Data Sharing Policy

Information for Students and Applicants

1.    Our role as a Data Controller and why we collect personal data
1.1    In accordance with the Data Protection Act 1998, Edinburgh Business School is registered as a Data Controller for personal data we hold about students. Edinburgh Business School collects and processes information, including images, about current students, potential students and former students, applicants and potential applicants. Edinburgh Business School will process personal data in accordance with its Data Protection Policy, the UK Data Protection Act 1998 and other applicable laws. Edinburgh Business School holds this personal data securely and restricts access to personal data to staff that need to use it in the course of their duties. Some of this information is defined as sensitive personal data in terms of the Data Protection Act 1998.

1.2    Edinburgh Business School could not exercise its responsibilities and fulfil its obligations to students without holding and using personal data. Edinburgh Business School needs to communicate and share personal data worldwide in the course of its business and transfers personal data to countries outside the European Economic Area, where adequate levels of protection are in place.

2.    With whom do we share personal data?
2.1    Edinburgh Business School works together with Heriot-Watt University and Edinburgh Business School’s partners to deliver programmes and support obligations. To ensure that your programme is managed efficiently, the personal data and images that you provide and data recorded when you commence your studies and as you progress in your studies will be shared amongst Edinburgh Business School, Heriot-Watt University and Edinburgh Business School’s partners. Such data shall be used as follows:

(a)    Edinburgh Business School and Heriot-Watt University will each use the data for academic programme management and for operational and administration purposes;
(b)    Edinburgh Business School’s partners will use the data for programme support, administration and for the provision of information to students and potential students; 
(a)    Edinburgh Business School and Heriot-Watt University may appoint external organisations to undertake work and contract with them to act as data processors to manage personal data and communications on their behalf (e.g. examination centres hosting examinations, payment services, plagiarism detection systems), and require such organisations to use personal data only for the purpose relevant to the service.

Edinburgh Business School and Heriot-Watt University act as Joint Data Controllers in respect of data they collect, use and share about students studying on Heriot-Watt University programmes delivered by Edinburgh Business School.

3.    How is personal data used?
3.1    Data recorded and shared under this Policy will be used as follows:

3.1.1    Partners of Edinburgh Business School will record information and may use the resulting data for:

(a)    Marketing programmes to potential students and providing information to Edinburgh Business School on marketing and recruitment;
(b)    Communicating with, and providing support to, students;
(c)    Quality assurance monitoring and the provision of quality assurance reports to Edinburgh Business School;
(d)    The purchase and supply of courses.

3.1.2    Edinburgh Business School and Heriot-Watt University will record information and use the resulting data for:

(a)    Marketing programmes to potential students;
(b)    Recruitment and matriculation;
(c)    Communicating with, and providing support to, students;
(d)    Processing appeals and complaints; 
(e)    Alumni relations;
(f)    Quality assurance monitoring;
(g)    Seeking and acting on student feedback, providing management and statistical information to monitor and improve our performance and enhance the student experience 
(h)    Administering programmes, monitoring performance, conducting assessments and examinations, and conferring and providing confirmation of awards;
(i)    Monitoring marketing and recruitment activities;
(j)    Returns to government or government agencies to comply with statutory and legal obligations including the Higher Education Statistics Agency (HESA)* and funding bodies;
(k)    Sharing information with and requesting information from UK Visas and Immigration and other relevant government authorities about potential students and students who are subject to immigration law in line with sponsorship duties; 
(l)    Providing information for Council Tax exemption;
(m)    Providing a reference for a potential or current employer;
(n)    Providing information to a sponsor;
(o)    Providing information to the Heriot-Watt University Student Union;
(p)    Archival purposes.

*For information on what data Heriot-Watt University shares with HESA please refer to the HESA Student Collection Notice. This notice may be subject to revision from time to time.

3.1.3    Edinburgh Business School and Heriot-Watt University film and publish audio and visual images of events held worldwide on their websites. Both parties may also take photographs and other images of students, potential students and former students for possible use in publicity and promotional material in print and on their websites. Both parties publish names and awards of all graduands in the graduation programme and in press releases to the media (unless you ask us not to do this).

4.    How we protect personal data
4.1    Edinburgh Business School and its partners will protect the data that each holds in relation to any student, potential student or former student by:

4.1.1    Implementing appropriate technical and organisational measures to protect students’, potential students’ and former students’ data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure;

4.1.2    Using data held in relation to each student, potential student and former student solely and exclusively for the purposes referred to in clause 3;

4.1.3    Giving students, potential students and former students in relation to whom each of the parties holds data, a right of access to that data, including the right to rectify or be given a copy of, the information concerned; and in the case of potential students, to have information removed; and

4.1.4    Complying with all Applicable Laws (including specifically the Data Protection Act 1998 and any equivalent laws in the Territory) in connection with the data processing activities that each party carries out under this Policy.

5.    Disclosing personal data to third parties
5.1    Edinburgh Business School and Heriot-Watt University will disclose information to third parties only:

5.1.1    With a student’s consent;
5.1.2    If requested by an organisation with a statutory function, such as the police, in a case where disclosure would prejudice law enforcement;
5.1.3    To meet a statutory or regulatory obligation;
5.1.4    Otherwise in accordance with the Edinburgh Business School’s Notification with the Information Commissioner and in compliance with the Data Protection Act.

(Edinburgh Business School April 2016) - Download this policy (PDF)