Privacy and GDPR
The privacy of our stakeholders is important to us and the University takes care to safeguard it. These pages provide information about how the University uses personal data in line with the requirements of the General Data Protection Regulation (GDPR). The Privacy Notice below sets out how we use the personal data of website users, enquirers, and visitors. Please click “In this Section” for our other Privacy Notices and further information.
This notice covers the personal data that we collect from enquirers by phone, email, live chat, social media, and voicemail. We have separate Privacy Notices for applicants, students, alumni, staff, governors, and research participants.
From 25 May 2018 the General Data Protection Regulation (GDPR) will replace the Data Protection Act and govern the way that organisations use personal data. Personal data is information relating to an identifiable living individual.
Transparency is a key element of the GDPR and this Privacy Notice is designed to inform you:
- how and why the University uses your personal data,
- what your rights are under GDPR, and,
- how to contact us so that you can exercise those rights.
What are the legal conditions/lawful bases for processing?
The legal conditions/lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever the University and other organisations process personal data:
- (a) Consent: you, the data subject have given clear consent for the University to process your personal data for a specific purpose.
- (b) Contract: the processing is necessary for a contract that the University has with you, or because you have asked the University to take specific steps before entering into a contract.
- (c) Legal obligation: the processing is necessary for the University to comply with the law (not including contractual obligations).
- (d) Vital interests: the processing is necessary to protect someone’s life.
- (e) Public task: the processing is necessary for the University to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.
- (f) Legitimate interests: the processing is necessary for the University’s legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the your personal data which overrides those legitimate interests.
Why are we processing your personal data?
We process your personal data to:
- Respond to enquiries from potential student applicants (Legal Basis-Consent) such as responding to requests for information about our courses including prospectus requests. To answer enquiries the University may use a customer relationship management system (CRM). It is in the University's legitimate interests to provide you with further information which we believe is relevant to your enquiry. You will have the opportunity to manage your preferences which includes the right to object to this processing and unsubscribe from further communications at any time. In these cases the University will respond promptly to any such request. In any case you will be removed from our mailing lists after two years
- Registration for events (Legal Basis-Consent)-We collect data that you provide to the University to enable us to register you for our events such as Open Days and other University sponsored events. Where you provide special categories of personal data/sensitive personal data , e.g. access requirements/disability/reasonable adjustments, we process this data on the basis of your explicit consent. It is in the University's legitimate interests to provide you with further information which we believe is relevant to your enquiry. You will have the opportunity to manage your preferences which includes the right to object to this processing and unsubscribe from further communications at any time. In these cases the University will respond promptly to any such request.
- Subscription Services (Legal Basis-Consent) such as SMS text messages with regular updates. Any information you supply for this is used only to deliver messages based on the subject you choose to the email address or phone number you specify. You may unsubscribe at any time. In these cases the University will respond promptly to any such request. Your data will be retained until you unsubscribe from this service.
- To process orders made through the University's online store (Legal Basis-Necessary for the Performance of a Contract) such as merchandise, events, and conferences. The University store offers a variety of services which you will need to register for to order goods and services from the University. You may be asked to supply different types of personal data depending on the goods or services you have requested such as:
- Registering to attend a field trip
- Short courses/CPD courses
- Requesting of Transcripts and replacement of certificates
- Registering interest or attendance in an event
- Registering for Sports Clubs
- Requesting a replacement of a SHUCard
- Purchase of University merchandise such as t-shirts, pens or other SHU logo items.
- Staff Travel Tickets
- To process applications for employment (Legal Basis-Necessary for the performance of a contract)- In order to apply for a vacancy within the University, applicants are required to register their details on the e-recruitment portal before they can apply for a job. To process your application you will be required to submit additional personal details. Where we process special categories of personal data/sensitive personal data in relation to your employment application, we do so on the basis of the employment and substantial public interest conditions in Article 9 of the GDPR. You will always have the option of responding to the equality monitoring questions with "Prefer not to say".
You can find more information about the use and retention of your data on the E-Recruitment Terms and Conditions [ADD LINK]
- Respond to Freedom of Information requests (Legal basis - legal obligation) - in order to make a valid FOI request, you must provide your name and an address /email address for correspondence. These are used for the purpose of managing your request and complying with our legal obligations. Data that you supply and our response to you will be retained for 6 years to fulfil legal obligations.
- Respond to other enquiries (e.g. research, consultancy, business services) (Legal basis - consent, necessary for a contract, legitimate interests depending on the nature of your enquiry) - The University will use the data that you provide to respond to your enquiry. To answer enquiries the University may use a customer relationship management system (CRM). It is in the University's legitimate interests to provide you with further information which we believe is relevant to your enquiry. You will have the opportunity to manage your preferences which includes the right to object to this processing and unsubscribe from further communications at any time. In these cases the University will respond promptly to any such request. Retention will depend on the nature of your enquiry.
- To maintain the appropriate physical, electronic and organisational security measures of the University (Legal Basis-Legitimate Interest)-The University collects data through our CCTV which has signage in place to indicate areas that have CCTV in place. This is done to ensure the safety of our staff, students, visitors and the wider community. We may also collect your data when you are asked to sign in at certain locations on campus.
- Process feedback on our services(Legal Basis-Legitimate Interests)- If you contact us by email or through a web page to request information, report a problem, make a complaint or provide feedback on our services we will use the information you provide to respond to your message, to address the issue you have raised, and to make improvements to our services. We do not use this information for other purposes.
Who do we share your data with?
You should be aware that in order to provide our services we may need to share your personal or sensitive personal data within the organisation or outside Sheffield Hallam University. The privacy of your personal data is paramount and will not be disclosed unless there is a justified purpose for doing so. The University NEVER sells personal data to third parties.
Your data may be shared with:
- University staff who need the information to process your request, purchase, or application
- Contractors and suppliers, where the University uses external services or has outsourced work which involves the use of your personal data on our behalf. The University will ensure that appropriate contracts and/or data sharing agreements are in place and that the contractors and suppliers process personal data in accordance with the GDPR and other applicable legislation. Examples of suppliers include WPM who host our Online Store, Relex who process payments on behalf of the University, IT services and support, confidential waste disposal, mailing services. If we need to transfer your personal information to another organisation for processing in countries that aren’t listed as 'adequate' by the European Commission, we’ll only do so if we have model contracts or other appropriate safeguards (protection) in place.
- Government bodies and departments, in the UK and overseas, responsible for statistical analysis, monitoring and auditing.
We may also ask for your consent to use your personal data for other purposes. You will be given additional information for each purpose and have the right to withdraw your consent at any time.
The University takes a robust approach to protecting the information it holds. This includes the installation and use of technical measures including firewalls and intrusion detection and prevention tools on the University network and segregation of different types of device; the use of tools on University computers to detect and remove malicious software and regular assessment of the technical security of University systems. University staff monitor systems and respond to suspicious activity. The University has Cyber Essentials certification.
Alongside these technical measures there are comprehensive and effective policies and processes in place to ensure that users and administrators of University information are aware of their obligations and responsibilities for the data they have access to. By default, people are only granted access to the information they require to perform their duties. Training is provided to new staff joining the University and existing staff have training and expert advice available if needed.
Data Subject Rights
One of the aims of the General Data Protection Regulation (GDPR) is to empower individuals and give them control over their personal data.
The GDPR gives you the following rights:
- The right to be informed
- The right of access
- The right to rectification
- The right to erase
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
For more information about these rights please see here and the Contact Us section at the end of this Privacy Notice.
- If you would like to request copies of your personal data held by the University please see our info about SARs (a subject access request).
- If you would like to exercise your other rights (e.g. to have inaccurate data rectified, to restrict or object to processing) please contact our Data Protection Officer.
You should also contact the Data Protection Officer if:
- you have a query about how your data is used by the University
- you would like to report a data security breach (e.g. if you think your personal data has been lost or disclosed inappropriately)
- you would like to complain about how the University has used your personal data
Data Protection Officer
Telephone: 0114 225 5555
Further Information and Support
Please see more information about how the University uses personal data here
The Information Commissioner is the regulator for GDPR. The Information Commissioner's Office (ICO) has a website with information and guidance for members of the public:
The Information Commissioner's Office operates a telephone helpline, live chat facility and email enquiry service. You can also report concerns online. For more information please see the Contact Us page of their website:
Sheffield Hallam University is not responsible for the content of external websites.