Advance HE Privacy Notice Connect Platform (Hivebrite)
About This Notice
This Privacy Notice outlines the personal data that will be collected from or about an individual for the purpose of using the Advance HE Connect Platform.
The Notice will set out why Advance HE will collect, use, and protect an individual’s personal data, and the rights an individual has over their data.
This Notice covers our requirement under the Data Protection legislation applicable in the UK (GDPR UK) to notify individuals of the information contained in this statement.
Data Roles
For the purposes of the Data Protection Act 2018, Advance HE is the Data Controller and is responsible for the personal data that will be processes, this means we are responsible for deciding how we collect, use and store information about an individual or generate about them.
Hivebrite is the Data Processor and provides the platform for Connect, ensuring appropriate technical and organisational measures are met and processing is conducted in line with their Data Processing Agreement and Master Service Agreement.
Advance HE Details (Data Controller)
Advance HE is a company limited by guarantee incorporated in England and Wales under company number 4931031 and registered as a charity in England under charity number 1101607 and in Scotland under charity number SC043946, with its registered office at Innovation Way, York Science Park, York, YO10 5BR.
Advance HE is registered with the Information Commissioner’s Office (ICO) under registration number Z8550188.
General Contact
Name: Digital Development Team
Address: IC 1.25 Innovation Centre, Innovation Way, York Science Park, York, YO10 5DG
Email Address: [email protected]
Data Protection Officer
Name: Becky Tasker
Address: IC 1.25 Innovation Centre, Innovation Way, York Science Park, York, YO10 5DG
Email Address: [email protected]
Hivebrite Details (Data Processor)
Hivebrite is a company which develops and offers community management and engagement platforms.
General Contact
Address: 6 rue Auber, 75009, Paris, France
Data Protection Officer
Address: 6 rue Auber, 75009, Paris, France
Email Address: [email protected]
Type of Personal Information We Will Collect
For the purposes of the Connect, Advance HE will collect the following information, some data may be optional:
- Identification factors, such as forename and surname.
- Contact information, such as email address and phone number.
- Employment details, including job role, organisation and previous work experience.
- Open text which may include personal information.
- Images, such as a profile picture an individual may wish to upload.
- Login and security information for account access.
- Birthplace.
- Educational information.
In addition to the above, Advance HE may collect the following special category personal data which is optional for individuals to provide:
- Gender
- Age
- Nationality
How We Collect the Personal Information and Why We Have It
The personal information will be collected directly through:
- The individual registering for an account on Advance HE Connect.
- The individual engaging and posting within the platforms forums or message boards.
The personal information will be collected indirectly through:
- Cookies and tracking on the Advance HE Connect. For further information, please visit our Connect Cookie Policy.
When an individual first visits Advance HE’s Connect, they will be presented with a cookie banner which allows them to make an informed choice about which types of cookies to accept on their device. They can opt out of tracking at any time by using a private browsing mode.
When the individual interacts with Advance HE, we may keep a record of this information on our systems and use it to determine an individual’s interest. We automatically generate data from certain interactions which allows us to tailor communications so that they are relevant to an individual and assist them in accessing the information and products that interest them. In addition, if an individual has consented to tracking cookies, some of their past browsing history on our site will also be available to help us more effectively engage with the individual.
Advance HE will also use these sources to improve our site, services and products and assess our marketing performance.
Advance HE collects this personal information for the following purposes:
- To provide a community engagement platform for individuals within the higher education sector to share ideas, information and discussions on key sector related topics.
- Keeping in touch for the purposes connected to the Connect platform.
- Marketing information, should individuals opt in.
- Service information relating to Connect.
- Correspondence with individuals on support related enquiries or complaints.
- Applying and enforcing Advance HE standards, the terms of this Privacy Notice and our terms of use for Connect.
- Advising and enforcing changes to this Privacy Notice and Terms of Use.
- To fulfil Advance HE’s obligations to member institutions, such as providing reports detailing results of personnel from their institution, and other users, of Connect.
- Administration purposes including establishing, amending, closing or renewing user accounts.
- To better understand how users access Connect, both on an aggregated and individual basis, in order to improve Connect and respond to user desires and preferences.
Lawful Basis
Advance HE are only about to use and individual’s data when the law allows us to do so. This is called lawful basis. The lawful basis Advance HE will rely on to use an individual’s data for the Disabled Student Commitment is as follows:
Consent – As part of registering with the Connect platform, the individual is providing their consent for their data to be processed in line with this Privacy Notice.
Third Party Use of Data
The following identifies any third-parties who Advance HE share the personal data with:
Third Party Provider Used: Hivebrite
Purpose: Providers of the Connect Platform. In addition to this, Hivebrite’s sub-processors can be found here.
Privacy Notice: Hivebright privacy notice
Third Party Provider Used: Registered Users
Purpose: As an open forum, other individuals who are registered to use the site will be able to access any personal data the individual shares freely.
Privacy Notice: Connect Terms of Use
As with most organisations, Advance HE uses service providers to support in delivering our services and keep an individual’s data secure. When we use these services providers, it is necessary for us to share an individual’s personal data with them.
Advance HE will ensure that the correct agreements are in place with all of our providers that ensures they are obliged to protect an individual’s data.
Cloud service providers used to store, process, and protect Advance HE data will provide the relevant certification, security, and encryption to support the organisation. Any cloud service provider cannot under any contractual arrangement use, process, or store any Advance HE personal information without the express permission of Advance HE. Breach notification obligations and protocols will be included in any data arrangement with cloud providers and notifications on any data breach reported to Advance HE immediately. In the case of any data breach, Advance HE will work with the cloud provider to ensure data is secured and relevant parties informed of the data breach immediately. Any cloud providers chosen by Advance HE will demonstrate compliance through data protection impact assessments and by being ISP 27001 and ISO 27018 compliant.
Each third-party contract ensures ongoing security protocols for collecting and sharing personal and special category data with auditing measures in place. Upon expiry of a third-party contract, the contractor is obliged to cease processing the data, to destroy or return any copies of data they hold on our behalf, and we block further access to our systems.
How We Store Personal Information
Advance HE will only retain personal data for as long as necessary to fulfil the purposes of which it is collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of personal data, the purposes for which we process individuals’ personal data and whether we can achieve those purposes through other means, and the applicable legal or regulatory requirements.
In some circumstances Advance HE may anonymise individuals’ personal data, so that it can no longer be associated with the individual, for research or statistical purposes in which case we may use this information indefinitely without further notice to the individual.
Where personal data is held electronically by Advance HE, it is held on a computer system that is owned and controlled by us, or such other third party appointed by us.
When Advance HE stores details in a paper format, they are held securely and locally at our offices by staff and contractors. Sometimes, Advance HE will make electronic copies by scanning or typing up the information from paper documents, which are then stored on our computer system.
It is the responsibility of the individual to keep their any passwords that may be used to access Advance HE sites and services, confidential. Individuals should not share passwords with anyone.
Connect Data Retention Rules
Advance HE will manage active personal data for the duration the users account is being accessed and will conduct an annual data cleanse to identify any dormant or inactivated accounts.
If an account has been inactive for 2 consecutive years the account will be scheduled for deletion from the date of last accessed. Individuals will be notified 30 days prior of their account deletion and will be given the opportunity to login and continue their account. After the 30 days, the account will be deleted securely and irreversibly.
As part of the registration process, individuals are required to activate their accounts. Any account that has not been activated will be deleted after six months from the date of creation.
In addition to this, the data cleanse will consider the relevance of Groups on Connect. Groups that have been inactive or deemed no longer relevant will be archived and hidden from the public view. Archived groups will be retained for 2 years from the date of archiving. Following this period, the Group will be deleted.
Group admins will be contacted to confirm whether the Group is relevant and can be closed, should no response be received within 30 days the above will apply.
Transference of Personal Data
International Transfers
Under this Privacy Notice, Advance HE will not be intending on transferring any personal data outside of the UK and EEA.
Legal Obligations
Sometimes, we may be legally obliged to supply copies of personal information to other organisations, for example to supply information to the Police. Advance HE may not be able to always inform the individual in this way, however we will ensure this is only shared in accordance with the law.
Links to Other Websites
Advance HE Connect may contain links to other websites, if an individual follows these links they must note that these websites will have their own Privacy Notices and Advance HE does not accept any responsibility or liability for their use of any personal information that is submitted to them.
Individuals Data Protection Rights
Under the Data Protection Law, an individual has the following rights:
- Right to Access – individuals have the right to request us for copies of the information that we hold about them.
- Right to Rectification – individuals have the right to ask us to rectify personal information you think is inaccurate. Individuals have the right to ask us to complete information they think is incomplete.
- Right to Erasure – individuals have the right to ask us to dispose of all personal information that is held under certain circumstances.
- Right to Restriction of Processing – individuals have the right to ask us to restrict the processing of their personal information in certain circumstances.
- Right to Object to Processing – individuals have the right to object to the processing of their personal information in certain circumstances.
- Right to Data Portability – individuals have the right to ask that we transfer their personal information that has been given to use to another organisation, or to themselves, in certain circumstances.
Individuals will not be charged for exercising their rights, only under certain circumstances may an administrative fee be request.
If individuals wish to make a data subject request, we will aim to response within one calendar month once individual’s identification has been confirmed. Advance HE reserves the right to extend the response time by two calendar months if required, the individual will be notified accordingly.
Please contact us at [email protected] if you wish to make a request.
Making a Data Protection Complaint
If individuals are unhappy with any aspect of this Privacy Notice, or how their personal data is being processed, please contact our Data Protection Officer at [email protected].
If individuals are still not happy, they have the right to lodge a complaint with the ICO:
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
