University of Sunderland Privacy Notice for Higher Education Access Tracker (HEAT)
Data Controller
Data Controller Name: University of Sunderland
Data Protection Officer: Sam Seldon
ICO Registration Number: Z6120473
Registered address:
4th floor, Edinburgh Building
City Campus
Chester Road
Sunderland
SR1 3SD
Department responsible for processing: Widening Access and Participation.
Contact email: pre16activities@sunderland.ac.uk.
Overview
The University of Sunderland undertakes outreach activities with schools, colleges, academies, and communities across the UK to support progression and widen participation in higher education. This is part of our commitment as a university to open opportunities and transform lives as part of government policy as overseen by the Office for Students. The University of Sunderland’s outreach programme is funded by the Government to increase the number of young people from different backgrounds going into Higher Education (HE)/university, especially those groups who are currently under-represented in HE.
This privacy notice explains:
- Who we are, how and why we collect and use personal information about you
- What personal data is collected and held about you for the Higher Education Access Tracker (HEAT)
- Our purposes and lawful bases for processing
- Who we share your personal data with, relevant retention periods
- And how you can exercise your privacy rights
HEAT is the system supplied, hosted, and operated by the University of Kent, which is used by over 80 higher education institutions to evaluate the effectiveness of their outreach and widening participation activities. The University has used the HEAT system for several years. The system links closely with government agencies such as the Office for Students (OfS), the Department for Education (DfE), and data custodians including the Higher Education Statistics Agency (HESA) and The Universities and Colleges Admissions Service (UCAS) to establish which learners engaging with the University have progressed into higher education. For further information see HEAT Privacy Notice and HESA Privacy Notice.
Please read this notice to understand our practices and if you have any questions, please contact us using the department contact details provided above.
Who we are
Throughout this notice, ‘University’, ‘we’, ‘our’, and ‘us’ refer to the University of Sunderland. The University is the Controller in respect of the personal data you provide as part of this activity.
The personal data we process
If you attended an outreach event or activity organised by the University and supplied us with your personal data using our Activity Collection Form, we will process the following personal data about you:
- Name
- Gender
- Date of birth
- Postcode
- School
- Links to the activities you engaged with
- Links to Universities and College Admissions Service (UCAS) and Higher Education Statistics Agency (HESA) data
Where does the University get your personal data from?
We obtain personal data about you from the following sources:
- Direct from you via the Activity Collection Form
- From third-party sources, where we will always try to ensure that the third party has lawful authority to provide us with the data, for example from your school/college with permission from you or your parent/carer (if under the age of 13) or as part of a data sharing agreement
The purpose of the processing
As part of our activities to promote and widen access to higher education, we upload your personal data to the HEAT system so that it can be used for the following purposes:
- Monitoring and evaluating the effectiveness of our outreach and widening participation programmes
- Demonstrating the impact of our outreach and widening participation programmes
- Producing statistics, including event application and participation numbers, and participant outcomes
- Tracking future outcomes of event participants, including applications to the University and other higher education institutions
- Understanding the student journey through education and progression to Higher Education/future careers
If you contact us, we may also keep a record of that correspondence as part of our legitimate interests.
Lawful bases for processing
For all learners engaging from the start of the 2023 academic year – as a public authority acting in the public interest we rely upon the ‘public task’ lawful basis to process your personal data for these purposes. Our public interest is to: promote and widen access to higher education, particularly among underrepresented groups.
Our clear basis in law is the Higher Education (Access and Participation Plans) (England) Regulations 2018. S2(1) (f) which states that Higher Education Institutions shall monitor and evaluate their compliance of its provisions set out in its access and participation plans, and its progress in achieving its access and participation objectives. Furthermore, s2(1)(g) states that Higher Education Institutions shall provide the Office for Students with such information as it may reasonably require from time to time regarding the contribution that the institution has made towards furthering equality of opportunity.
For all learners engaging prior to the start of the 2023 academic year we obtained your written consent via our Activity Collection and Consent Form to process your personal data for the specified purposes.
The recipients or categories for recipients of the personal data
Once uploaded to HEAT your personal data is made available to the following third parties:
- The University of Kent under the terms of a data processing agreement; as part of the HEAT service, they provide for the University they support the HEAT system, and conduct monitoring and evaluation activities
- Other higher education institutions who also organise outreach activities and add HEAT data to the system
- HESA, UCAS, DfE and OfS to help determine whether our activities are helping participants move on from higher education and employment
- The Right to Withdraw Consent, Request Erasure, Opt Out of the Processing
You can ask for your personal data to be withdrawn from the HEAT system at any time by writing to pre16activities@sunderland.ac.uk stating your name, date of birth, and school you attended while participating in our outreach activities. If we relied upon your consent for our processing, withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal.
Data retention
Your personal data will only be retained for as long as it is necessary in accordance with the University’s Retention Schedule. Specifically, we will retain your HEAT personal data for:
- Activity Collection Form – for no longer than one academic year from the date you completed your form and volunteered your personal data to the University
- On the HEAT system until you reach 30 years of age, or if you go to university in this time for 15 years after you graduate from university
- Until you ask us to remove your personal data
Your rights under UK GDPR
Under the UK General Data Protection Regulations, you have eight fundamental rights as follows:
1. The right to be informed
The University is obliged to provide you with information on how we plan to process your data, we do this by means of a privacy notice. The University does this in order to process your personal data in a transparent manner.
2. The right of access
You as the data subject have a right to access the personal (and supplementary) information that we hold, you also have the right to be made aware of and to verify the lawfulness of processing undertaken.
3. The right to rectification
If you find that we hold incorrect or incomplete data about you, then you have the right to request this information is rectified.
4. The right to erase
This right enables you to request deletion or removal of your personal data when there is no longer a compelling reason for its continued processing.
5. The right to restrict processing
Under certain (defined) circumstances you have the right to request that we restrict the processing we undertake using your personal data.
6. The right to data portability
You have the right to request your personal data, which is held electronically, to be provided to you in a reusable format, such as a .csv file.
7. The right to object
You have the right to object to processing based on legitimate interests or in the performance of a task in the public interest (including profiling). This also applies to direct marketing and purposes of scientific/historical research and statistics.
8. Rights in relation to automated decision-making and profiling
You have the right to object to your data being used in automated decision-making or profiling.
In the first instance, we would ask that you contact the Widening Access and Participation Team pre16activities@sunderland.ac.uk within the University.
If you are unhappy with how your request has been handled or have not received a response from the individual department, please contact the Data Protection Officer either by email or by post. The email address for the Data Protection Officer is dataprotection@sunderland.ac.uk.
Should you still feel that your request has been handled inadequately, you have the right to complain to the supervisory authority in the UK, this is the Information Commissioners Office, details of how to complain can be found at https://ico.org.uk/concerns.