Student Privacy Notice                

This notice is for all students attending the University of Central Lancashire (UCLan), and explains how and why we will process your information.

Who we are:

UCLan is a registered data controller. We are registered as such with The Information Commissioners Office under registration number Z5512420.

Why do we collect your data?

Who do we share your data with?

Students should be reassured that UCLan take their obligations towards data security seriously. Any data about you which is shared will only be done so if permitted by current data protection legislation.

How long do we store your data?

We will maintain your full student record for 6 years following your graduation.

For students on certain courses there is a statutory requirement to hold your data for longer. You will be notified if you are on such a course.

After 6 years we will only retain your basic data to enable us to confirm, if necessary, your attendance on one of our courses, and your grade achieved.

Your rights:

Subject Access Request:

Under the General Data Protection Regulations (GDPR) you have the right to make a subject access request (SAR) and to obtain copies of records and files relating to you held by the University.

If you wish to make a SAR then please complete our SAR form or email dpfoia@uclan.ac.uk details of the information you require. The University has a month to reply to you unless your request is complex or there are a number of requests, in which case the deadline can be extended by a further two months, but the University will contact you within a month of receipt of the SAR, explaining why an extension is necessary.

There is ordinarily no charge for making a SAR.

Right to Erasure

The right to erasure is also known as ‘the right to be forgotten’.

The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing.

When does the right to erasure apply?

The right to erasure does not provide an absolute ‘right to be forgotten’. Individuals have a right to have personal data erased and to prevent processing in specific circumstances:

• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
• When the individual withdraws consent.
• When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
• The personal data was unlawfully processed (ie otherwise in breach of the GDPR).
• The personal data has to be erased in order to comply with a legal obligation.

Under the GDPR, this right is not limited to processing that causes unwarranted and substantial damage or distress. However, if the processing does cause damage or distress, this is likely to make the case for erasure stronger.

When can UCLan refuse to comply with a request for erasure?

We can refuse to comply with a request for erasure where the personal data is processed for the following reasons:

• to exercise the right of freedom of expression and information;
• to comply with a legal obligation for the performance of a public interest task or exercise of official authority.
• for public health purposes in the public interest;
• archiving purposes in the public interest, scientific research historical research or statistical purposes; or
• the exercise or defence

Data portability

The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services.

It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability

The right to data portability only applies:

• to personal data you has provided to UCLan;
• where the processing is based on your consent or for the performance of a contract; and
• when processing is carried out by automated means

Where a relevant request is made by you to UCLan we will facilitate your request as soon as possible, and in no longer than one month.

How we keep your data secure:

We will never give or sell your data to anyone else, nor will we make use of it except as described above.

Your data is stored on our secure server, which is properly protected by the use of firewalls and other data security systems. Further, access to your data is restricted, with access to student data restricted. Our Data Protection Policy and related guidance documents can be located here [hyperlink] which give more detail of how we will treat your data.

Download the Student Privacy Notice (.pdf 100KB)

Last updated: June 2018

Alumni: Privacy Statement

The aim of this Privacy Statement is to explain how the University of Central Lancashire’s alumni department collects, stores, manages and protects your data.

Our responsibilities

The alumni department is part of the University of Central Lancashire; we manage communications and relationships with our alumni, whether you have graduated from the Harris Institute, Preston Polytechnic, Lancashire Polytechnic or the University of Central Lancashire. We do this by offering a range of services, support, publications, news, event information and careers and business advice. In order to do this we hold a database that contains personal data from when you studied with us.  We process and store personal data relating to our alumni, and as a result adhere to the General Data Protection Regulations (GDPR), the legal basis for collating this data is Legitimate Interest.

Further, we are aware of our responsibilities under the Privacy & Electronic Communications Regulations 2003 (PECR) and as such we will only communicate with you via email, SMS or telephone if we have your consent to do so.

Updating your contact details and preferences

At any time you can update your contact details and your communication preferences, you can also stop all communications from the University of Central Lancashire. You can do this by updating your details or by contacting the alumni team on email: alumninetwork@uclan.ac.uk  01772 892344.

How your information is collected

Data about our graduating students is transferred into the alumni database from the student record system. We aim to keep your details up to date, and we encourage all departments within the University to direct communications to you via our alumni department. All graduating students will be asked about their marketing preferences prior to graduation, and asked to opt-in to communications from us.

Data we hold

The alumni department hold records of all graduating students from UCLan in perpetuity. The personal data we store and process, of which the majority is given by you may include:

• Name(s), title, gender, nationality, date of birth, name changes
• Contact details including email, postal address, telephone number, mobile number and links to social media account
• Information about your time at the University and other academic institutions, including other qualifications or courses studied
• Your occupation and professional details
• Records of donations and gift aid status (where applicable )
• Records of communications sent to you by the alumni department
• Information on the engagement you have had with the University, e.g. events attended, networks involved in etc.
• Case study information and associated images – consent to use is also recorded

How we use your data

Based on your opting-in to communications from the University’s alumni department, the alumni department will use your data to communicate key university messages. These include the following, which may be delivered by email, telephone, post or SMS subject to your preferences:

• Sending university news and publications
• Notification of university events
• Academic course and professional development information
• Career opportunities and business start-up support
• Fundraising and charitable programmes

We may also process personal data for the following purposes:

• To verify an account when you register for UCLan Connect
• To verify you are an alumnus if you register to use the library or Sir Tom Finney sports Centre
• To register you to attend an event
• To process and organise any mentoring, volunteering or speaking activity you have agreed to undertake for us
• To process a gift or donation to have given us

In some cases, we may be obliged to process your data for statutory and contractual purposes. In particular HESA who run the annual Graduate Outcomes survey. Further information can be found here: https://www.hesa.ac.uk/innovation/outcomes/students

Keeping your data secure

We will not disclose your data to individuals or other third-party organisations external to the University, other than those entities who are delivering a service to the University or you. The University does not sell or trade your data with any other organisations.

Your data is stored on our secure server, which is properly protected by the use of firewalls and other data security systems. Further, access to your data is restricted, with access to student data restricted. Our Data protection policy and related guidance documents can be located here www.uclan.ac.uk/data_protection/index.php which give more detail of how we will treat your data.

Your rights

Subject Access Request

Under the General Data Protection Regulations (GDPR) you have the right to make a Subject Access Request (SAR) and to obtain copies of records and files relating to you held by the University.

If you wish to make a SAR then please email dpfoia@uclan.ac.uk with details of the information you require. The University has a month to reply to you unless your request is complex or there are a number of requests, in which case the deadline can be extended by a further two months, but the University will contact you within a month of receipt of the SAR, explaining why an extension is necessary. There is ordinarily no charge for making a SAR.

Right to Erasure

The right to erasure is also known as ‘the right to be forgotten’. The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing.

The right to erasure does not provide an absolute ‘right to be forgotten’. Individuals have a right to have personal data erased and to prevent processing in specific circumstances:

• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
• When the individual withdraws consent.
• When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
• The personal data was unlawfully processed (ie otherwise in breach of the GDPR).
• The personal data has to be erased in order to comply with a legal obligation.

Under the GDPR, this right is not limited to processing that causes unwarranted and substantial damage or distress. However, if the processing does cause damage or distress, this is likely to make the case for erasure stronger.

We can refuse to comply with a request for erasure where the personal data is processed for the following reasons:

• to exercise the right of freedom of expression and information;
• to comply with a legal obligation for the performance of a public interest task or exercise of official authority.
• for public health purposes in the public interest;
• archiving purposes in the public interest, scientific research, historical research or statistical purposes; or
• the exercise or defence of legal claims.

Data portability

The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services.

It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability.

The right to data portability only applies:

to personal data you have provided to UCLan;
where the processing is based on your consent or for the performance of a contract; and
when processing is carried out by automated means

Where a relevant request is made by you to UCLan we will facilitate your request as soon as possible, and in no longer than one month.

Policy Changes

Whilst this statement covers what and how we use your information for presently, it is possible that we may use your data for new purposes in the future which is not currently described in this statement. If our practices do change, then this policy will be amended to reflect this.

Download the Alumni Privacy Notice (.pdf)

Policy last updated: May 2018

Human Resources Privacy Notice for Employees

On behalf of your employer, HR collects and processes data about you for normal employment purposes. The information held and processed concerning you and your employment will be used to enable the University to manage its relationship with you effectively, lawfully and appropriately, during the recruitment process, during your employment, at its end and after you have left.

HR collects and processes a range of personal information, including:

• Your name, address and contact details, including e-mail address and telephone number(s), date of birth and gender;
• The terms and conditions of your employment;
• Details of your qualifications, skills, experience and employment history, including start and end dates both internally and with previous employers;
• Details of salary and entitlement to benefits such as pension membership;
• Details of your bank account and national insurance number;
• Next of kin and emergency contacts;
• Details of your nationality and eligibility to work in the UK;
• Information relating to a criminal record;
• Details of your days and hours of work and your attendance;
• Periods of leave, including holiday, sickness absence, family leave and sabbaticals along with the reasons for the leave;
• Details of any grievance or disciplinary procedures in which you have been involved, including any warnings issued and related correspondence;
• Training records, performance improvement plans and related correspondence;
• Information regarding medical or health conditions, including whether you have a disability and any reasonable adjustments required, occupational health reports and associated risk assessments;
• Equal opportunities monitoring data, including ethnicity, sexual orientation, religion or belief.

HR may collect this information in a number of ways. For example, from application forms; passports and other identity documents including biometric cards; forms completed by you at the start or during employment including pension and benefit nominations; from correspondence with you; or through interviews and meetings.

In some cases, HR may collect data about you from third parties, including references from former employers, employment background check providers and criminal record checks.

HR needs to process data in order for the University to enter into and meet its obligations under your employment contract. In some cases data is processed to meet legal and statutory obligations. For example, demonstrating that checks have been undertaken to ascertain eligibility to work in the UK, to deduct tax and to comply with procedures for the payment of statutory benefits and dealing with applicant data for vacancies.

Data will be stored in a range of different places, including your personal file, in HR’s management information systems and other IT systems such as the University’s e-mail system and telephone directory.

Processing data allows HR to:

• Manage recruitment and selection processes;
• Maintain accurate and up-to-date employment records and contact details and records of employee contractual and statutory rights;
• Operate and maintain records of disciplinary and grievance processes to ensure acceptable conduct within the workplace;
• Operate an appraisal process and maintain records relating to staff learning and development to support career progression, succession planning and workforce management activities;
• Manage and maintain absence management procedures including the recording of absence type and reasons to support employee welfare and capability processes and to ensure that employees receive appropriate payment and/or other benefits as appropriate;
• Seek occupational health advice and guidance to ensure compliance with duties relating to individuals with disabilities and those of health and safety legislation;
• Ensure effective general HR and business administration;
• Operate within the statutes imposed by employment law, respond to and defend against legal claims; and
• Maintain and promote equality, diversity and inclusion within the workplace.

Where special categories of information are processed, for example those covered by equal opportunities legislation, we will obtain your explicit consent to those activities unless this is not required by law or the information is required to protect your health in an emergency.

HR will share some of your information internally, for example, with other HR colleagues, with Payroll and IT staff and your line manager where access is necessary for the performance of your and their roles.

HR will also share some of your data with third parties in order to obtain references, complete background and eligibility checks, obtain medical clearance and administer pension and other benefits.

HR takes the security of your data seriously and operates within the University’s internal policies and procedures in order to try to ensure that your data is not lost, accidently destroyed, misused or disclosed and is not accessed except by the relevant employees in the performance of their duties. More information regarding data security can be found below: https://intranet.uclan.ac.uk/sites/uclanwide/info-security/Pages/default.aspx.

The University has also introduced mandatory training for all staff in relation to information security and GDPR and these courses can be undertaken on-line via the following link: https://intranet.uclan.ac.uk/ou/hr/Pages/Mndatory-Training.aspx.

Your information will be held for the duration of your employment. The periods for which your data is held after the end of your employment are set out in the University’s Retention Schedule which can be accessed via:

https://intranet.uclan.ac.uk/ou/sds/information-governance/rrs/_layouts/15/start.aspx#/SitePages/Home.aspx.

Your Rights

Under the GDPR, as a data subject you have the right to request:

• Access to a copy of your data;
• Rectification of inaccurate or incomplete data;
• HR, on behalf of the University, to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing.

You have the right to lodge a complaint to the Information Commissioner’s Office if you believe that the University has not followed the requirements of the GDPR with regard to your personal data.

However, you have certain obligations to provide and allow the processing of information in order for the University to comply with the employment contract, legal requirements and any statutory responsibilities. If you do not provide the information the University may be unable to administer the rights and obligations resultant upon the employment relationship.

Identity and contact details of controller and data protection officer

The University of Central Lancashire is the controller and processor of data for the purposes of the GDPR.

If you have any questions or concerns regarding your data and how it is processed, please contact:

Information Governance Manager: DPFOIA@uclan.ac.uk

Download the Staff Privacy Notice (.pdf)