Data Privacy Policy

Data Privacy Policy (ARC)

When students use the Student’ Union’s Advice and Representation Centre (ARC) certain personal information is collected/ used that is pertinent to supporting the case. This information is held independently, with the exception of anonymous analysis for statistical reporting.

Legal Justification

There will be times where we won’t need to ask for consent to process personal information which is it is the “Legitimate Interest” of both the data controller (ARC) and the data subject (client).

“Legitimate Activity” in this respect means administrative purposes and data analysis.

Clients Rights

The right to be informed - At the point of engagement with ARC, through the advice enquiry form (online and paper) the client is informed of the data use.

The right of access – A client can request to access their data by making a Subject Access Request, in writing, to the ARC Manager

The right of rectification – Having accessed their data, a client can ask for rectification of information that is incorrect, by writing to the ARC Manager.

The right of erasure – A client can ask for their personal data to be forgotten (erased) by requesting this in writing to the ARC Manager.

The right of data portability – Information can be provided electronically at the client’s request.

The right to restrict the processing of data - A client can request to restrict the processing of their data, in writing to the ARC Manager. This will mean that their personal information may be kept, but not processed (used) in any other way.

The right to object – A client has the right to object to their data being processed at any time. The data will not be processed but the client may be advised that advice may be limited, dependant on the query.

The right to not be automatically profiled – ARC clients are not subject to automatic profiling.

Data Retention and Destruction

ARC will only keep client records for as long as they are needed in terms of administration, research or law.

We will hold the data for 6 years after a student has been completed from their studies. This falls in line with our Advice Quality Standard (AQS) accreditation. The ARC Manager is responsible for the secure destruction (deletion) of the data after that time.

Special Categories of Data

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited unless the client has given explicit consent to the processing of that personal data for one or more specified purposes or where processing is necessary to protect the vital interests of the client.

Confidentiality and Data Sharing

We will only share data in anonymised form with third parties for statistical purposes. Written consent from individuals prior to direct contact with University staff. Data shared internally with Advice staff and system administrators only.

Last Updated: September 2019