Data Controller
Data Controller Name: University of Sunderland
Data Protection Officer: Sam Seldon
ICO Registration Number: Z6120473
Registered Address:
4th Floor Edinburgh Building
City Campus
Chester Road
Sunderland
SR1 3SD
Department Responsible
for processing: Marketing and Recruitment Services
Contact email: donna.beardmore@sunderland.ac.uk
Overview
The collection of personal data is used to communicate with the customer along different stages of their journey. The University will only communicate with those people via the channels they have specified on the form, or where the communication is relevant and necessary for the purpose that they have provided it, for example to communicate open day details to someone who has registered for that event. The subject’s data will be stored and used for statistical analysis, for example to see the effectiveness of forms of marketing and customer touch points across the website and recruitment events. The data will be segmented into relevant groups in order to provide the most relevant communications where someone has opted in or where statistical analysis is required – for example grouping people into similar areas of interest, geographical locations and nationality. The website also uses a tool which recognises location of website users and provides a more relevant browsing experience for those users.
| No. |
Specific Activity |
Legal Basis |
| 1 |
Provision of a prospectus, where the prospectus request form has been completed by the data subject |
Legitimate interest |
| 2 |
Administration and management of open days, including communications relating to open days, where the open day registration form has been completed by the data subject |
Legitimate interest |
| 3 |
Administration and management of the University Schemes (e.g. First Choice Scheme, MedStart Scheme) including communications relating to the schemes, where the scheme registration form has been completed by the data subject |
Legitimate interest |
| 4 |
Administration and management of the Progression Scheme, including communications relating to the Progression Scheme, where the Progression Scheme registration form has been completed by the data subject |
Legitimate Interest |
| 5 |
Administration and management of Course Interest requests, including communications relating to Course Interests sign up forms, where the Course Interest registration form has been completed by the data subject |
Legitimate Interest |
| 6 |
Administration and management of, and communications relating to Clearing, where the Clearing form has been completed by the data subject |
Legitimate Interest |
| 7 |
Administration and management of, and communications relating to Individual Tours, where the Individual Tour form has been completed by the data subject |
Legitimate Interest |
| 8 |
Administration and management of, and communications relating to Student Shadowing, where the Student Shadowing form has been completed by the data subject |
Legitimate Interest |
| 9 |
Administration and management of, and communications relating to School liaison, where the expression of interest for Schools and Colleges form has been completed by the data subject |
Legitimate Interest |
| 10 |
Administration and management of, and communications relating to a Live Chat transcript and associated data, where the data subject has used the Live Chat service and provided information. |
Legitimate Interest |
| 11 |
Administration management and provision of communications relating to marketing, not specific to any of the above specific activities. I.e. sending general University of Sunderland Marketing emails to enquirers |
Consent |
| 12 |
Administration and management of, and communications relating to the Video Builder platform transcript and associated data, where the data subject has used the Video Builder service and provided information. |
Legitimate Interest |
Legitimate Interests
The University has carried out a legitimate interest assessment and has concluded that legitimate interest can be applied to the specific processing activities, listed above, that site legitimate interest as the legal basis for processing. The Data Protection Officer holds a copy of this assessment, which can be provided upon request.
The subject’s data may be shared with trusted partners for the purpose of fulfilling communications actions including direct postal communications and, where consent has been given, digital advertising. Data will also be shared with Higher Education Access Tracker (HEAT) for more information see the HEAT Privacy notice. Data will be transferred securely, with encryption techniques applied appropriately.
Enquirer data will be stored for three years after the subject’s desired Year of Entry, as expressed on the initial contact form, unless the subject becomes an applicant and/or a student.
Your rights under GDPR
Under the General Data Protection Regulations, you have 8 fundamental rights as follows:
The right to be informed
The University is obliged to provide you with information on how we plan to process your data, we do this by means of a privacy notice. The University does this in order to process your personal data in a transparent manner.
The right of access
You as the data subject have a right to access the personal (and supplementary) information that we hold, you also have the right to be made aware of and to verify the lawfulness of processing undertaken.
The right to rectification
If you find that we hold incorrect or incomplete data about you, then you have the right to request this information is rectified.
The right to erase
This right enables you to request deletion or removal of your personal data when there is no longer a compelling reason for its continued processing.
The right to restrict processing
Under certain (defined) circumstances you have the right to request that we restrict the processing we undertake using your personal data.
The right to data portability
You have the right to request your personal data, which is held electronically, to be provided to you in a reusable format, such as a .csv file.
The right to object
You have the right to object to processing based on legitimate interests or in the performance of a task in the public interest (including profiling). This also applies to direct marketing and purposes of scientific / historical research and statistics.
Rights in relation to automated decision making and profiling
You have the right to object to your data being used in automated decision making or profiling.
In the first instance we would ask that you contact the department within the University that is processing your personal information. The contact details for this department can be found in the first section of this notice.
If you are unhappy with how your request has been handled, or have not received a response from the individual department, please contact the Data Protection Officer either by email or by post. The email address for the Data Protection Officer is dataprotection@sunderland.ac.uk.
Should you still feel that you request has been handled inadequately, you have the right to complain to the supervisory authority in the UK, this is the Information Commissioners Office, details of how to complain can be found at https://ico.org.uk/concerns/.