Privacy Notice
Privacy and data protection at WAES
Westminster Adult Education Service (WAES) is part of Westminster City Council (WCC). Westminster City Council is the data controller for personal information processed by WAES. This information is provided in line with Westminster City Council’s approach to data protection and transparency.
This page explains, at a high level, how personal data is collected and used when you apply for, enrol on or take part in courses and services provided by WAES, or when you use the WAES website. It should be read alongside Westminster City Council’s wider data protection information.
What information we collect
WAES collects and processes personal information relating to learners, applicants, visitors and website users. This may include:
- personal details such as your name, date of birth and contact details
- information needed to assess eligibility for courses, funding or fee concessions
- enrolment, attendance, assessment and achievement information
- payment, fee and refund information
- information you choose to provide about learning support needs, health or accessibility requirements
- records of communications with WAES
When you use the WAES website, we may also collect limited technical information, such as your IP address, browser type, device information and pages visited. This information is collected using cookies and similar technologies.
Why we use your information
WAES uses personal data for purposes including:
- processing course enquiries, applications and enrolments
- delivering courses and supporting learners during their studies
- meeting statutory education, funding, audit and reporting requirements
- communicating with learners about courses, learning activities and related services
- safeguarding learners and meeting our duty of care
- operating CCTV at some WAES premises for public safety, crime prevention and safeguarding purposes (further information is available in the WAES CCTV policy on our Policies and Procedures page)
- managing payments, instalment plans, refunds and financial records
- improving our services and understanding how our website is used
Lawful basis for processing
Most of the personal data processed by WAES is processed because it is necessary for the performance of a public task carried out by Westminster City Council, or to meet legal obligations relating to education, funding, safeguarding and financial management.
Some processing is necessary to meet contractual obligations, for example to deliver courses you have enrolled on or to manage course fees.
Where we rely on consent (for example, to send marketing emails or to use photographs, video or testimonials), this will be clearly explained, optional, and you can withdraw your consent at any time.
Where special category personal data is processed (such as information about health, disability or learning support needs), it is handled with additional protections and only where permitted by law, including where necessary for reasons of substantial public interest or with your explicit consent.
Who we share information with
Your personal information may be shared, where necessary and lawful, with:
- Westminster City Council staff and systems that support the delivery of WAES services
- government departments and agencies, including the Department for Education, for statutory education, funding and reporting purposes
- awarding bodies and organisations responsible for qualifications and learner records
- external IT suppliers who host, support and maintain our website, learner management systems and online services, under contractual arrangements that require them to protect personal data
- external suppliers, partners and contractors who provide services or support on our behalf (such as IT systems, communications, research, design or payment services), under appropriate data protection agreements
We do not sell personal data.
How long we keep information
Personal data is retained only for as long as necessary for the purposes for which it was collected, in accordance with Westminster City Council’s retention schedules and legal requirements. Some education and funding records must be kept for extended periods to meet statutory, audit or qualification record obligations.
Your data protection rights
You have rights under UK data protection legislation, including the right to request access to your personal information, to ask for inaccurate information to be corrected, and in certain circumstances to request restriction or erasure of your data.
Information about your rights and how to make a subject access request is available on Westminster City Council’s website.
Access to your information and correction
You have the right to request a copy of the personal information that Westminster City Council holds about you in connection with WAES.
If you would like to request access to your information, or ask for information to be corrected if you believe it is inaccurate or incomplete, you can contact WAES at info@waes.ac.uk or write to us at:
Westminster Adult Education Service
219 Lisson Grove
London
NW8 8LW
We may need to verify your identity before responding to your request. Further information about data protection rights and subject access requests is available on Westminster City Council’s website.
Changes to this privacy information
We keep this information under regular review and may update it from time to time. Any updates will be published on this webpage.
Cookies and website tracking
WAES uses cookies and similar technologies to help the website function properly, to remember user preferences and to understand how visitors use the site so we can improve it. Some cookies are essential, while others are used only if you choose to allow them.
Full details about the cookies we use and how you can manage or change your preferences are available on our Cookie Policy page.
Individualised Learner Record (ILR) Privacy Notice 2026/27
This privacy notice is issued on behalf of the Secretary of State for the Department of Education (DfE) to inform learners about the Individualised Learner Record (ILR) and how their personal information is used in the ILR. Your personal information is used by the DfE to exercise our functions under article 6(1)(e) of the UK GDPR and to meet our statutory responsibilities, including under the Apprenticeships, Skills, Children and Learning Act 2009. Our lawful basis for using your special category personal data is covered under Substantial Public Interest based in law (Article 9(2)(g)) of UK GDPR legislation. This processing is under Section 54 of the Further and Higher Education Act (1992).
The ILR collects data about learners and learning undertaken. Publicly funded colleges, training organisations, local authorities, and employers (FE providers) must collect and return the data each year under the terms of a funding agreement, contract or grant agreement. It helps ensure that public money is being spent in line with government targets. It is also used for education, training, employment, and well-being purposes, including research.
We retain your ILR learner data for 20 years for operational purposes (e.g. to fund your learning and to publish official statistics). Your personal data is then retained in our research databases until you are aged 80 years so that it can be used for long-term research purposes. For more information about the ILR and the data collected, please see the ILR specification at https://www.gov.uk/government/collections/individualised-learner-record-ilr
ILR data is shared with third parties where it complies with DfE data sharing procedures and where the law allows it. The DfE and the English European Social Fund (ESF) Managing Authority (or agents acting on their behalf) may contact learners to carry out research and evaluation to inform the effectiveness of training.
For more information about how your personal data is used and your individual rights, please see the DfE Personal Information Charter ( https://www.gov.uk/government/organisations/department-for-education/about/personal-information-charter ) and the DfE Privacy Notice ( https://www.gov.uk/government/publications/privacy-notice-for-key-stage-5-and-adult-education )
If you would like to get in touch with us or request a copy of the personal information DfE holds about you, you can contact the DfE in the following ways:
- Using our online contact form
https://form.education.gov.uk/service/Contact_the_Department_for_Education - By telephoning the DfE Helpline on 0370 000 2288
- Or in writing to: Data Protection Officer Department for Education 4th floor 2 St Paul’s Place 125 Norfolk Street Sheffield S1 2FJ
If you are unhappy with how we have used your personal data, you can complain to the Information Commissioner’s Office (ICO) at:
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You can also call their helpline on 0303 123 1113 or visit https://www.ico.org.uk
Date last updated: January 2026
View 2026/27 ILR privacy notice on Government website
View 2025/26 ILR privacy notice on Government website
Learning Records Service (LRS) Privacy Notice
Overview
To comply with data protection legislation, schools, colleges, local authorities, and training sector organisations are responsible for issuing a copy of this privacy notice to learners and/or parents/guardians. This notice summarises the information held on record about them, why it is held and the third parties with whom the data may be shared.
Privacy notice for pupils, students, learners, and trainees
The information you supply is used by the Learning Records Service (LRS). The LRS issues Unique Learner Numbers (ULN) and creates Personal Learning Records across England, Wales, and Northern Ireland, and is operated by the Department for Education (DfE) in England. This privacy notice explains how we use your personal information. For the purposes of relevant data protection legislation, the DfE is the data controller for personal information processed.
Who we are?
The LRS supports the DfE by collecting learner information from training providers and awarding organisations. For the purposes of relevant data protection legislations, the DfE is the data controller for personal information we process.
How we will use your information
We receive your personal data from:
- schools, colleges, local authorities, and training/learning providers
- accredited achievement data supplied by awarding organisations
The aims of LRS are to:
- create a trusted and verified record of learning for citizen across England, Wales, and Northern Ireland
- enable education organisations to access these records when required to support individuals with enrolment to education and careers advice, ensuring they get access to the correct education and government funding
- issue you with a Unique Learner Number (ULN)
- create your Personal Learning Record (PLR)
- collect entries and results data that is used to create national statistical publications
The nature of your personal data that LRS will process
The categories of personal data that can be processed in LRS includes:
- personal contact details
- data related to an individual’s learning
- data and information about your learning, including courses and qualifications you are taking or have taken
To ensure that our records are accurate, it may be necessary for training providers to collect further personal information from you. This information will be used to identify the correct learner where their personal information is similar to other learners (e.g. name(s) and date of birth):
- where further information is required to distinguish between learners, the following personal information is deemed as mandatory:
- last known post code
- date of birth
- gender
Why our use of your personal data is lawful
For our use of your personal data to be lawful, we need to meet one (or more) conditions in the data protection legislation. For LRS, the relevant conditions are:
- Article 6(1)(e) UK General Data Protection Regulations (GDPR), to perform a public task as part of our function as a department
We also rely on legitimate interests, where we may need to collect additional personal information, to distinguish you from another individual. This is:
- Article 6(1)(f) of the UK General Data Protection Regulations
Who we will make your personal data available to
We sometimes need to make personal data available to other organisations. These might include contracted partners (who we have employed to process your personal data on our behalf) and/or other organisations (with whom we need to share your personal data for specific purposes).
Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. For LRS we share your personal data with the following:
- schools, colleges, local authorities, and training/learning providers when you enrol onto a course
- awarding bodies to record achievement/attainment information such as exam or course grades
- permitted organisations such as Federation for Industry Skills & Standards (FISSS) and Universities and Colleges Admissions Service (UCAS) to record or verify individual’s qualifications
How long we will keep your personal data
The PLR is a lifetime record of achievement for all learners.
All data in LRS will be retained until a learner is 80 years old and has not engaged with a learning provider for 7 years.
Your data protection rights
You have specific rights under data protection law. You can:
Request a copy of all information relating to you held by the DfE. You can do this by making a Subject Access Request using the DfE Contact Form.
DfE processes your personal information on LRS in the exercise of its official authority under the Education Act 2011 and the Apprenticeships, Skills, Children & Learning Act 2009. This allows us to ensure that training providers are claiming for the correct government funding, safeguard public money and prevent fraud.
More information about how the DfE handles personal information is published in the DfE Personal Information Charter. If you need to contact us regarding any of the above, please do so via the DfE site at DfE – Contact Us. If you are unable to use the online contact form, you can write to us at the address provided under Contact Information below.
Further information about your data protection rights appears on the Information Commissioner’s website at Information Commissioners Office – Individual Rights
Last updated
We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time. This version was last updated on 27 November 2023.
