Student Loans Company Limited (“SLC”, “we”, “us” and “our”)
Return to: www.slc.co.uk
Student Loans Company Limited (“SLC”, “we”, “us” and “our”)
PLEASE NOTE: This Notice is applicable to customers, students, parents or partners (hereinafter referred to as “you”, “your”, “customer” and/or “student” as appropriate in the particular context) who have supported an application. The Notice explains how SLC and others may use personal data (as defined below).
Student Loans Company Limited (“SLC”) is a non-profit making Government-owned organisation set up in 1989 to provide loans and grants to students in universities and colleges in the United Kingdom (“UK”). Certain functions relating to the student finance schemes within the UK have been transferred to SLC by:
the Secretary of State for Education;
If you have:
- Student Finance England (“SFE”);
- Student Finance Wales (“SFW”); or
- Student Finance Northern Ireland (“SFNI”)
(or you’re a parent or partner who has supported such an application);
- Student Awards Agency Scotland (“SAAS”);
- Student Finance Services as an EU student studying in England, Wales or Northern Ireland;
you will have supplied information about yourself (your “personal data”). Your personal data will be held and used by SLC to administer the student finance schemes (or part thereof) in the UK for and on behalf of the UK administrations noted above.
SFE and SFW are trading names of SLC which provide student finance services for English and Welsh domiciled students. SFNI is a partnership between SLC and the Education Authority in Northern Ireland which provides student finance services for Northern Ireland domiciled students. Student Finance Services is a trading name of SLC which provides the student finance services for students from the EU studying in England, Wales or Northern Ireland.
Your personal data will be held by SLC in accordance with relevant data protection legislation for the purposes as set out in this Notice. It is important that you read this Notice, together with any other privacy notice we may provide on specific occasions when we collect or process your personal data, so that you are aware of how and why we are using such information.
SLC is a joint data controller for the personal information we collect from you alongside the Department for Education; the Welsh Ministers; the Department for the Economy Northern Ireland (and the Education Authority or the Department for Education Northern Ireland where applicable); and SAAS (together the “Joint Controllers”). The Joint Controllers are all responsible for deciding how your personal data is held and used.
We may collect, store and use the following categories of personal data:
• contact details such as name, title, addresses, telephone numbers and personal email addresses;
• date of birth;
• marital status;
• National Insurance Number (“NINO”);
• financial data, including bank account details, student loan repayment details and annual income details;
• nationality and residency details;
• education history;
• residence history;
• household details (for example if you have any dependants); and
• employment status.
We may also collect, store and use the following “special categories” of personal data:
• Information about your race or ethnicity, religious beliefs and sexual orientation (so that we can, for
example, comply with our public sector equality duty under the Equality Act 2010);
• Information about your health, including any medical condition, health and sickness records (so that we
can, for example, administer applications for Disabled Students’ Allowances, and make reasonable
adjustments in line with our statutory obligations under the Equality Act 2010);
• Information about criminal convictions and offences (for example, where this is provided as evidence to
support an application or appeal).
We may also collect, store and use the following categories of information about members of your family, including child or adult dependants, in order to assess your eligibility for, and entitlement to, student finance:
• date of birth;
• marital status;
• financial details, including income;
• nationality and residency details; and
• childcare or education details.
We may also collect, store and use information about anyone with a Power of Attorney, Court of Protection appointed Deputy or consent to act on your behalf. For these purposes we may therefore collect the following categories of personal data:
We collect your data in the following ways:
You may give us your personal data through the student finance applications, student loan repayment and the student finance overpayment processes. This information may be provided by you, your partner, relatives (including step-parents) or Attorney/Court of Protection Deputy.
Your personal data may be shared by and/or among the Joint Controllers for the purposes for administering your loan application.
We may also collect additional information from third parties including HM Revenue & Customs (“HMRC”); the Home Office; other government departments such as the Department for Work and Pensions (“DWP”); and fraud prevention and law enforcement agencies such as the Police and the National Crime Agency.
You should check the privacy policies of the relevant Joint Controller and the other government departments mentioned above (available on their websites) in order to fully understand how they will process your data.
We need this personal data to administer student finance within the legislative framework set by the Government and the Devolved Administrations. In particular, we need it in order to:
We may use also your personal information for the following purposes:
We must have a legal basis for processing your personal data (and special categories of your personal data). The legal basis for processing personal data is set out in data protection legislation. Some of the above basis for processing will overlap with others, so there may be several grounds which justify us using your personal data.
We will primarily process your personal data in order to fulfil our public task of administering student finance in the UK and to ensure public funds are used appropriately.
SLC’s primary roles and performance targets include:
We may therefore use your personal data for these purposes, which form part of our public function. Processing your personal data to make payment of student finance is also necessary for us to fulfil our obligations under the contract you enter into with us to provide student finance.
We also have legal obligations under the Equality Act 2010, for example we must comply with the public sector equality duty. We may therefore use your personal data to fulfil these obligations.
For Disabled Student’s Allowance (“DSA”) and bursary administration we will process your personal data based on the consent that you have provided to us.
As we process special category data, we must also identify a special category condition for processing. We process special category data where: (i) we have your explicit consent; (ii) it is necessary for the purposes of carrying out our obligations in the field of social security and social protection law; or (ii) it is necessary for archiving purposes in the public interest and statistical purposes.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider it is necessary to use it for another purpose and that purpose is compatible with the original purpose. If we need to use your personal data for a different purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Due to the volume of applications SLC receive on a yearly basis, SLC replicate the manual assessment of our SLC assessors and carry out automated processing using the same rules assessors would use to determine whether an applicant is eligible for funding based on government regulations and policies.
Your application may be subject to automated-decision making if you are:
This automated processing also reduces the need for you to complete a full application for subsequent academic years if the information you have previously supplied SLC with is unchanged. If your information has changed, you can manually make changes to your application on your online account or contact us on the numbers below. Once you have made the manual changes online this will trigger a re-assessment of the application by an assessor, who will re-assess your application based on the new information, and make a new decision based on the updated information. The re-assessment may or may not alter the original decision made.
The automated-decision making process is reviewed and tested yearly to ensure that all decisions made are correct at the time the assessment is carried out based on the information the customer provided SLC with in their previous years application.
For more information on how your personal information is processed by automated-decision making or to challenge an automated decision, or to request human intervention please contact us on:
If you wish to appeal against our decision not to award you student finance or you disagree with how any funding has been calculated please contact us depending on your domicile:
We may share your personal data with third parties where required by law, where it is necessary to process your application or administer your student finance account, or where we have another legitimate interest to do so. We may share the personal data you have provided as an applicant or parent/partner with:
|Who we share your information with||Why we share your information|
|Banks and Building societies||
|Chief Executive if Education and Skills Funding Agency||
|Contracted Third Parties||
|Disability Equipment Suppliers||
|Disability Needs Assessors||
|Fraud prevention and law enforcement agencies such as the Police and the Serious Crime Agency (including CIFAS)||
|General Registrars Office||
|Home Office including Her Majesty’s Passport Office and UK Visas and Immigration Agency||
|ID and Income Checking Agencies||
|Joint Data Controllers: Secretary of State for Education; The Welsh Ministers; Department for the Economy; The Education Authority; The Northern Ireland Assembly; The Scottish Ministers; and SAAS.||
|National Health Service (NHS) Business Services; Care Council for Wales; Northern Ireland Social Care Council||
|Non Medical Help (NMH)||
|The Office for Students (“OfS”), United Kingdom Research and Innovation (“UKRI”) and the Higher Education Statistics Agency (“HESA”)||
|Universities, colleges, and training providers||
Our applications and accompanying guidance set out which information will or may be shared with third parties, and for what purposes. Please review these fully in order to establish which personal data will be shared with third parties.
*Bursaries and Scholarships
Some students may be eligible for a non-repayable Bursary or scholarship. Your University or College will determine whether or not you are eligible to receive a Bursary or scholarship, and if you are eligible, will pay the relevant sum to you. In order for your University or College to determine your eligibility, we will share some of your personal data including your contact details, your financial circumstances and course details as well as some information about your eligibility for student finance with them. If you do not want us to share your information with your University or College for these purposes, please contact one of these numbers depending on your domicile:
We may transfer the personal data we collect about you to countries outside the EU in line with carrying out the specific purposes that the personal data was collected for. We will only transfer your data to countries outside of the EU whose data protection laws offer an equivalent or greater level of protection than EU and UK data protection laws. Where this is not the case, we will ensure appropriate safeguards are in place to ensure that your personal data is protected. For more information about transfers of your personal data outside the EU, please contact the Data Protection Officer, 100 Bothwell Street, Glasgow, G2 7JD.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
SLC retains your personal data, and may retain that of your partner and your relatives (including step-parents) in order to:
We will only retain your personal data for as long as it is necessary to fulfil the purposes for which we collected it, including satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of the personal data, the purposes for which we process personal data and whether we can achieve those purposes through other means, as well as any relevant legal requirements. In some circumstances we will retain personal data indefinitely, generally for the purposes described above. For more information on data retention, contact Data Protection Office, 100 Bothwell Street, Glasgow, G2 7JD.
In some circumstances we may anonymise [or pseudonymise] your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.
Your duty to inform us of changes
It is important that the personal data we hold about you is accurate and current. You are obliged to let us know if your personal data changes during your relationship with us.
Your rights in connection with personal data
You have the following rights in relation to your personal data:
Right to Withdraw Consent
In the limited circumstances where you may have provided your consent to us processing your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact one of these numbers depending on your domicile: England – 0300 100 0607; Northern Ireland – 0300 100 0077; Wales – 0300 200 4050; SAAS – 0300 100 0609
Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we are required to do so by law, or have another legitimate basis for doing so in law.
Data Protection Officer and right to complain
We have appointed a Data Protection Officer (“DPO”) to oversee compliance with this Notice. If you have any questions about this Notice or how we handle your personal data, please contact the DPO:
Data Protection Officer
100 Bothwell Street
You also have the right to make a complaint at any time to the Information Commissioner’s Office (“ICO”), the UK supervisory authority for data protection issues about the way in which we process (or have processed) your personal data. You can contact the ICO by writing to:
Information Commissioner's Office
E: firstname.lastname@example.org T: 0303 123 1113
We reserve the right to update this Notice at any time. We may also notify you in other ways from time to time about the processing of your personal data.