Data Protection Information

Data Privacy Statement – Estates, Facilities & Residences

Estates, Facilities & Residences collects, records, uses and in some cases shares personal information that we hold on the users of our various services for the purposes in which they were intended upon collection. Estates, Facilities & Residences is committed to the protection and safeguarding of our user’s privacy through compliance of the General Data Protection Regulation (GDPR) and Data Protection Act 2018.

Legal basis for processing your information

To ensure compliance under the GDPR, Estates, Facilities & Residences are required to notify users of the ‘Lawful Basis’ upon processing of personal data.  For more information on the lawful basis for processing and the General Data Protection Regulation Act, click HERE

Throughout this statement, for each area of data processing, Estates, Facilities & Residences are required to consider the following lawful basis, which may include:

  • Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
  • Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
  • Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
  • Vital interests: the processing is necessary to protect someone’s life.
  • Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
  • Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

The information we collect, record, use and share

Estates, Facilities & Residences operates the following forms of data processing, or utilise data in conjunction with other University departments.  Within this section, and adjoining University web pages, we will seek to cover:

  1. How information is collected
  2. What information is collected
  3. Any 3rd party data sharing (if applicable)
  4. Where data is stored
  5. How long data is stored for
  6. The lawful basis for collection

Accommodation lock out process

All student lock-outs are dealt with over the telephone in the first instance. Security checks are carried out over the phone to determine that the person on the phone is the student living at the address given.  Personal information asked for over the phone includes (but is not necessarily limited to): full name; address of University residence; date of birth; Student reference number; Aberystwyth University IT Account Data provided is cross-checked against that stored using in-house Student Record System ‘AStRA’ (Aberystwyth Student Records and Admissions System).  Some of this information, namely: full name & address of University residence will be shared with Campus Services’ Security team to enable them to deal with the lock-out.  Information provided is not kept for any longer than necessary to ensure the resident is allowed back into their residence. 

  • Lawful basis: Consent

Additional Items form

Information is collected by the student resident completing the Campus Services Additional Items Form. This form is for the recording and processing of student residents’ requests for additional items to be brought into University Residences.  The data collected will include (but not necessarily be limited to): name; contact details; Aberystwyth University Student reference Numbers; details of residence; signature, item details.  Data is stored locally in hard-copy format for a period of no longer than 12 months following the termination of the Accommodation Licence Agreement.  

  • Lawful basis: Consent

Bedding Pack request form

Information is collected via the Bedding Pack Form for purpose of processing requests for bedding packs out of hours and are completed by the student/guest. The data collected will include (but not necessarily be limited to): name; contact details; Aberystwyth University Student reference Numbers; details of residence; signature.  Data is stored locally in hard-copy format and is disposed of once the bedding pack has been paid for.  Information may be shared internally between Campus Services security operatives and the Accommodation Office only.

  • Lawful basis: Consent

Bicycle Storage Application

Information is collected via the application form for indoor secure cycle storage and its submission to the Accommodation Office Reception. The data collected will include (but not necessarily be limited to): name; contact details; Aberystwyth University IT Account username; details of residence; bike details.  Data is stored locally in hard-copy format and is disposed of 12 months following the end of that academic year.  Information may be shared internally with by Campus Services security operatives in the event of any bicycle being left behind.

  • Lawful basis: Consent/Contract

Breaches of the accommodation licence agreement

Information can be collected using: Incident report forms and interviews/meetings with any and all parties involved in an incident. During the investigation process data collected will include (but not necessarily be limited to): name; contact information; information relevant to the incident; Student reference number; signature.  Information is shared with Aberystwyth University’s Health & Safety Department and the Police (where necessary); the Senior Tutor at Aberystwyth University (when necessary and in-line with the Accommodation Licence Agreement.  Incident report forms are sent to Health and Safety in the first instance.  Electronic copies of all associated correspondence, records and evidence are kept on the Students’ Hall Record in the Accommodation Office’s sharepoint site and on Aberystwyth University’s in-house Student Record System ‘AStRA’ (Aberystwyth Student Records and Admissions System).  Data is kept for a period of current academic year plus 5 years. 

  • Lawful basis: Contract/Legitimate Interests

Closed Circuit Television (CCTV)

The monitoring, recording, holding and processing of images of distinguishable individuals constitutes personal data as defined by the General Data Protection Regulation and the Data Protection Act (2018). The Aberystwyth University (AU) CCTV Code of Practice is consequently intended to ensure that in its use of CCTV, AU is fully compliant with the requirements of the General Data Protection Regulation and with related legislation and with the CCTV Code of Practice published by the Office of the Information Commissioner. For full details, click HERE

  • Lawful basis: Legitimate interest

Electronic locking systems

Aberystwyth University utilises an electronic locking system which is integrated with the Staff/Student Identification card. The Aber Card, amongst other things, allows access to pre authorised doors in place of traditional key entry systems and in doing so maintains an audit trail recording dates, times, door name and card holder name.  For full details click HERE

  • Lawful basis: Consent

Endsleigh Insurance

Aberystwyth University works in partnership with Endsleigh to provide student residents with contents insurance. Endsleigh provide a service to registered students living in University accommodation; however, personal data is only shared with Endsleigh during an insurance claim. The data shared will include (but is not necessarily be limited to): name; contact information. Data provided is cross-checked against that stored using in-house Student Record System ‘AStRA’ (Aberystwyth Student Records and Admissions System). Please see Endsleigh’ privacy statement for further information.

  • Lawful basis: Contract/Legitimate Interests

Fault reporting system

Aberystwyth University operates a maintenance reporting system for both academic and residential areas via the Campus Services Helpdesk using our call management system, Planet FM Enterprise intranet site. Planet FM is a database which the Estates Department then uses to administer hard facilities management. In the course of its use it may record names of staff and other members of the University in association with the work of the Estates Department. The data is held securely on a local, internal server. It is only accessible to a number of staff in the Estates Department and a small number in Campus Services. Records are reviewed annually and deleted as required.

We record information in the master key book for when staff within the Estates Department and/or Contractors visit site in order to gain access to the area requiring repair. The data collected will include (but is not necessarily be limited to): name; company information. The data may be shared for auditing purposes and is stored locally for 5 years.

There are three main ways that faults are reported during and out of office hours: over the telephone (24/7 Campus Life Helpline - 01970 622900); online fault report web-form; in person (either at Main Campus Reception or at the Accommodation office reception in Y Sgubor, Fferm Penglais).  Maintenance issues reported through Campus Services Security detail, either academic or residential are logged on a Maintenance Sheet.  These are forwarded to the facilities management via Aberystwyth University Help Desk, or out of hours direct to the managing agent.  The information collected will include (but is not necessarily be limited to): name; contact information; details of current accommodation/office; fault information (description & location as detailed as possible).  Name and contact details are used solely for the purpose of the Campus Services Helpdesk obtaining further information regarding the fault/maintenance issue if necessary.  Third party providers include (though may not limited to):
POBL Group;
Balfour Beatty.
In the vast majority of cases only details surrounding the fault/maintenance issue (such as location and fault) will be passed on to third party providers. Please see Privacy Statements of our partners for further information (linked above).

  • Lawful basis: Contract/Consent

Incident reporting system

Aberystwyth University operates an incident reporting system through its Health & Safety Department. Campus Services use of the system is in line with the H&S data protection statement which you can view HERE.  We record information, sometimes personal, through an incident report, and use this information to investigate and record a range of issues, such as Health & Safety accidents or near misses, and breaches of the Accommodation Licence Agreement.  In addition, an occurrence log is maintained within the Campus Security control room, Penglais Campus, recording basic details of all key actions and incidents 24/7/365.  Any personal information is restricted to names and location, and used only for the purpose of cross referencing with other reporting systems, such as incident and fault reporting.  Occurrence logs are filed in a locked store for a period of 12 months before being destroyed.

  • Lawful basis: Legitimate interest

Key Card/Out of Hours Key Return

The key card is our record of the resident collecting and returning the key to their accommodation. The out of hours key return form is used as an addition to the key card to enable the correct logging of students’ departure out of office hours.  The resident’s name is recorded and their signature taken to release and sign back the key.  For out of hours departures data is collected by Campus Services security operatives via a bespoke form at the time of the student Moving Out from their University Accommodation.  The data collected will include (but not necessarily be limited to): name; Aberystwyth University IT Account username; details of residence; reason for leaving; signature.  This information is kept for up to 12 months locally and, for a further 3 years in the Aberystwyth University Archives

  • Lawful basis: Consent/Contract

Lost Keys

Lost key forms are utilised for both student residents and conference guests. Information is collected either at: the Accommodation Office Reception, Y Sgubor, Fferm Penglais or; at the Main Campus Reception (operated by Campus Services), Penglais.  Information is collected on either: Lost Key Form – Student or; Lost Key Form – Conference, depending on the customer’s status.  The data collected will include (but not necessarily be limited to): name; contact details; Aberystwyth University IT Account username; event attending; details of residence/room; signature.  Personal information gathered in this process is not shared with anyone outside of Campus Services.  This data is stored locally in a hard-copy file for a maximum of 5 years (in the event of a query should arise regarding, for example, accommodation fees). 

  • Lawful basis: Consent/Contract

Parking enforcement system

The University's Traffic and Parking Regulations apply to staff, students and members of the public who use motor vehicles on the University's estate. Aberystwyth University are responsible for the issuing of all Warnings and Parking Charge Notices, and for the purpose of GDPR, are the Data Controllers.  All follow up action including payment collection, and all communication with the vehicle owner is dealt with by Excel Parking Ltd, and for the purpose of GDPR are the Data Processors.  The Parking Enforcement Privacy Statement can be view under point 8 of the University's Traffic and Parking Regulations

  • Lawful basis: Contract

Parking permit system

The University's Traffic and Parking Regulations apply to staff, students and members of the public who use motor vehicles on the University's estate. Staff, students and external stakeholders are able to apply for parking permits which results in personal information being collected at the point of applying.  The Parking Permit Privacy Statement can be viewed HERE.

  • Lawful basis: Consent

Police requests for data

Dyfed Powys Police (or other Police Forces within the UK), from time to time, may contact Campus Services outside Student Support Services and Human Resources opening hours to formally request data on Staff and Students. Full details of the University procedure for dealing with these requests can be found HERE

  • Lawful basis: Legal obligation

Private sector accommodation database

Our private sector accommodation database is provided by our third party provider StudentPad. The site acts as a database and search engine for students wishing to find accommodation in the private sector.  Local landlords can open an account and advertise their available properties on the site.  The data collected will include (but not necessarily be limited to): name; property details; payment information.  Please see StudentPad’s Privacy Statement for further details.

  • Lawful basis: Consent/Contract

Request to End University Accommodation Licence Agreement Early form

Data is collected by a student resident completing and submitting the Request to End University Accommodation Licence Agreement Early form to the Accommodation Office. The data collected will include (but is not necessarily be limited to): name; contact information; student reference number; details of current accommodation; course details; health/medical/disability information; reasons behind request & evidence in support of request (this may include , for example, supporting letters from: a medical professional; a department within Aberystwyth University or; their home University); signature.  All data is stored locally in a hard-copy file and office shared file store for a maximum of 5 years (in the event of a query should arise regarding, for example, accommodation fees).  This data is not shared. 

  • Lawful basis: Consent

Student Accommodation Application system

 

Data is collected through our dedicated Accommodation Portal where an applicant (prospective student and/or registered student at Aberystwyth University) will be required to log in using their UCAS/10 digit Personal ID number; name, date of birth, Aberystwyth University username and password (where applicable), in line with our Accommodation Application process. During the application process data collected will include (but not necessarily be limited to): contact information; health/medical/disability information; Welsh language preference; reason for staying in Aberystwyth, accommodation preferences. The information provided in this process will be used for the purposes of the accommodation application, record and the terms of the Accommodation Licence Agreement. It will be held securely by the University in line with the General Data Protection Regulation and associated legislation and treated as confidential – though it will be shared with members of staff who need access to it in order to offer appropriate services. For example, Information may be shared with Student Support Services for independent and professional assessment if applicable and consented to by the applicant. The processing of this information is necessary for the performance of contractual obligations and for the purposes of the University’s legitimate interests. In providing the information, including any sensitive data, the applicant is consenting to its processing in relation to their accommodation requirements.

Data provided during the initial Accommodation process is stored using in-house Student Record System ‘AStRA’ (Aberystwyth Student Records and Admissions System).  Data obtained during the Accommodation Application process will be kept for the duration of the application process, for the duration of any Licence Agreement stemming from the application and, up to a maximum of 6 years.

  • Lawful basis: Consent/Contract

Student Accommodation Licence Pack

Following an applicant applying for University accommodation, the application is processed and if successful an offer of accommodation is sent by e-mail. Acceptance of the offer of accommodation is required via our online Accommodation Portal, along with successful completion of the Accommodation Licence Pack by a given deadline date. The Terms and Conditions of the Accommodation Licence Agreement can be found at the back of the Residents’ Handbook. The information provided in this process will be used for the purposes of the accommodation application, record and the terms of the Accommodation Licence Agreement. It will be held securely by the University in line with the General Data Protection Regulation and associated legislation and treated as confidential – though it will be shared with members of staff who need access to it in order to offer appropriate services. The processing of this information is necessary for the performance of contractual obligations and for the purposes of the University’s legitimate interests. In providing the information, including any sensitive data, the applicant is consenting to its processing in relation to their accommodation requirements.

Data provided during the Accommodation Licence Pack process is stored using in-house Student Record System ‘AStRA’ (Aberystwyth Student Records and Admissions System). Personal data, as appears in the Accommodation Licence Pack will be retained in this format for 6 years and is processed for the purposes of your accommodation record and the terms of the licence. This processing is necessary for the performance of the contractual obligations of the licence (General Data Protection Regulation 6(1)(b) and for the pursuit of the University’s legitimate interests (General Data Protection Regulation 6(1)(f)). The Accommodation Application Process Privacy Statement can be viewed HERE.

It is a requirement during the completion of the Accommodation Licence Pack that payment information is provided to pay the Acceptance Fee and to set up a payment plan for the Accommodation Fees. This data is shared with the University’s Finance Department who liaise with a 3rd party to facilitate payments. For further information as to how your information is used please see the Finance Departments Data Privacy Information.

The online Induction Programme forms the final part of the process which is provided in conjunction with our third party induction system provider STEMS. Please see Student induction system point on this page for further information.

  • Lawful basis: Contract/Legitimate Interests

Student accommodation transfer form

Data is collected via our Accommodation Transfer Request Form completed by a student in residence wishing to transfer to alternative University accommodation. The data collected will include (but is not necessarily be limited to): name; contact information; sex/gender; health/medical/disability information; Student reference number; details of current accommodation; course details; signature.  In-house (AU department-department), information may be shared with: Student Support Services for independent and professional assessment if applicable and consented to by the applicant and; Campus Services’ Security teams on the successful completion of a transfer.  On the successful completion of a transfer vital data regarding said transfer will be shared our third party software provider STEMS to enable ‘Inventory’ & ‘Inspection’ functions/procedures (please see individual sections on this page) to be carried out as appropriate.  Data provided is stored locally using in-house Student Record System ‘AStRA’ (Aberystwyth Student Records and Admissions System) for up to a maximum of 6 years and the Transfer Request Form is stored locally in a hard-copy file for a maximum of 5 years (in the event of a query should arise regarding, for example, accommodation fees). 

  • Lawful basis: Consent

Student induction system

Our Student Online Induction Programme forms part of the process of completing the Accommodation Licence Pack. No personal data is collected at this point.  Information collected during the Accommodation Application and Licence Pack processes which is stored on Aberystwyth University’s in-house Student Record System ‘AStRA’ (Aberystwyth Student Records and Admissions System) is shared with our third party service provider to enable the provision of this service.  Our third party providers of this service are STEMS.  Please see STEMS’ privacy statement for further information.  Students may be contacted on their Aberystwyth University IT Account email address informing them of any updates regarding the process.

  • Lawful basis: Contract

Student inspection system

Regular inspections of student accommodation forms part of the Accommodation Licence Agreement. No personal data is collected at this point.  Information collected during the Accommodation Application and Licence Pack processes which is stored on Aberystwyth University’s in-house Student Record System ‘AStRA’ (Aberystwyth Student Records and Admissions System) is shared with our third party service provider to enable the provision of this service.  Information collected is only regarding the condition of the accommodation.  Our third party providers of this service are STEMS.  Please see STEMS’ privacy statement for further information.  Students may be contacted on their Aberystwyth University IT Account email address informing them of any updates regarding the process.

  • Lawful basis: Contract

Student inventory system

Our Student inventory system is to be used by students living in University accommodation to record the condition of their accommodation upon moving into the property. No personal information is gathered at this point.  Information collected is only regarding the condition of the accommodation.  Information collected during the Accommodation Application and Licence Pack processes which is stored on Aberystwyth University’s in-house Student Record System ‘AStRA’ (Aberystwyth Student Records and Admissions System) is shared with our third party service provider to enable the provision of this service.  Our third party providers of this service are STEMS.  Please see STEMS’ privacy statement for further information.  Students may be contacted on their Aberystwyth University IT Account email address informing them of any updates regarding the process.

  • Lawful basis: Contract

Student Transfer from Private Sector

The Student Transfer from Private Sector form is only used when an Aberystwyth University student is wishing to transfer into University Accommodation from the private sector. The student signs the form to confirm they have understood they may be liable for two rents should they enter into an Accommodation Licence Agreement with the University while still under contract in the private sector.  The student’s name and signature are all that are required.  This form is held for Accommodation Office use only and is held for a period of no longer than 12 months following the end of any Accommodation Licence Agreement entered into following completion of the form.

  • Lawful basis: Consent/Contract

Student Withdrawal from University form

Information is gathered by a student completing our Withdrawal from Aberystwyth University form. The form is used for student residents to inform the Accommodation Office of their intent to withdraw from their studies at Aberystwyth University (AU).  Aberystwyth University Accommodation Office is only able to house registered AU students meaning a withdrawal/temporary withdrawal directly affects their Accommodation Licence Agreement.  The data collected will include (but not necessarily be limited to): name; contact details; Aberystwyth University Student reference Number; details of residence; signature.  Data collected is for the information of the Accommodation Office only.  Information is stored as the hard-copy form for a period of 12-months following the end of the Accommodation Licence Agreement or, the end of the next academic year.

  • Lawful basis: Consent/Contract

Visitors Parking

Occasional visitors to the University may be issued with a Visitors Day Parking Permit. Permits are available upon request from Site Security at no cost. For emergency purposes, visitors name and contact number are collected, recorded, used and shared by Security in accordance with the General Data Protection Regulation and Data Protection Act 2018. Record sheets are stored for 2 weeks and then shredded. There is no 3rd party sharing.

  • Lawful basis: Consent

Visitor registration form

Data is collected via our student residents Register a Visitor web-form. The data collected will include (but not necessarily be limited to): name; visitor name; Aberystwyth University IT Account username; details of residence.  Some of this information will be shared with Campus Services’ Security team to fulfil Health and Safety obligations.  This information is only stored for the duration of the visit.

  • Lawful basis: Consent

Uni Kit Out

In preparation for your arrival you can pre-order essential packs, such as bedding and kitchen items, from Uni Kit Out. In order for Uni Kit Out to deliver your goods, so that they can be in your room ready for your arrival, Uni Kit Out will be required to share your details with us. The data shared will include (but is not necessarily be limited to): name; contact information. Data provided is cross-checked against that stored using in-house Student Record System ‘AStRA’ (Aberystwyth Student Records and Admissions System). Data is stored locally in electronic format and is disposed of 12 months following the end of that academic year. Information relating to your room allocation will be shared with Uni Kit Out and internally with Campus Services Security Operatives in order to assist in distribution of the items. Please see Uni Kit Out privacy statement for further information. 

 

Lawful basis: Consent / Contract

Your rights

You have a right to access your personal information, to object to the processing of your personal information, to rectify, to erase, and restrict use of your personal information. If you have provided consent to Campus Services to process any of your data then you also have a right to withdraw that consent. Please note that this may directly impact on the department’s ability to provide services to you.  Please visit the University Data Protection webpages for further information in relation to your rights:  https://www.aber.ac.uk/en/infocompliance/policies/dp/data-subject-rights/ 

Further information

Further details can be found here: https://www.aber.ac.uk/en/infocompliance/dp/ 

You are encouraged to report any improvements, suggestions, or any suspected breaches of privacy or security to us by using the contact information below:

Thomas Bates
Head of Campus Life
Campus & Commercial Services
Y Sgubor
Fferm Penglais
Aberystwyth University
Penglais
Aberystwyth
Ceredigion
SY23 3FH

efastaff@aber.ac.uk

Dr Jonathan Davies
Data Protection Manager
Hugh Owen Library
Aberystwyth University
Penglais
Aberystwyth
Ceredigion
SY23 3DZ

infocompliance@aber.ac.uk

 

 

Issue date 25.05.2018 - Version number 1.0.

AU staff and others

AU staff and others

The department may also process basic personal information (names, addresses, locations etc) of staff members, students and others, incidentally, in relation to Estates work in order to allocate jobs, identify parties associated with jobs and the reporting of Estates related information.  This processing will be covered by contractual agreement, or will be undertaken as it is in the legitimate interests of the University to do so.

Should individuals require any further information or clarification regarding any of the above please contact the Estates, Facilities & Residences Department on efastaff@aber.ac.uk or on 01970 62(1660)

In addition, you can find further information about the University and Data Protection by clicking on the below link:

https://www.aber.ac.uk/en/infocompliance/dp/

If you have any queries in relation to the above, please contact the Data Protection and Copyright Manager, Dr Jonathan Davies at infocompliance@aber.ac.uk

You can also contact the Information Commissioner's Office (ICO). The ICO is the UK regulator who oversees compliance with data protection legislation.

https://ico.org.uk/

Suppliers/Contractors

Suppliers/Contractors

Information (including personal data) provided to the department will be used for the administration of your work with the University as an external supplier/contractor and for remuneration in relation to that role. AU, as data controller, will be required to collect, store, use and otherwise process information about you for any purposes connected with the goods or services provided and as deemed necessary for the performance of your contractual agreement with the University (see GDPR Article 6(1)(b)).  We will retain your information for 6 years after you cease to be an external provider.

Your information will be held securely but will be made available to Aberystwyth University staff who will require this information as part of their role.