Data Processing Declaration

Summary

1. Aberystwyth University is a data controller under the Data Protection Act 1998 (DPA) and also under the General Data Protection Regulation due to be implemented in 2018.

2. The University’s nominated representative is:

Pro Vice-Chancellor (Chief Operating Officer)

Vice-Chancellor’s Office

Aberystwyth University

Visualisation Centre

Penglais Campus

Aberystwyth

Ceredigion

SY23 3BF

3. The University needs to process personal information about you so that it can:

Process your application to study;

Provide services (e.g. accommodation; student support);

Organise courses;

Maintain your personal learning record;

Monitor performance;

Process payments;

Provide information for authorized agencies;

Investigate, and act on, disciplinary matters.

4. We do not necessarily collect or retain data in all of the categories below, but you should be aware that some of the information which we receive, request and process may be defined as ‘sensitive’ under the DPA.  Those sensitive categories of data currently cover:

Racial or ethnic origin

Political opinions

Religious beliefs or other beliefs of a similar nature

Membership of a trade union

Physical or mental health or condition

Sexual life

The commission or alleged commission of any offence

Any proceedings for any offence committed or alleged to have been committed, the disposal of such proceedings or the sentence of any court in such proceedings

5. Students (as data subjects) have a number of rights under data protection legislation, including the right to:

Access the personal data the University holds about you;

Have inaccurate data corrected;

Prevent processing of information which may cause you harm or distress;

Prevent unsolicited marketing;

Prevent automated decision making.

Details

6. Your personal data is the information we collect about you during the application, admissions and enrolment processes and during your time as a student or alumnus.  This includes details such as your name, address, date of birth, course details, attendance data, fee payments, marks and exam results.  Your personal data will be used, for example, to:

Process your application for study;

Enroll you as a student and maintain your student record;

Allow you to be contacted (your name, department and University e-mail address will be made available in an internal online directory);

Administer your course and your academic progress;

Administer the financial aspects of your studies such as tuition and accommodation fees;

Provide or offer facilities and services to you during your time as a student and after your departure, as part of the University’s legitimate business.  This includes such things as provision of library and computing access, sports facilities, arranging accommodation, alumni membership and related activities;

Facilitate any required learning support (e.g. by the internal sharing of disability information as appropriate);

Allow the Students Union to be run in a fair and democratic manner;

Collate reports and statistics which the University is required to return, for example, to official government bodies;

Regulate secure access to University buildings and properties.

7. Some information will be retained after your period of registration as a student and may be used to provide transcripts of results and educational references to prospective employers, professional bodies and other agencies with a legitimate interest in this data.

8. Personal data will also be retained for alumni relations and fundraising purposes and the University may contact students after they have left in relation to these purposes.  For further details, see: https://www.aber.ac.uk/en/development/data-protection/

9. Information retained after leaving may also be used by the Careers Service to offer support and advice.

10. You may also be asked to provide further information at, and after, graduation as part of the national Destination of Leavers from Higher Education (DLHE) survey which is an important and mandatory exercise undertaken across all higher education institutions in the UK.  Any information we retain after your period as a registered student may be used in order to contact you for these purposes.

11. The Finance Department will hold information about you during, and subsequent to, your period as a student and may need to contact you regarding any outstanding debts.  Where appropriate, information may be passed on to external agencies for processing and follow -p actions.

12. The University shares some personal data with Aberystwyth University Students’ Union for the administration of its business, for fair and democratic representation and for the running of its clubs and societies.  The Students Union may also share with the University information which it has collected.  A data sharing agreement governs this process which facilitates the University’s obligations under section 22 of the education Act 1994.

13. The University will, in some circumstances, disclose information about students (including sensitive personal data) to authorized third parties.  These include, inter alia:

Central and local government departments such as the Higher Education Statistics Agency, the Department for Business, Innovation and Skills, the Welsh Government, UK Visas and Immigration, Ceredigion County Council;

The Student Loans Company;

University auditors and insurers;

The courts, police forces, coroners’ offices;

Professional bodies;

Agencies contracted to undertake official student surveys;

Other educational institutions which collaborate with the University or which require verification of student information or qualifications;

External bodies which accredit University schemes or awards;

External agencies, such as the Joint Information Systems Committee and any relevant subcontractors, which supply analytical services to enhance learning outcomes (for the development, testing and supply of these services).  See https://www.aber.ac.uk/en/infocompliance/dp/learning-analytics/

Please note that details relating to the processing of your personal data by the Higher Education Statistics Agency can be found here: https://www.hesa.ac.uk/about/regulation/data-protection/notices

14. As part of the academic process, the University uses plagiarism detection services and this may require passing basic information relating to students to third parties which provide this service.  These services may be outside the EEA.

15. Information relating to students based at non-UK campuses may also be provided to appropriate official bodies (equivalent or similar to those listed in 13 above) in those countries in which they are based.

16. Students should also note that there is a statutory duty for higher education institutions to have due regard to the need to prevent individuals from being drawn into terrorism.  This may mean that, in particular circumstances, the University will need to pass on personal data to co-ordinating bodies and partner organisations such as local government and the police.

17. In order to facilitate the registration of students for electoral purposes under the Individual Electoral Registration system (IER) the University may provide lists of students together with other identifying data (such as addresses, other contact details and unique identifying numbers where available) to the local Council. Please note that this process is intended to help the Council identify individuals who are entitled to vote and is not, in itself, registering you to vote.  Students should check with the Council’s Electoral Office to ensure that they are on the electoral register. See: https://www.ceredigion.gov.uk/English/Your-Council/Voting-Elections/The-Electoral-Register/Pages/default.aspx

18. The University may share basic information regarding results and details relating to student status with current and potential employers.  This data may also be shared with an external company who provide similar services, such as the production of award certificates and Higher Education Achievement Reports.

19. In circumstances where the University works together with a partner body (including organizations outside the UK) on a course, collaborative project or on a wider level, such as general accreditation, there may be a practical requirement to share student data under reciprocal arrangements or data sharing agreements. 

20. The University may also employ external agencies as data processors in order to provide services such as e-mail and data storage, to staff and students.  The University remains the Data Controller in these circumstances.

21. The University may combine and analyse information which has been collected in the course of normal day to day University activities, such as logs of students’ access to resources, in order to better provide support for learning.  See https://www.aber.ac.uk/en/infocompliance/dp/learning-analytics/

22. The conditions under which such information may be disclosed are described in the University’s entry in the Register of Data Controllers.  The University’s Registration Number is Z6483435 https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/

23. Under the DPA and other incoming data protection legislation, an individual has the right to a copy of personal information held on them by the University and a right to raise an objection to data processing that causes unwarranted and substantial damage and distress. It should be noted that although an objection can be made, in some circumstances the University may be required to hold certain information in order to carry out its legitimate business and to comply with specific requirements of data protection legislation. To discuss any objections or concerns, individuals should contact the Data Protection and Copyright Manager at the e-mail address provided below. 

24. The personal data, as detailed above, is processed by the University as a result of the contractual relationship which exists, in light of its performance of public tasks and  also the legitimate interest which it has in  retaining and processing the data in the manner described above. During your period as a registered student you may be requested to provide further personal data.  In certain circumstances, in order for this to go ahead in a manner compatible with data protection legislation, your consent may be required from time to time.

For more detailed information about how information is used and shared by, and within, the University, see: https://www.aber.ac.uk/en/infocompliance/dp/

If you have any further queries please contact: infocompliance@aber.ac.uk