Student Privacy Statement | Queen Margaret University, Edinburgh

��ݮ�� Student Privacy Statement

Who we are

This is the privacy statement of Queen Margaret University. This privacy statement explains how we collect and use personal information about you.

Queen Margaret University (��ݮ��) is a Data Controller in terms of the Data Protection Act 2018 (DPA) and the UK General Data Protection Regulations. The University is registered with the��Our Registration Number is Z6013920.

We are a public authority under the Freedom of Information Act 2000 and a Scottish public authority under the Freedom of Information (Scotland) Act 2002. Personal Information that we collect and hold about you is used by us for our statutory and/or public functions. Where we collect or share data it is on the basis of the exercise of official authority vested in us as a public authority, and on the basis of public interest.

��Union is a data controller in its own right. You can read its privacy policy here: ��

The type of personal data we collect

We collect and process the following types of personal data:

Name, age and DoB
Contact details including email, phone number and home and term address.
Proof of identity
Disability and health information
Ethnicity, nationality, domicile
Immigration information
English language test results
Qualification information and work experience information
Marks, awards, exam scripts
Fees and payment information
Student funding, scholarship and grant information
Criminal convictions and charges��
Disclosure and PVG clearance
References
Photographs and recordings
Next of kin and family information
Sociological background
Spent and unspent criminal convictions
Complaints, appeals and discipline records
CCTV footage

How we collect your data

The personal data ��ݮ�� holds about you is obtained from a variety of sources.

In most instances we collect your personal data directly from you through the following means:

Information you have provided on your application form (including applications made directly to the University, via a third party such as UCAS, via a partner institution, or via an overseas agent);

Information you provide us with annually at enrolment (matriculation) and during the course of your studies;
Information related to performance, attendance and awards during your studies;

We also receive personal data indirectly through the following sources:��

Information related to performance, attendance, and awards during your studies from academic staff.

Information about wellbeing and health from Student Services
Funding organisations such as SAAS or sponsorship bodies;
Information relating to CAS numbers or PVG scheme records from third party organisations such as UKVI and Disclosure Scotland.
Partner organisations such as professional bodies, employers, and other educational��establishments for the purposes of external study or exchange.

Why we collect and use your personal information

When you apply to ��ݮ�� and then accept your offer you enter into a contract with the University and agree to accept the University’s Terms and Conditions. This includes, agreeing that the University can process your personal information for administrative and educational purposes. The purposes and legal basis for processing your personal data is as follows:

Legal basis	Purposes
Performance of a contract and performance of a task in the public interest	Administering and providing education & training Managing and administering the University, including accommodation services. Recruitment, admissions and enrolment. Maintaining your student records and managing academic processes, including��attendance and assessment. Processing financial transactions including fee payments and the administration of grants and loans Providing advice and support to you, including disability services, counselling and��wellbeing services, mentoring, health and safety, attendance monitoring, pastoral��services (Personal Academic Tutor system) and careers guidance. Managing disciplinary issues, fitness to practice, appeals and complaints. Managing and monitoring access to University services including library, IT, printing,��sports, catering and events. Graduation and confirmation of awards.��
Legal Obligation	��Preventing and detecting crime, fraud or corruption. To meet our obligations under equality law. Statistical and archive purposes including statutory reports to SFC, HESA etc Compliance with the requirements of the UK Government Home Office Compliance with our duties under PREVENT To meet our obligations under FOI and Data Protection legislation
Consent	Managing participation in events Providing you with information about educational programmes and services. The provision of counselling or support services��
Legitimate Interest	Seeking feedback and aggregating survey responses
Vital interests	Where there is a risk to your health or your life we may share your information with third parties e.g ambulance services�� Your emergency contact/ next of kin details may be passed to Student Services where there is genuine concern about your wellbeing or safety. This includes where information is marked as do not contact.

Special categories of personal information

We sometimes process special category personal data. Where we process special category data or criminal conviction data we are required to identify an additional legal basis for processing. Special category data is held in the strictest confidence and only shared on a strict need to know basis. This data may be shared with other competent authorities such as HESA or Disclosure Scotland.

Type of data	Purpose and additional legal basis
Data on gender, ethnicity, religion/beliefs, disability, sexual orientation, trans status of students.��	Under the UK Equality Act 2010, we need to collect sensitive personal data about our applicants and students on UK campuses to assist with monitoring equality of opportunity and eliminating unlawful discrimination You can choose whether you want to provide information for this purpose. We process this on the basis it is necessary for compliance with our legal obligation and reasons of substantial public interest. ��
Information on a student’s physical or mental health	We have a duty to collect this information so we can ensure any reasonable adjustments are made and any relevant support put in place for students who require it. We process this personal data on the basis it is necessary for compliance with our legal obligation and for reasons of substantial public interest.��
Information on a student’s mental health or wellbeing collected through wellbeing or counselling services	We can provide wellbeing and counselling services to our students. These services are open to all students on a voluntary basis. Information may be shared in confidence with Personal Academic Tutors where required to provide ongoing support for students. Personal data processed for this purpose is processed on the basis the student has given consent and the explicit consent of the data subject.
Data relating to criminal convictions and live criminal proceedings��	It is mandatory for all Universities in Scotland to collect information about relevant criminal convictions and live criminal proceedings (charges). We collect this at the post-offer stage and annually on re-enrolment. This allows us to assess risk and maintain a safe and secure environment at ��ݮ��. For certain courses applicants must declare all criminal convictions and in these cases the Rehabilitation of Offenders Act 1974 does not apply. We use this information to assess suitability for certain courses. This information enables us to measure risk and ensure we are safeguarding children and vulnerable adults. We may sometimes be required to disclose this information to competent authorities. �� We process this data on the basis that it is necessary for performance of a task in the public interest and reasons of substantial public interest.

��How we store your personal data

The University will manage your information securely and will restrict access to only those who need to use it in the course of their duties. The University will put in place technical and organisational measures necessary to ensure the security of your information.

We will only retain your information as long as is reasonably necessary for the purpose it was gathered and in accordance with ��ݮ��’s Retention Schedule. We may be required to keep some of your personal information permanently for historical and archival purposes.

Sharing your personal data

The University will only disclose your information to third parties where we:

Have a legal basis to do so under the UK General Data Protection Regulation; or
Are required to under a statutory or regulatory obligation; or

Have your consent

The reasons we may share your data are detailed below.

For academic and educational purposes

With a partner institution to deliver a programme collaboratively or jointly between the University and the partner institution.
With our external examiners, to check that our assessment of your work is fair.
With the QAA or similar body for official independent assessment of our programmes
With a potential employer or agency to provide a reference
Your sponsor to confirm your attendance, progress and assessment marks
A work placement if this is part of your course.
If you have taken part in the Lothians Equal Access Programme for Schools��(), which provides advice and support to help eligible students to enter Higher Education, we may share limited information with LEAPS about your progress and outcome of your studies, in order to improve the LEAPS service for future participants.
With relevant support agencies to enable appropriate adjustments to be made in line with an individual needs assessment.
Publicise your award in our graduation programme and in the list of awards we provide in press releases. You have the right to opt out of your award being detailed in the press release.

To meet statutory and legal obligations

The��. For more information on what HESA does with your personal data please see the HESA Student Collection Notices
The Scottish Funding Council (SFC).
The Student Loans Company (SLC).
The Student Awards Agency for Scotland (SAAS).
Home Office/UK Visas and Immigration (UKVI).
The Office for Students.
UKRI, including agents managing the Research Excellence Framework (REF)
HM Revenue & Customs (HMRC).
Local authority for Council Tax exemption purposes.
Electoral Registration Office in accordance with the Representation of the People (Scotland) Regulations 2001.
Professional bodies, for example HCPC, NMC, GTCS.
Embassies and other Governments.
Law enforcement agencies and debt controllers.
Potential employers or education and placement providers.
Research surveys approved by the University covering student progress, attitudes,
social and financial circumstances including the National Student Survey (NSS) and
the International Student Barometer (ISB).
Relevant authorities dealing with emergency situations at the University.
The University also provides limited information to the ��ݮ�� Students’ Union for the��purpose of academic representation, running of elections, administering clubs, societies and sports clubs and social marketing activities.

International data transfer

As an international organisation, the University may need to process your personal information in a country other than the one you are studying in, when this is necessary to provide you with academic and support services, meet a legal obligation, fulfil a contract with you, or where we have your consent.

Personal data may be transferred outside the EEA, to countries which may not have equivalent data protection laws. Examples of circumstances when personal data may be transferred outside the EEA include:

Managing collaborations with overseas educational institutions including student exchanges and partnership programmes.
Working with overseas recruitment agencies.
Information posted on our website which is accessible outside the EEA.
Some of the systems and services the University uses to store data in the Cloud��which may include storage facilities based outside the EEA

Where your personal information is transferred to a third country outside of the EEA, and no adequacy decision is in place, ��ݮ�� will put in place appropriate safeguards.

Profiling or automated decision making

We do not use profiling or automated decision-making processes. Some processes are semi-automated but a human decision maker will always be involved before any decision is reached in relation to you.

Graduation ceremonies

Graduation ceremonies are public events. Audio and visual images of ceremonies may be made publicly available via the sale of DVDs and live broadcast at the venue, on campus and on the Internet. Names of graduands, including those graduating in absentia, are published in the graduation programme. Lists are published in the press and you will be offered the opportunity to opt out of this.

The University may take photographs and other images for possible use in University publicity and promotional material. Graduands who do not wish to be included, must inform the photographer at the time the photograph is taken.

A separate Privacy Notice is provided for Alumni Engagement.

Survey Responses

��ݮ�� collects data through student surveys. The information collected in surveys is pseudonymised and stored against a unique personal identifier. Anonymous aggregated reports are shared more widely. Information entered in free text boxes may indirectly identify a student. Where this is the case we go to reasonable lengths to redact any information that acts as an identifier before sharing the results more widely. We encourage students to be cautious of what they enter so as not to identify themselves. Survey results are shared with Deans, Heads of Division and Programme Leads in order that feedback can be acted on.

Use of our Website

��ݮ�� respects the privacy of every individual who visits our websites or responds to our interactive advertisements. The��Privacy Statement��on our website outlines the information we collects via its various web pages and how we use that information. The Statement also instructs you on what to do if you do not want your personal information collected or shared when you visit ��ݮ��'s website or respond to our advertisements.

Your rights relating to your personal information

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

If you wish to make a rights request the relevant contact details can be found at the end of this statement.

Changes to our privacy statement

We keep this privacy statement under regular review and will place any updates on this website. We will publish any changes we make to this data protection policy on our website at the following link:��Regulations, Policies and Procedures��or at��Data Protection webpage.

Paper copies of the privacy statement may also be obtained by request from the Data Protection Officer.

This privacy statement was last updated on

Contact details and further advice

If you have any queries about the processing of your personal data as described above, please contact the University’s Data Protection Officer. You can do this by

Email:

��dataprotection@qmu.ac.uk��

Post:

Data Protection Officer

Queen Margaret University

Queen Margaret University Drive��

Musselburgh��

EH216UU

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us by contacting the Data Protection Officer in the first instance.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113 ICO

website: https://www.ico.org.uk

��