Student Funding Unit: Confidentiality Statement and Privacy Notice

How will we use your information?

The personal data you provide will be used to contact you for further information, to update you if we need further information, or to offer you an appointment.

We will usually contact you via your student email address ending in dundee.ac.uk.

We keep written case notes which is a summary record of information shared by students to deliver fair and transparent support. The Student Funding Unit will keep all students’ records confidential and will not otherwise allow access without written consent, except in accordance with the limited exceptions described or where otherwise permitted or required to do so by law. We will take all reasonable steps to safeguard the security of any service user information that the Student Funding Unit holds in written or electronic form.

The Student Funding Unit will ensure that all statistical information given to third parties (for example, for practice evaluation purposes) is produced in an anonymous format so that service users cannot be identified.

We will destroy all written and electronic student records that the Student Funding Unit holds 6 years after the end of the Academic Year in which you leave the University. You can also exercise your right to erasure under the UK GDPR (General Data Protection Regulation) at any time. However, the erasure of your data whilst you are still an active student may prevent the Student Funding Unit from being able to offer any level of support.

Confidentiality is an essential part of our process. Your information will only be shared:

• At your request
• If there is a legal obligation to do so
• If we believe you or someone else is in danger, we may share information with other University staff or other appropriate services e.g. Your GP or Police.

Non-personal statistical information you provide may be shared within the University for the purposes of service analysis and improvement.

Personal data and Sensitive (special categories) of personal data

The personal data and special categories of personal data processed by the Student Funding Unit will vary according to the support required. However, general biographical information such as your name, address, student ID no, date of birth, telephone number, address, email address etc will be required as standard.

Financial information specific to your interaction with the Student Funding Unit will also be required.

Data controller

The data controller for personal data used in the support is the University of Dundee.

Data will be processed using the University’s business systems. The University has contracts with providers for their cloud services to safeguard your data.

Your data may be shared with other Student Services departments with your permission. This will be discussed with you on a case-by-case basis.

Lawful processing

The lawful grounds for processing personal data within this service are normally:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
• processing is necessary for compliance with a legal obligation to which the controller is subject.
• processing is necessary to protect the vital interests of the data subject or of another natural person.
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• processing is necessary for the pursuit of our or a third party’s legitimate interests (unless those interests are overridden by your interests, rights or freedoms).

The lawful grounds for processing special categories of personal data within this service are normally:

• the data subject has given explicit consent to the processing of those personal data for one or more specified purposes
• processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by domestic law or a collective agreement pursuant to domestic law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.
• processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.
• processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Where processing falls out-with the normal course of business the University may, from time to time, seek your consent to process special categories of personal data for one or more specific purposes.

Your rights

The University respects your rights and preferences in relation to your data. If you wish to update, access, erase, limit or complain about the use of your information, please let us know by emailing  dataprotection@dundee.ac.uk. You may also wish to contact the Information Commissioner’s Office.

Enquiries

If you have any questions about this privacy notice please email the Data Protection team: dataprotection@dundee.ac.uk