Data Protection Statement

PRIVACY NOTICE

GROWS Network

The GROWS network operates under the governance structure of the University of Gloucestershire as the lead Higher Education Institution.

1. Identity and contact details of the Data Controller

The University of Gloucestershire is registered with the Information Commissioner’s Office as a Data Controller and is committed to protecting the rights of individuals in line with Data Protection legislation.

A copy of this registration can be found here.

2. Contact details of the Data Protection Officer

The Data Protection Officer is responsible for advising the University on compliance with Data Protection legislation and monitoring its performance against it.  If you have any concerns regarding the way in which the University is processing your personal data, please contact the Data Protection Officer at:

Sue MacGregor
Data Protection Officer
University of Gloucestershire
Registrar’s Directorate
Fullwood House
The Park
Cheltenham, GL50 2RH

Email: dpo@glos.ac.uk

3. What information do we collect about you?

We may collect the following types of personal data about you:

• your name, date of birth, attended school, and contact information such as address, email address and telephone number, as well as your country of domicile and your nationality. We will also allocate you a unique identification number; 
• information relating to your education and employment history, the school(s), sixth form college(s) and other colleges you have attended and places where you have worked, the courses you are completing and the grades you are predicated to achieve or have achieved; 
• information about your family or personal circumstances.

Special category (sensitive) personal data including: 

• information concerning your health and medical conditions e.g. disability and dietary needs;  
• information about your racial or ethnic origin, religion or similar beliefs; 
• Your UPN (unique pupil number).

We will collect information using surveys and feedback forms; these will contain opinions, activity evaluation, attitudes, aspirations and plans relating to education and careers.  We also ask schools and colleges to provide event attendance/activity participation registers and personal information in compliance with any data protection regulations. If consent is given, we use your personal data to provide you with information and invitations to participate in relevant activities.

4. How will your information be used?

GROWS is funded by the Office for Students and by six higher education and further education institutions in Gloucestershire.  To deliver, evidence the performance of, and demonstrate the impact of the project, we use your personal data to:

• identify target cohorts/participants;
• monitor and measure participation in activities and the project;
• track any changes in your attitudes towards higher education;
• track any changes in aspiration to career choices;
• track the pathways you take after you leave school/college;
• carry out research;
• provide aggregated reports to a variety of educational and research bodies.  These do not have individually identifiable data. 

The work we undertake requires individual student identification as well as activity and participation monitoring and evaluation to ensure the funding is being used appropriately and to assess the quality and impact of the project.  This also allows the tracking of individual’s progression through their educational pathways. If consent is given, we will send you further information relating to educational and career pathways or activities that may be of interest to you. We will not sell your data to third parties. 

5. What is our lawful basis for processing your personal data?

Our lawful basis for collecting this information is legitimate interest. We have a legitimate interest in obtaining and processing this data in order to successfully implement and track the effectiveness of our project. Data is also processed on the basis of public task under Article 6 of the General Data Protection Regulation (GDPR), as this data is collected in the public interest of improving access to higher education and condition J of Article 9(2) of the GDPR which states:  processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes to safeguard the fundamental rights and the interests of the data subject.

6. Who your personal information is shared with?

Your information will be processed by the University and organisations working on its behalf (for example a company which posts letters on the University’s behalf), who have GDPR compliant processes in place. We also share reports about the activities students participate in, evaluation and survey results and perceptions and behaviour towards higher education.

In order to evaluate our activities, we may share your data with partners including the Office for Students (OfS), the Higher Education Funding Council for England (HEFCE), the Higher Education Statistics Agency (HESA), the Universities and Colleges Admissions Service (UCAS), the Department for Education (DfE), and the Higher Education Access Tracker and its subscribers, CFE Research and your school or college.

7. Transfers to third countries and safeguards in place

Data collected may be transferred outside the European Union (EU), for example, some data processed by the University’s contracted software supplier is stored on servers located in Canada.  

Canada has “adequacy” status from the European Commission, which determined in 2001, that Canada’s law under PIPEDA (the Personal Information Protection and Electronic Documents Act) was strong enough to satisfy that any data transferred from the EU to Canada would be adequately protected. Whenever data is transferred from one location to another, it will always be in a secure, encrypted or password protected format. 

8. How long will your information be held?

To evaluate the long term impact of our activities, the University will keep your data until you are age 27, unless you tell us otherwise. This will enable us to track your university and career destinations. 

If you have given your consent for individual tracking, Higher Education Access Tracker (HEAT) will retain your data until you are age 30. If you have entered higher education during that period, your data will be retained for 15 years from your graduation to ensure continued commitment to long-term research into post-graduation outcomes and social mobility. 

If you have given your consent and you wish to withdraw it, you can opt out at any point by contacting us directly at grows@glos.ac.uk, at the address below, or by unsubscribing via any email communications you receive from us.

9. What are your Rights?

Under Data Protection legislation you have the following rights:

• to request access to, and copies of, the personal data that we hold about you;
• to request that we cease processing your personal data;
• to request that we do not send you any marketing communications;

• to request us to correct the personal data we hold about you if it is incorrect;
• to request that we erase your personal data;
• to request that we restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal);
• to receive from us the personal data you have provided to us, in a reasonable format specified by you, to another data controller;
• to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights and freedoms.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

Any requests or objections should be made in writing to the University’s Data Protection Officer, using the contact details in Section 2 of this Privacy Notice. 

10. How to make a complaint

If you have queries, concerns or wish to raise a complaint regarding the way in which your personal data has been processed you should contact the Data Protection Officer in the first instance, using the contact details under Section 2 above.  

If you still remain dissatisfied, then you have the right to apply directly to the Information Commissioner’s Office (ICO) for a decision. The ICO can be contacted at: 

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113 Website: www.ico.org.uk

11. Links to other websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.