Privacy Notice – US Federal Aid, Ulster University, Department of Global Engagement
This Privacy Notice explains how Ulster University (Global Engagement) collects, uses and processes participants’ personal data as a data controller and explains participants’ rights in relation to the personal data that the University processes for students in receipt of US Federal Aid.
The University actively seeks to preserve the privacy rights of those individuals that share information with the University. The personal data which you provide to the University will be processed in accordance with UK data protection legislation, specifically UK GDPR and the Data Protection Act 2018.
What is the purpose and legal basis of the processing?
The Global Engagement team is responsible for the processing of US Federal Aid loans on behalf of eligible US students. The University has a Program Participation Agreement (PPA) issued by the US Department of Education (USDE), which allows it to participate in the US Federal Aid loan programme. The University is required under this agreement to follow USDE regulations when processing student loan applications. The loan applications contain personal data which the University must use in order to assess loan eligibility.
The University collects this personal data in line with US Department of Education requirements.
The following lawful basis applies to this search study:
UK GDPR Article 6.1(a) – the data subject has given consent to the processing of their personal data for specific purposes.
UK GDPR Article 6.1(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
For special category data, our legal basis for processing is:
UK GDPR Article 9(g) – reasons of substantial public interest (with a basis in law).
Data Protection Act 2018, Part 2, Schedule 1 (6) – Statutory etc and government purposes
How the University collects your personal data
The University shall collect the personal data through a number of sources (as listed below):
- US Systems – COD, FAA Access to CPS online, EdConnect, NSLDS
- From you directly with the completion of the loan application and your supporting documents ) i.e. Cost of Attendance, Master Promissory Note, Student Aid Report, Entrance and Exit Counselling, Annual Student Loan Acknowledgement, Credit Check confirmations. This documentation is assessed in order to identify your eligibility for a loan.
Change of Purpose
The University will only use your personal data for the purposes for which it collects, unless the University reasonably considers that it needs to use the personal data for another reason and that reason is compatible with the original purpose. If the University needs to use your personal data for an unrelated purpose it shall notify you and explain the legal basis for which it allows the University to do so.
How long does the University hold your personal data?
Personal data collected as part of US Federal Aid loan application processing will be retained for the current academic year +6 years.
The University’s Retention and Disposal Schedule includes guidance on retention and disposal periods.
Categories of personal data processed by the University
Personal Data
The University may collect, use, store and transfer the following types of personal data as part of this processing:
If you are a student who has submitted a US Federal Aid loan application, we will collect the following personal data about you:
- Full Name
- Home/Term Address
- Email Address
- Date of Birth
- Social Security Number
- Student ID Number
- Telephone Number
- Bank details (if applicable)
- Information contained within your Student Aid Report (SAR) will also be reviewed to determine your eligibility.
Special Category Data
“Special Categories” or particularly sensitive personal information, such as information about your health, racial or ethnic origin, sexual orientation require higher levels of protection. The following categories of special category data may be processed:
- Health
Who does the University share your data with
The University shares personal data with third parties where necessary for the purposes of the processing and where there is a legal basis to do so. Where information is shared with such third parties, the University will seek to share the minimum amount necessary.
Your personal data will not be shared with third parties as part of this processing.
International Transfers
The University will transfer your personal data to the following countries outside the United Kingdom:
- United States of America
These countries are deemed not to provide an adequate level of protection for your personal data.
The University will access and process your personal data already held in systems in the USA. The University will access and process this personal information under the following derogation:
- UK GDPR, Article 49 (b) the transfer is necessary for the performance of a contract between the data subject and the controller, or the implementation of pre-contractual measures taken at the data subject’s request.
Your rights as a Data Subject
As a University data subject you have the right to:
- Access and obtain a copy of your personal data on request;
- Require the University to change incorrect or incomplete personal data;
- Require the University to delete or remove your personal data, for example where the data is no longer necessary for the purposes of processing. Note, however that the University may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request;
- Object to the processing of your personal data where the University is relying on its legitimate interests as a legal ground for processing;
- Where the University is relying upon consent to process your personal data, you may withdraw your consent at any time; and ask the University to stop processing personal data for a period if the personal data is inaccurate or there is a dispute about whether or not your interests override the University’s legitimate grounds for processing the personal data.
Further information and your right to complain
Get further information in respect of the University’s practice in respect of data protection and our Data Protection Policy
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request the University transfer a copy of your personal information to another party, please contact the University’s Data Protection Officer,
Eoin Coyle at:
c/o Ulster University, Room J308
Coleraine
BT52 1SA
02871 675525
gdpr@ulster.ac.uk
If you are not satisfied with how the University is processing your personal data, you can make a complaint to the ICO. Get further information about your data privacy rights is available on the ICO’s website.