This notice sets out how the University uses your personal information. It applies if you are a member of the University Council or a Committee of Council (herein referred to as "Council members"). The notice should be read in conjunction with the University's Data Protection Policy.
What personal information will be processed?
The University may store, process or otherwise control the following types of personal data. The list is non-exhaustive. This data may be captured from you when you apply to become or are appointed as a Council member, as a result of your responses to surveys or requests for information or as a result of your involvement in general University business.
- Name and contact details
- Vehicle registration details
- Dietary requirements
- Gender
- Highest level of qualification held
- Personal data provided as part of your CV
- Personal data provided as part of a declaration of interest return
- Financial data provided as part of an expenses claim
- Opinions provided during the course of Council business that may be attributable to you
Where provided, he University may also process information relating to the following special categories of personal data:
- Gender reassignment
- Religion
- Ethnicity
- Disability
- Sexual Orientation
How your personal data is used by the University
The personal data outlined above will be used by the University for the following purposes because it is legally obliged to do so:
- To arrange meetings and provide Council members with adequate information to enable them to discharge their legal duties
- To assess applications and ensure that Council members are fit and proper persons for the purposes of Company Law, Charity Law and under the requirements of the Office for Students
- To provide information as required to Companies House, the Charity Commission, the Office for Students and others about its governing body
The personal data outlined above will be used for the following purposes because it is necessary to do so for the performance of the contract between the University and Council members
- Processing expenses claims
- Providing accommodation and parking where required
The personal data outlined above will be used for the following purposes because it is in the University's legitimate interests:
- Monitoring the skills mix of Council and its Committees to ensure that the University's governing body is equipped to make effective decisions
- Monitoring the composition and characteristics of Council and its Committees to ensure that it reflects the diversity of the University community
Where the University is relying on legitimate interests as its lawful basis for processing, these interests are primarily enabling the University to better fulfil its charitable purpose and legal obligations. The University considers that the relevant processing activities set out in this notice are necessary to fulfil these aims, and that the safeguards set out in this notice mean that there is little risk of harm to the data subject.
Council members' personal data will not be used for automated decision-making or profiling.
Withdrawing consent
Any processing of special category data by the University under the terms of this notice will be undertaken on the basis of explicit consent. Council members' data will be anonymised by the Planning Team within 30 days of receipt and stored in an aggregated form that does not allow for the identification of individual members. Any non-anonymised special category data will be deleted. The University will keep a record of your consent. If you would like to withdraw your consent where it has been given, please contact the Data Protection Officer. Processing of fully anonymised and aggregated data may continue after consent has been withdrawn.
Rights
Data subjects have the following rights in respect of their personal data:
- Right of access
- Right to data portability
- Right to rectification
- Right to be forgotten
- Right to request a restriction of processing
- Right to object to processing
- Right not to be subject to automated processing
Depending on the lawful basis for processing and other factors, there may be exemptions or restrictions on these rights. The University will manage data subject rights access in accordance with the General Data Protection Regulation, the Data Protection Act 2018 and its Data Subject Rights Procedure. To find out more information or to exercise your rights as a data subject, please visit the University's website.
Transfers
The University may share some or all of your personal data with the following third parties:
- Companies House
- The Charity Commission
- The Office for Students
- UK Research and Innovation
- Accommodation or other hospitality providers during the course of Council or Committee business
The University will also publish your name and some limited biographical information on its website and more broadly, including as part of various annual reports, and will also publish a list of Council members' trusteeships
In certain circumstances the University may share your personal data with other third parties, with or without prior notification, but will only do so in compliance with its legal obligations. The University will not sell your personal data to third parties under any circumstances or permit any third parties to sell the data we have shared with them.
Storage and retention
Your data will be stored safely and securely. Data relating to Council members is generally held for a period of six years after the individual's tenure has ended. However, the names of Council members and other data relating to their contribution to the University are held in Council papers and minutes which are held indefinitely. For more detailed information, please consult the University's Record Retention Schedule or contact the Data Protection Officer.
Other information
The University will publish any changes we make to this data protection statement on the website, and will and notify you by other communication channels where appropriate. The University of Roehampton is registered with the Information Commissioner's Office, and acts as data controller for the personal data outlined in this notice.
You can raise any queries relating to the processing of your personal data with the University's Data Protection Officer, whose name and contact details are available on the University website. You have the right to make a complaint about the University's handling of your personal data to the Information Commissioner's Office, and can do so at http://ico.org.uk/concerns/.