Privacy notice

The University of Worcester (“University”, “We”, “Us” or “Our”) is committed to protecting and respecting Your privacy.  This Privacy Notice is provided for Our prospective, existing and former users of our Website (“You”, “Your”).

This Privacy Notice together with Our Cookie Notice published on Our Website (“Notices”) tells You about how We process Your personal data, including Our collection, usage and sharing of Your personal data, and including in relation to Your use of Our website (“Website”).

We will only process Your personal data in accordance with the Notices (and any other information We give to You about how We process Your personal data) or for compatible purposes, and in accordance with the Data Protection Legislation.

In this Privacy Notice the terms “personal data”, “Data Controller” and “Data Processor” (and, respectively, the synonymous terms “controller” and “processor”) each have a special meaning that is set by the Data Protection Legislation.  The “Data Protection Legislation” is: the EU General Data Protection Regulation (2016/679) and the Data Protection Act 2018.

Your Data Controller

The University is a Data Controller in relation to Your personal data. Our address is Henwick Grove, Worcester, WR2 6AJ, You can contact Us by email at infoassurance@worc.ac.uk

We have appointed a Data Protection Officer (“DPO”), who is responsible for overseeing our compliance with Data Protection Legislation. If you have any questions about this Privacy Notice, including requests to exercise your rights (as detailed below), please contact the DPO, using the contact details above marking your communication for the attention of the DPO.

Information We collect about You

We may obtain Your personal data via Our Website, or in relation to something You are using our Website for (such as a booking).  We obtain Your personal data from the following sources:

  • Directly from You

You will know what personal data We obtain from You, because You (or someone who You trust, and who You have authorised Us to deal with, such as a member of Your family) provide it to Us.  Examples of how We obtain personal data from You include:

  • when You use Our Website to do something, such as making a request (e.g. for a Prospectus), enquiry (e.g. registering Your interest in a course), booking or order (e.g. to attend an Open Day, courses or conferences) via Our Website;
  • when you create or log in to Your account using the Website;
  • when you provide related information to Us by other means (for example, by email, telephone or face to face discussion with Us about Your request, enquiry, booking or order);
  • when you report something to Us, such as a problem with Our Website.
  • From marketing sources

Our Website uses cookies to help Us and Our service providers to collect information and build a profile about You.  We will use this information to understand how You use the Website (so we can take that into account when we plan and develop the Website), and to direct Our advertisements to You when You visit locations on the internet where Our service providers show adverts.  See the Cookie Notice on Our Website for more information.

  • From Our other service providers

We receive personal data about You from the following third parties who provide services to Us:

  • our bank or providers who process payments from You, to confirm the outcome of payment transactions that You make via Our Website;
  • our digital media and marketing service provider(s) who provide us with personal data obtained via social media, being the Contact Details detailed below (see under the heading, “Your choices about what We collect”) and details of any enquiry that You make via social media; and
  • information supplied by third party suppliers who may refer enquiries and/or bookings to Us.

Your choices about what We collect

To enable Us to deal with Your enquiry or complete a booking or order for You, as a minimum We need the following:

  • Your contact details: Your first name, last name, a postal or email address or telephone number (as applicable) that We can use to respond to You.  Normally We will contact You by email.
  • For requests and enquiries: details of Your request or enquiry, sufficient to enable Us to deal with it, in addition to Your contact details.
  • For bookings and related enquiries: the details of the course or event that You wish to book (event name, venue, date and time), in addition to Your contact details.
  • For orders and related enquiries: the description and quantities of products and/or services You require, the price and invoicing address (where applicable), the postal address where the products are to be delivered (if applicable), and (for enquiries) the order reference, in addition to Your contact details.
  • For payments for orders and bookings: the Website will redirect You to our payment processing service provider.  We will not receive or store Your payment card details.

When you provide information via the Website, some fields will be identified as being mandatory.  You will not be able to submit the information via the Website, or We will be unable to deal with Your request, enquiry, booking or order, unless you complete the mandatory fields with true and accurate information.

If You want Us to use less personal data, You can choose to make less available to Us.

  • How to withhold personal data: You can:
    • provide less personal data than We request;
    • exercise choice about what personal data You provide as long as it is true and accurate (for example, You may have a choice about which payment details You provide to Us);
    • not respond to Our marketing and communications (and You also have rights to stop Our direct marketing to You: see below);
    • change Your settings and connections in the social networks that you use; and/or
    • change Your internet browser settings to prohibit cookies.
  • Impact of withholding personal data: Withholding Your personal data from Us will may impact on how We contact You. For example, We may be unable to personalise communications to You based on Your preferences. 

    If You make a request or enquiry, or make a booking or place and order via Our Website, withholding Your personal data may mean that Our response to Your request or enquiry is not personalised or suitable for You, and We may be unable to complete or fulfil Your booking or order. 

    If You ask Us to erase Your personal data We may be unable to comply with Your previous instructions to Us about Your personal data.  For example, if You have asked Us not to email You and We erase records of your instruction, You may receive emails from Us if We subsequently lawfully acquire Your email address from a third party. If this happens, You will need to contact Us again if You want Us to stop contacting You.

Our use of Your personal data

For as long as We have access to Your personal data, We will use it for the following purposes (and compatible purposes), unless otherwise required as a result of You exercising Your rights under Data Protection Legislation.  We may use Your personal data for any of the following purposes, whether We obtained it directly from You (or someone You trust), or another source:

 

PurposeLegal basis
  1. To take steps (at Your request) before forming a contract with You for courses, events or other products or services.
 Processing by Us (or on Our behalf by our service providers and suppliers) will be necessary for Us to take the steps.
  1. To provide you with courses or events (or course/ events facilities) that You have booked with Us in accordance with Our contract with You, or to take steps (at Your request) before forming the contract.
 Processing by Us (or on Our behalf by our service providers and suppliers), will be necessary for Us to perform the contract or to take the steps before We enter into the contract with You.
  1. To provide delegates at Our courses and events that You attend with a list of the names and contact details of the delegates (and if You book on behalf of other individuals You must ensure they are aware that We do this, and only give Us consent if those individuals agree).
 We will only include You on the list if We have Your consent.

If You make a booking for someone else and You give consent on their behalf, We will act on that consent as if We had received it directly from that person.
  1. To process Your payment for Our courses, events or other products or services. 

    We may process Your payment by referring You to Our third party service provider.  Currently We use Worldpay.  When You are ready to pay, Our website transfers You (together with the payment amount and a transaction code) to Worldpay who will receive Your payment card details and process the payment for Us.
 Our legitimate interest in obtaining payment for Your order (whether We process the payment Ourselves or using Our third party service provider.

When We use Worldpay, it acts as a controller in relation to Your personal data.  You must refer to Worldpay’s Privacy Notice for details of what personal data it will obtain about You, its purposes for using the data, the location(s) where Your personal data will be held, who Worldpay may share the data with, and Your associated rights.
  1. To fulfil Your booking or other order.
 Processing by Us (or on Our behalf by our service providers and suppliers) will be necessary for Us to perform the contract or to take the steps before We enter into the contract with You.
  1. To respond to requests or enquiries that You make to Us (including to provide You with information that You request from Us) or to contact You about Your booking or other order.
 Our legitimate interest in responding to Your requests and enquiries and deal with Your booking or other order using contact details that We have lawfully obtained for You, e.g. by email, telephone, post or social networks.  Normally We will contact You by email.
  1. To prepare, and send You unsolicited direct marketing (unless You ask Us to stop), consisting of:
    • online advertising directed to You via our service providers; or
    • direct correspondence with You, containing relevant information about courses, events or other products or services that We provide, and life at the University.
    Also to select or de-select You for each of Our direct marketing initiatives.

    We may contact You to stay in touch with You about Our Website, tell You about the courses, events, products, services and other facilities available on or via Our Website, and keep you up to date with University life.
Marketing Purposes		 If We contact You by email about goods or services that We have previously provided to You: Data Protection Legislation allows Us to contact You for the Marketing Purposes, as long as We give You the chance to opt out beforehand, and each time We contact You.  Each time We contact You, We will tell You:
  • how You can stop the emails; and 
  • which Department of the University sent the emails to You, so You can contact that Department about the emails.
If We contact You by email about goods or services that we have not previously provided to You: Your consent for us to contact You for the Marketing Purposes. 

If We contact You by any other means: Our legitimate interest in contacting You for the Marketing Purposes. 

We use Cookies. See the Cookie Notice on Our Website for more information. 
  1. To profile You via selected social media channels, using information about social media group(s) that You belong to and Your use of the Website.  We will use information about (for example) the demographics, age, gender and approximate geographical location of the groups, and Our followers.
 Our legitimate interest in ensuring We are able to focus our marketing and advertising more effectively provided that You can ask Us to stop profiling You at any time (in which case We will stop).
  1. To give Us information about how You use the Website, so we and our service providers can review the information and ensure that the Website is presented in the most effective manner for You and for Your devices, and that it is an effective sales and communication tool.
 Our legitimate interest in providing products, services, events, choices, operations and Websites that meet the requirements of Our users. 

We use Cookies. See the Cookie Notice on Our Website for more information.
  1. To check and confirm that We carry out Your instructions accurately, to enable Us to review and improve the Website and Our courses, events, products, services, facilities and operations, and develop new and changed offerings, facilities and operations.
 Our legitimate interest in providing offerings, facilities, operations and Websites that meet the requirements of Our users.
  1. For Us to take legal or administrative action, including to collect debts, resolve disputes with You, and deal with regulators.
 Our legitimate interest in enforcing Our contract with You and in resolving any disputes with You, in dealing with regulators and as necessary for Us to establish, exercise or defend legal claims.

How long We retain Your personal data

We will hold Your contact details (and any contact preferences You have told Us about) indefinitely, until We find Your Contact Details are not current, or We are notified that You are deceased, or You or a regulator ask Us to stop using and erase Your personal data after Our contracts with You have all expired.

Unless You ask Us to keep Your personal information for longer, We will hold job application data that You submit via the Website for 6 months.  We will hold information about orders that You place with Us for up to 7 years.  We will hold information relating to requests and enquiries that You make via the Website for as long as the request or enquiry remains relevant (so, for example, Your enquiry about a future semester may be kept until up to 12 months after that semester has ended).  We will hold Your contact details indefinitely, until You de-register as a user of the Website, or You exercise Your rights so that We must stop using Your personal information.

Disclosure of Your personal data

For as long as We have access to Your personal data, We may share any of it with any of the following to the extent that they need to have access to Your personal data in order to perform their role:

  1. Any employee of the University or any company that is owned by the University.
  2. Our digital media and marketing service providers who may build a profile about You and create and/or distribute Our marketing materials to You). 
  3. Our banks and other payment processing service providers who process Your payments to Us.
  4. Our IT service providers who provide, maintain, improve, manage, optimise or fix the IT facilities that We use or rely on, including computing devices, computer networks, connectivity, telecommunications, software and Our Website.
  5. Our online service providers who provide marketing and advertising placement services for Us, including providers of search engines, analytics services, behavioral marketing services, advertisement placement services, social media and online software applications.
  6. Our professional service providers, such as accountants, auditors, legal advisers and insurance brokers.
  7. Any third party person such as a company in the event that We go through a business transition, such as a merger, being acquired by another person or company, or selling a portion of Our assets.

We reserve the right to disclose Your personal data to other third parties if We have lawful grounds to do so, or are under a legal obligation to disclose or share it with them, or in order to establish, exercise or defend Our legal rights, or to protect the rights, property, or safety of the University or Our employees or subcontractors.

We do not share Your personal data with third parties for their own marketing purposes.

Our transfer of Your personal data abroad

Our paper records and our internal IT systems on which We store Your personal data are all within the United Kingdom.

Currently We use Worldpay to process payments that You make on Our website.  When You are ready to pay, Our website transfers You to Worldpay’s computer systems that are located in the UK.  Worldpay is a data controller so, when You provide Your payment card details, You provide them to Worldpay (on its terms and conditions and policies), not to Us.  You must refer to Worldpay’s Privacy Notice, policies and terms and conditions for details of the location(s) where Your personal data will be processed by Worldpay and its service providers.

When We use social networks, Our use (as well as Yours) is subject to each social network provider’s terms and conditions and policies, which may state that the provider will store Your personal data outside of the EEA.  Please refer to each provider and their terms and conditions and policies.

Your Rights

Under the Data Protection Legislation:

  1. You have the right to access personal data that We hold about You.  Your right of access can be exercised in accordance with the Data Protection Legislation.  You can submit a request at any time. In order to do this, please contact Us at infoassurance@worc.ac.uk.
  2. If You become aware of any inaccuracies in Your personal data which We process on Your behalf, You have a right to ask Us to rectify the inaccuracies.
  3. You have the right to ask Us to erase Your personal data in certain circumstances.  If We erase Your personal data, Your ability to use Our Website (and, if applicable, our other offerings that You use on or via Our Website) will be affected, as described above.
  4. You have the right to ask Us not to process Your personal data for marketing purposes (including profiling).  You may unsubscribe from Our direct marketing at any time.  Each time We contact You for direct marketing purposes We will tell You how You can stop the emails, and which Department of the University sent the emails to You, so You can contact that Department about the emails
  5. You have the right to object to Our processing of Your personal data to the extent that (a) We use the personal data on grounds of Our legitimate interests and no exception applies to permit Us to keep using it, or (b) We use it for direct marketing purposes, or (c) We use it for scientific or historical research purposes or statistical purposes and no exception applies to permit Us to keep using it.
  6. You have the right to ask Us to restrict Our processing of Your personal data to the extent that (a) You have questioned the accuracy of the personal data and We are still checking its accuracy, (b) it is established that We did not have the lawful right to process the personal data, (c) We no longer need to use Your personal data for the purposes We collected or used it for but You need it to be preserved for the purposes of legal claims, or (d) You have exercised Your right to object to Our use of Your personal data and no exception applies to permit Us to keep using it.
  7. If We rely on Your consent for processing Your personal data, You can withdraw Your consent at any time.
  8. You have the right to complain to the Information Commissioner (http://www.ico.gov.uk/) if You have any concerns in respect of the handling of Your personal data by Us.

If You would like to exercise any of the above rights, please contact Us at infoassurance@worc.ac.uk, marking your communication for the attention of the DPO.

Our protection of Your personal information

We do not accept any responsibility for the policies of third party Data Controllers, such as providers of search engines and social networks.  Your use of such third parties, their websites and services is at Your own risk, even if we have provided links to third party websites on our Website  Please check the third parties’ Privacy Notices before You submit any personal data to them.

Changes to Privacy Notice

We reserve the right to make changes to this Privacy Notice from time to time. If this Privacy Notice changes in any way, We will place an updated version on Our Website. Regularly reviewing Our Website ensures that You are always aware of what information We collect, how We use it and under what circumstances, if any, We will share it with other parties.

Updated August 2018