NSPC Personal Data and Privacy Notice

Applicants and students

Last reviewed: June 2026. This notice is reviewed annually or whenever our processing changes.

This notice explains how the New School of Psychotherapy and Counselling (NSPC Ltd) collects, uses, stores and shares the personal data of applicants and students, the lawful bases on which we do so, your rights, and how to raise a concern or complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection.

NSPC processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take our obligations seriously and ensure personal data is collected, handled, stored and shared in a secure manner.

Where relevant, this notice also applies to “staff” including contractors, teachers, and academic and non-academic staff who hold a contract with NSPC or one of its associated organisations.

Data controller and contact details

NSPC Ltd is the data controller for the personal data described in this notice. Where data relates to your Middlesex University award, NSPC and Middlesex University each act as independent data controllers for their own purposes, and NSPC shares the relevant data with Middlesex under a data-sharing arrangement; Middlesex’s own privacy notice governs its processing.

If you have any questions about this notice or wish to exercise your rights, please contact:

Data Protection Lead: Danny van Deurzen-Smith

NSPC Ltd, 61–63 Fortune Green Road, London NW6 1DR

Email: [email protected]

How does NSPC collect your personal data?

We collect your personal data both directly and indirectly.

Directly from you:

  • through the application you submit via the NSPC portal or other recruitment processes;
  • during enrolment, when we collect further information needed once you become a student;
  • when you access a particular service - the data needed, and why, is explained to you at that point.

Indirectly:

  • automatically through our website (see our Cookie Policy for details).

What personal data does NSPC collect?

From application forms:

  • name and address
  • contact details (telephone number, email address)
  • age / date of birth
  • gender
  • passport details
  • nationality and country of residence
  • educational records to date
  • academic references (including personal statement)
  • disability declaration
  • criminal-conviction declaration
  • for students undertaking clinical placements, a DBS check
  • English language proficiency

Equality-monitoring data (special category data):

We collect data on characteristics such as ethnicity, religion and sexual orientation for equality-monitoring and statutory-reporting purposes. This is treated as special category data and is reported in aggregated or anonymised form wherever possible.

From international students requiring a visa, to meet UK immigration requirements:

  • visa details
  • data evidencing attendance on your course

Collected at enrolment or updated during your studies:

  • home address and next of kin
  • term-time address
  • entry and other qualifications
  • demographic information
  • funding, bursary and fee-related information
  • information needed to provide disability, wellbeing or other pastoral support
  • course and stage details
  • attendance, progress and current status
  • assessment results
  • photograph for ID cards

Additional personal data may be collected where relevant to placements, professional-body requirements, extenuating-circumstances applications, appeals, complaints or disciplinary cases, and any optional student services.

The lawful bases we rely on

For most personal data, we rely on one or more of the following under Article 6 of the UK GDPR:

  • Contract: to administer your application, enrolment, studies and award;
  • Legal obligation: for example, immigration checks for sponsored students, statutory data returns to the Office for Students and the designated data body, and health and safety;
  • Legitimate interests: for example, administering services, securing our systems, and alumni relations, balanced against your rights;
  • Consent: for limited, optional purposes such as certain marketing communications and voluntary wellbeing support, which you can withdraw at any time.

Special category and criminal-offence data

Some of the data we process is more sensitive, including health, disability, equality-monitoring data such as ethnicity; and criminal-conviction information from DBS checks required for clinical placements. We process this under the additional conditions in Article 9 (and, for criminal-offence data, in line with Article 10) of the UK GDPR and Schedule 1 of the Data Protection Act 2018.

How and why does NSPC use your personal data?

The primary purposes for which we process information about students include:

  • administering student-related functions from application through to graduation, and providing alumni services;
  • planning and accounting for the services we provide;
  • producing statutory data returns for external bodies such as the Office for Students (OfS) and the designated data body;
  • communicating with applicants, students and staff;
  • monitoring academic progress towards completion of a qualification;
  • carrying out assessment, authorising the award of qualifications, and verifying awards after study;
  • administering policies and procedures, including appeals, complaints, academic misconduct, and general conduct and discipline;
  • providing student support services, including financial, pastoral, employability and IT/learning resources;
  • issuing communications about student benefits, opportunities, and NSPC or Middlesex University activities and events;
  • carrying out immigration-compliance checks for sponsored students;
  • monitoring, developing and securing our systems;
  • monitoring equality and diversity objectives;
  • undertaking surveys, market research and statistical analysis to improve the student experience.

We also process personal data as part of research activity, which must be consistent with the policies of, and approved by, our Research Ethics Committee.

Sharing of personal data

We share personal data with certain other organisations in order to meet statutory requirements or to provide services to students. Sharing is always undertaken in line with data protection law, using the relevant lawful basis, and is limited precisely to what the recipient needs.

Statutory, funding and regulatory bodies:

  • Middlesex University: for validation of registrations and awards;
  • the Office for Students and the designated data body: for statutory data returns;
  • UK immigration authorities: to ensure compliance with the conditions of student visas;
  • the Student Loans Company: in connection with grants, fees, loans and bursaries;
  • professional bodies requiring eligibility information;
  • the courts, the police and other organisations with a crime-prevention, Prevent or law-enforcement function, where the conditions of relevant legislation are met.

Service providers (processors), under data processing agreements:

  • KDAWS: hosting of our current student records system;
  • Microsoft: cloud hosting and productivity services (Microsoft 365, SharePoint, Dataverse);
  • Xero: accountancy software;
  • Little Fire Digital: development and maintenance of the NSPC website and Moodle.

Other individuals and organisations:

  • external examiners: for examination, assessment and moderation;
  • our insurers and legal advisers: for insurance cover or in the event of a claim;
  • the Office of the Independent Adjudicator: to review student complaints;
  • employers who request a reference (for relevant students);
  • survey providers for the Postgraduate Taught Experience Survey (PTES) and Postgraduate Research Experience Survey (PRES), administered by Advance HE.

How is your data stored?

Your personal data is held in two main environments: our current student records system, which runs on a dedicated server hosted by KDAWS; and Microsoft 365 cloud services (including SharePoint and Dataverse), where data is currently stored in Microsoft’s United Kingdom data centres and encrypted both in transit and at rest. Access to both is controlled on a least-privilege basis and protected by multi-factor authentication. Data is backed up regularly to secure infrastructure, and our backup and restore procedures are tested at regular intervals by our IT providers. All company devices are protected by endpoint cyber-security software, and NSPC holds Cyber Essentials certification, which we renew annually.

International transfers

Your personal data is currently stored in the United Kingdom. Where data is transferred to the European Economic Area (for example through our cloud service providers), this is covered by the UK’s adequacy regulations. Where data is transferred outside the UK or EEA, we ensure an appropriate safeguard is in place, such as the International Data Transfer Agreement.

How long does NSPC keep your personal data?

We do not hold personal data for longer than is necessary, and we maintain a retention schedule for the different categories of data we hold.

Applicants:

  • if you enquire but do not apply, we hold your data for up to two years from your intended start month;
  • if you apply but do not enrol, we hold your data for up to three years from your intended start month.

Enrolled students

we retain data for longer where there is good reason, including:

  • to verify awards in the long term;
  • to produce transcripts and references;
  • for alumni services and ongoing relations;
  • for careers and employability services;
  • to deal with complaints, appeals and disciplinary cases;
  • for statutory reporting, including the Graduate Outcomes survey.

Your rights

Under data protection law you have the following rights, some of which apply only in certain circumstances:

  • the right to be informed about how we use your data;
  • the right of access to the personal data we hold about you;
  • the right to rectification of inaccurate or incomplete data;
  • the right to erasure of your data;
  • the right to restrict our processing;
  • the right to object to our processing;
  • the right to data portability;
  • the right to withdraw consent, where our processing is based on consent.

These rights are not absolute, and we may be entitled to refuse a request where an exception applies. To exercise any of your rights, please contact our Data Protection Lead using the details above.

If you believe your request has not been handled properly, or you have any other data protection concern, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Your responsibilities

All staff and students who handle personal data for which NSPC is responsible must follow our Data Protection Policy and any related guidance issued by NSPC or Middlesex University.

Changes to this notice

We may update this notice from time to time. The current version, and the date it was last reviewed, is shown at the top of this document and published on the NSPC website.