Privacy notice for the Turing Scheme

About the Turing Scheme

The Turing Scheme (‘the scheme’) provides education providers across the UK and the British Overseas Territories with funding to support students to take part in study and work placements. The fourth year of the Turing Scheme will take place during the 2024 to 2025 academic year.

Who we are

From academic year 2024/25 onwards, the Turing Scheme (‘the scheme’) will be delivered directly by the Department for Education (‘we’, ‘our’, ‘us’).

For the purposes of the UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller for the personal data collected and processed as part of the scheme from its fourth year onwards.

For more information about how we handle personal data please see: , Personal information charter - Department for Education - GOV.UK (www.gov.uk).

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department.

This is done under Section 50 of the UK Internal Market Act 2020 which enables a Minister of the Crown to provide financial assistance to support international education and training activities and exchanges.

With regards to the sharing information to prevent fraud, this is done under section 56 of the Digital Economy Act 2017 which permits the disclosure of information to combat fraud against the public sector.

When we use your sensitive or ‘special category’ data

We use it because we have a substantial public interest, the Education Act 2002 allows this.

DfE uses your data for research and to publish statistics on learners and funding. Our lawful basis for using your special category personal data is Public interest based in law (Article 9(2)(g)) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

When we collect your personal information

We receive your personal information when:

  • You submit an application for funding on behalf of your school, further education or higher education provider
  • You provide us with information as part of the payments or reporting processes
  • You contact us for support about using our service
  • You leave feed feedback about our service
  • You are taking part in a study or work placement (or are expected to do so)
  • You are assessing applications on our behalf

The personal information we collect

The personal information we collect will depend on whether you:

  • work for an education provider
  • are a student taking part in the scheme
  • are assessing applications for funding on our behalf

The information we will collect if you work for an education provider

If you submit an application for funding or request funding from the scheme, we will collect and process the following personal information:

  • First name
  • Last name
  • You contact us for support about using our service
  • Email address and telephone number
  • Your role within your organisation

The information we will collect if you are a student

If you are a student taking part in an activity funded under the scheme, we expect to collect and process the following information:

  • First name
  • Last name
  • Email address and telephone number, or the email address and telephone number of the person accompanying you if you are under 18
  • Date of birth
  • Pupil, learner or student ID number
  • Home postcode
  • Nationality
  • Ethnicity
  • Gender
  • Level of education
  • Whether you have a special educational need or a disability
  • Whether you are eligible for extra financial support provided to students who receive funding from the scheme and who are from disadvantaged backgrounds

The information we will collect if you are an assessor

If you are assessing applications for funding on our behalf, we will collect and process the following information:

  • First name
  • Last name
  • Email address and telephone number

How we use your information

We will use your information to process your application, your requests for funding and other documentation shared during the funding cycle.

We may also use this information to contact you about your project or to ask if you would like to take part in user research.

We will not share this information with other parties. Examples of this activity includes:

  • Registering your interest in the scheme
  • Processing your application for funding
  • Notifying you about the outcome of your application or funding request
  • Distributing funding to your organisation
  • Reviewing how funding is used
  • Recovering funding where necessary
  • Preparing anonymous data on organisations or students taking part in the scheme
  • Reviewing our administration of the scheme
  • Inviting you to participate in anonymous research about the scheme
  • Sharing information about the scheme

Who we share your personal information with

Additionally, we may need to share your information with other organisations so that we can:

  • Assess your application for funding
  • Evaluate the short, medium and long term benefits and impacts of the scheme
  • Contact you if there is an emergency in the region where you are undertaking your placement so that you can receive guidance
  • Detect fraudulent activity on our service

In these instances, we may need to share your information with our appointed assessors, other government departments and agencies, research partners or law enforcement agencies.

Measuring website usage (Azure Application Insights)

We use Azure Application Insights software to collect information about how you use this website. We do this to help make sure the site is meeting the needs of its users and to help us make improvements. Azure Application Insights stores information about:

  • the pages you visit on this website
  • how long you spend on each page
  • how you got to the site
  • what you click on while you're visiting the site

We don't collect or store your personal information (for example your name or address) so this information can't be used to identify who you are.

We don't allow Microsoft to use or share our analytics data.

Azure Application Insights sets the following performance cookies:

Name Purpose Expires
ai_session This helps us track activity happening over a single browser session 1 hour
ai_user This helps us to identify the number of distinct users accessing the site over time by tracking if you've visited before 1 year

Where your data is stored and processed

We use Microsoft products to design, build and run our systems. All personal data is stored in the EU Data Boundary.

The EU Data Boundary is a geographically defined boundary within which Microsoft has committed to store and process customer data for their major commercial enterprise online services, subject to limited circumstances where customer data will continue to be transferred outside the EU Data Boundary.

The EU Data Boundary consists of the countries in the European Union (EU) and the European Free Trade Association (EFTA). The EU Countries are Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden; and the EFTA countries are Liechtenstein, Iceland, Norway, and Switzerland.

The EU Data Boundary uses Microsoft datacentres announced or currently operating in Austria, Belgium, Denmark, Finland, France, Germany, Greece, Ireland, Italy, Netherlands, Norway, Poland, Spain, Sweden, and Switzerland. In the future, Microsoft may establish datacentres in additional countries located in the EU or EFTA to provide EU Data Boundary services.

How long we will keep your personal data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information:

  • for five years for correspondence purposes
  • for five years for application purposes
  • for seven years for funding purposes

Data protection rights

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

For more information, see the, ICO’s guide to individual rights.

If you need to contact us regarding any of the above, or have any other questions about how your personal information will be used, please contact us stating Turing Scheme

More information about how we handle personal information is published here: https://www.gov.uk/government/organisations/department-for-education/about/personal-information-charter.

The Information Commissioner’s Office makes further information about your data protection rights available in their : Guide to the General Data Protection Regulation (GDPR).

Right to lodge a complaint

You have the right to raise any concerns with the Information Commissioner’s Office (ICO) .