Student Privacy Notice

1. Introduction

Glasgow Caledonian University (GCU) is a Data Controller in terms of Data Protection Legislation. GCU is registered with the Information Commissioner’s Office, our Registration Number is Z5761620.

GCU needs to process and retain certain information relating to you by virtue of you enquiring about, applying to be or being a student of the University. All of your personal information will be treated in accordance with data protection law including the Data Protection Act and the General Data Protection Regulation from 25 May 2018.

The purpose of this statement is to inform students how their personal information will be used by the University.

2. Purpose of this Privacy Notice

This Privacy Notice sets out the University’s responsibilities and obligations as a Data Controller – The organisation responsible for protecting your personal data. In addition it:

  • Explains the legal basis relied on when using your personal data;
  • Provides an overview of the purposes for which your personal data will be used;
  • Explains the sources of the information which we hold:
  • Sets out the types of information which are used;
  • Informs you who has access to your personal data and the limited conditions under which your personal data may be shared with a third party;
  • Explains your privacy rights and the steps you can take to exercise these; and
  • Explains how the University will protect your personal data, keeping this safe and secure.

3. Personal Information Processed Under Contract

The University is required to explain that your personal data is being processed as you have or are taking steps to become party to a contract with the University. This is because when you apply and accept an offer, you enter into a contract with the University and as part of this we need to use your personal information for administrative and educational purposes. Without processing your information, it will not be possible for you to become a student, continue to be a student or to gain the benefits of the GCU student experience and a qualification from GCU.

In addition, we process information which is necessary for a public interest or in the exercise of the official authority vested in the University.

4. Why we use your Personal Information?

The purpose of processing your information includes, but is not limited to:

  • Recruitment, application, admissions, transmission and enrolment purposes, including electronic applications (apps) supporting enrolment and orientation week, and to provide you with information about University advice, guidance, IT and other support services.
  • Providing you with information about educational programmes and services.
  • Making and keeping student records on the University’s central systems. Maintaining your student record and managing academic processes.
  • Educational, assessment, placement, work experience and training purposes, including providing you with technology which assist you to undertake and manage your studies, work groups and collaborative learning, and assessments, and to record and reflect on your learning, as well as interact with other students in your modules (e.g. “GCU Learn” Virtual Learning Environment). This includes using an online similarity checking service and video/lecture capture software.
  • Support purposes, including the provision of advice and support to you, including academic services, welfare including counselling and pastoral services, academic support, health care services, health and safety, attendance monitoring, vacancy information and careers guidance, where you need or choose to access these services.
  • Undertaking enquiries and investigations in relation to complaints, student conduct, fitness to practice, fitness to study, academic appeals, and any other enquiries and investigations in line with University regulations, codes and policies.
  • Managing University services including IT services, library services and events.
  • Administrative purposes to support the other purposes including: processing immigration data where appropriate; providing support services, advice and appointments; to ensure that sufficient and up-to-date records of your module participation, academic results, educational needs and preferences; confirming qualifications and providing references.
  • Administering financial matters including payment of fees, administering grants and loans. This includes your liability for fees, and payment of, student fees, grants and loans and use of the University’s online payment system for payment of fees and other costs. Financial information may be shared outside the University including sharing information with organisations such as the Student Loans Company (SLC) and other providers.
  • For educational purposes and a part of the “core” GCU learning experience, in particular gathering of basic personal data and analysis of your patterns of study; including your use of library, log-in, and electronic study resources, including participation in group-study software; collecting marks and averaging your academic results. This automated processing is integral to our student learning experience, and is intended to help you to succeed in your studies. The process is called “learning analytics” and it allows the University to improve its teaching and learning. No decisions will be made about you on the basis of this information.
  • Communications purposes including email, text messages and other electronic communications, including communicating across the GCU community and seeking your opinion.
  • Management and administration purposes relating to University property (including accommodation services).
  • Providing reports to education sector bodies, such as the Funding Councils, which provides funding for students to Scottish Universities and the Higher Education Statistics Agency, which monitors and reports on UK higher education and trends.
  • For the purposes of ensuring that the University community remains safe and inclusive, including the management of behavioural or disciplinary issues (including use or misuse of electronic and communication systems and social media).
  • Research including monitoring quality and performance.
  • Contacting your emergency contacts.
  • CCTV for the purposes of public safety and the prevention and detection of crime. CCTV footage may also be used for investigations or proceedings arising under the University’s regulations, codes and policies.
  • Graduation and confirmation of awards.
  • Alumni membership.
  • Statistical and archive purposes.

For these purposes, personal data may also be transferred outside the European Union, to countries which may not have equivalent data protection laws.  Examples of circumstances when personal data may be transferred outside the EU include:

5. Profiling or Automated Decision Making

We do not use automated decision-making processes. Some processes are semi-automated but a person will always be involved before any decision is reached in relation to you.

6. Sources of Information

The personal information GCU holds about you is obtained from a number of sources including the following:

      • Personal data provided by you in person, by letter, by telephone or by email when enquiring and discussing, applying to and enrolling at the University. This includes personal data from your previous or current: school or other educational establishment; employer; referees; including applications made via a third party such as UCAS, partner organisations or recruitment agencies.
      • Personal data built up about you during your studies e.g. marks and grades; academic assessments; conduct; your use of IT systems and Information Services; and learning analytics. Financial and fees information provided by you and from funding organisations such as Student Awards Agency for Scotland, or other education authority or your sponsors.
      • Personal data obtained from partner organisations, such as professional bodies, employers, workplaces and other educational establishments, for the purposes of external study and for any placements, field trips or exchanges which may be part of your programme.
      • Immigration, residence and visa-related information, where appropriate, obtained from you and from these authorities or from your own country’s educational or other bodies.
      • University CCTV systems.

7. Types of Information that we use

The University holds personal information relating to you including but not limited to your name, data of birth, student ID number, address, telephone number, email addresses, qualifications, skills, and personal statements.

8. Special Categories of Personal Information

The University may use special categories of personal information which are given an extra level of security and confidentiality. This includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or sexual orientation.

9. Sharing Information with Other People

9.1 Using your Emergency Contact Details

Emergency contact details will only be used in exceptional circumstances by the University. Wherever possible, your permission will be sought prior to the University getting in touch with your emergency contact. However, it may be necessary for the University to use the emergency contact details when we feel that there are significant concerns about your health or well-being.

The decision to contact an emergency contact will be taken by two managers and will be based on the agreement that communication with an emergency contact is necessary in order to protect the student. The most common causes of this necessary communication are where a student has been reported missing and is believed to be at risk, where a student is unresponsive and has been hospitalised or where a student is mentally incapacitated and at extreme risk.

9.2 Access to and Disclosure of Information

The University will manage your information securely and will restrict access to employees, advisors, agents, contractors and service providers, who will only process information in accordance with data protection legislation and the University’s instructions. The University will put in place technical and organisational measures necessary to ensure the security of your information.

The University will only disclose your information to third parties where we:

      • Have your consent; or
      • Are required to under a statutory or regulatory obligation; or
      • Are permitted to do so under the data protection legislation.

9.3 Sharing your Personal Data

The University is obliged to disclose personal data to some external bodies, including organisations which administer statistics and reports on UK higher education and institutions. To fulfil our statutory or legal obligations your data may be provided to organisations or agents acting on their behalf including but not limited to:

      • The Higher Education Statistics Agency (HESA). HESA is the official source of data about UK universities, and it collects and analyses information about students and Universities. This work includes disclosing some of your personal data to other organisations. The information gathered is used for statistics in the public interest, and for informing census and planning in higher education, and it may be used for detecting and investigating fraud. Information about employment and occupation is also provided to HESA.
      • If you provided information to the University about your disability status, ethnicity, sexual orientation, gender reassignment or religion, this will be included in your HESA information and it will be used to assist with monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act. Some other sensitive information is used to enable research into the provision of fair access to higher education, for example, whether you are care-experienced. For more information on what HESA does with your personal data, please see the HESA Student Collection Notices:www.hesa.ac.uk/about/regulation/data-protection/notices
      • The Scottish Funding Council (SFC).
      • The Student Loans Company (SLC).
      • The Student Awards Agency for Scotland (SAAS).
      • Home Office/UK Visas and Immigration (UKVI).
      • Higher Education Funding Council for England (HEFCE) including agents managing the Research Excellence Framework (REF).
      • HM Revenue & Customs (HMRC).
      • Professional bodies, for example SSSC (Scottish Social Services Council).
      • Embassies and other Governments.
      • Law enforcement agencies and debt controllers.
      • Potential and current academic partners, employers or education and placement providers.
      • Research surveys approved by the University covering student progress, attitudes, social and financial circumstances including the National Student Survey (NSS) and the International Student Barometer (ISB).
      • Relevant authorities dealing with health and safety and emergency situations at the University.

If your course is sponsored by a third party, we may share information about your attendance, participation and progression with your sponsor including your employer.

9.4 GCU Student's Association

As a registered GCU student you are automatically a member of GCU Students' Association. The Students’ Association exists to represent GCU students and provides services and activities to support and develop students. Further information is available: www.GCUstudents.co.uk/aboutus

The University provides limited information to the GCU Students’ Association for the purpose of your membership and enables the University to support the Students’ Association to be run in a fair and democratic manner. This includes academic representation, democratic activities, running of elections, volunteering, administering clubs, societies and student groups, managing events, providing support and advice and social marketing activities. If you do not want to be a member of GCU Students’ Association, you can opt out by contacting the Chief Executive of GCU Students’ Association: chief.executive@GCUstudents.co.uk

To share this information, the University is relying on the Education Act 1994.

9.5 Council Tax and Electoral Registration

To meet legal obligations, we may provide information to Councils for exemption of Council Tax. In addition, your information will be shared with the Electoral Registration Office in accordance with the Representation of the People Act 1983.

9.6 International Students

For international students, the University may confirm your dates of study and academic award to your embassy to assist with the recognition of your academic award in your home country.

If you need a visa to study at GCU, you must comply with the terms of your visa and with all the University's requirements arising from our duties and obligations as a Home Office Points Based System sponsor licence holder. GCU is required to report to the Home Office, details of students subject to immigration control who fail to enrol, who discontinue their studies, where their expected end date has changed or who fail to maintain contact with the University. We may also be required to provide the Home Office with other information about you.

10. Graduation

Graduation ceremonies are public events which are recorded and made available in live broadcasts, on campus and on the internet, and made publically available via the sale of DVDs.

The University may take photographs and other images for possible use in University publicity and promotional material. Graduands who attend the ceremony will be photographed or filmed and, as we cannot guarantee that you will not be photographed or filmed, if you do not wish to be included you should not attend the ceremony.

Names of graduands, including those graduating in absentia, are published in the graduation programme.

Lists are usually published in the press and you will be offered the opportunity to choose to be included when you register to graduate.

Your name will appear in the graduation programme. If you do not want your name included you must tell us by emailing academicregistrar@gcu.ac.uk no later than 5 weeks before the ceremony.

11. GCU Foundation

When you graduate or leave the University, you become a member of the University alumni and information about you is managed by GCU Foundation. This is undertaken under the official authority vested in the University. We will ask for your consent when we communicate with you for marketing purposes. A separate Privacy Notice is provided for Alumni Engagement and GCU Foundation: http://www.gcu.ac.uk/alumni/

12. Protecting your Information

The University puts in place a series of technical and organisational measures to protect and safeguard all the information that it holds. For example, data is securely stored in dedicated data centres, where appropriate data and devices are encrypted, staff receive training and briefings on information security and data handling. The effectiveness of those measures is routinely reviewed by University Court (through the Audit Committee) and through internal audit.

13. Where your information is held?

For these purposes, personal data may also be transferred outside the European Economic Area (EEA), to countries which may not have equivalent data protection laws. Examples of circumstances when personal data may be transferred outside the EU include:

      • Participation in and management of collaborations with overseas educational institutions including student exchanges and partnership programmes.
      • Working with overseas recruitment agencies.
      • Information posted on our website which is accessible outside the EEA.
      • Some of the systems and services the University uses to store data in the “Cloud” which may include storage facilities based outside the EEA.

When information is transferred outside the EEA, the University will ensure that appropriate safeguards are in place.

14. Email

Student email is provided by a third party. This requires the University to disclose some personal information to this third party in order to provide the service. Students should refer to the third party's terms of use and privacy policy, which are available at the logon screen.

This personal data is held in accordance with the Data Protection Act and will be stored either in the EEA or, if stored outside the EEA will have a level of protection which has been assessed to ensure that it is adequate for your privacy. You control information including any personal data stored within your email account.

15. CCTV

The University’s premises are monitored by CCTV systems for the purposes of public safety and the prevention and detection of crime. CCTV footage may also be used for investigations or proceedings arising under the University’s regulations, codes and policies. Our CCTV Policy will be published online.

16. Retention of your Personal Information

GCU will retain your personal data only as long as necessary for its purposes as described. Please note, however, that even after termination of your student relationship with the University, GCU may still need to retain your personal data to meet its obligations to keep certain records for particular periods under applicable law. We also keep a limited permanent record of you being a student for archival purposes. The University’s Records Retention Schedule can be found on our website at: http://www.gcu.ac.uk/recordsmgt/documents/

17. Making sure your Personal Information is Accurate

GCU strives to ensure that all personal data remain current and accurate. If you become aware of any incorrect information held by the University, you have the right to request that this is rectified. There are particular areas where the University relies upon you to inform it of any changes to your personal data; for example contact and emergency contact details. Our website tells you how to update us if your contact or other personal details change: http://www.gcu.ac.uk/student/registry/studentrecords/yourstudentrecord

19. Data Protection Contact Details and Further Information

We will publish any changes we make to our Data Protection Policy on our website: http://www.gcu.ac.uk/dataprotection/

If you are not happy with your personal information being processed as described above, please contact the University’s Data Protection Officer (DPO). You can do this by:

Email: dataprotection@gcu.ac.uk
Telephone: 0141 331 8392
or post: Department of Governance
Glasgow Caledonian University
Cowcaddens Road
Glasgow
G4 0BA

If you are dissatisfied with the response from the University, you have the right to lodge a complaint with the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email: casework@ico.org.uk
Telephone: 0303 123 1113