Privacy Policy

‘Alumni records’ is how we describe all personal data kept by OPPA for the University of York and Hull York Medical School. Alumni records are kept by OPPA for the following groups of people: 

• Alumni and current or former students of undergraduate, postgraduate and accredited programmes delivered or part-delivered by the University of York.
• Donors and volunteers for the University of York and the University of York in America.
• Current and retired staff of the University of York.
• University of York event registrants and attendees.
• Students, alumni and staff of Hull York Medical School.
• Others in contact with OPPA, including prospective donors and volunteers.

• From you: Your alumni records contain the information you provide when you interact with us, e.g. through surveys, sign-up forms, and other contact with us before, during and after graduation.
• From the University or HYMS: Some parts of your alumni records are taken from student and staff records, e.g. your name, contact details and details of your award. Much of this data originally comes from your undergraduate or postgraduate application form. Additional information may also have been provided by you as part of your interactions with the University/HYMS, e.g. when enrolling for your course or applying for scholarships.
• From third parties: Some parts of your alumni records may be drawn from data given to us by a third party, e.g. your sponsor, agent, referee or previous employer, college or university, family member or classmate.
• From publicly available sources: Some relevant information may be added to your alumni records from information you have chosen to publish in the public domain, e.g. your LinkedIn profile.

Your alumni record contains personal data about you including the following:

• Basic details e.g. name, title, gender, date of birth and student number. We need these to identify you when we are communicating and so we know how to address you.
• Addresses and contact details e.g. phone, email and LinkedIn profile. We need these to contact you in accord with your Communication Preferences.
• Consent, privacy and communications preferences including Telephone Preference Service (TPS) registrations. We need these to make sure we only contact you in ways that are acceptable to you.
• Course and educational attainment details, e.g. what qualification you received and some of the extracurricular opportunities you participated in. We need this to identify you when we are communicating, to confirm your achievement when asked (e.g. by employers seeking a reference), and to personalise our communications to you.
• Professional details, e.g. the profession you work in and your employer. We need this for statistical and research purposes and to personalise our communications to you.
• Information about your interests you provide to us. We need this to personalise our communications to you.
• Payment and financial data you provide to us. We need this to process payments, e.g. a donation or an event booking, to claim Gift Aid, and to carry out other processes related to finance and taxation.
• A record of your engagement with us e.g. enquiries, event participation, volunteering, donations, and any other interactions you have with us. We need these to respond to your enquiries, process your payments, provide you with services and handle complaints or problems.

Special category data – which is especially sensitive data such as health records, ethnicity and religious views – are not kept as part of your alumni records.

We keep your data in line with legal requirements or where there is a business need. Retention timeframes are determined in line with the University’s Records Retention Schedule.

Our services are not directed at children, and we do not have alumni records for you if you are under the age of 16.

We keep and use your alumni records, including your contact details, for the following purposes:

1. to distribute publications, newsletters and other communications from the University, Departments, Colleges and clubs and societies;
2. to promote University events, benefits and services;
3. to provide information about alumni groups and professional opportunities; to operate surveys, censuses and research projects for the benefit of the University and alumni community;
4. to promote and manage University volunteering opportunities;
5. to carry out University fundraising operations, except where you have asked not to be included;
6. to provide you with and manage your use of University facilities and services and your participation at events;
7. to administer the financial aspects of our relationship with you and any funders including processing any payments made by you to the University;
8. to manage academic progress (including the provision of references and the processing of student complaints and appeals, academic misconduct investigations and student disciplinary cases);
9. to operate the University’s quality assurance processes and arrangements;
10. for legal, personnel, administrative and management purposes;
11. to enable effective communication with you including without limitation, providing you with information relating to University services and products, funding and/or sponsorship opportunities as well as links to relevant surveys and information on York student organisations;
12. to identify ways to enhance learning, teaching, assessment and the broader student experience;
13. to monitor equal opportunities;
14. to compile statistical and personal returns which the University may be required to publish or pass to government bodies or the Higher Education Statistics Agency (HESA).

You can control which communications and information you receive from us here: Communication Preferences.

In addition, please note:

• Photography: While on campus or at events you may be captured in photographs or video footage as part of a wider group shot. These images/recordings may be used by the University for promotional purposes e.g. in the development of the University’s alumni magazine. If you have any concerns about the use of your image, please contact the Data Protection Officer for more information at dataprotection@york.ac.uk 
• Profiling: We analyse alumni records to target and personalise our communications with you and to promote our services to those who are most likely to be interested. You can opt out of this here: Communication Preferences.

The University needs to collect and retain alumni records in order to fulfil its functions as an education provider and to maintain its lifelong relationship with its alumni community. Our legal basis for doing so is the legitimate interests of the University community and wider societal good, except in these cases:

• on the grounds of contractual requirement or to take steps to enter into a contract with you e.g. to allow you to access a University event;
• because it is necessary for the performance of a task carried out in the public interest (for information on our public task see our function as set out in our charter);
• because it is necessary for a third party’s legitimate interests;
• to allow us to comply with our legal obligations;
• to protect your or another person’s vital interests;
• to monitor equality and diversity;
• because you have given us your consent.

Storage

Alumni records may be stored outside of the UK and EU, with appropriate safeguards and security provisions such as the EU–US Privacy Shield.

We take information security extremely seriously. We have both technical and organisational measures in place to protect your alumni records. Access to your records are restricted on a need-to-know basis and security arrangements are regularly reviewed to ensure their continued suitability. For further information see IT Security.

Transfers

Your alumni records may also be transferred to other countries in certain circumstances, e.g. to allow staff and volunteers to access records when working internationally.

Any storage or transfer of your alumni records will comply with our obligations under data protection law, and we will ensure an adequate level of protection for all transferred data.

Under the General Data Protection Regulation, you have a right of access to your data, a right to rectification, erasure (in certain circumstances), restriction, objection or portability (in certain circumstances). You also have a right to withdraw any consent you have given.

Basic details

You can update your basic details, including contact details here.

Preferences and Consent

You can update your communications preferences and what you have consented to here: Communication Preferences. 

Updating alumni records:

You can check and correct any part of your alumni records by contacting us at alumni@york.ac.uk.

Right of access:

You can receive a copy of your full alumni records by submitting a Subject Access Request. To do this, email your request to dataprotection@york.ac.uk

Right to object:

In instances where we keep or use your data without explicitly asking for consent, you have the right to object. To do this, email your objection to alumni@york.ac.uk. Please give as much information as possible – the right to object is not absolute, so by stating your reasons for objecting you can help us to handle your objection appropriately.

Right to object to marketing:

You have the absolute right to object to our use of your data for direct marketing. If you do this, you will not receive any kind of newsletters, event invitations, appeals, career opportunities or other marketing contacts from us. To object to all direct marketing, email your objection to alumni@york.ac.uk. Alternatively, you can use the Communication Preferences page to opt out of specific types of communication from us while still keeping the communications you are interested in.

In addition to the above options for your alumni records, you can verify or correct information in your student record at any time by following the guidance here: Your Student Record. For all other requests, see GDPR Individual Rights.

Your alumni records may be shared with:

• organisations that process data on behalf of the University to support it in fulfilling its obligations and responsibilities to and relationship with you (such as software and system providers);
• other organisations involved in delivery of services to you, such as partners in events you attend;
• employers and other organisations (such as professional and regulatory bodies) to confirm your qualifications and other activities on your course, with your permission;
• government departments/agencies and other relevant authorities to fulfil our legal duties (see How do we respond to legal requests? below);
• current or potential employers of our students or current or potential providers of education (to provide references and verify details of your qualifications). The University is a member of the Higher Education Degree Datacheck Service: a shared service which allows employers or statutory bodies and their agents to verify basic degree and enrolment information about you, having sought your consent. These checks are most commonly made if you register with an employment agency or are offered a job.

• The University may also disclose parts of your alumni records to other third parties not listed above on a case-by-case basis. Disclosures will be made in full accordance with data protection legislation and only where necessary. Consent will be sought from you where appropriate and you will be told about such disclosures where possible, unless exceptional circumstances apply.

  Parts of your student records may also be shared by the University after you have graduated. This is documented in the Student Privacy Policy.

In addition to our usual information-sharing arrangements (see above), we may be required by law to share your records with:

• government departments/agencies to whom we have a statutory obligation to release information (including the Office for Students, Higher Education Statistics Agency, the UK Research Councils, the Education and Skills Funding Agency, the Quality Assurance Agency for Higher Education, the Home Office UK Visas and Immigration, HM Revenue and Customs and Council Tax and Electoral Registration Offices;
• current or potential employers of our students or current or potential providers of education (to provide references and verify details of your qualifications). The University is a member of the Higher Education Degree Datacheck Service: a shared service which allows employers or statutory bodies and their agents to verify basic degree and enrolment information about you, having sought your consent. These checks are most commonly made if you register with an employment agency or are offered a job;
• law enforcement agencies such as the police or relevant authorities dealing with emergency situations (only as required or appropriate and in line with Data Protection legislation). 

If you are a Canadian National: For the purposes of maintaining our Prescribed University status with the Canadian Revenue Agency (CRA) to enable donors in Canada to give tax efficiently, your information will also be passed to the CRA. This information is required by the CRA as proof that the University of York educates Canadians. The data will remain with the Canadian Revenue Agency and is given solely for purposes of verification. To opt out of this process please contact the OPPA Information and Insight Manager at alumni@york.ac.uk.

We may revise this privacy policy from time to time. 

If we make a change to the policy that we believe to be significant, we will notify you by email (unless you have asked us not to or we do not have your email address) and announce the change on our website, York.ac.uk/alumni. You can update your email address and contact preferences here.

If you have any questions about this privacy notice or concerns about how your data is being processed, please contact the OPPA Information and Insight Manager at alumni@york.ac.uk. You can also contact the University’s Data Protection Officer at dataprotection@york.ac.uk.

If you are unhappy with the way in which the University has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office, see www.ico.org.uk/concerns.

For the purposes of this privacy notice, University of York is the Data Controller as defined in the General Data Protection Regulation. We are registered with the Information Commissioner’s Office and our entry can be found here: University of York Data Protection Register entry. Our registration number is: Z4855807.

Our contact details are:

Information and Insight Manager
Office of Philanthropic Partnerships and Alumni
University of York
York
YO10 5DD
United Kingdom
Email: alumni@york.ac.uk
Phone: +44 (0)1904 324467

Data Protection Officer
Information Governance Office
University of York
York
YO10 5DD
United Kingdom
Email: dataprotection@york.ac.uk