Advance HE Privacy Notice Programmes and Events

About This Notice

This Privacy Notice outlines the personal data that will be collected from or about an individual for the purpose of the individual attending one of Advance HE’s programmes and events.

The Notice will set out why Advance HE will collect, use, and protect an individual’s personal data, and the rights an individual has over their data.  

This Notice covers our requirement under the Data Protection legislation applicable in the UK (GDPR UK) to notify individuals of the information contained in this statement.

Advance HE Role

For the purposes of the Data Protection Act 2018, Advance HE is the Data Controller, and is responsible for the personal data that will be processes, this means we are responsible for deciding how we collect, use and store information about an individual or generate about them.

Advance HE is a company limited by guarantee incorporated in England and Wales under company number 4931031 and registered as a charity in England under charity number 1101607 and in Scotland under charity number SC043946, with its registered office at Innovation Way, York Science Park, York, YO10 5BR.

Advance HE is registered with the Information Commissioner’s Office (ICO) under registration number Z8550188.

Advance HE Contact Details (Data Controller)

Type of Personal Information We Will Collect

For the purposes of programme and events, Advance HE will collect the following information:

• Identification data (first and last name).
• Email Address
• Postal Address
• Location
• Job title
• Employment status
• Financial details (for payment)
• Dietary requirements
• Communications between individual and Programme and Events team.
• Recordings of the sessions, which may show attendees.
• Attendance details.

In addition to the above, Advance HE will collect the following special category personal data:

• Accessibility requirements
  

How We Collect the Personal Information and Why We Have It

The personal information will be collected directly through:

• By the delegate registering to attend the programme or event via My Advance HE Portal.
• Communicating directly with the Programme and Events team.

The personal information will be collected indirectly through:
 

• Cookies and tracking on the Advance HE website. For further information, please visit our Cookie Policy.

When an individual first visits Advance HE’s website, they will be presented with a cookie banner which allows them to make an informed choice about which types of cookies to accept on their device. They can opt out of tracking at any time by using a private browsing mode.

When the individual interacts with Advance HE, we may keep a record of this information on our systems and use it to determine an individual’s interest. We automatically generate data from certain interactions which allows us to tailor communications so that they are relevant to an individual and assist them in accessing the information and products that interest them. In addition, if an individual has consented to tracking cookies, some of their past browsing history on our site will also be available to help us more effectively engage with the individual.

Advance HE will also use these sources to improve our site, services and products and assess our marketing performance.

Advance HE collects this personal information for the following purposes:
 

• To facilitate and administrate the individual participating in an event or programme delivered by Advance HE.
• To set up an My Advance HE accounts, which allows for the individual to manage bookings on events and programmes.
• To provide the individual with any specific requirements to support their attendance to a programme or event.
  

Lawful Basis

Advance HE are only about to use and individual’s data when the law allows us to do so. This is called lawful basis. The lawful basis Advance HE will rely on to use an individual’s data for the title is as follows:

• Contract – when a delegate registers onto an event or programme, they are required to sign terms and conditions.

Third Party Use of Data

The following identifies any third-parties who Advance HE share the personal data with:

Third Party Provider         Purpose                                                          Privacy Notice

My Advance HE Portal    To deliver the services and security of data. My Advance HE Portal Privacy Notice

Dynamics 365                 To store, protect and process the data. Dynamics 365 Privacy Notice
Associates                       Limited personal data (such as delegates list and requirements) shared with Associates who are delivering the event.

Partner Institutions          Advance HE may deliver events in partnership with other institutions. In order to deliver these types of events, Advance HE is required to share certain data with these institutions. Partner institutions will be identified on the events page.
 

As with most organisations, Advance HE uses service providers to support in delivering our services and keep an individual’s data secure. When we use these services providers, it is necessary for us to share an individual’s personal data with them.

Advance HE will ensure that the correct agreements are in place with all of our providers that ensures they are obliged to protect an individual’s data.

Cloud service providers used to store, process, and protect Advance HE data will provide the relevant certification, security, and encryption to support the organisation. Any cloud service provider cannot under any contractual arrangement use, process, or store any Advance HE personal information without the express permission of Advance HE. Breach notification obligations and protocols will be included in any data arrangement with cloud providers and notifications on any data breach reported to Advance HE immediately. In the case of any data breach, Advance HE will work with the cloud provider to ensure data is secured and relevant parties informed of the data breach immediately. Any cloud providers chosen by Advance HE will demonstrate compliance through data protection impact assessments and by being ISP 27001 and ISO 27018 compliant.

Each third-party contract ensures ongoing security protocols for collecting and sharing personal and special category data with auditing measures in place. Upon expiry of a third-party contract, the contractor is obliged to cease processing the data, to destroy or return any copies of data they hold on our behalf, and we block further access to our systems.

How We Store Personal Information

Advance HE will only retain personal data for as long as necessary to fulfil the purposes of which it is collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of personal data, the purposes for which we process individuals’ personal data and whether we can achieve those purposes through other means, and the applicable legal or regulatory requirements.

In some circumstances Advance HE may anonymise individuals’ personal data, so that it can no longer be associated with the individual, for research or statistical purposes in which case we may use this information indefinitely without further notice to the individual.

Where personal data is held electronically by Advance HE, it is held on a computer system that is owned and controlled by us, or such other third party appointed by us.

When Advance HE stores details in a paper format, they are held securely and locally at our offices by staff and contractors. Sometimes, Advance HE will make electronic copies by scanning or typing up the information from paper documents, which are then stored on our computer system.

It is the responsibility of the individual to keep their any passwords that may be used to access Advance HE sites and services, confidential. Individuals should not share passwords with anyone.

Transference of Personal Data

International Transfers

In some circumstances the data that Advance HE collects from an individual may be transferred to, and stored at, a destination outside the European Economic Area (‘EEA’).

It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers, for purposes including, but not limited to, the fulfilment of an order, the processing of payment details and the provision of support services.

An individual submitting their personal data, agrees to this transference, storage, or processing.

Advance HE complies with the applicable data protection laws and takes all steps reasonably necessary to ensure that their data is treated securely and in accordance with this Privacy Notice.

Where data is transferred outside of the UK, Advance HE makes sure that the individuals’ data is given the same level of protection, either because that country have a comparable data protection standard (Adequacy), or by using another safeguard such as an enhanced contractual agreement (IDTA).

Legal Obligations

Sometimes, we may be legally obliged to supply copies of personal information to other organisations, for example to supply information to the Police. Advance HE may not be able to always inform the individual in this way, however we will ensure this is only shared in accordance with the law. 
 

Links to Other Websites

There may be links to other websites when delegates register onto programme and events, if an individual follows these links they must note that these websites will have their own Privacy Notices and Advance HE does not accept any responsibility or liability for their use of any personal information that is submitted to them.

Individuals Data Protection Rights

Under the Data Protection Law, an individual has the following rights:

• Right to Access – individuals have the right to request us for copies of the information that we hold about them.
• Right to Rectification – individuals have the right to ask us to rectify personal information you think is inaccurate. Individuals have the right to ask us to complete information they think is incomplete.
• Right to Erasure – individuals have the right to ask us to dispose of all personal information that is held under certain circumstances.
• Right to Restriction of Processing – individuals have the right to ask us to restrict the processing of their personal information in certain circumstances.
• Right to Object to Processing – individuals have the right to object to the processing of their personal information in certain circumstances.
• Right to Data Portability – individuals have the right to ask that we transfer their personal information that has been given to use to another organisation, or to themselves, in certain circumstances.

Individuals will not be charged for exercising their rights, only under certain circumstances may an administrative fee be request.

If individuals wish to make a data subject request, we will aim to response within one calendar month once individual’s identification has been confirmed. Advance HE reserves the right to extend the response time by two calendar months if required, the individual will be notified accordingly.

Please contact us at data.protection@advance-he.ac.uk if you wish to make a request.

Making a Data Protection Complaint

If individuals are unhappy with any aspect of this Privacy Notice, or how their personal data is being processed, please contact our Data Protection Officer at data.protection@advance-he.ac.uk.

If individuals are still not happy, they have the right to lodge a complaint with the ICO:

The ICO’s address:            
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk