Privacy Notice

Background

This Privacy Notice is designed to explain how and why information about individuals in the following categories is used and managed:

• Students participating in an international exchange

All of the personal information will be treated in accordance with the terms of the Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR).  This means that confidentiality will be respected and that appropriate security measures will be taken to prevent unauthorised disclosure.  This notice is intended to meet the transparency requirement of the legislation and to ensure that all individuals in the categories above know how their data will be processed.

Using your personal information

Who will process my information?

Under Data Protection law the University is the “data controller”.  This means that the University is responsible for how it uses and processes your information and complying with requests relating to your personal data.

When you apply to attend another university, that institution will also be a data controller for the information, which it needs to manage your time as a student at the partner University. You should refer to their Student Privacy Notice for information on how they use and manage your personal data.

The GCU Student Privacy Notice provides information on how Glasgow Caledonian manages your personal information. This notice is intended to provide additional information for students who are taking part in an exchange programme.

Why do we collect and use your personal information?

For the purposes of the exchange process we will use the following information and may share it with another institution on your behalf:

• *Your name, address and contact information
• The programme you are studying
• Any additional support requirements

Keeping information updated

The University strives to ensure that all personal information is accurate and up to date. You should update your information in the Student Records System and inform the partner university if your personal details change before and during the exchange.

How long is the information kept?

The University will retain your information only for as long as necessary for the purposes described.

Further information is available in the University Records Retention Schedules

Where do we obtain information from?

We obtain information from you directly and from the university student records system. We may also receive information from the partner institution which you attend.

What information is being collected and used?

Data will consist of the information provided by the “data subject” or a company acting on behalf of the University.  Information may be in hard copy or electronic format.  This includes:

• Biographical information such as name, email address and contact telephone number
• The programme you are studying
• Any additional support requirements.

Special category personal information is also processed where it is necessary and lawful for us to do so.  In most cases you have the option whether to provide this information or not.  This refers to data revealing:

• Racial or ethnic origin
• Political opinion
• Religious or philosophical beliefs
• Trade union membership
• Physical or mental health
• Sex life or sexual orientation.

Data relating to criminal convictions and offences is also subject to additional protection.

Who is the information shared with?

Your information will be shared internally only with those individuals who require it in the course of their duties.

The University may be required to share your personal information with external organisations, including the partner university that you will attend.

How is the information kept securely?

Information is kept securely on University equipment in line with University Information Security and Data Protection Policies.  Access is restricted to only those staff or authorised agents who require it and on a “need to know” basis.

Will the information be used for automated decision-making?

No

Is the information transferred outside the UK?

If you choose to attend another university outside the UK, your personal data will require to be shared and used in that country. You should also refer to the partner university’s Student Privacy Notice.

Your rights

You have the right to:

• Find out what personal data we process about you and to request a copy of the data
• Ask us to correct inaccurate or incomplete data
• Withdraw consent to process your personal data, if you were asked for and provided consent.

If you think we are acting unfairly or unlawfully you can:

• Object to the way we are using your data
• Complain to the UK Information Commissioner’s Office.

Under certain conditions you also have the right to ask us to:

• Restrict the use of your data
• Erase your information or tell us to stop using it to make decisions about you
• Provide you with a portable electronic copy of the data you’ve given us.

Please contact us if you wish to exercise/enquire about any of these rights.

Contact details

Data Protection Officer (DPO)
Department of Governance
Britannia Building
Glasgow Caledonian University
Cowcaddens Road
Glasgow
G4 0BA

Email:  dataprotection@gcu.ac.uk

Legal basis for using your information

The legal condition which enables the University to process personal information is found in Article 6 of the General Data Protection Regulation (GDPR).  In particular, we rely on:

• Article 6(1)(a) consent
• Article 6(1)(b) performance of a contract
• Article 6(1)(c) compliance with a legal obligation
• Article 6(1)(d) vital interests
• Article 6(1)(e) performance of a task in the public interests/exercise of official authority
• Article 6(1)(f) legitimate interests.

Where special categories of data are processed we will have your explicit consent or another legal reason within Article 9(2) of GDPR will apply.

Further information

The Information Commissioner’s Office website

The  University’s Data Protection webpages

Further information is available in the Student Privacy Notice