this privacy notice explains how the university of buckingham (“the university, “we”, “our”, “us”) collects, uses and shares your personal data, and your rights in relation to the personal data we hold.
the university needs to hold and process personal data relating to many people in order to:
- keep proper records
- provide advice
- manage and fulfil contracts
- comply with legal obligations
- pursue our legitimate interests as an independent not-for profit institution of higher education.
we hold financial information so that we can process payments; information on health and disability so that we can provide support and assistance to students, staff, visitors and guests; and many other categories of information, which are more fully set out below, in order to both run the business and activities of the university, and in order to fulfil our legal obligations.
the university is a data controller of your personal data (ico registration number: z8974286) and is subject to the general data protection regulation (“gdpr”). we take the security and integrity of all the personal data we hold very seriously. we have a data protection policy and our staff are trained in data protection. we strive to ensure that our systems are secure. we do not release information about anyone to any third parties outside the university unless we have a legal obligation to do so, or in very specific and limited circumstances; which are set out in this notice.
if you are a person whose personal data is used by the university in order to carry out research, we take the processing of your data particularly seriously. all research at the university involving human participants is subject to scrutiny and must be sanctioned by the university research ethics procedures.
under the gdpr we are obliged to provide you with information which explains in detail how and why we are processing your personal data and explains your legal rights. general information on data protection law is available from the information commissioner’s office.
how and why we obtain and process your personal information
please refer to the section of this notice that is relevant to you:
- alumni, donors, sponsors, collaborators and friends of the university
- staff, contractors, consultants, independent examiners and invigilators
data sharing with third parties – general
all new processes that involve of data sharing/hosting are covered by data sharing agreements or undertakings.
data may be released to specific third parties in order to carry out research relevant to the staff population but this will only be done where necessary, and when covered by a data sharing agreement.
we will not release data to any third person without there being a legitimate reason to do so, except where you ask us to. this means that we will not release data to banks, friends, relatives etc, without your prior agreement.
the university does not utilise cloud storage outside of the eu and data sharing agreements are in place for all data stored by third parties which seek to ensure that you enjoy the same protections that you do under this privacy notice.
the university does not intentionally retain data for longer than is necessary and data is retained for different periods of time, depending on the need. certain information is retained indefinitely such as student academic records. some information is retained for six years so as to protect the university’s legal interests. retention periods for different categories of data are more fully set out in the university’s record retention schedule (under development).
you have a number of rights in relation to the information that we hold about you. these rights include:
- the right to access information we hold about you and to obtain information about how we process it;
- in some circumstances, the right to withdraw your consent to our processing of your information;
- in some circumstances, the right to receive certain information you have provided to us in a specific electronic format and/or request that we transmit it to a third party in a specific format;
- the right to request that we rectify your information if it’s inaccurate or incomplete;
- in some circumstances, the right to request that we erase your information;
- the right to object to, and to request that we restrict, our processing of your information in some circumstances.
Complaints & further information
if you wish to raise any concerns about this privacy notice or the way in which the university processes your data, you should contact the university’s data protection officer: david watson, on 01280 820 383 or firstname.lastname@example.org
you also have the right to complain to the information commissioner’s office which is the uk regulator for data protection. for more information about this body and how to make a complaint, please see www.ico.org.uk.