Privacy Notice – Student Wellbeing
This Privacy Notice explains how Ulster University (University) collects, uses and processes participants’ personal data as a data controller and explains individuals’ rights in relation to the personal data that the University processes during the interventions conducted by the Department of Student Wellbeing to provide information, support and guidance students.
The University actively seeks to preserve the privacy rights of those individuals that share information with the University. The personal data which you provide to the University will be processed in accordance with UK data protection legislation, specifically UK GDPR and the Data Protection Act 2018.
What is the purpose and legal basis of the processing?
Student Wellbeing is a holistic service providing information, support and guidance on a range of mental and physical wellbeing concerns as well as confidential advice and support to students with undiagnosed mental health conditions, personal issues and academic issues. The department also provides support for students with a disability or additional study needs (for example Dyslexia, ASD, mental health condition, physical impairment).
The following lawful basis that applies to this processing is:
UK GDPR Article 6.1(a) – the data subject has given consent to the processing of their personal data for specific purposes.
UK GDPR Article 6.1(b) – the processing is necessary for a contract the University has with the data subject, or because they have asked you to take specific steps before entering into a contract.
UK GDPR Article 6.1(c) – the processing is necessary for the University to comply with its legal obligation (not including contractual obligations).
UK GDPR Article 6.1(d) – the processing is necessary for the University protect vital interests, such as someone’s life.
UK GDPR Article 6.1(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
For processing special category data, our legal basis for processing is:
UK GDPR Article 9(a) – the data subject has given explicit consent.
UK GDPR Article 9(b) – processing is necessary for reasons of substantial public interest.
UK GDPR Article 9(g) – reasons of substantial public interest (with a basis in law).
Data Protection Act 2018, Part 2, Schedule 1 (6) – Statutory etc and government purposes
Data Protection Act 2018, Part 2, Schedule 1 (8) – Equality of opportunity or treatment
Data Protection Act 2018, Part 2, Schedule 1 (16) – Support for individuals with a particular disability or medical condition
Data Protection Act 2018, Part 2, Schedule 1 (18) – Safeguarding of children and of individuals at risk
How your personal data is collected
If you are a student, the University shall collect the personal data from you directly when you register on-line, in the UCAS database, when you enrol in the University’s Student Record System and when you register in the Student Wellbeing web application. In addition, in response to an email or telephone request for support from you, Student Wellbeing staff may register you in the Student Wellbeing web application.
All your information is stored securely in accordance with Ulster University GDPR guidelines and Student Privacy Notice guidelines. Note, on occasion, it may be necessary for us to share information with relevant third parties in your best interests, including health & social care professionals, parent and/or next of kin, if there is a known or suspected risk of harm to yourself or others.
In addition, to enhance the support that the University can provide for you, on occasion, some of the data that is held on you may be shared, on a sensitive basis, with university staff outside Student Wellbeing, e.g. for academic or career support purposes. Again, there may also be occasions where we have a legal obligation to share information with other professionals, however we will advise you of this.
If you are a support worker, interacting with students, the University will collect personal information from you when you register in the Student Wellbeing on-line portal.
Change of Purpose
The University will only use your personal data for the purposes for which it collected in, unless the University reasonable considers that it needs to use the personal data for another reason and that reason is compatible with the original purpose. If the University needs to use your personal data for an unrelated purpose it shall notify you and explain the legal basis for which allows the University to do so.
How long is your personal data kept
Personal data collected as part of Student Wellbeing will be retained for a period of 7 years, after graduation. Where support worker data pertains to a student, it will be retained for the same period. Otherwise support worker data will only be retained until the member of staff no longer has a contract with the University
The University’s Retention and Disposal Schedule includes guidance on retention and disposal periods.
Categories of personal data processed by the University
Personal Data
The University may collect, use, store and transfer the following types of personal data as part of this processing:
Student Data
- Date of Birth
- Gender
- Address
- Email (Personal and UU)
- Contact number
- Disability
- Course
- Emergency Contact
- GP Information
- Bank details for support payments
Student Support Workers
- Name
- Gender
- Date of Birth
- National Insurance Number
- Contact numbers
- Email (Personal and University)
- Emergency Contact
- Hours worked
Special Category Data
“Special Categories” or particularly sensitive personal information, such as information about your health, racial or ethnic origin, sexual orientation require higher levels of protection. The following categories of special category data will be processed:
- Health Data
- Racial or Ethnic Origin
- Data concerning a person’s sex life and/or sexual orientation
Who does the University share your data with?
The University shares personal data with third parties where necessary for the purposes of the processing and where there is a legal basis to do so. Where information is shared with such third parties, the University will seek to share the minimum amount necessary.
As part of this processing the University may share your personal data with the following third parties:
- Health & social care professionals
- Other professionals, as agreed with data subjects
International Transfers
The University will transfer your personal data to the following countries outside of the United Kingdom:
- Republic of Ireland
In these circumstances your personal data is being transferred on the basis that the Secretary of State has made an adequacy regulation in respect of said countries. This means that countries are deemed to provide equivalent protection to personal data as provided by the UK data protection regime.
Your rights as a Data Subject
As a University data subject you have the right to:
- Access and obtain a copy of your personal data on request;
- Require the University to change incorrect or incomplete personal data;
- Require the University to delete or remove your personal data, for example where the data is no longer necessary for the purposes of processing. Note, however that the University may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request;
- Object to the processing of your personal data where the University is relying on its legitimate interests as a legal ground for processing;
- Where the University is relying upon consent to process your personal data, you may withdraw your consent at any time; and ask the University to stop processing personal data for a period if the personal data is inaccurate or there is a dispute about whether or not your interests override the University’s legitimate grounds for processing the personal data.
Further information and your right to complain
Further information of the University’s practice in respect of data protection and our Data Protection Policy is available at Data Protection at Ulster University
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request the University transfer a copy of your personal information to another party, please contact the University’s Data Protection Officer, Eoin Coyle, Data Protection & Information Compliance Manager, c/o Ulster University, Room J306, Coleraine, BT52 1SA, 02871 675525 gdpr@ulster.ac.uk
If you are not satisfied with how the University is processing your personal data, you can make a complaint to the ICO. Further information about your data privacy rights are available on the ICO’s website.