This policy describes how Advance HE collects and uses personal information about you when you register on an event, programme or access one of our online programmes. For the purpose of data protection legislation (which includes the General Data Protection Regulation (Regulation (EU) 2016/679) (or such replacement thereof in the UK), and any national implementing laws, regulations and secondary legislation relating to the protection of personal data and the privacy of individuals, including (but not limited to) the Data Protection Act 2018 as amended or updated from time to time in the UK including applicable regulatory policies, guidelines or industry codes 2018 , Advance HE is the "data controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this policy.
1 Who we are
Advance HE is a company limited by guarantee incorporated in England and Wales under company number 4931031, and registered as a charity in England under charity number 1101607 and in Scotland under charity number SC043946, with its registered office at Innovation Way, York Science Park, York YO10 5BR. We can also be contacted by e-mail at email@example.com or firstname.lastname@example.org, or by phone on 01904 717500.
2 Information we may collect from you
We may collect and process the following data about you:
- Information that you provide when submitting your personal details;
- Publicly available information about you;
- If you contact us, we may keep a record of that correspondence;
- Details in relation to your dietary and access requirements for events; and
- Equality and diversity information.
3 What we may use your data for
The situations in which we will process your personal information are listed below:
- For communicating with you about your booking or application;
- To assist in the preparation of the event or programme;
- Evaluating and analysing the information provided by you including for diagnostics and for speakers to prepare for the programme/event they are to deliver;
- To deal with any queries or complaints in relation to your attendance at an event or programme; and
- Generating reports for internal use by us (including our staff) in relation to your attendance at an event or programme.
Our lawful basis for the above activities is necessity to perform our contract with you.
- Circulating your name, institution/company name, job title, e-mail address on a delegate list to be shared with other delegates and the speakers.
Our lawful basis for the above activity is our legitimate interests to encourage networking and engagement amongst delegates and speakers.
- Appointing third party service providers to use your personal data for our purposes (not the purposes of the third party) on our behalf, under our instruction, such as support services for use of the VLE, diagnostics or e-learning to third parties assisting Advance HE to inform future review processes and evaluation activities; and accommodation booking support services; and
- Keeping in touch with you to send you details about service information, our products and services, surveys, newsletters, events, courses, seminars and workshops.
Our lawful basis for these activities is the pursuit of our legitimate interests to engage external support to deliver the event or programme and to bring to your attention other services that may be of interest to you.
- Where we wish to use data for other purposes, we may anonymise your information so that it cannot be linked to you. In that case, it will cease to be personal data and we may use the anonymised data for any purpose.
4 How we will protect your personal information
We are committed to securely holding your personal information provided in this form.
Where personal information is held electronically, it is held on a computer system that is owned and controlled by Advance HE or such other third party appointed by Advance HE.
Each third party contract ensures on-going security protocols for collecting and sharing personal and special category data with auditing measures in place. Upon expiry of a third party contract, the contractor is obliged to cease processing the data, to destroy or return any copies of data they hold on our behalf, and we block further access to our systems.
Cloud service providers used to store, process and protect Advance HE data will provide the relevant certification, security and encryption to support the organisation. Any cloud service provider cannot under any contractual arrangement use, process or store any Advance HE personal information without the express permission of Advance HE. Breach notification obligations and protocols will be included in any data arrangements with cloud providers and notifications on any data breach reported to Advance HE immediately. In the case of any data breach, Advance HE will work with the cloud provider to ensure data is secured and relevant parties informed of the data breach immediately. Any cloud provider chosen by Advance HE will demonstrate compliance through data protection impact assessments and by being ISP 27001 and ISO 27018 compliant.
To effectively process booking and programme applications, Advance HE stores details in electronic format.
Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
5 How long we will retain your data for
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for (see “3. What we may use your data for”).
To determine the appropriate retention period for personal data, we consider:
- the amount, nature, and sensitivity of the personal data;
- the potential risk of harm from unauthorised use or disclosure of your personal data; and
- the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Advance HE will ensure that our suppliers and selected third parties with whom we share your personal information in accordance with this policy will delete your personal information when they no longer require it.
6 Who else we may pass on your information to
We may pass your information on to the following third parties and/or internal teams or departments at Advance HE and for the following purposes:
- Your employer for the purposes of supporting the Advance HE Membership agreement and providing institutional reports containing details of the courses you have attended;
- Our suppliers who provide services on our behalf such as IT providers who own, manage or provide support for our computers or systems we use and our suppliers who provide the VLE, e-learning, diagnostic tools or other software;
- Our staff or individuals that we appoint to process bookings; and
- Partner organisations we may use to deliver events, such as the Venue.
We may sometimes be obliged to disclose your personal information by law such as by a regulator with appropriate power, or court order. In addition, information held by or for public bodies can be subject to freedom of information requests.
7 Your duty to inform us of changes
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.
8 Your rights in connection with personal information
Under certain circumstances, by law you have the right to:
- Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the Data Protection Team in writing at email@example.com.
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
You have the right to complain to the Information Commissioner (https://ico.org.uk/) if you have any concerns in respect of the handling of your personal information by Advance HE.
10 Changes to this privacy statement
This statement may change. We will display the new statement on our website.