Privacy Notice for the My Advance HE Portal

This Privacy Notice outlines the personal data that will be collected from or about an individual for the purpose of the My Advance HE Portal (‘My Advance HE’). 

The Notice will set out how Advance HE will collect, use, and protect an individual’s personal data, and the rights an individual has over their data.  

This Notice covers our requirement under the Data Protection legislation applicable in the UK (GDPR UK) to notify individuals of the information contained in this statement. 

For the purposes of the Data Protection Act 2018, Advance HE is the Data Controller, and is responsible for the personal data that will be processes, this means we are responsible for deciding how we collect, use and store information about an individual or generate about them.

Advance HE is a company limited by guarantee incorporated in England and Wales under company number 4931031 and registered as a charity in England under charity number 1101607 and in Scotland under charity number SC043946, with its registered office at Innovation Way, York Science Park, York, YO10 5BR.

Advance HE is registered with the Information Commissioner’s Office (ICO) under registration number Z8550188.

For the purposes of the My Advance HE, we will collect the following information:

• Mandatory and optional information provided when registering, such as personal identifiers (first and last name), date of birth, location, and employment information.
• Additional information when reporting a problem with My Advance HE portal.
• Records of communication correspondence.
• Completion of surveys to support research purposes, if chosen to respond.
• Details of transactions carried out through My Advance HE and of the fulfilment of orders. 
• Details of visits to My Advance HE including, but not limited to: traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise and the resources access.
• Institution
• Employment status
• Learning behaviours
   

The personal information will be collected directly through the individuals completing the My Advance HE portal registration process, direct correspondence, website information request form completions, programme and event bookings, Fellowship applications or the completion of surveys.  

The personal information will be collected indirectly through cookies and tracking on the Advance HE website and within emails. For further information, please visit our Cookie Policy.

When an individual first visits Advance HE’s website, they will be presented with a cookie banner which allows them to make an informed choice about which types of cookies to accept on their device. They can opt out of tracking at any time by using a private browsing mode.

When the individual interacts with Advance HE, we may keep a record of this information on our systems and use it to determine an individual’s interest. We automatically generate data from certain interactions which allows us to tailor communications so that they are relevant to an individual and assist them in accessing the information and products that interest them. In addition, if an individual has consented to tracking cookies, some of their past browsing history on our site will also be available to help us more effectively engage with the individual.

Advance HE will also use these sources to improve our site, services and products and assess our marketing performance.

We collect this personal information for the following purposes:

• Customer care in relation to My Advance HE, or any other Advance HE services an individual uses.
• Create an individual customer profile, consisting of the registration data, preferences, Advance HE accreditations, purchases and booking and attendance history.
• Administration of an individual’s profile or account, including confirming identity when dealing with lost password requests.
• Allow for individuals to administrate the recovery process for access to their account.
• Transmission of data to suppliers of Advance HE services, and we may share your personal data between suppliers of Advance HE services, only when relevant.
• To ensure content from My Advance HE is presented in the most effective manner for an individual and their computer.
• To provide an individual with information, products or services that are requested of us.
• To carry out our obligations arising from any contracts entered into between an individual and us.
• To notify individuals about changes to our services.
• To use information for reporting purposes, including our internal reporting and reporting to individuals’ institutions when they are an Advance HE member institution.
• Advance HE may sometimes be obliged to disclose individual’s personal information by law, such as by a regulator with appropriate power, or court order. Note: in particular that information held by, or for public bodies, can be subject to the Freedom of Information Act 2000.
• For use of our Moodle learning management system, which will process personal data to provide individuals with their own personal learning dashboard and suggestions on learning content.

An individual can unsubscribe from our mailings by updating your contact preferences, from an individual's “your preference page” in My Advance HE, or by clicking ‘unsubscribe’ link at the end of an email received.

Advance HE is only about to use and individual’s data when the law allows us to do so. This is called lawful basis. The lawful basis Advance HE will rely on to use an individual’s data for the My Advance HE is as follows:

• Consent – Individuals are required to provide their consent to Advance HE processing their personal data when using the My Advance HE Portal.
• Contract – Advance HE will have contracts with member institutions who give their employees access to My Advance HE. Terms and Conditions are agreed with individuals who access the portal for Fellowship, Moodle LMS and event bookings purposes. 

The following identifies any third-parties who Advance HE share the personal data with: 

Accipio    - Vendor of Moodle LMS. To provide a learner dashboard and suggestions on learning content. Accipio Privacy Notice

C2 - To store, protect and process the data. C2 Privacy Notice

Stripe - Payment gateway provider for Moodle shop purchases. Stripe Privacy Notice

As with most organisations, Advance HE uses service providers to support in delivering our services and keep an individual’s data secure. When we use these services providers, it is necessary for us to share an individual’s personal data with them.

Advance HE will ensure that the correct agreements are in place with all of our providers that ensures they are obliged to protect an individual’s data.

Cloud service providers used to store, process, and protect Advance HE data will provide the relevant certification, security, and encryption to support the organisation. Any cloud service provider cannot under any contractual arrangement use, process, or store any Advance HE personal information without the express permission of Advance HE. Breach notification obligations and protocols will be included in any data arrangement with cloud providers and notifications on any data breach reported to Advance HE immediately. In the case of any data breach, Advance HE will work with the cloud provider to ensure data is secured and relevant parties informed of the data breach immediately. Any cloud providers chosen by Advance HE will demonstrate compliance through data protection impact assessments and by being ISP 27001 and ISO 27018 compliant.

Each third-party contract ensures ongoing security protocols for collecting and sharing personal and special category data with auditing measures in place. Upon expiry of a third-party contract, the contractor is obliged to cease processing the data, to destroy or return any copies of data they hold on our behalf, and we block further access to our systems. 

Advance HE will only retain personal data for as long as necessary to fulfil the purposes of which it is collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of personal data, the purposes for which we process individuals’ personal data and whether we can achieve those purposes through other means, and the applicable legal or regulatory requirements.

In some circumstances Advance HE may anonymise individuals’ personal data, so that it can no longer be associated with the individual, for research or statistical purposes in which case we may use this information indefinitely without further notice to the individual.

Where personal data is held electronically by Advance HE, it is held on a computer system that is owned and controlled by us, or such other third party appointed by us.

When Advance HE stores details in a paper format, they are held securely and locally at our offices by staff and contractors. Sometimes, Advance HE will make electronic copies by scanning or typing up the information from paper documents, which are then stored on our computer system.

Where your data is transferred outside of the UK, Advance HE makes sure that the individuals’ data is given the same level of protection, either because that country have a comparable data protection standard (Adequacy), or by using another safeguard such as an enhanced contractual agreement (IDTA).

Sometimes, we may be legally obliged to supply copies of personal information to other organisations, for example to supply information to the Police. Advance HE may not be able to always inform the individual in this way, however we will ensure this is only shared in accordance with the law.

It is the responsibility of the individual to keep their My Advance HE password, and any other passwords that may be used to access Advance HE sites and services, confidential. Individuals should not share passwords with anyone. 

International Transfers

Under this Privacy Notice, Advance HE will not be intending on transferring any personal data outside of the UK and EEA.  

Legal Obligations

Sometimes, we may be legally obliged to supply copies of personal information to other organisations, for example to supply information to the Police. Advance HE may not be able to always inform the individual in this way, however we will ensure this is only shared in accordance with the law. 

My Advance HE may contain links to other websites, if an individual follows these links they must note that these websites will have their own Privacy Notices and Advance HE does not accept any responsibility or liability for their use of any personal information that is submitted to them.

Under the Data Protection Law, an individual has the following rights:

• Right to Access – individuals have the right to request us for copies of the information that we hold about them.
• Right to Rectification – individuals have the right to ask us to rectify personal information you think is inaccurate. Individuals have the right to ask us to complete information they think is incomplete.
• Right to Erasure – individuals have the right to ask us to dispose of all personal information that is held under certain circumstances.
• Right to Restriction of Processing – individuals have the right to ask us to restrict the processing of their personal information in certain circumstances.
• Right to Object to Processing – individuals have the right to object to the processing of their personal information in certain circumstances.
• Right to Data Portability – individuals have the right to ask that we transfer their personal information that has been given to use to another organisation, or to themselves, in certain circumstances.

Individual will not be charged for exercising their rights. If individuals wish to make a data subject request, we will aim to response within 30 working days.

Please contact us at data.protection@advance-he.ac.uk if you wish to make a request. 
 

The contact details for Advance HE’s Data Protection Officer are as follows:

By Post:
IC 1.25 Innovation Centre
Innovation Way
York Science Park
York 
YO10 5 DG

By Email: data.protection@advance-he.ac.uk
By Phone: +4420 3870 6011
 

If individuals are unhappy with any aspect of this Privacy Notice, or how their personal data is being processed, please contact our Data Protection Officer at data.protection@advance-he.ac.uk.

If individuals are still not happy, they have the right to lodge a complaint with the ICO:

The ICO’s address:            
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk