Privacy and GDPR Sheffield Hallam University Study here International Business Research Alumni Visit us About us MORE Covid-19 Local residents MyHallam Staff Expand Search About this website Privacy and GDPR Privacy and GDPR In this section Covid-19 Update In some cases the University may be processing additional personal data in connection with the pandemic. Please see the relevant privacy notice for more information. You can also find out more information here (PDF, 94.9KB). Introduction The University has transitioned to a remote working pattern in line with current government guidelines to fight the Coronavirus. We will therefore not be able to collect correspondence sent via post. Where possible, we ask that you contact us at DPO@shu.ac.uk This Privacy Notice sets out how we use the personal data of website users, enquirers, and visitors collected by phone, email, live chat, social media, post, and voicemail in line with Data Protection legislation (GDPR and DPA 18). We have separate Privacy Notices for applicants, students, alumni, staff, governors, and research participants. The current data protection legislation came into force on 25 May 2018. This governs the way that organisations use personal data. Personal data is information relating to an identifiable living individual. Transparency is a key element of the data protection legislation and this Privacy Notice is designed to inform you: how and why the University uses your personal data, what your rights are under GDPR, and, how to contact us so that you can exercise those rights. Download our Privacy Notice for External Stakeholders What are the legal conditions/lawful bases for processing? The legal conditions/lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever the University and other organisations process personal data: (a) Consent: you, the data subject have given clear consent for the University to process your personal data for a specific purpose. (b) Contract: the processing is necessary for a contract that the University has with you, or because you have asked the University to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for the University to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for the University to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for the University’s legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the your personal data which overrides those legitimate interests. Why are we processing your personal data? We process your personal data to: Respond to enquiries from potential student applicants (Legal Basis-Consent) such as responding to requests for information about our courses including prospectus requests. To answer enquiries the University may use a customer relationship management system (CRM). It is in the University's legitimate interests to provide you with further information which we believe is relevant to your enquiry. You will have the opportunity to manage your preferences which includes the right to object to this processing and unsubscribe from further communications at any time. In these cases the University will respond promptly to any such request. In any case you will be removed from our mailing lists after two years Respond to enquiries from students in the South Yorkshire region hosted by our Uni Connect partnership, HEPPSY who provide impartial advice and guidance as part of outreach activities. (Legal Basis-Consent) The University and its HEPPSY Partners will also use this information to evaluate and improve HEPPSY provision and services. (Legal Basis-Legitimate Interests) and with your consent may send a follow-up survey to evaluate the quality of the support given. More information about the HEPPSY partnership and programme is available here. Registration for events (Legal Basis-Consent)-We collect data that you provide to the University to enable us to register you for our events such as Open Days and other University sponsored events. Where you provide special categories of personal data/sensitive personal data , e.g. access requirements/disability/reasonable adjustments, we process this data on the basis of your explicit consent. It is in the University's legitimate interests to provide you with further information which we believe is relevant to your enquiry. You will have the opportunity to manage your preferences which includes the right to object to this processing and unsubscribe from further communications at any time. In these cases the University will respond promptly to any such request. Subscription Services (Legal Basis-Consent) such as SMS text messages with regular updates. Any information you supply for this is used only to deliver messages based on the subject you choose to the email address or phone number you specify. You may unsubscribe at any time. In these cases the University will respond promptly to any such request. Your data will be retained until you unsubscribe from this service. Enable you to enter prize draws. (Legal Basis-Consent) Information on the personal data required to enter and how long we will retain this data will be made available in the terms and conditions for each prize draw. To process orders made through the University's online store (Legal Basis-Necessary for the Performance of a Contract) such as merchandise, events, and conferences. The University store offers a variety of services which you will need to register for to order goods and services from the University. You may be asked to supply different types of personal data depending on the goods or services you have requested such as: Registering to attend a field trip Short courses/CPD courses Requesting of Transcripts and replacement of certificates Registering interest or attendance in an event Registering for Sports Clubs Requesting a replacement of a SHUCard Purchase of University merchandise such as t-shirts, pens or other SHU logo items. Staff Travel Tickets You can find more information on the SHUStore Terms and Conditions. Information related to financial transactions will be retained for 7 years for tax and audit purposes. To Process payments and direct debits made or set up by you on behalf of students. (Lawful Basis- Necessary for the performance of a contract.) Your payment and contact details will be processed to the administration of the payment. To process applications for employment (Legal Basis-Necessary for the performance of a contract)- In order to apply for a vacancy within the University, applicants are required to register their details on the e-recruitment portal before they can apply for a job. To process your application you will be required to submit additional personal details. Where we process special categories of personal data/sensitive personal data in relation to your employment application, we do so on the basis of the employment and substantial public interest conditions in Article 9 of the GDPR. You will always have the option of responding to the equality monitoring questions with "Prefer not to say". You can find more information about the use and retention of your data on the E-Recruitment Terms and Conditions. Respond to other enquiries (e.g. research, consultancy, business services) (Legal basis - consent, necessary for a contract, legitimate interests depending on the nature of your enquiry) - The University will use the data that you provide to respond to your enquiry. To answer enquiries the University may use a customer relationship management system (CRM). It is in the University's legitimate interests to provide you with further information which we believe is relevant to your enquiry. You will have the opportunity to manage your preferences which includes the right to object to this processing and unsubscribe from further communications at any time. In these cases the University will respond promptly to any such request. Retention will depend on the nature of your enquiry. Respond to Freedom of Information requests (Legal basis - legal obligation) - in order to make a valid FOI request, you must provide your name and an address /email address for correspondence. These are used for the purpose of managing your request and complying with our legal obligations. Data that you supply and our response to you will be retained for 6 years to fulfil legal obligations. Subscription Services (Legal Basis-Consent) such as SMS text messages with regular updates. Any information you supply for this is used only to deliver messages based on the subject you choose to the email address or phone number you specify. You may unsubscribe at any time. In these cases the University will respond promptly to any such request. Your data will be retained until you unsubscribe from this service. Vital Interests To protect the vital interests of our stakeholders in emergencies/life or death situations/ where we believe that a stakeholder or another individual is at significant risk of harm. Who do we share your data with? You should be aware that in order to provide our services we may need to share your personal or sensitive personal data within the organisation or outside Sheffield Hallam University. The privacy of your personal data is paramount and will not be disclosed unless there is a justified purpose for doing so. The University NEVER sells personal data to third parties. Your data may be shared with: University staff who need the information to process your request, purchase, or application, to make improvements to our service and to maintain the security and systems of our premises. Contractors and suppliers, where the University uses external services or has outsourced work which involves the use of your personal data on our behalf. The University will ensure that appropriate contracts and/or data sharing agreements are in place and that the contractors and suppliers process personal data in accordance with the current data protection legislation and other applicable legislation. Examples of suppliers include WPM who host our Online Store, Global Payments who process payments on behalf of the University, IT services and support, confidential waste disposal, mailing services. If we need to transfer your personal information to another organisation for processing in countries that aren’t listed as 'adequate' by the European Commission, we’ll only do so if we have model contracts or other appropriate safeguards (protection) in place. Government bodies and departments, in the UK and overseas, responsible for statistical analysis, monitoring and auditing. University Insurers, legal advisors and auditors The Information Commissioners's Office to respond to complaints challenges and audits Students, where the information is required to contact you about a learning opportunity, project or placement you are providing which forms part of the students module or course. We may also ask for your consent to use your personal data for other purposes. You will be given additional information for each purpose and have the right to withdraw your consent at any time. Security The University takes a robust approach to protecting the information it holds. This includes the installation and use of technical measures including firewalls and intrusion detection and prevention tools on the University network and segregation of different types of device; the use of tools on University computers to detect and remove malicious software and regular assessment of the technical security of University systems. University staff monitor systems and respond to suspicious activity. The University has Cyber Essentials certification. Alongside these technical measures there are comprehensive and effective policies and processes in place to ensure that users and administrators of University information are aware of their obligations and responsibilities for the data they have access to. By default, people are only granted access to the information they require to perform their duties. Training is provided to new staff joining the University and existing staff have training and expert advice available if needed. Data Subject Rights One of the aims of the Data Protection Legislation is to empower individuals and give them control over their personal data. The GDPR gives you the following rights: The right to be informed The right of access The right to rectification The right to erase The right to restrict processing The right to data portability The right to object Rights in relation to automated decision making and profiling For more information about these rights please see here and the Contact Us section at the end of this Privacy Notice. Contact Us If you would like to request copies of your personal data held by the University please see our info about SARs (a subject access request). If you would like to exercise your other rights (e.g. to have inaccurate data rectified, to restrict or object to processing) please contact our Data Protection Officer. You should also contact the Data Protection Officer if: you have a query about how your data is used by the University you would like to report a data security breach (e.g. if you think your personal data has been lost or disclosed inappropriately) you would like to complain about how the University has used your personal data Data Protection Officer Governance Services City Campus Howard Street Sheffield S1 1WB DPO@shu.ac.uk Telephone: 0114 225 5555 Further Information and Support Please see more information about how the University uses personal data here The Information Commissioner is the regulator for GDPR. The Information Commissioner's Office (ICO) has a website with information and guidance for members of the public: https://ico.org.uk/for-the-public/ The Information Commissioner's Office operates a telephone helpline, live chat facility and email enquiry service. You can also report concerns online. For more information please see the Contact Us page of their website: https://ico.org.uk/global/contact-us/ Sheffield Hallam University is not responsible for the content of external websites. Sheffield Hallam University City Campus, Howard Street, Sheffield, S1 1WB, UK Phone +44 (0)114 225 5555 Social media links Courses and study Undergraduate courses Postgraduate courses International students How to apply Accommodation Fees and funding About Who we are News Jobs Staff search Contact us Legal information Accessibility How we use cookies Freedom of information Legal information Modern slavery statement Privacy and GDPR © Copyright 2021 Sheffield Hallam University Share to Facebook Share to Twitter Share to Email More AddThis Share options