Skip to main content

Legal info

Data Protection Statement

PRIVACY NOTICE

GROWS Network

The GROWS network operates under the governance structure of the University of Gloucestershire as the lead Higher Education Institution.

1. Identity and contact details of the Data Controller

The University of Gloucestershire is registered with the Information Commissioner’s Office as a Data Controller and is committed to protecting the rights of individuals in line with Data Protection legislation.

View our Data protection register entry details.

2. Contact details of the Data Protection Officer

The Data Protection Officer is responsible for advising the University on compliance with Data Protection legislation and monitoring its performance against it.  If you have any concerns regarding the way in which the University is processing your personal data, please contact the Data Protection Officer at:

Data Protection Officer
University of Gloucestershire
Registrar’s Directorate
Fullwood House
The Park
Cheltenham, GL50 2RH

Email: dpo@glos.ac.uk

3. What information do we collect about you?

We may collect the following types of personal data about you:

  • your name, date of birth, attended school, and contact information such as address, email address and telephone number, as well as your country of domicile. We will also allocate you a unique identification number; 
  • information relating to your education and employment history, the school(s), sixth form college(s) and other colleges you have attended and places where you have worked, the courses you are completing and the grades you are predicated to achieve or have achieved; 
  • information about your family or personal circumstances, including whether you have ever been in Local Authority care;
  • information about whether you are eligible for free school meals, are classed as pupil premium, or are in receipt of bursaries.

Special category (sensitive) personal data we may collect includes: 

  • information concerning your health and medical conditions e.g. disability and dietary needs;  
  • information about your racial or ethnic origin, religion or similar beliefs; 
  • Your UPN (unique pupil number).

In most cases, we will collect this information directly from your school or college. We also collect information through your completion of surveys and feedback forms at activities you take part in - these could contain opinions, activity evaluation, attitudes, aspirations and plans relating to education and careers.  We also ask schools and colleges to provide event attendance/activity participation registers and personal information in compliance with any data protection regulations.

If you provide us with contact information (mobile number and email address), we use this data to provide you with information and invitations to participate in relevant activities.

4. How will your information be used?

GROWS is funded by the Office for Students (OfS) and by six higher education and further education institutions in Gloucestershire.  To deliver, evidence the performance of, and demonstrate the impact of the project, we use your personal data to:

  • identify target cohorts/participants;
  • monitor and measure participation in activities and the project;
  • track any changes in your attitudes towards higher education;
  • track any changes in aspiration to career choices;
  • track the pathways you take after you leave school/college;
  • carry out research;
  • provide aggregated reports to a variety of educational and research bodies.  These do not have individually identifiable data. 

The work we undertake requires individual student identification as well as activity and participation monitoring and evaluation to ensure the funding is being used appropriately and to assess the quality and impact of the project.  This also allows the tracking of individual’s progression through their educational pathways.

If you sign up to our mailing list or provide your contact details to us, we will send you further information relating to educational and career pathways or activities that may be of interest to you. We will not sell your data to third parties. 

5. What is our lawful basis for processing your personal data?

Our lawful basis for collecting and processing your data is public task as this data is collected in the public interest of improving access to higher education and falls under condition J of Article 6(1) of GDPR: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Within the basis of public task, our basis for processing special category data (as detailed in Section 5 of this policy) is condition (g) under Article 9 of GDPR: Reasons of substantial public interest. Relying on this condition, the specific substantial public interest condition this meets is statutory and government purposes as set out in Part 2 of Schedule 1 of the Data Protection Act 2018.

The University of Gloucestershire is the lead organisation for GROWS and is registered with the Information Commissioner’s Office as a Data Controller, collecting and processing participant data in the exercise of public authority on the behalf of the Office for Students, and carrying out a function of a government department.

6. Who will your personal information be shared with?

Your information will be processed by the University and organisations working on its behalf (for example a company which posts letters on the University’s behalf), who have GDPR compliant processes in place. We also share reports about the activities students participate in, evaluation and survey results and perceptions and behaviour towards higher education.

In order to evaluate our activities, we may share your data with partners including

  • Office for Students (OfS),
  • Higher Education Statistics Agency (HESA),
  • Universities and Colleges Admissions Service (UCAS),
  • Department for Education (DfE),
  • Higher Education Access Tracker and its subscribers,
  • CFE Research and other official research bodies
  • your school or college.
7. Transfers to third countries and safeguards in place

Data collected may be transferred outside the European Union (EU), for example, some data processed by the University’s contracted software supplier is stored on servers located in Canada.  

Canada has “adequacy” status from the European Commission, which determined in 2001, that Canada’s law under PIPEDA (the Personal Information Protection and Electronic Documents Act) was strong enough to satisfy that any data transferred from the EU to Canada would be adequately protected. Whenever data is transferred from one location to another, it will always be in a secure, encrypted or password protected format. 

8. How long will your information be held?

To evaluate the long term impact of our activities, the University and HEAT will keep your data until you are age 27, unless you tell us otherwise. This will enable us to track your university and career destinations. 

Your information will be retained on the Higher Education Access Tracker database (HEAT) (University of Kent) will retain your data until you are 30 years old. If you have entered higher education during that period, your data will be retained for 15 years from your graduation, to ensure continued commitment to long-term research into post-graduation outcomes and social mobility. 

If you believe that the personal data we hold on you is inaccurate or incomplete and needs correcting, or you no longer wish to be involved in the GROWS project, please contact us. You can email us directly at grows@glos.ac.uk, or write to us and mail to:

GROWS (DH210)
University of Gloucestershire
The Park
Cheltenham
GL50 2RH

9. What are your Rights?

Under Data Protection legislation and on the basis of public task you have the following rights:

  • Right to be informed: You have the right to be informed about the collection and use of your personal data, including the purposes for processing your personal data, the retention periods for keeping and processing that personal data, and who it will be shared with.
  • Right of access: You have the right to receive confirmation that your data is being processed and to request access to it and a copy of it.
  • Right to rectification: You have the right to request that inaccurate or incomplete personal data held about yourself is rectified or completed.
  • Right to restrict processing: You have the right to request that we no longer process your personal data in certain ways, whilst not requiring us to erase the same data. You also have the right to request that we do not send you any marketing communications.

  • Right to object: You have the right to object at any time to the processing of your personal data if you feel your fundamental rights and freedoms are impacted. Please notify us of your objection and we will cease such processing, unless we have overriding legitimate grounds.

  • Rights in relation to automated decision making and profiling: You have the right to not be subjected to decision-making based solely on automated processing (including those based on profiling) that have a legal or similarly significant impact on you.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

Any requests or objections should be made in writing to the University’s Data Protection Officer, using the contact details in Section 2 of this Privacy Notice. 

10. How to make a complaint

If you have queries, concerns or wish to raise a complaint regarding the way in which your personal data has been processed you should contact the Data Protection Officer in the first instance, using the contact details under Section 2 above.  

If you still remain dissatisfied, then you have the right to apply directly to the Information Commissioner’s Office (ICO) for a decision. The ICO can be contacted at: 

Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Telephone: 0303 123 1113 Website: www.ico.org.uk

11. Links to other websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question. 

This document was last updated on 19.10.2021, it is reviewed and updated when necessary.