Privacy Policy

Sheffield Hallam University

Privacy Notice for students and applicants and enquirers for Online Courses

Who we are

Sheffield Hallam University (‘The University’, ‘we’ or ‘us’) are a ‘Data Controller’ and are responsible for and control the processing of your Personal Data.

This privacy notice is for Sheffield Hallam University’s Courses.  We have partnered with Higher Education Partners (HEP) to carry out this function.   The University provides privacy notices for other activities and stakeholders on our website.

Introduction

The UK General Data Protection Regulations (UK GDPR) and Data Protection Act 2018 (and, where applicable the EU GDPR) govern the way that organisations use personal data.   Personal data is information relating to an identifiable living individual.

Transparency is a key element of data protection law and this privacy notice is designed to inform you:

• how and why the University uses your personal data,
• what your data protection rights are, and,
• how to contact us so that you can exercise those rights.

We keep our privacy notice under regular review.  Any changes we make to our privacy notice in the future will be posted on this page so please check back regularly for updates and changes.  Where appropriate, we will notify you changes by email or post.

Why are we processing your personal data and what is the lawful basis for our processing?

It is necessary for the University to process your personal data in order to enter into a student contract with you and fulfil all aspects of that contract:

• To manage and assess applications, eligibility and suitability, support applicants, and to issue offers and prepare for enrolment;

• To manage all the elements of our contract with you and the student lifecycle from enrolment through to graduation and becoming an alumni, including course delivery, teaching and learning, exams and assessment;
• To process payments to and from you or made on your behalf;
• To identify you and manage access to our facilities and services;
• To provide support services including, library, IT, financial, careers, disability and wellbeing support and to enable offers of additional support to you;
• To monitor progress, engagement and attendance in order to
  • Improve learning outcomes
  • Target appropriate support
  • Support the development of a personalised academic experience
  • Ensure course requirements are met;
• To enable us to investigate, consider, respond to and monitor
  • reasonable adjustments
  • extenuating circumstances
  • fitness to study cases
  • academic appeals
  • complaints
  • disciplinary cases
  • academic conduct
  • fitness to practice cases and to provide information to professional and regulatory bodies which deal with such matters.

It is necessary for the University to process your personal data in order to comply with legal obligations

• To monitor and promote equality and diversity within the University
• For safeguarding purposes and to carry out background and suitability checks where required for your course

It is necessary for the University to process your personal data in order to meet our public tasks or for a task carried out in the public interest (learning and teaching, research, knowledge exchange)

• To monitor, review and evaluate the quality, standards and effectiveness of our teaching, research, and other services and facilities;
• To produce reports and returns for funding agencies, government departments, and public bodies and to facilitate student and graduate participation in national surveys where the University is required to do so;
• To award and verify degrees and other qualifications/awards.

There are also a number of legitimate business purposes/legitimate interests for which the University processes your data

• To plan, deliver and review our services, events, and facilities.
• To evaluate and report on our recruitment and admissions activities and improve the applicant experience
• To provide you with information and updates about our services and facilities, opportunities to get involved with University activities, and marketing related emails.
• To protect our premises, facilities and other assets and resources
• To monitor and manage Internet use e.g. essay mill sites and extremist content

With your consent we also use your data

• To register you for events such as open days
• To respond to your enquiries.

Which personal data do we collect and use?

In order to provide our services we need to collect and use your personal data. Below is a list of what this may include:

* Denotes information which may contain data classified as sensitive personal data/special categories of personal data under the GDPR and as such is subject to a greater level of control and protection.
^ Denotes information which you provide on a voluntary basis or where you are given the option of “prefer not to say” or “information refused”.

Contact information and personal details

• Name(s)
• Address(es)
• Telephone number(s)
• Email address(es)
• Trusted/emergency contact
• Nationality, country of residence & birth
• Age/Date of Birth
• Gender/sex
• Photograph(s)
• Names changes (including reason and evidence)

• National Insurance number (only for courses where required)

• Criminal convictions (where required or provided)*^
• IP address
• Specific circumstances (e.g. care leaver / looked after child / estranged / veteran)

Your academic and learner records:

• Schools / colleges attended
• Qualifications and grades
• Transcripts and certificates
• Academic references
• Course and stage details
• Attendance, progress & current status
• Module results and final award
• Video and audio recordings of teaching and learning activities
• Use of and engagement with University services and events
• Course Rep information
• Data related to complaints/disciplinary investigations
• Unique Learner Number (ULN) where applicable

The University also collects information about your engagement with your course and our services, including attendance at timetabled teaching and learning sessions and your use of IT and learning resources. We may match these with information about your personal circumstances in order to personalise your academic experience, improve your learning outcomes and target appropriate support.

Financial information

• Payments and refunds
• Fees
• Income information

Equality/statutory monitoring information:

• Disability*^
• Religion/belief*^
• Sexual Orientation*^
• Ethnicity*^
• Gender identity*^
• Pregnancy, maternity, paternity, adoption*
• Socio-economic background
• Parental occupation
• Parental education

Information relating to your health, disabilities, wellbeing and safety:

• Evidence of disability*^
• Health records*^
• Reasonable adjustments*
• Details of extenuating circumstances*
• Safeguarding information*
• Pastoral notes, clinical case notes, counselling records*^
• Occupational health referrals and reports*
• Website data linked to extremist ideologies*
• Absence information (including reasons and dates)*

Information relating to your career and employment:

• Curriculum Vitae
• Employer details
• References and referees
• Fitness to Practice*
• Membership of professional or industry associations
• Teacher Reference Number where applicable

Information relating to your enquiries and application:

• Application form including eligibility and suitability information
• References
• Social media engagement / contact
• Queries, calls and communications
• Registration and attendance at any online or in person events

Sources

Most of the data that we hold is collected directly from you as the data subject but other sources of personal data include:

• Referees
• Education providers including schools, colleges, and other universities
• Funding bodies, employers and sponsors – i.e. where an organisation is paying your fee.

Who do we share your personal data with?

You should be aware that in order to provide our services we may need to share your personal or sensitive personal data within the organisation or outside Sheffield Hallam University. The privacy of your personal data is paramount and will not be disclosed unless there is a justified purpose for doing so.  The University, BlueSnap and HEP NEVER sell personal data to third parties.

Your data may be shared with:

• University staffwho need the information for administrative and student support purposes. In the case of international students, this may include staff in our overseas offices.
• BlueSnap, our payment portal for online courses. BlueSnap collect and use personal data on behalf of the University to take payments for online courses. This includes data sharing with HEP (see below) and the University for the purpose of ensuring transactions and refunds are processed effectively. Please see the BlueSnap Privacy Policy.
• Higher Education Partners (HEP), our partner for online courses, with whom we have a robust data processing agreement. HEP collect and use personal data on behalf of the University to manage admissions and courses and to support students.  This includes data sharing between the HEP Student Success Coordinators and the University Student Support Advisors for the purpose of ensuring student wellbeing and support.  HEP uses third parties for services such as website hosting, contact centres, IT and data analysis:
  • WordPress Engine
  • Twillio
  • Sprinklr
  • Salesforce.com
  • Dell Boomi
  • Files.com
  • Adobe Inc
  • Amazon Web Services
  • Automation Anywhere
  • Microsoft
  • Box
  • Slack
  • Atlassian
  • GearSet Limited
  • Zoom Video Communications
  • Google
  • OwnBackup
  • Darktrace Holdings Limited
  • Instructure
  • MailGun
  • Radicle
  • Anything is Possible Media Limited
• Contractors and suppliers, where the University uses external services or has outsourced work which involves the use of your personal data on our behalf. The University will ensure that appropriate contracts and/or data sharing agreements are in place and that the contractors and suppliers process personal data in accordance with the GDPR and other applicable legislation.  If we need to transfer your personal information to another organisation for processing in countries that doesn’t have equivalent data protection law in place, we’ll only do so if we have model contracts or other appropriate safeguards (protection) in place.
• Government bodies and departments, in the UK and overseas, responsible for:
  • public funding and sponsorship
  • statistical analysis, monitoring and auditing
  • regulatory matters.
• The University shares data with a number of organisations to facilitate academic, financial, and administrative functions essential to your contract with us:
  • student funding organisations in connection with grants, fees, loans and bursaries
  • employers, other education providers or others sponsoring students to obtain verification of qualifications, to provide references, and updates on attendance, progress, conduct and matters relating to fees and funding
  • validating and professional bodies in connection with registration and awards
  • occupational health provider to assess fitness to study
  • 3rd party organisations who collate data with regards to national student activity and attainment for the purposes of statistical analysis, monitoring and use by member organisations to inform recruitment and other activities.
  • the University’s insurers, legal advisers and auditors
• Sheffield Hallam Students’ Unionto enable the Union to enrol members, to contact members, to plan and promote its services, to provide services to opted-out members, to facilitate elections for student course reps and officers, and for the administration of the student rep system etc. Students may opt out of membership of the Union by contacting the Union via optinoptout@shu.ac.uk. Please see the Code of Practice relating to the Operation of the Students’ Union and the statement on Membership of Sheffield Hallam Students’ Union for more information.
• The University may share data with external services to provide additional support for individual students
  • the emergency services and/or other support organisations called upon in the case of an emergency where the disclosure of personal data is considered in the student’s best interests or pertinent to their safety and well-being
  • specialist external support services, e.g. external Disabled Student Allowance (DSA) services
• Family members only where you have given your consent or in the event of an emergency where the disclosure is considered to be in your vital interests or pertinent to your safety and well-being.
• The University may also be required to share data with the police and/or other organisations responsible for safeguarding or law enforcement,
• The University may also share data with partner organisations (e.g., other universities) as part of our public task to conduct research.

Security

The University takes a robust approach to protecting the information it holds. This includes the installation and use of technical measures including firewalls and intrusion detection and prevention tools on the University network and segregation of different types of device; the use of tools on University computers to detect and remove malicious software and regular assessment of the technical security of University systems. University staff monitor systems and respond to suspicious activity.

Alongside these technical measures there are comprehensive and effective policies and processes in place to ensure that users and administrators of University information are aware of their obligations and responsibilities for the data they have access to. By default, people are only granted access to the information they require to perform their duties. Training is provided to new staff joining the University and existing staff have training and expert advice available if needed.

Retention

Most student data is held for the duration of your course plus one further academic year. Some data is held for audit purposes beyond this time and the retention period depends on the type of audit (up to 7 years). Some data is held for statistical reporting purposes and analysis for a further 6 years. Data from complaints, appeals, disciplinary, fitness to practice and fitness to study cases are kept for 6 years in case of further queries or actions. Your core student record, including details of your award is kept permanently so that your award can be verified in the long-term to future employers and educational providers. Relevant information from your core record will become your alumni record at the completion of your qualification.  You can find more information on our Alumni Privacy Notice.

Data subject rights

Under data protection law you the following rights:

• The right to be informed
• The right of access
• The right to rectification
• The right to erase
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling

For more information about these rights please see here and the Contact Us section at the end of this privacy notice.

Contact us

If you would like to request copies of your personal data held by the University please see our info about SARs (a subject access request).

If you would like to exercise your other rights (e.g. to have inaccurate data rectified, to restrict or object to processing) please contact our Data Protection Officer.

You should also contact the Data Protection Officer if:

• you have a query about how your data is used by the University
• you would like to report a data security breach (e.g. if you think your personal data has been lost or disclosed inappropriately)
• you would like to complain about how the University has used your personal data.

Data Protection Officer
Governance Services
City Campus
Howard Street
Sheffield
S1 1WB
DPO@shu.ac.uk
Telephone: 0114 225 5555

Further information

Please see more information about how the University uses personal data here

The Information Commissioner is the regulator for GDPR.  The Information Commissioner’s Office (ICO) has a website with information and guidance for members of the public.

The Information Commissioner’s Office operates a telephone helpline, live chat facility and email enquiry service.  You can also report concerns online. For more information please see the Contact Us page of their website.

The University is required to provide data to JISC/HESA for regulatory and analytical purposes. Please see the HESA privacy notices.

Please see more information about the Key Terms Summary  here