Privacy Policy

Privacy Policy

by kensley

Student data Privacy Notice


  1. What is this notice?


This notice provides you with information about how and why the Institute collects, holds, uses and in some instances may share your personal information in accordance with the provisions of applicable Data Protection legislation. This notice may be updated from time to time to ensure continued compliance with current legislation and to reflect best practice. The Kensley Graduate School (KGS) is a data controller as defined by the Data Protection legislation. KGS’s contact details are:


Kensley Graduate School,

No.20 Clifford Avenue,

Colombo 03.


Queries regarding this Privacy Notice or your statutory data protection rights should be directed in writing to the Institute’s Data Protection Officer, whose contact details are as follows:


Data Protection Officer

Kensley Graduate School,

No.20 Clifford Avenue,

Colombo 03



  1. Why do we process your personal data?


    1. Becoming and being a KGS student


When you make an application, accept an offer and register as a student at the Institute, KGS needs to process your personal data for the purposes of entering into a contractual relationship with you and then administer that relationship for example to provide you with services (both academic and non-academic) and to meet our obligations to you as outlined in the Terms & Conditions. In particular your personal data will be processed for the following purposes:


  • Administering and managing your educational programme and qualifications and matters connected to your studies or your apprenticeship;


  • Communicating information to you relating to your studies;


  • Providing services including accommodation, academic skills, pastoral care, advice and guidance, security, health and safety, information and communications technology;


  • Fulfilling our obligations under our Academic Regulations and Procedures


  • Responding to any complaints you make to us;


  • Monitoring, quality assuring and auditing our activities;


  • Undertaking evaluation and research specifically intended to better understand student needs in order to improve our provisions;


    1. Institute y’s Audio/Video Recording for Educational Purposes policy

The Institute has facilities to record your taught classes (lectures, seminars, practicals) to support your studies. These recordings will allow you to review and revise sessions at your own pace whenever and wherever suits the way you learn. More details about how your personal data may be processed in this context are available in the


Inability to process this information could limit the services the Institute is able to provide you with and could thus be detrimental to your overall educational experience and you financially (for example if we cannot administer financial support for your studies).


    1. Emergency situations


Sometimes the Institute may need to process your personal data and/or sensitive personal data (“special categories”) without your consent in situations it deems to be critical or an emergency (for example if you have an accident or are taken unwell).




    1. Legitimate interests of the Institute or a third party


In some circumstances the Institute will process your personal data in pursuance of our own legitimate interests or those of a third party. Where this is the case the Institute will always take into account your privacy rights and expectations and acknowledges your right to object to such processing. Processing in pursuance of legitimate interests occurs in the following contexts:


The Institute will maintain your personal data after you graduate for the purpose of maintaining links with its Alumni and friends.


Cybersecurity/network security – e.g. detecting viruses and malware on KGS systems: In some instances, the Institute will process your personal data in order to maintain and enhance the security of its IT systems.


Attendance recording and learner engagement. We may record your educational attendance to inform our decision making and enhance the overall learning experience for example in reviewing programme content, structure and delivery methods.


Other legitimate interests will include upholding the Institute’s regulations for example in detecting assessment offences or our legitimate business interests such as promoting events that relate to your studies.


    1. Sensitive personal data


In certain instances, the Institute will process your sensitive personal data (“special categories” of data). In such cases it will either get your explicit consent or only process the data without your consent in very limited circumstances and under a relevant other lawful basis such as meeting our legal obligations with regard to reasonable adjustments or a matter of substantial public interest including where there is a risk of harm to yourself or others.


  1. Data obtained from third parties


The Institute will obtain and process your personal data from the following third parties.


Who data obtained from   Why
Placement providers and degree   Administration and assessment of
apprenticeship partners   programme of study
Other Education providers and partners   Administration and assessment of
    programme of study








Who do we share your data with and why?


Who data shared with Why
Parents/spouses/family Only in exceptional
members/designated emergency contacts circumstances. For example, where a
  student has authorised disclosure (in
  writing), has asked the relative to act as
  his/her advocate in a dispute with
  the Institute y or where the Institute y
  deems that there is a threat to your vital
Police forces and other law enforcement Our practice is to co-operate with the police
agencies in the detection and
  prevention of crime, and to alert
  appropriate authorities should we consider
  you, or someone associated with you, to be
  at potential risk of exploitation or
Potential employers, employment agencies Academic references may be provided
and other educational establishments without the explicit
  written consent of the student as long as
  the request is in writing from a
  bona fide employer or agency. The
  information released will be the minimum
  relevant to the request – usually
  attendance and award details.


Students’ Union Your data will be shared with the Students’
      Union (SU) in pursuance of the SU’s
      legitimate interests.
Work placement providers or educational Where this is necessary for delivery of your
partners involved in the delivery of your programme of study
programme of study .
Sponsors (including Local Education In accordance with the terms of the
Authorities, overseas governments and the contract (which usually relates to
Student Loans Company) where a contract attendance and progress reports). Note this
exists with you. does not include anyone who may be
      paying money toward your studies and
      where there is no formal contract i.e.
      parents, employers. In such circumstances
      disclosure will only be made with your
Debt recovery agents The Institute may pass information to
      authorised third parties contracted to
      recover unpaid debt owed in pursuance of
      its legitimate financial interests.
  1. International transfers


In certain circumstances your personal data may be transferred overseas In such instances transfers will be protected by appropriate measures.


  1. How long do we keep your data for?


KGS will retain your personal information in line with the Institute’s Records

Management Policy and Records Retention Policy.


The Institute will maintain a core student record of your studies that it keeps permanently.


The Institute will otherwise hold records only as per the requirements of the different Qualifications offered.



Automated decision making


The Institute will not process your personal data and profile/make decisions about you solely by automated means.


Your rights


Under the Data Protection legislation, you have the following qualified rights:


The right to access your personal data held by or on behalf of the Institute


The right to rectification if the information is inaccurate or incomplete


The right to restrict processing and/or erasure of your personal data


The right to data portability


The right to object to processing


The right to object to automated decision making and profiling


The right to complain in case of violation of personal Data


If you wish to exercise any of these rights please contact the Data Protection Officer