ÌÒ×ÓÊÓƵ

ÌÒ×ÓÊÓƵ (ÌÒ×ÓÊÓƵ) is a Data Controller in terms of the Data Protection Act 2018 (DPA) and the UK General Data Protection Regulations. The University is registered with theÌýÌýOur Registration Number is Z6013920.

We are a public authority under the Freedom of Information Act 2000 and a Scottish public authority under the Freedom of Information (Scotland) Act 2002. Personal Information that we collect and hold about you is used by us for our statutory and/or public functions. Where we collect or share data it is on the basis of the exercise of official authority vested in us as a public authority, and on the basis of public interest.

ÌýUnion is a data controller in its own right. You can read its privacy policy here: Ìý

We collect and process the following types of personal data:

• Name, age and DoB
• Contact details including email, phone number and home and term address.
• Proof of identity
• Disability and health information
• Ethnicity, nationality, domicile
• Immigration information
• English language test results
• Qualification information and work experience information
• Marks, awards, exam scripts
• Fees and payment information
• Student funding, scholarship and grant information
• Disclosure and PVG clearance
• References
• Photographs and recordings
• Next of kin and family information
• Sociological background
• Spent and unspent criminal convictions
• Complaints, appeals and discipline records
• CCTV footage

The personal data ÌÒ×ÓÊÓƵ holds about you is obtained from a variety of sources.

In most instances we collect your personal data directly from you through the following means:

• Information you have provided on your application form (including applications made directly to the University, via a third party such as UCAS, via a partner institution, or via an overseas agent);

• Information you provide us with annually at enrolment (matriculation) and during the course of your studies;
• Information related to performance, attendance and awards during your studies;

We also receive personal data indirectly through the following sources:Ìý

• Information related to performance, attendance, and awards during your studies from academic staff.

• Information about wellbeing and health from Student Services
• Funding organisations such as SAAS or sponsorship bodies;
• Information relating to CAS numbers or PVG scheme records from third party organisations such as UKVI and Disclosure Scotland.
• Partner organisations such as professional bodies, employers, and other educationalÌýestablishments for the purposes of external study or exchange.

When you apply to ÌÒ×ÓÊÓƵ and then accept your offer you enter into a contract with the University and agree to accept the University’s Terms and Conditions. This includes, agreeing that the University can process your personal information for administrative and educational purposes. The purposes and legal basis for processing your personal data is as follows:

We sometimes process special category personal data. Where we process special category data or criminal conviction data we are required to identify an additional legal basis for processing. Special category data is held in the strictest confidence and only shared on a strict need to know basis. This data may be shared with other competent authorities such as HESA or Disclosure Scotland.

The University will manage your information securely and will restrict access to only those who need to use it in the course of their duties. The University will put in place technical and organisational measures necessary to ensure the security of your information.

We will only retain your information as long as is reasonably necessary for the purpose it was gathered and in accordance with ÌÒ×ÓÊÓƵ’s Retention Schedule. We may be required to keep some of your personal information permanently for historical and archival purposes.

The University will only disclose your information to third parties where we:

• Have a legal basis to do so under the UK General Data Protection Regulation; or
• Are required to under a statutory or regulatory obligation; or

• Have your consent

The reasons we may share your data are detailed below.

For academic and educational purposes

• With a partner institution to deliver a programme collaboratively or jointly between the University and the partner institution.
• With our external examiners, to check that our assessment of your work is fair.
• With the QAA or similar body for official independent assessment of our programmes
• With a potential employer or agency to provide a reference
• Your sponsor to confirm your attendance, progress and assessment marks
• A work placement if this is part of your course.
• If you have taken part in the Lothians Equal Access Programme for SchoolsÌý(), which provides advice and support to help eligible students to enter Higher Education, we may share limited information with LEAPS about your progress and outcome of your studies, in order to improve the LEAPS service for future participants.
• With relevant support agencies to enable appropriate adjustments to be made in line with an individual needs assessment.
• Publicise your award in our graduation programme and in the list of awards we provide in press releases. You have the right to opt out of your award being detailed in the press release.

To meet statutory and legal obligations

• TheÌý. For more information on what HESA does with your personal data please see the HESA Student Collection Notices
• The Scottish Funding Council (SFC).
• The Student Loans Company (SLC).
• The Student Awards Agency for Scotland (SAAS).
• Home Office/UK Visas and Immigration (UKVI).
• The Office for Students.
• UKRI, including agents managing the Research Excellence Framework (REF)
• HM Revenue & Customs (HMRC).
• Local authority for Council Tax exemption purposes.
• Electoral Registration Office in accordance with the Representation of the People (Scotland) Regulations 2001.
• Professional bodies, for example HCPC, NMC, GTCS.
• Embassies and other Governments.
• Law enforcement agencies and debt controllers.
• Potential employers or education and placement providers.
• Research surveys approved by the University covering student progress, attitudes,
• social and financial circumstances including the National Student Survey (NSS) and
• the International Student Barometer (ISB).
• Relevant authorities dealing with emergency situations at the University.
• The University also provides limited information to the ÌÒ×ÓÊÓƵ Students’ Union for theÌýpurpose of academic representation, running of elections, administering clubs, societies and sports clubs and social marketing activities.

As an international organisation, the University may need to process your personal information in a country other than the one you are studying in, when this is necessary to provide you with academic and support services, meet a legal obligation, fulfil a contract with you, or where we have your consent.

Personal data may be transferred outside the EEA, to countries which may not have equivalent data protection laws. Examples of circumstances when personal data may be transferred outside the EEA include:

• Managing collaborations with overseas educational institutions including student exchanges and partnership programmes.
• Working with overseas recruitment agencies.
• Information posted on our website which is accessible outside the EEA.
• Some of the systems and services the University uses to store data in the CloudÌýwhich may include storage facilities based outside the EEA

Where your personal information is transferred to a third country outside of the EEA, and no adequacy decision is in place, ÌÒ×ÓÊÓƵ will put in place appropriate safeguards.

We do not use profiling or automated decision-making processes. Some processes are semi-automated but a human decision maker will always be involved before any decision is reached in relation to you.

We do not use profiling or automated decision-making processes. Some processes are semi-automated but a human decision maker will always be involved before any decision is reached in relation to you.

Graduation ceremonies are public events. Audio and visual images of ceremonies may be made publicly available via the sale of DVDs and live broadcast at the venue, on campus and on the Internet. Names of graduands, including those graduating in absentia, are published in the graduation programme. Lists are published in the press and you will be offered the opportunity to opt out of this.

The University may take photographs and other images for possible use in University publicity and promotional material. Graduands who do not wish to be included, must inform the photographer at the time the photograph is taken.

A separate Privacy Notice is provided for Alumni Engagement.

ÌÒ×ÓÊÓƵ collects data through student surveys. The information collected in surveys is pseudonymised and stored against a unique personal identifier. Anonymous aggregated reports are shared more widely. Information entered in free text boxes may indirectly identify a student. Where this is the case we go to reasonable lengths to redact any information that acts as an identifier before sharing the results more widely. We encourage students to be cautious of what they enter so as not to identify themselves. Survey results are shared with Deans, Heads of Division and Programme Leads in order that feedback can be acted on.

ÌÒ×ÓÊÓƵ respects the privacy of every individual who visits our websites or responds to our interactive advertisements. TheÌýPrivacy StatementÌýon our website outlines the information we collects via its various web pages and how we use that information. The Statement also instructs you on what to do if you do not want your personal information collected or shared when you visit ÌÒ×ÓÊÓƵ's website or respond to our advertisements.

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

If you wish to make a rights request the relevant contact details can be found at the end of this statement.

We keep this privacy statement under regular review and will place any updates on this website. We will publish any changes we make to this data protection policy on our website at the following link:ÌýRegulations, Policies and ProceduresÌýor atÌýData Protection webpage

Paper copies of the privacy statement may also be obtained by request from the Data Protection Officer.

This privacy statement was last updated on

If you have any queries about the processing of your personal data as described above, please contact the University’s Data Protection Officer. You can do this by

Email:

Ìýdataprotection@qmu.ac.ukÌý

Post:

Data Protection Officer

ÌÒ×ÓÊÓƵ

ÌÒ×ÓÊÓƵ DriveÌý

MusselburghÌý

EH216UU

If you have any concerns about our use of your personal information, you can make a complaint to us by contacting the Data Protection Officer in the first instance.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113 ICO

website: https://www.ico.org.uk