Education Liaison and Outreach Privacy Notice
Our General Data Protection Regulation
At Middlesex University we take your privacy seriously and will only use your personal data as notified to you under this Privacy Policy. This will include processing to coordinate our outreach work at your organisation, to facilitate your visit to our events and to provide information about our services, offers and information you have requested from us. This is crucial to assess student eligibility in our activities, monitor participation, and effectively report and evaluate our activities to understand the student journey through the educational and professional career.
This Privacy Notice relates to personal data processed by the University’s Education Liaison and Outreach team in its work to build a more engaged and informed community. The team provides information and advice to prospective students and their parents, guardians and teachers about applying to university and supporting decision making. We work to raise awareness of higher education and to support progression, focusing in particular on life on Middlesex University by offering a range of presentations and interactive workshop sessions to assist students on matters such as making choices, preparing for student life, applying through UCAS and finance.
We work in line with Middlesex University’s Data Protection Policy and the following statements below set out how the Education Liaison and Outreach Team use your data.
Middlesex University is a data controller and is registered with the Information Commissioner’s Office as required under the Data Protection Act 2018, as well as all legislation enacted in the UK in respect of the protection of personal data ("Data Protection Legislation"). The Education Liaison and Outreach Team will only process your personal data in accordance with current Data Protection legislation as set out in this Privacy Policy.
Data is processed by staff who have received data protection training and in accordance with this Privacy Policy.
Why we collect your data
Middlesex University undertakes outreach activities with schools, colleges and communities across the UK, to support progression and widen participation into higher education. This is part of our commitment as a university to open opportunities and transform lives, as well as part of government policy to widen participation in higher education, as overseen by the Office for Students.
We collect details of individuals taking part in our activities for the following reasons:
- To plan activities
- To monitor participation in activities
- To evaluate, research and report on the effectiveness and impact of our outreach activities
- To understand the student journey through education and progression to HE/future careers
Under data protection law we are able to process this data because it is necessary for a task carried out in the public interest.
Collecting your data
How does the Education Liaison and Outreach Team collect personal data?
Education Liaison and Outreach collects personal information from you both directly and indirectly.
We collect information directly
- Requesting our information or services by email or a sign-up form or a survey, either online or on paper.
- Registering for an event.
We collect information indirectly
- Transfer of student information – basic contact details and education information is transferred from schools and further education institutions to our team to enable us to provide workshops or events for students.
- We might also collect and store anonymous visitor engagement information, from our microsite Make Your Mark and our social media channels, and from forms we publish on our website or share as part of our activities depending on your settings; and we might use it to better understand your needs and provide you with information that is relevant to you.
What personal data does the Education Liaison and Outreach Team collect?
Personal data can be collected from the individual or through the school or college. What is held and processed by Education Liaison and Outreach will vary depending on the type of type of engagement and activity undertaken by the individual and may include the following:
- Biographical information such as name, gender*, race, disability, care leaver status, young carer status and date of birth.
- First generation into Higher education, estranged status, free school meals, and other equal opportunity metrics
- Personal location data such as addresses and borough you live in.
- School/college name and unique learner ID
- Personal device ID and anonymous online visit duration and engagement patterns with our emails, website, micro-sites and social media.
- Contact details and communication preferences.
- Academic history. Extra-curricular activities and community activities.
- A history of communication and interaction we have had with you, for example, events, emails or mailings.
*Due to changes on the HEAT database, this information as collected by schools and colleges will be recorded on HEAT under the label ‘Sex’. Data collected directly from participants as gender will be recorded in the same way. More information can be found about HEAT, and how it is used, below.
Why are we able to process data?
- Under data protection law we are able to process this data because it is necessary for a task carried out in the public interest (Article 6(1)(e) GDPR: "processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller").
- In some circumstances, for example if you participate in certain activities as part of our access programmes, we may process your data because you have given your consent for us to do this (Article 6(1)(a) GDPR: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”).
- We are able to process special category data as it is justified under Article 9(2)(g) UK GDPR - "processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject". Our substantial public interest conditions (which will vary depending on the nature of the processing) are Schedule 1, Part 2, Paragraph 6 of the Data Protection Act 2018 (Statutory purposes) or Schedule 1, Part 2, Paragraph 8 of the Data Protection Act 2018 (Equality of opportunity or treatment).
- We are also able to process special category data for statistical purposes, as this is justified under Article 9(2)(j) GDPR - "processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes". We are relying on Schedule 1, Part 1, Paragraph 4 of the Data Protection Act 2018 (Research) as our condition for processing.
How and why does the Education Liaison and Outreach Team use your personal data?
We will keep safe any personal data that is shared with us; we will treat it with respect and only process it in line with the expectations set out in this Privacy Policy.
Developing a better understanding of our contacts personal data allows us to make better decisions about how we engage with you most appropriately.
Data that we do store is used to underpin a full range of activities for Education and Outreach; and to ensure that the way we communicate with you, for example sending event invitations, calls for scholarship applicants or updates about Education and Outreach activities adhere to your communication preferences. This is done through our virtual newsletters and bespoke event communication.
We also use digital tracking tools to monitor the impact of our communications – for example email tracking to record when an email we send to you has been opened, or you have clicked on a particular link. This provides us with metrics that enable us to gain a better understanding of what interests you and send communications that are relevant and beneficial to you.
Sharing your data
On occasion your data may be shared with other relevant teams within Middlesex University that we are collaborating with in order to provide you with support services, relevant information about the university and its portfolio and invites to events and activities.
Middlesex University is a subscribing member of the HEAT Service and they are a data processor for the data we collect from you. Our Contract with HEAT includes details about the organisational and technical measures they have put in place to secure the data we share with them. All their services and Sub-processors are based in the UK.
The HEAT Track service may link your data to records held by the National Pupil Database, Universities and Colleges Admissions Service (UCAS), the Higher Education Statistics Authority (HESA) and the Individualised Learner Record, which collect information about students from schools, colleges and universities. This is done to better understand how the project is helping you, and other young people.
For the purposes of data-linking HEAT are the Data Controller and this is covered by their own Privacy Notice.
Student data will be stored on a secure database (the Higher Education Access Tracker - HEAT) and used to administer participation in widening access activities and projects. This data may also be shared back with your school or college, with government and funding bodies* and our collaborative partners** to help run and evaluate the effectiveness of the activity. The project and its partners will not use your record in a way that would affect you individually and we will not release data to anyone who is unauthorised. The University does not, and will not, sell personal data to third party organisations.
*Government and funding bodies include: Office for Students, Higher Education Statistics Agency (HESA), Department for Education, Local Authorities, UCAS, CFE Research.
HESA and HEAT may share your data as detailed in their own privacy notices, which are accessible at the links provided:
**Our collaborative partners include: Universities, Schools and Colleges, Higher Education Progression Partnership, Higher Education Access Tracker (HEAT) service subscribers, The Brilliant Club, Realising Opportunities, and London UniConnect organisations.
How long will the Education Liaison and Outreach Team hold your data?
We will keep basic details, contact details, education information (when required), records of your communication preferences, records of event attendance and a record of any interaction you have with Education Liaison only whilst it is still necessary to administer our services to you. This includes monitoring and assessing the impact of our activities in widening access to Higher Education. We will retain records securely for the durations detailed below, and will review our retention periods in line with Information Commissioner’s Office guidance and other best practice in the sector.
All the data we collect is stored in the HEAT database, and the HEAT data retention policy is outlined below:
Under the terms of this Schedule the following is applied to personal data:
1. Where a participant has supplied a first name, last name, date of birth, and postcode and has not withdrawn or denied permission for their data to be included in research, their record is considered expired and should not be retained for longer than 15 years from:
a) the year in which they might be expected to enter HE, or
b) the date their record was created, or
c) when they last engaged in activity, whichever of these conditions is most recent.
Once expired, according to the criteria above, the record will appear in the Retention Filter to be reviewed by the collecting member organisation.
2. Where personal data is considered incomplete, i.e., the following has not been captured:
a) any or all of first name, last name, date of birth, postcode
b) and/or the data subject’s permission for inclusion in tracking research,
it will be considered expired after 7 years from the date the record was created. It will appear in the Retention Filter, except where a data subject has taken part in an activity within the last 7 academic years.
We may retain and use your information as necessary to comply with your requests and our obligation to provide a service to you and your organisation or to implement our agreements. Otherwise, we will delete your information upon request. We will undertake data cleansing on a periodic basis, in an attempt to ensure that the data we do hold about you is up to date.
Your rights
Under the GDPR you have the following rights:
- to obtain access to, and copies of, the personal data that we hold about you
- to require that we cease processing your personal data if the processing is causing you damage or distress
- to require us not to send you marketing communications. to require us to correct the personal data we hold about you if it is incorrect
- to require us to erase your personal data; to require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
- to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller
- to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights.
Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply. To exercise any of the above rights please get in contact with the University’s Data Protection Officer using the contact details provided at the start of this notice.
Making complaints
You also have the right to complain to the UK Regulator the Information Commissioner’s Office (ICO), if you believe you request has not been dealt with properly or you have a complaint to raise against the University for any other data protection related issue.
A complaint can be raised via the ICO’s website. You also have the right to withdraw consent from the processing of your personal data by the University at any time, if your consent was sought initially to use your personal data.
Requesting your data
An individual has the right to ask the University what personal data we hold about them, and to ask for a copy of that information. This is called making a Data Protection Subject Access Request. A Subject Access Request should be submitted in writing via email to the Data Protection Officer or in hard copy to the postal address provided:
Data Protection Officer
Middlesex University
The Burroughs
London
NW4 4BT
If you believe the Education Liaison and Outreach Team holds information about you that is factually incorrect, or you would like to request that we stop processing your data please email Education Liaison and Outreach and we will update your records accordingly.