Data Protection Schedule – Processing AHE Staff Data
1 In this Schedule:
1.1 “Data Protection Legislation” means the GDPR, the DPA, and any national implementing laws, regulations and secondary legislation relating to the protection of Personal Data and the privacy of individuals in the UK; all as amended or updated from time-to-time;
1.2 “Data Subject” means an identified or identifiable living person;
1.3 “DPA” means the UK Data Protection Act 2018;
1.4 “GDPR” means the General Data Protection Regulation (EU) 2016/679, or such replacement thereof in the UK.
1.5 “Personal Data” means any information relating to an identified or identifiable living person that is Processed under this Contract;
1.6 “Processing” means any operation or set of operations performed on Personal Data, including but not limited to collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, erasure or destruction. “Process” and “Processed” shall be construed accordingly;
1.7 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
2 Customer’s obligations
2.1 To the extent that the Customer may Process Personal Data provided by Advance HE on behalf of Advance HE under this Contract, the Customer:
2.1.1 shall Process such Personal Data in accordance with the obligations set out in clauses 2.2 and 2.3 of this Schedule; and
2.1.2 shall not do anything to put Advance HE in breach of the laws applicable in the territory in which Customer is based.
2.2 For the purposes of this Schedule:
2.2.1 the type of Personal Data being Processed by the Customer includes: names, e-mail addresses and, where relevant, passport details;
2.2.2 the categories of Data Subjects include: employees, agents, consultants and contractors of Advance HE engaged in connection with the provision of the Services to the Customer (“Advance HE Trainers”);
2.2.3 the nature/purpose of the Processing under this Schedule is to enable the Customer to communicate with the delivery team and, where relevant, to assist with any visa application, in connection with the provision of the Services; and
2.2.4 the duration of the Processing shall be the term of this Contract.
2.3 The Customer shall:
2.3.1 Process the Personal Data only to the extent, and in such manner, as is necessary for the purpose set out in paragraph 2.2.3 above and in accordance with Advance HE’s written instructions and this schedule;
2.3.2 implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks that are presented by such Processing, to protect in particular against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the likelihood and severity of risk in relation to the rights and freedoms of the Data Subjects;
2.3.3 follow Advance HE’s written instructions with regard to any transfer of Personal Data to another territory or organisation;
2.3.4 ensure that any employees or other persons authorised by the Customer to process the Personal Data are subject to appropriate obligations of confidentiality;
2.3.5 not engage any third party to carry out its Processing obligations under this Contract without obtaining the prior written consent of Advance HE and, where such consent is given, procuring by way of a written contract that such third party will, at all times during the engagement, be subject to data Processing obligations equivalent to those set out in this schedule;
2.3.6 notify Advance HE, as soon as reasonably practicable, about any request or complaint received from Data Subjects without responding to that request (unless authorised to do so by Advance HE) and assist Advance HE by technical and organisational measures, insofar as possible, for the fulfilment of Advance HE’s obligations in respect of such requests and complaints;
2.3.7 on request by Advance HE and taking into account the nature of the Processing and information available to the Customer, assist Advance HE by:
(i) notifying Advance HE without undue delay on becoming aware of any Personal Data Breach; and
(ii) where necessary, carrying out and/or reviewing and, if applicable, consulting with Advance HE with respect to data protection impact assessments;
2.3.8 on request by Advance HE, make available all information necessary to demonstrate the Customer’s compliance with this schedule and otherwise permit, and contribute to, audits carried out by Advance HE (or its authorised representative); and
2.3.9 on termination or expiry of this Contract, destroy or return to Advance HE (as Advance HE directs) all Personal Data and delete all existing copies of such Personal Data.
