Carlow College. You refers to learners. 

Types of data held

The College processes a number of categories of learner data, including: 

  • Name and contact details 
  • Student ID number and CAO number 
  • PPSN 
  • Date and country of birth 
  • Nationality 
  • Gender 
  • Identity documents 
  • Emergency contact details 
  • Financial data, including bank account details 
  • Modules and programme of study 
  • Examination and assessment results 
  • Previous educational institutions 
  • Employment history 
  • Programme application details 
  • Interview records 
  • Assignments and examination scripts 
  • Details of qualifications and prizes awarded 
  • Health and disability information 
  • Records arising from investigations carried out under College policies, including disciplinary   records 
  • Complaints and grievances 
  • Photographs and CCTV images 
  • Vetting records 
  • Data that you send and receive using the College’s IT systems 
  • Learner input into College promotional materials 
  • Survey responses 
  • Records of engagement with College services, including the Academic Resource Office, Writing Development Service, Learner Information & Retention Officer, Counselling Service (including parental/guardian consent for learner    who are under 18), College Nurse, Chaplaincy, Careers Office and the Library 

How does the College collect this data?

Much learner data is collected directly from you or is generated by the College during your studies. Third parties, such as your referees, may supply data to us. We also acquire some data from bodies which act on our behalf, such as the Central Applications Office (CAO), and from grant-awarding bodies such as Student Universal Support Ireland (SUSI). 

Personal data provided by you about others 

You may provide us with personal data about other individuals, for example, emergency   contact details and information about your family circumstances and dependents. You should notify the relevant person that you are providing their contact details to us as your emergency contact. 

 Purposes of processing learner data 

The purposes of processing learner data include: 

  • Replying to expressions of interest about our programmes of study 
  • Organising classes, assessments, examinations and conferring of awards 
  • Administering financial payments, for example, grants, bursaries and fees 
  • Providing support services, including health and counselling services, and supports to  learners with disabilities or learning differences 
  • Monitoring and evaluating the learner experience, including inviting learners to participate  in voluntary surveys 
  • Providing library and IT services 
  • Providing operational information 
  • Promoting our services 
  • Organising and assessing work placement 
  • Monitoring learner attendance 
  • Vetting learners on relevant programmes 
  • Ensuring the safety and security of learners, employees, visitors and our premises 
  • Carrying out audits 
  • Compliance with our legal and regulatory obligations as a provider of third level education 
  • Protection of Enrolled Learners 
  • Production of reports and aggregate statistics for management and research purposes in order to plan and improve services 
  • Implementation of College policies, including investigations under disciplinary and dignity and respect policies 
  • Obtaining legal advice for the establishment, exercise or defence of legal claims 
  • Providing references for future education and employment 
  • Keeping in touch with alumni. 


How the college communicates with learners

The College needs to communicate with learners from time to time in relation to academic, operational and other matters, and strives to use the most effective and efficient+ method of communication. This may be by email (both your College and personal email), telephone call or text message, and by post to your home and term addresses. The College provides all registered learners with an ‘’ email address. This is the most usual way that the College will communicate with current learners. The College uses a text messaging system to communicate urgent information to learners, for  example, regarding the cancellation of classes.   

Where the College urgently requires contact with a learner and we have been unsuccessful in contacting you directly, or it is not possible to contact you directly, we may contact your designated emergency contact using the contact details you provided. We will disclose the minimum amount of personal data necessary during such communications. Learners are responsible for ensuring their contact details as recorded on the Student Record Management System (SRMS) are correct. Please contact Academic Administration to change your contact details if you cannot do so yourself.  

Disclosing information about learners to parents, other relatives or third parties 

It is the responsibility of the learner to communicate and engage with the College. In normal circumstances, the College will not disclose the personal data of learners to parents, other relatives or third parties. However, the College may disclose personal data at the learner’s request. The usual procedure for granting such consent is that the learner emails Academic Administration at from their College email account stating that the College may disclose personal data to a named person about a particular matter. In an emergency situation, the College will act in your best interests and may contact a learner’s designated emergency contact using the contact details provided by you. As the previous section states, where the College urgently requires contact with a learner and we have been unsuccessful in contacting you directly, we may contact your emergency contact person. 

Legal bases for processing

Data protection law permits us to process personal data only when we can identify a legal basis. A number of legal bases apply to the processing of learner data. These include: 

  • Where you give your consent for the processing 
  • Performance of a contract or take steps prior to entering into a contract 
  • A legal obligation to which the controller is subject 
  • To protect the vital interests of the data subject or another person 
  • Performance of a task carried out in the public interest  
  • The legitimate interests of the controller or third party. 


Where special categories of personal data are processed, we have to be able to apply a further legal  basis to the processing. The usual bases that apply are: 

  • Your explicit consent for the processing 
  • Vital interests of the data subject or another person 
  • Establishment, exercise or defence of legal claims 
  • Statistical purposes. 


Recipients of learner data

The College may disclose learner data to other organisations in connection with the aforementioned purposes, including: 

  • Regulatory bodies, such as Quality and Qualifications Ireland (QQI) 
  • Bodies that validate our programmes, including QQI and South East Technological University 
  • Funding bodies and schemes, including grant-awarding bodies, such as SUSI and the Fund for Students with Disabilities 
  • Third party service providers, who are under contract to the College, including software  suppliers, insurers, legal advisors and auditors 
  • Professional, educational or similar institutions with which learners have a relationship, including other third level education providers, and work placement providers 
  • Institutions with which the College has a relationship for the collaborative provision of programmes 
  • The public at large, for example, in the course of conferring ceremonies where learner graduate status or another award is announced publicly, and where learners contribute to promotional materials, including the College website 
  • We may disclose your data to any recipient with your consent 
  • We will act in your best interests in an emergency situation, for example, disclose medical data to the emergency services in a life-threatening situation 
  • Public authorities and bodies where required or permitted by law, for example, the Department of Employment Affairs and Social Protection, Department of Education and Skills; and An Garda Síochána in connection with the prevention, investigation or detection  of crime 
  • Sporting organisations to verify learner identity and registration status 
  • Data which requires to be retained permanently may be transferred to the Delany Archive, a charitable trust based in Carlow College, and in which the College is a partner. 


Data subject rights

Data subjects have the following rights, subject to restrictions, which are set out in data protection legislation: 

  • Information about how we process your data 
  • Access to personal data we hold about you 
  • Rectification of incorrect or incomplete data 
  • Erasure of data, the so-called ‘right to be forgotten’ 
  • Restriction of data processing  
  • To object to the processing of data, including where the College relies on its legitimate interests to process personal data 
  • Data portability 
  • Not to be subject to a decision made solely on automated processing,   including profiling. 



We will seek your consent to process personal data, where necessary. You may grant or refuse consent, and may later withdraw consent. Where personal  data processing is based on consent, you may withdraw your consent at any time by contacting the office/staff member to whom you gave consent or the Data Protection Officer. Withdrawal of consent does not affect the lawfulness of processing prior to the withdrawal of consent. 

Third country transfer

Where personal data is transferred outside the European Economic Area (EEA), we will ensure that an appropriate safeguard is in place, where required. 


We will not keep your personal data for longer than is necessary. Detailed information on retention periods is set out in our Records Retention Schedules.  

Failure to provide data

You may decline to provide us with data in some circumstances. Where there is a statutory or  contractual requirement for data, we may not be in a position to enter into or continue a relationship with you, or to provide services to you.


If you have any queries about this Privacy Notice or wish to make a data protection request, please contact:

Bernie Deasy

Data Protection Officer

Email                 ,

Telephone                   059-9153200

Postal address            Carlow College, St. Patrick’s,

College Street, Carlow.

How to make a complaint

If you are unhappy with the way in which your personal data has been processed, you may, in the first instance, contact the College’s Data Protection Officer using the contact details provided above. If you remain dissatisfied, you have the right to complain to the Data Protection Commission at:


Telephone                    +353 (0761) 104800

LoCall number              1890 25 22 31

Postal address              Data Protection Commission,

Canal House, Station Road, Portarlington, Co. Laois, R32 AP23.

Version: 1.4 

Date: 17 July 2023