International Student Support Data Protection Privacy Notice for Students
This Privacy Notice is applicable from the 2017/18 academic year onwards
Your privacy and trust are important to us and this Privacy Notice provides essential information about how the University, and specifically the International Student Support Team, handles your personal information.
The University of Strathclyde is a data controller under data protection legislation. Any enquiries regarding data protection should be made to the University’s Data Protection Officer at firstname.lastname@example.org.
This notice is regularly reviewed and sometimes updated. It is important that you check back often for updates to this Notice. Updates may be made at any time and you will always find the most up to date version at - www.strath.ac.uk/dataprotection. If we make significant changes we will contact you to inform you of this.
Rights under the Data Protection Act
As a ‘Data Subject’ you have a number of rights under the Act. These include the right to:
- access the personal data the University holds about you
- have inaccurate data corrected
- prevent processing of information which may cause you harm or distress
- prevent unsolicited marketing
- prevent automated decision-making.
For more information on your rights please see - https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/
What is personal data/personal information?
In simple terms, personal data is information which identifies and relates to you, either on its own or in conjunction with other information held by the University. Sensitive personal data (or special categories of personal data, as it will be known under new EU legislation coming into force on 25th May 2018) is personal data which falls within one of these categories:
- personal data revealing racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data, biometric data for the purpose of uniquely identifying a natural person
- data concerning health
- data concerning a natural person's sex life or sexual orientation shall be prohibited
- data relating to criminal convictions/criminal proceedings (this definition will change slightly under GDPR)
If we are ever collecting sensitive personal data, as defined above, additional safeguards will be in place around how we can use that data.
The types of personal information we collect
We collect identifiable information about you in order to create and maintain adequate records in relation to the various interactions you may have with the International Student Support Team. Whenever you provide personal data there should be a privacy notice, like this one, which tells you what the information will be used for.
Examples of some of the personal data we collect when you access our service include:
- Your name
- Your nationality and immigration status
- Your address
- Your student registration number
- Your bank details
- Your course details
- Your year of study
- Details on any health or disability issues you may have
- Your relationship status (i.e. married, single, separated, widowed, divorced etc)
- Details on any caring responsibilities you might have
- Details on if you are a care-experienced student
- Details of any children you may have including their name and age
- Details on how you are currently funding your course
- Details of any personal issues that may affect the advice we give you
The above is not an exhaustive list and on occasion we may ask for other personal data or sensitive personal data as part of the application process. Where requested this data will be held and processed in accordance with the data protection legislation in force at the time.
You should note that you are under no statutory or contractual obligation to provide personal or sensitive personal data to the University or the International Student Support Team. However, failure to disclose data when requested may result in a delay to our response, or the team’s ability to accurately advise you or support you.
We collect this data in order to give you accurate advice. As a provided of immigration advice and services we are required by the Office of the Immigration Services Commissioner (OISC) to ensure that we provide advice and information that is appropriate to your situation. In order to do this we must collect data from you.
Data Protection legislation also requires that we clarify to students our legal basis for wishing to collect and process their personal data. The International Student Support Team process personal and special data about students on the basis that the student has entered into a contract by agreeing to the terms & conditions outlined when they access our service and under our legal obligations arising from the University’s position as the holder of Licenses under Tiers 2, 4 and 5 of the Points Based System for Immigration and our obligation as a provider of immigration advice and services under the OISC Code of Standards.
How we use personal information
The International Student Support Team uses your personal data for a variety of reasons. These include:
- Responding to enquiries
- Advising you about your immigration status
- Advising you about making an immigration application
- Advising you about your stay in the UK, your studies at the University or other aspects of life in the UK about which you seek advice
- Compiling records and statistics for research and audit purposes and management information
- Communications with students (including by electronic means) relating to the progress of immigration applications
- Undertaking surveys
Where we store and process personal information
Electronic personal data is held on the University’s secure servers. Hard copy data will be stored securely to prevent unauthorised disclosure.
How we secure personal information
The University has robust Information Security policies in place to protect all the data it holds, including your personal data. You can read more about these policies and technical standards on the University website - https://www.strath.ac.uk/staff/policies/informationsecurity/
On a day-to-day basis staff access to student personal data is restricted on a ‘need to know’ basis. The University’s data protection policies and procedures make clear that all staff have a responsibility to ensure that they handle personal data appropriately and that suitable organisational security measures are in place.
Who we share data with
The International Student Support Team discloses information about students to a variety of third parties. This will always be done in accordance with the relevant legislation. You should be aware that in many cases it is not necessary to seek your consent to share your personal data. This may be for a number of reasons, for example, the University is under a legal or statutory obligation to provide the information.
If your consent is required before we can share your information then we will contact you to ask for this. If you do not consent then your data will not be shared (unless we are legally required to do so). Personal data will only ever be disclosed in accordance with the data protection legislation in force at the time. Third parties who we share your data with include (but are not limited to):
- Authorised agents of the University
- UK Visas and Immigration
- Law enforcement agencies
- Relevant authorities dealing with emergency situations at the University *
- Any other authorised third party to whom the University has a legal/contractual obligation to share personal data with
Please note that in emergency situations where the University deems it to be in your (or potentially a third party’s) ‘vital interests’ the University may share your personal data, including sensitive personal data with relevant individuals/agencies, e.g. the Police.
How long we keep personal information
The International Student Support Team will retain your personal data as long as necessary for the purposes described above. Please note that after completion of your studies the University may still require to hold your personal data for a period of time to satisfy statutory/legal obligations and/or to meet administrative requirements. Appropriate data will be retained permanently to ensure a record of your educational achievements is retained.
Detailed below is the current retention schedule for personal data held by the International Student Support Team.
Data relating to an immigration application in which we have assisted
Current academic year + 6 years
Data relating to immigration advice we have provided
Current academic year + 6 years
Data relating to advice requested or received in relation to matters other than immigration
Current academic year + 6 years
Testing IT Systems
The University may also, where required, use copies of the data you provide (including sensitive personal data) in order to test our IT systems. If personal data is used for system testing, it will be copied to a test environment, where it will be used to test IT systems in a realistic way. This is done to ensure that changes will be effective and will not cause loss or damage to data in the ‘live’ environment. The data about you which we hold in our ‘live’ systems will not be affected in any way. Data will not be kept in the test environment for longer than is necessary for testing purposes, and data in that environment will not be used for any purpose other than testing. Appropriate security precautions and permissions will be applied to the data and any copy used for testing will be deleted as soon as the testing has been completed.
Right to access personal data
As a data subject you have a right to request a copy of the information the University holds about you, this is known as a ’Subject Access Request’ (SAR). The University currently charges £10 and has 40 calendar days to process a SAR. For more information see the University’s Data Protection web pages or contact email@example.com.
You are required to read this privacy notice/statement for students before accessing advice and services provided by the International Student Support Team. It is important that you do so, as this contains important information about how we use your personal data and your rights.
The University strives to ensure your personal data remains accurate, to assist with this please ensure you keep your record up-to-date via PEGASUS. More general information on Data Protection is available at - http://www.ico.gov.uk. For information on the University’s Data Protection policies and procedures see - http://www.strath.ac.uk/dataprotection/.
Your right to complain to supervisory authority
If you have any concerns or issues with the way the University has processed your personal data you can contact the Data Protection Officer at firstname.lastname@example.org. You also have the right to lodge a complaint against the University regarding data protection issues with the Information Commissioner’s Office - https://ico.org.uk/concerns/.
Status of this Privacy Notice
This privacy notice is subject to change. Data protection legislation is changing in May 2018 when the new EU General Data Protection Regulation comes into force. You can find out more about the legislation on the ICO website - www.ico.gov.uk. The University will advise you of any significant changes you need to be aware of, in relation to this privacy notice.
This Privacy Notice was last reviewed on 11th March 2019.