Privacy Notice

1. Introduction and purpose of this document

TEDI-London is committed to protecting the privacy and security of personal data.

This Privacy Notice explains the types of personal data we may collect about you when you interact with us. It also explains how we store and handle that data and keep it safe. This Privacy Notice does not constitute, or form part of, any contract between us. We hope that this document answers any questions you have but, if not, please do get on touch. Contact details are set out below.

The main section of this document covers the following information:

• Who we are, our aims and objectives;
• Key definitions, a summary of our legal obligations and contact details;
• Details regarding when and how we will collect your data, and the lawful bases we will rely on to process it;
• Our use of cookies;
• Your rights as a data subject; and
• Additional information about how we use your data including retention and sharing of your data.

The annexes to this document provide additional detail regarding our data collection and processing in relation to students (including applicants) and staff (including applicants):

You should refer to the relevant annex for more specific information about the types of personal data we hold about you and how we will use it.

It is likely that we will need to update this Privacy Notice from time to time, and you are welcome to come back and check this at any time or contact us by any of the means shown below.

Past versions of this Privacy Notice are available by request to the Data Protection Officer – data.request@tedi-london.ac.uk.

2. Who we are, our aims and objectives

We are TEDI-London, a new specialist HE provider in London, co-founded by Arizona State University, King’s College London and UNSW Sydney, and providing innovative engineering education programmes.

3. Key definitions

TEDI-London is a data controller. This means that we are responsible for deciding how we hold and use personal information about you.

“Personal data” is information relating to you as a living, identifiable individual

“Processing” your data includes various operations that may be carried out on your data, including collecting, recording, organising, using, disclosing, storing and deleting it.

The law requires us:

• To process your data in a lawful, fair and transparent way;
• To only collect your data for explicit and legitimate purposes;
• To only collect data that is relevant, and limited to the purpose(s) we have told you about;
• To ensure that your data is accurate and up to date;
• To ensure that your data is only kept as long as necessary for the purpose(s) we have told you about;
• To ensure that appropriate security measures are used to protect your data.

4. Contact us

The following sections will answer any questions you have but if not, please contact our Data Protection Officer by email at data.request@tedi-london.ac.uk or by post to: TEDI-London, 11 Quebec Way, London, SE16 7LG.

5. How we collect your personal data

Data that we collect includes names, contact details, socio- economic, medical and financial information, education, qualifications and references, passport details and nationality, awards and achievements and is collected during various periods and interactions. The data collection could be in electronic or paper format.

At present we collect your data:

• When you apply to TEDI-London or request information;
• When you are an employee of TEDI-London, or an applicant for a vacancy;
• When you access or engage with our website.
• For further information about the specific types of information we collect about you, please refer to the relevant annex.

Often, we receive your personal data directly from you. In addition, we may receive data from third parties. We may also produce personal data relating to you in the course of our relationship with you.

6. Why we collect your personal data

TEDI-London collects personal data in order to manage its functions as a provider of higher education.

For example:

• Copies of passports, right to work, and visa information may be collected by us to enable us to comply with UK Immigration and Visa requirements;
• Financial data, such as student loan references, account numbers and sort codes, NI number, tax codes and payments information will be collected by us to enable us to manage our accounts, fees and payroll;
• Information that you provide to us about any disabilities or health conditions you have, and about your age, ethnicity, gender, religion and belief, and/or sexual orientation may be used for equality monitoring purposes, as well as to fulfil our obligations to make reasonable adjustments pursuant to our legal obligations under the Equality Act 2010;
• When you visit our website, we may collect your IP Address, page visited, web browser, any search criteria entered, previous web page visited and other technical information. This information is used for web server monitoring and to deliver the best visitor experience;
• We may collect your social media username if you interact with us through those channels, in order to help us respond to your comments, questions and feedback;
• When we interact with you we may also collect notes from our conversations with you, and details of any complaints or comments you make.

If we are unable to collect necessary data, it may mean that we are unable to properly manage our activities, or to fulfil our obligations. Where provision of a service to you requires the collection of your personal data, it may not be possible to offer that service to you if we are unable to collect the data needed.

7. Explaining the legal bases we rely on when processing your data

The law on data protection sets out a number of different reasons or conditions for which an organisation may collect and process your personal data. When collecting your personal data, we will always make clear to you which data is necessary for each purpose.

We will generally use your personal information to provide you with the services, products or information you have requested from us. We may need to share your information with our service providers for these purposes, but we will ensure that appropriate contracts with these parties are in place and they only process your information in accordance with our instructions and data protection legislation. If we need to transfer any information to a country not recognised as providing equivalent protection, we will use additional safeguards approved by UK or EU regulators.

Most commonly, we will process your data on the following lawful grounds:

Contractual obligations

In certain circumstances, we need your personal data to comply with our contractual obligations. For example, course applicants and students will need to provide us with personal data to enable us to process their applications, manage students on-course and provide other pastoral and domestic services. Similarly, applicants for jobs and employees will need to provide details of their qualifications, and we will need to process their bank details for payments to be made.

Legal compliance

If the law requires it, we may need to collect and process your data. Relevant data may include employment information required to report earnings to tax authorities, evidence of student attendance in support of visa conditions, or providing data about our staff and students to the Higher Education Statistics Agency (HESA) in line with the legal requirement for universities under the Further and Higher Education Act 1992).

We may also share personal data with law enforcement and similar agencies to meet our obligations under UK and international law in matters such as Safeguarding and Prevent in the UK, or to assist in the investigation of fraud or other criminal activity affecting TEDI-London.

Legitimate interests

In specific situations, we will process your data to achieve legitimate interests, aims and objectives as an organisation. For example, in time we will keep records of past members and associates of TEDI-London so we can keep you informed about TEDI-London and invite you to events which we consider will be of interest to you. We will keep our donors and supporters informed of new developments in TEDI-London and of new goals which you might wish to support.

Consent

In specific situations, we can collect and process your data with your consent. The use of consent will generally be limited to circumstances in which we need to collect and process more sensitive data (called “special category” data) and where no other legal basis is applicable, for example, medical information in relation to requests for support in respect of a disability or nationality information in support of a visa application. If you are aged under 18, we may ask your parent or guardian to provide appropriate consent.

We may also rely on your consent to send you electronic communications detailing certain events and opportunities which we consider may be of interest to you.

You are entitled to withdraw your consent at any time. This may mean that we are not able to provide you with information in which you may subsequently have an interest.

Vital interests

We may also use your data, typically in an emergency, where this is necessary to protect your vital interests, or someone else’s vital interests.

For specific information about which lawful basis we will rely on in relation to your data, please see the relevant annex.

8. Special category data

“Special categories” of particularly sensitive personal data require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal data. We aim to collect and process special category data as little as possible. Generally, we will only collect information on your health where we are legally obliged to do so. This is to uphold our duty of care and to ensure the safeguarding of students, candidates, employees and visitors. Other special categories of data may be revealed to us by students during the course of their studies.

The Special Categories of personal data consist of data revealing:

• Racial or ethnic origin;
• Political opinions;
• Religious or philosophical beliefs;
• Trade union membership.

They also consist of the processing of:

• Genetic data;
• Biometric data (e.g. fingerprints) for the purpose of uniquely identifying someone;
• Data concerning health;
• Data concerning someone’s sex life or sexual orientation.

We may process special categories of personal data in the following circumstances:

• Where there is a legal obligation;
• Where it is necessary in the substantial public interest, and further conditions are met;
• Where the processing is necessary for archiving purposes in the public interest, or for scientific or historical research purposes, or statistical purposes, subject to further safeguards for your fundamental rights and interests specified in law; or
• With your explicit written consent.

Further legal controls apply to data relating to criminal convictions and allegations of criminal activity. We may process such data on the same grounds as those identified for “special categories” referred to above. We have in place appropriate documents and safeguards which govern the processing of such data.

9. Visitors to our website: our use of Cookies

We use cookies on our website, which track your activity when you visit our website. We use the information gathered to improve our website and user experience. Cookies are small text files that are placed on your computer by the websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

These cookies are used to collect information about how visitors use our site. We only use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited.

We do not collect or store your personal information (e.g. your name or address) so the analytics data cannot be used to identify who you are. We do not allow Google to use or share our data.

The following cookies are set by Google Analytics:

If you would prefer to restrict, block or delete cookies from us, or indeed any other website, you can use your browser preferences to do so. If you wish to opt out of all Google Analytics tracking then you can do so, here: https://tools.google.com/dlpage/gaoptout

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see which cookies have been set and how to manage and delete them, visit aboutcookies.org or allaboutcookies.org.

10. What are your rights over your personal data?

Subject to certain conditions and exceptions set out in UK data protection law, you have:

• The right to request access to a copy of your data, as well as to be informed of various information about how your data is being used;
• The right to have any inaccuracies in your data corrected, which may include the right to have any incomplete data completed;
• The right to have your personal data erased in certain circumstances;
• The right to have the processing of your data suspended, for example if you want us to establish the accuracy of the data we are processing;
• The right to receive a copy of data you have provided to us, and have that transmitted to another data controller;
• The right to object to any direct marketing (for example, email marketing or phone calls) by us, and to require us to stop such marketing;
• The right to object to the processing of your information if we are relying on a “legitimate interest” for the processing or where the processing is necessary for the performance of a task carried out in the public interest. The lawful basis for any particular processing activity we carry out is set out in our detailed table of processing activities, which we will provide on request; and
• The right to object to any automated decision-making about you which produces legal effects or otherwise significantly affects you.

Where the lawful basis for processing your data is consent, you have the right to withdraw your consent at any time. When you tell us you wish to exercise your right, we will stop further processing of such data. This will not affect the validity of any lawful processing of your data up until the time when you withdrew your consent. You may withdraw your consent by contacting TEDI-London’s Data Protection Officer using the contact details below.

To make a request for any of the above, please contact us at data.request@tedi-london.ac.uk.

Some of these rights are not automatic and we reserve the right to discuss the basis of your request with us before taking action.

Further guidance on your rights is available from the Information Commissioner’s Office https://ico.org.uk/. You may also wish to contact TEDI-London’s Data Protection Officer if you are considering how or whether to exercise your rights. To protect the confidentiality of your information and the interests of TEDI-London, we will ask you to verify your identity before proceeding with any request to exercise the above rights. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to request such information.

You have the right to complain to the UK’s supervisory office for data protection, the Information Commissioner’s Office if you believe that your data has been processed unlawfully.

11. Data retention

Whenever we collect or process your personal data, we will only keep it for as long as is necessary for the purpose for which it was collected. TEDI-London’s Registers of Processing Activities (ROPAs) includes retention periods and will indicate the types of data which are archived for historical or statistical purposes.

View the Student ROPA
View the Staff ROPA

We may retain anonymised statistical data indefinitely to enable us to report on such matters as diversity and equality, or the incidents of complaints. Anonymous data is no longer personal data, and as such is not subject to data protection legislation requirements.

12. Sharing your data

We do not, and will not, sell your data to third parties.

TEDI-London will only share it with third parties, if we are allowed or required to do so by law. Where information is shared with third parties, we will seek to share the minimum amount of information necessary to fulfil the relevant purpose. Examples of instances in which we may share your data are:

• Legal advisors, accountants, auditors, and agents: to facilities the legal, financial, commercial and other activities of TEDI- London.
• Police and other investigatory agencies: where, in context, it is necessary in order to carry out, or assist in, a relevant investigation.
• Third party contractual service providers: to ensure the smooth running of our services and systems.

It also includes disclosures where the third party is an agent or service provider appointed by TEDI-London to enable us to operate effectively, provided we are satisfied that appropriate safeguards have been put in place to ensure adequate levels of security for your data. All our third party service providers are required to take appropriate security measures to protect your personal information in line with our policies, and are only permitted to process your personal data for specific purposes in accordance with our instructions. We do not allow our third party providers to use your personal data for their own purposes.

13. Protecting your data outside the EEA

Occasionally we will need to share your personal data with third parties and suppliers outside the European Economic Area (EEA). The EEA includes all EU Member countries as well as Iceland, Liechtenstein and Norway.

We will only transfer personal data that we collect from you to third-party data processors in countries outside the EEA if an adequacy decision of the European Commission is in place, or appropriate data protection safeguards have been put in place, or it is otherwise lawful to transfer the data. For example, this might be required when we store data in a Cloud Service, or engage international firms to carry out data processing activities on our behalf.

14. The use of personal data for marketing purposes

We will only send you electronic communications where we have your consent. In relation to other marketing activities, including postal and telephone communications, and analysis or profiling of contacts to ensure appropriate messages are provided, we have a legitimate interest in carrying out these activities and do so with appropriate consideration of and regard for your rights.

You are free to opt out of hearing from us at any time. You can stop communications from TEDI-London as follows:

• By clicking the ‘unsubscribe’ link in any email communication that we send you will stop further marketing communications; or
• By contacting us at hello@tedi-london.ac.uk

15. Automated decision making

TEDI-London does not carry out automated decision making.

16. How to complain about our processing of your data

If you feel that your data has been handled incorrectly, or you are unhappy with the way we have dealt with your query regarding the way we use your personal data, you have the right to complain to the Information Commissioner’s Office (ICO) which regulates the use of information in the UK.

You can call them on 0303 123 1113 or go online to https://ico.org.uk/concerns

If you are based outside the UK you have the right to complain to the relevant data protection supervisory authority in your country.