ACCESS EDUCATION GROUP - GOOGLE SERVICES PRIVACY NOTICE

OAuth Single Sign-on and Google Drive Integration

Responsible for Implementation: DATA PROTECTION OFFICER

Latest Review Date: September 2026

Next Review Date: September 2027

Authorised By: DPIS Committee

Version: 1.0 2026

Contents

1. Introduction
2. Who is Responsible for Your Data
3. The Data We Collect & How We Use It
4. Our DPO
5. How To Contact Us
6. How To Contact The ICO

About Us

Access Further Education Ltd (‘The College’) has subsidiary companies, trading names and trading partnerships through which it operates. The trading names and partnerships might have their own names or brands, but the legal entity for the purpose of this policy is Access Further Education Ltd. Trading subsidiaries, trading names and trading partnerships include Access Creative College (‘ACC’), Access Industry and Access Sport College (‘ASC’). The dBs Institute (DBS Music UK Holdings and its subsidiaries), whilst a separate legal entity, shares common Directorships with the College, however, responsibility for Data Protection related Policies within dBs falls to the DPO for Access Further Education Ltd.

Introduction

This Privacy Notice is intended to provide information on how your personal data is handled as part of the Moodle Service we provide to you, our Staff and Learners.

For information relating to other systems and services, please see our other relevant Privacy Notices.

As part of logging in to your Moodle account, we use the OAuth Single Sign-On Application from Google, enabling you to ‘Sign in with Google’ through technical links to your existing Google Workspace Education Account.

Who Is Responsible for your Data

• For learners with Access Creative College, Access Sport College, Access Industry accounts, and for our relevant subcontractors, the associated controller is Access Further Education Ltd. The Information Commissioner’s Office (ICO) registration number is: Z7480437.

• For Higher Education learners with dBs Institute, the associated controller is one of the below companies, in joint controllership with Falmouth University:

• Deep Blue Sound Limited (Z8751984)
• DBS Bristol Limited (ZA546654)
• DBS (Falmouth) Limited (ZB586460)

The Data We Collect & How We Use It

This section details how Access Education Group (‘The College’) handles user data obtained through Google services (Single Sign-On and Google Drive integration) when you access our Moodle Learning Management System, hosted at moodle.accesstomusic.ac.uk.

1. Data We Access

When you interact with Google services within our Moodle platform, we access data across two functional areas:

• Authentication (Google Sign-in): When you sign in to our Moodle platform using your institutional Google Workspace account, we request access only to your basic account identity information via standard Google OAuth scopes (openid, email, profile). This includes:

• Email Address: Used as your unique identifier and primary contact email for course notifications.
• Basic Profile Information: Your full name and primary Google profile picture (if applicable).
• Unique Google Identifier (Subject ID): An internal ID provided by Google to verify your identity upon login.

• Google Drive Assignment Submissions: When you use the Google Drive repository picker within Moodle to submit an assignment, browsing takes place directly inside Google's secure interface. Moodle requests permission only for the specific file you select to make a copy of, to be stored within our Institution's secure Master Google Account for the purposes of evidence storage. Your original Google file remains your own and only a copy of it is stored with us, following our Institution’s data and retention timelines.  Moodle does not request or have access to, view, or scan any other files, folders, Gmail, Google Calendar, contacts, or personal Google Workspace data in your Drive.

2. How We Use Google User Data

The Google user data retrieved is used strictly for internal educational and platform operational purposes:

• Authentication: To authenticate your identity and allow secure, passwordless login to Moodle.
• Account Provisioning: To provision or map your user profile within Moodle so you can participate in courses, submit assignments, and view relevant linked data.
• Notifications: To deliver automated course-related updates and platform notifications to your verified college email address.
• Assignment Submissions: When you select a file via the Google Drive repository picker for an assignment, Moodle copies that specific file into our Institution's secure Master Google Account and automatically prepends your Student ID number to the filename. This ensures your submission is properly identified and made visible to permitted academic staff for the sole purpose of grading and feedback.

3. How We Store and Protect Your Data

• Storage: Your name, email address, unique Google account ID, are stored securely within our self-hosted/managed Moodle platform and database. We do not store your Google password, nor do we store credentials to your personal Google Drive.  Only files that you have explicitly submitted to an assignment as evidence, will be stored within our Institution's secure Master Google Account for the purposes of evidence storage.
• Retention: The data we collect is retained for the duration of your enrollment or employment with The College and in accordance with our data retention policy.
• Security: All data transmitted between Google, Moodle, and your browser is encrypted in transit using industry-standard Transport Layer Security (TLS/HTTPS).

4. Data Sharing and Transfer

• No Third-Party Sharing: We do not sell, rent, trade, or share your Google user data with third-party advertisers, commercial entities, or external data brokers.
• Limited Use Disclosure: The College’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data Revocation and Deletion

• Revoking Access: You can revoke Moodle’s access to your Google account at any time by visiting your Google Account Third-Party Permissions.
• Data Erasure: To request the deletion of your Moodle account and associated stored profile data, please submit a request to our DPO via the details below.

Our DPO

We meet the criteria set within the Data Protection Legislation to appoint a DPO (Data Protection Officer). They advise and inform the College about all aspects of data protection, and monitor our compliance with the legislation. They assist with risk assessments, staff training and awareness. The DPO is our designated point of contact for both you, our data subjects, and the ICO.

Their email address is: dpo@accesscreative.ac.uk 

How To Contact Us

If you have any questions about this notice, or wish to complain about how your data is being processed, please contact us via one of the following methods:

By email:         dataprotection@accesscreative.ac.uk

By post:         Access Education Group

5th Floor, Hanover House, 30-32 Charlotte Street, Manchester, M1 4EX

How To Contact the ICO

If you are not happy with the way your information is being handled, or with a response we have provided to you regarding a data use complaint, you have the right to lodge a complaint with the Information Commissioner’s Office:

Online:        https://ico.org.uk/make-a-complaint/data-protection-complaints/

By Post:        The ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF