PROCESSING NOTICE ALUMNI

Transcription

1 PROCESSING NOTICE ALUMNI SUMMARY This summary is intended t cnvey essential infrmatin nly. Fr mre detailed infrmatin abut hw Ravensburne cllects, stres and prcesses yur persnal data can be fund in the full ntice attached t this Summary. The Data Prtectin Act (1998) is being updated t reflect changes in technlgy and hw yur persnal data is cllected, used and shared. In the UK, the new law will be called the Data Prtectin Act 2018 and will be based n the General Data Prtectin Regulatin. Fr the purpse f this law, Ravensburne will be acting as the Data Cntrller and will make decisins abut hw t use any persnal data we cllect frm yu. The principle purpse fr prcessing persnal data f ur alumni is t facilitate the prvisin f alumni services between Ravensburne and yu n the basis f ur legitimate interests. Every persn has rights assciated with hw their persnal data is used and prcessed. These rights include: T be infrmed what persnal data abut yu the University hlds and what it is used fr T access yur persnal data T update the persnal data the university hlds abut yu T be infrmed hw the university is cmplying with its bligatins under the Act T cmplain t the Data Prtectin Officer if yu believe that the Data Prtectin plicy has nt been fllwed T cmplain t the Infrmatin Cmmissiner (ic.rg.uk) if yu believe that the Data Prtectin Act has nt been fllwed T have persnal data erased where there is n cmpelling reasn fr us t keep the data Fr infrmatin n hw t exercise yur infrmatin rights, r t see the full versin f this fair prcessing ntice, please visit

2 Data Prtectin and Alumni Data at Ravensburne The Data Prtectin Act 2018 (DPA) regulates the prcessing f persnal data in any frmat by Ravensburne including bth digital and hard cpy persnal data and persnal data in all ther activity carried ut invlving persnal data, including cllecting, hlding, viewing and string it. On 25 May 2018, the DPA will be superseded in the UK by the General Data Prtectin Regulatin (GDPR) as part f the Data Prtectin Act 2018, which prvides individuals with enhanced rights, and impses increased respnsibilities n rganisatins prcessing persnal data. This statement applies under bth the DPA and GDPR. Our alumni and supprters are extremely imprtant t us, and this Fair Prcessing Ntice explains hw ur Alumni and Develpment department cllects, stres, manages and prtects yur data. It utlines the types f data that we hld and hw we use them t prvide services t ur alumni and supprters. We aim t be clear when we cllect yur persnal infrmatin, and nt d anything yu wuld nt reasnably expect. Ravensburne acts as the data cntrller fr all persnal data that it hlds and prcesses, except where it is dne in the capacity f a data prcessr n behalf f anther data cntrller. Our cntact details are: Data Prtectin Officer Ravensburne 6 Penrse Way Lndn SE10 0EW Tel: dp@rave.ac.uk Our Data Prtectin Officer wrks independently with us t ensure that we prtect yur persnal data and t cmply with ur legal requirements. Our DPO can be cntacted using the details listed abve.

3 Infrmatin We Cllect During the curse f ur activities, we will cllect, stre and prcess persnal infrmatin abut all f ur frmer students. We treat all alumni persnal data in a fair and lawful manner and in line with the data prtectin principles. N persnal infrmatin held by us will be prcessed unless the requirements fr fair and lawful prcessing are met. This Fair Prcessing Ntice prvides a summary f hw we will ensure that we d that, by describing: The categries f persnal data we will handle; The purpse(s) fr which it is being prcessed; and The persn(s)/ rganisatin(s) it will be shared with. Types f Persnal Data Prcessed The recrds we hld are limited t what is necessary fr us t prvide yu with an alumni service. In rder t carry ut ur activities and bligatins as a university, we prcess data in relatin t: Bigraphical infrmatin (including name, titles, gender, date f birth) Cntact details (including pstal address, address, phne numbers, scial media prfiles) Infrmatin abut yur time at Ravensburne (including educatin details, memberships f clubs and scieties and details f placements, prizes and schlarships) Emplyment details (including psitins held, rganisatins wrked fr, areas f respnsibility, cntact details, incme) Cmmunicatins sent t yu by Ravensburne r received frm yu as well as yur cmmunicatin preferences Vlunteering n behalf f the University (fr example mentring, giving a talk, advisry bard membership) Events yu have attended (including meetings with University staff) Media articles that yu have featured in, including details f awards yu have been nminated fr r have wn Hbbies and interests bth current and while yu were at Ravensburne In sme cases, ther infrmatin is cllected: Special categries f data yu prvide fr a specific purpse (e.g. disability r dietary requirements fr event management purpses)

4 Infrmatin abut yur family and ther relatinships (including spuse/partner, friends, family, university staff, ther alumni and rganisatins) Financial data, including infrmatin n yur dnatins (including gift aid status and, if dnating by Direct Debit, yur bank details). We d nt stre credit r debit card numbers Infrmatin abut yur areas f interest and ptential t supprt the University Assessment f yur wealth and future fundraising and engagement plans (including details f planned financial and nn-financial asks fr supprt, prjects f ptential interest and indicatrs f yur vlunteering/giving ptential and wealth) Legal Basis Alumni persnal r special categry data is cllected and prcessed by the Alumni and Develpment department as it is necessary fr ur legitimate interests in prviding yu with a vluntary alumni membership. Sme prcessing activities will als be carried ut fr ther reasns such as: Under a legal bligatin (fr example, disclsing persnal data t external parties under statutry pwers) Where it is necessary t prtect the vital interests f the graduate r anther party (fr example, disclsures t external parties t ensure the safety and wellbeing f individuals) Where it is necessary fr the perfrmance f a task carried ut in the public interest r in the exercise f fficial authrity (fr example, cllecting r disclsing infrmatin in rder t meet regulatry r statutry requirements) Hw we keep ur data accurate We always strive t keep ur data as accurate as pssible s we really appreciate it when yu keep us up-t-date with yur mst recent cntact details. Yu can d this nline, by , pst r telephne. We may als cnsult alternative and publicly available surces in rder t undertake data accuracy checks, such as: Ryal Mail Natinal Change f Address database (NCOA); BT Operatr Services Infrmatin System (OSIS) and wealth intelligence databases. We may als frm time t time review the emplyment infrmatin we hld fr yu thrugh publicly available infrmatin such as scial media, newspaper articles and publicatins, cmpany websites, Cmpanies Huse and ther cmpany infrmatin databases, Charity Cmmissin and Office f the Scttish Charity Regulatr (OSCR) registers. Where we appint an external party t undertake a screening f

5 infrmatin, any such arrangements will be subject t a frmal agreement between us and that rganisatin, t prtect the security f yur data. We ccasinally cnduct research t help us understand ur alumni, supprters and ptential supprters. This may include gathering infrmatin frm publicly available resurces, t give an insight int yur philanthrpic interests and ability t supprt Ravensburne. This is smetimes referred t as 'wealth screening'. Frm time t time, we may als cnduct sme analysis f ur data t help us understand ur alumni and supprters, t ensure we are efficient and that nly relevant cmmunicatins are sent t yu. This may include assigning a scre calculated using persnal data and hw engaged with us yu have previusly been. Tls may be used t mnitr the effectiveness f ur cmmunicatins with yu, including tracking, which recrds when an frm us is pened and/r hw many links are clicked within the message. Cntacting Yu If yu prvide us with cntact details fr a particular methd f cmmunicatin we will assume that yu have given us yur cnsent fr us t update yur recrd and cmmunicate with yu using this infrmatin, unless yu have tld us therwise. Cntact details prvided directly by yu will update any previus preferences in relatin t this channel unless yu infrm us therwise. If yu are registered with the Telephne Preference Service (TPS) but prvide us with a telephne number, we will verify if yu prvided us with yur telephne number befre r after registratin with the TPS. In the event f prviding us with yur telephne number after registratin with the TPS, we will take this as psitive indicatin f cnsent t cntact yu n that number. Fundraising is a key part f ur alumni wrk, and we are cmmitted t wrking in a transparent, ethical, respnsible and hnest way. T reflect this cmmitment, we are a member f the Prtecting yur Data We are cmmitted t hlding yur data securely and treating them with sensitivity. All data are held securely and in accrdance with the Data Prtectin Act Yur data are held n a database hsted n a secure server. This database is prtected and access is restricted t individuals wh need t see the data t carry ut their duties at the university. This is limited t: members f staff in alumni services; assigned IT supprt; and clleagues frm ther areas within

6 the university wh wrk clsely with us n the prvisin f services t alumni and supprters, such as the Careers Service. User access rights t the database are restricted accrding t individual jb rles in rder t ensure that users nly see infrmatin relevant t them. This access is reviewed n a regular basis. Sharing yur infrmatin Yur persnal data will nt be passed withut yur permissin t external rganisatins r individuals ther than where we have a legal bligatin t d s r where we pass data t rganisatins acting in a capacity as agents fr Ravensburne as Data Prcessrs. Within the university, we undertake regular reviews f wh has access t yur persnal data. Yur infrmatin is nly accessible by apprpriately trained staff. Individual Rights Individuals whse persnal data and sensitive persnal data/special categry data is held by us have the fllwing Infrmatin rights: (a) The right t request access t the persnal data held by us (b) The right t have inaccurate r incmplete persnal data rectified (c) The right t erasure f persnal data this will nly apply where there is n legitimate reasn fr us t cntinue t prcess the persnal data. There will usually be a requirement fr us t keep basic recrds indefinitely (d) The right t restrict the prcessing f persnal data prcessing f their persnal data in specific situatins individuals have the right t blck the (e) The right t data prtability sme data subjects have the right t request prvisin f sme elements f their infrmatin (fr example emplyment details) in digital frm in rder t prvide it t ther rganisatins (f) The right t bject yu can bject t the prcessing f yur persnal data in certain circumstances, including the sending and receipt f direct marketing material (g) The right t bject t autmated decisin making and prfiling individuals have the right t bject t decisins taken by autmatic means withut human interventin in sme circumstances

7 Nte: These rights are nt abslute in every circumstance and a number f factrs such as exemptins in law apply. All requests t exercise any f these rights shuld be made t the Data Prtectin Officer at dp@rave.ac.uk. Where the prcessing f yur persnal data r sensitive persnal data/special categry data is based nly n yur cnsent, yu have the right t withdraw yur cnsent at any time by cntacting the Data Prtectin Officer at dp@rave.ac.uk. Examples f where we can nly rely n yur cnsent include marketing and prmtins, r research. If yu are unhappy with ur handling f yur persnal data, r believe that the requirements f the DPA r GDPR (r any legislatin arising directly frm it) may nt be fully cmplied with, please cntact the Data Prtectin Officer at dp@rave.ac.uk. The frmal cmplaint prcedure will be used if apprpriate, and yu have right t submit a cmplaint t the Infrmatin Recrds Retentin Yur persnal data will be kept in line with the University Recrds Retentin Schedule, which is available n request. This is a large dcument s, if yu have any specific queries, please cntact the Data Prtectin Officer at dp@rave.ac.uk. Yur persnal data will be dispsed f when: We have met ur legal retentin requirements fr yur persnal data r; We n lnger have a legitimate reasn t maintain that data and it is cnsidered nt t cntain material that has archival value.