NW DEPTH Privacy Notice North West Digital Employment Pathways Training Hub

This Privacy Notice explains how Ulster University (University) collects, uses and processes participants’ personal data as a data controller and explains individuals’ rights in relation to the personal data that the University processes about applicants and participants / learners of the North West Digital Employment Pathways Training Hub (North West DEPTH).

North West DEPTH is a €10 million, four-year project supported by PEACEPLUS, a programme managed by the Special EU Programmes Body (SEUPB). In partnership with Atlantic Technological University, North West Regional College, and Donegal Education and Training Board, the Project will deliver digital upskilling and reskilling to over 2,000 learners.

The University actively seeks to preserve the privacy rights of those individuals that share information with the University.  The personal data which you provide to the University will be processed in accordance with UK data protection legislation, specifically UK GDPR and the Data Protection Act 2018.

What is the purpose and legal basis of the processing?

As part of the NW DEPTH project, UU is required to collect Applicant and Participant / Learner information for programme administration, participant monitoring, evaluation activities, equality monitoring, and PEACEPLUS reporting requirements.

Examples of how your data is used are as follows:

• For PEACEPLUS monitoring, evaluation, audit and reporting purposes;
• admission purposes, supporting registration and enrolment and thereafter maintenance of your records;
• for teaching purposes, be that face-to-face teaching, online synchronous teaching, recorded lectures tutorials seminars and workshops and other such remote learning as supported by software solutions;
• the administration of your education, including academic assessment, recording assessment results, granting of awards and organising graduations;
• providing student support services;
• welfare and pastoral support including ensuring the health and safety of students, staff and employees;
• administration and provision of facilities such as IT and Library services;
• monitoring equal opportunities and providing management statistics;
• holding student photographs to assist staff in identifying and recognising students and to produce ID cards;
• maintaining contact with alumni for alumni engagement and fundraising;
• fundraising and marketing;
• processing student academic appeals and student discipline cases;
• processing your images for use with CCTV for your security;
• to contact you and/or your emergency contact in the event of an emergency;
• to carry out our legal duties and statutory responsibilities.

The following lawful basis that applies to this processing is:

UK GDPR Article 6.1(a) – the data subject has given consent to the processing of their personal data for specific purposes.

UK GDPR Article 6.1(b) – the processing is necessary in order to meet our obligations or exercise our rights under our contract with you.

UK GDPR Article 6.1(c) – the processing is necessary for compliance with a legal obligation to which the controller is subject.

UK GDPR Article 6.1(d) – The processing is necessary in order to protect your vital interests or the vital interests of another individual. This is typically limited to processing needed for medical emergencies or where there is a threat to life.

UK GDPR Article 6.1(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

UK GDPR Article 6.1(f) – the processing is necessary for the purposes of the legitimate interests pursued by the University as controller relating to student administration, alumni relations, business continuity or similar activities except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

For processing special category data, our legal basis for processing is:

• UK GDPR Article 9(c) – processing is necessary to protect the vital interests of the data subject.
• UK GDPR Article 9(g) – reasons of substantial public interest (with a basis in law).
• UK GDPR Article 9(h) – Health or Social care (with a basis in law)
• Data Protection Act 2018, Schedule 1, Part 1 (2) – Health or socialcare purposes
• Data Protection Act 2018, Schedule 1, Part 2 (6) – Statutory etc and government purposes
• Data Protection Act 2018, Schedule 1, Part 2 (8) – Equality of opportunity or treatment
• Data Protection Act 2018, Schedule 1, Part 2 (16) – Support for individuals with a particular disability or medical condition

How the University collects your personal data

The University shall collect the personal data through the admissions, enrolment, induction and programme feedback / evaluation processes.

Change of Purpose

The University will only use your personal data for the purposes for which it collected in, unless the University reasonable considers that it needs to use the personal data for another reason and that reason is compatible with the original purpose.  If the University needs to use your personal data for an unrelated purpose it shall notify you and explain the legal basis for which allows the University to do so.

How long does the University hold your personal data?

Personal data collected as part of NW DEPTH project will be retained for a period of 5 years in line with PEACEPLUS requirements. The retention period commences on 31 December of the year in which the final payment is made by the Accounting Function to the Lead Partner. Based on the anticipated project closure date of June 2029, project records will be retained until 31 December 2034.

The University’s Retention and Disposal Schedule includes guidance on retention and disposal periods.  A copy of the Schedule is available at Retention & Disposal Schedule.

Categories of personal data processed by the University

Personal Data

The University may collect, use, store and transfer the following types of personal data as part of this processing:

• Name
• Gender
• Date of Birth
• Address
• Contact Details
• Next of Kin
• Educational Background
• Marital Status
• Dependents
• Employment Status and Length of Service
• Employment History
• Employer Sector
• English Language
• Lived in the UK, EEA or Switzerland for the past three years
• Asylum Seeker or Refugee
• Personal Digital Skills Assessment

Special Category Data

“Special Categories” or particularly sensitive personal information, such as information about your health, racial or ethnic origin, sexual orientation require higher levels of protection.  The following categories of special category data will be processed:

• Health (incl. Disabilities, learning difficulties and long-term medical conditions)
• Racial or ethnic origin
• Sexual Orientation
• Religious Belief
• Political Opinion

Who does the University share your data with

The University shares personal data with third parties where necessary for the purposes of the processing and where there is a legal basis to do so.  Where information is shared with such third parties, the University will seek to share the minimum amount necessary.

As part of this processing the University may share your personal data with the following third parties:

• Special EU Programmes Body (SEUPB) / PEACEPLUS
• Atlantic Technological University (ATU)
• North West Regional College (NWRC)
• Donegal Education and Training Board (Donegal ETB)
• Government Bodies pursuant to statutory obligations, the University is required to disclose your personal data to government departments, to the Higher Education Statistics Agency (HESA), and Education and Library Boards/Local Authorities.
• The information provided to HESA is used for statistical purposes and no information will be published that would enable you to be identified personally. The University will send information from the Destination of Leavers in Higher Education (DLHE) form to HESA. HESA may pass student personal data to other government departments or statutory bodies that need the personal data to carry out their functions connected with higher education. If you have any concerns about the use of your information, you can contact HESA directly.
• The National Student Survey – the University shall pass your contact details to the organisation contracted to carry out the National Student Survey.
• Google Analytics which processes information about how you use the website ulster.ac.uk.The University do this to help make sure the site is meeting the needs of its users and to help us make improvements. For further information please view our Privacy notice.
• SEAtS software is used to ensure that the university meets its regulatory requirements under UKVI rules. It is intended to use the system to also identify 'at risk' students who may be at risk of dropping out, and allowing university teams to have an early discussion with students.

Further, the University may share your personal data with the following categories of third parties:

• Firms that provide professional services to the University such as legal firms, consultants and auditors.
• Research and academic partners.
• Firms that provide IT or cloud services not previously identified which provide essential services to the University.
• Third parties who provide student support services for example in relation to welfare issues, disability, health or counselling.
• The PSNI or other law enforcement agencies when required by law to do so.

All third party service providers that process data on our behalf are required to take appropriate security measures to protect your data in line with our policies. We do not allow them to use your data for their own purposes. We permit them to process your data only for specified purposes and in accordance with our instructions.

International Transfers

The University will transfer your personal data to the following countries outside of the United Kingdom:

• European Economic Area

In these circumstances your personal data is being transferred on the basis that the Secretary of State has made an adequacy regulation in respect of said countries. This means that countries are deemed to provide equivalent protection to personal data as provided by the UK data protection regime.

Your rights as a Data Subject

As a University data subject you have the right to:

• Access and obtain a copy of your personal data on request;
• Require the University to change incorrect or incomplete personal data;
• Require the University to delete or remove your personal data, for example where the data is no longer necessary for the purposes of processing.  Note, however that the University may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request;
• Object to the processing of your personal data where the University is relying on its legitimate interests as a legal ground for processing;
• Where the University is relying upon consent to process your personal data, you may withdraw your consent at any time; and ask the University to stop processing personal data for a period if the personal data is inaccurate or there is a dispute about whether or not your interests override the University’s legitimate grounds for processing the personal data.

Further information and your right to complain

Further information in respect of the University’s practice in respect of data protection and our Data Protection Policy is available at Data Protection and Information Compliance.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request the University transfer a copy of your personal information to another party, please contact the University’s Data Protection Officer,

Eoin Coyle

Data Protection & Information Compliance Manager

c/o Ulster University, Room L132

Coleraine

BT52 1SA

02871 675525

gdpr@ulster.ac.uk

If you are not satisfied with how the University is processing your personal data, you can make a complaint to the ICO.  Further information about your data privacy rights are available on the ICO’s website.