Privacy Notice

Your personal data is obtained:

• directly from you, through online or paper forms, email or by telephone
• from your central student record (please see the student enrolment privacy notice for further information)
• from your doctor or assessor (if you have requested that they provide it)
• from partner institutions
• from your academic department, or other parts of the University, such as campus security
• from previous educational establishment
• from funding bodies (such as your Disabled Students’ Allowance (DSA) award letter if you receive DSA)
• from external agents (such as counsellors, social workers or the police)
• from other third parties (such as parents, guardians and friends if they report safeguarding concerns to us)
• when we create records such as of meeting notes relating to any meeting between you and SSW staff or keep copies of letters we have written on your behalf.

Personal data we collect about you in connection with the provision of Student Wellbeing Support:

• name
• address
• postcode
• email address
• telephone number
• date of birth
• identification number
• student identification number
• details of wellbeing concerns
• overview of issues to be discussed at counselling and appointment records
• SSW registration forms
• bursary application forms
• IT voucher scheme applications
• referrals
• national insurance number
• your images when we use video sessions (please note however, that counselling sessions are not recorded).

Special category data we will collect about you in connection with providing student support and wellbeing:

• physical or mental health data (such as information relating to a disability, medical condition, mental health difficulty, Specific Learning Difficulty (SpLD) or any other diagnosis or details relating to an alleged sexual assault or incident of harassment)
• racial or ethnic origin (to facilitate an Sanctuary Scholarship award).

Unless you provide it to us in the course of making a data subject access or other information request we do not routinely collect other special categories of data such as:

• sex life or sexual orientation
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic data
• biometric data for uniquely identifying you.

Criminal offence data: We receive incident reports from campus security and concerns about harassment from students which may contain details that include allegations that an individual has committed a criminal offence.

We will use your information in the following ways:

·       to facilitate support for students

·       to ensure students flagged as a cause for  concern receive appropriate support

·       to respond to security incidents relating to student wellbeing

·       to ensure counselling support is put in place

·       to facilitate bursary and scholarship and other support scheme applications

·       to create an Inclusive Learning Plan (ILP) which sits on your student record to inform your department and relevant Professional Services within the University about the required adjustments. One section of the ILP is the student profile, which will detail the impact of your disability/impairment on your studies. Where relevant, and only after you have approved the wording of the ILP, details of your conditions will be shared, if this is required for the purpose of making reasonable adjustments. However, if your department does not need to know details of your diagnosis or details of any treatment for the purpose of making the reasonable adjustments, these details will not be shared, unless you explicitly request this

·       if part of your support includes the provision of non-medical help (e.g. a note taker, a SpLD tutor, or mentor), we will also use your information for the purpose of delivering this service and for audit purposes

·       to track progress and monitor the support offered by the team

·       to comply with statutory requests for information in liaison with the Assurance and Data Protection team

·       for collating general statistical information about our service, for the purpose of service improvement and audits

·       to email you occasionally with information about SSW’s service and/or information considered to be of interest to users of our service but will not use your information for marketing purposes

We rely on the following lawful basis as allowed by the UK GDPR for processing your personal data as this is necessary for:
• the performance of a task carried out in the public interest or in the exercise of official authority - Article 6(1)(e)
• a legal obligation – Article 6(1)(c)
• to protect your vital interests or those of another person – Article 6 (1)(d)
• you have given your consent for one or more specific purposes- Article 6(1)(a) .

As we also use your special category data, we must identify a further basis for processing that data. The processing is necessary for making reasonable adjustments and/or assisting:
• employment, social security and social protection – Article 9(2)(b)
• to protect your vital interests or those of another where you are physically or legally incapable of giving consent – Article 9(2)(c)
• reasons of substantial public interest (as defined within the Data Protection Act 2018) – Article 9(2)(g)
Our substantial public interest reasons are:
          o statutory purposes
          o equality of opportunity or treatment
          o prevention or detection of crime.
          o safeguarding
• Archiving in the public interest, scientific or historical research purposes or statistical purposes with a basis in law – Article 9(2)(j) [Article 89(1) UKGDPR and section 19 DPA 18 must be satisfied]
• Where you have given your explicit consent (for example for us to make a reasonable adjustment or where you agree we may share information on well being with a third party)- Article 9(2)(a) .

The university’s public task and statutory purposes are underpinned by the following legislation:
• the Freedom of Information Act 2000
• the Equality Act 2010
• the Higher Education and Research Act 2017 (including the requirement to comply with registration conditions imposed by the Office for Students)
• the Data Protection Act 2018.

As we also use your criminal offence data, we additionally rely on the substantial public interest condition conferred under Section 36 and the vital interests basis under Section 30 Schedule 1, Part 3 of the Data Protection Act 2018.

We have a Special Category and Criminal Offence Data Appropriate Policy document in place throughout the time that we use your data and for 6 months after we cease to use it. 

Your ILP, as described above, is available to relevant staff across the University who are involved in teaching you and/or arranging your support.  This will include academic and professional services staff (e.g. the exams team), who will access your ILP for the purpose of making reasonable adjustments, to ensure appropriate support is provided and as part of any application for concessions.  Staff will only have access to the relevant sections of your ILP, for the purpose of delivering appropriate support, with only limited staff in your department having full access.

We use third party organisations (known as data processors) who carry out services on the University’s behalf under contract, such as Microsoft and GTI, who supply us with software for our case management system Target Connect. We will ensure that only the minimum amount of relevant personal data necessary for the purpose is transferred. We will ensure that contractual agreements exist to ensure compliance with data protection regulations and that data is used solely under our instruction. In these circumstances personal data shall be deleted after the contract has terminated.

We share your personal data with funding bodies and DSA assessment centres, for the purpose of enabling the timely progression of your DSA application and with SpLD assessors, if you are referred by us for a diagnostic assessment. It will also be shared with external auditors who are responsible for overseeing the regulation of the DSA process.

Where we have concerns regarding the safety of a student, limited information may be shared with Campus Security, the University Medical Centre, the University Nursing Service and relevant external partners, for the purpose of protecting your safety and/or the safety of others. 

SSW will never share your personal information with any third party (including family members), without seeking your explicit consent, other than in circumstances permitted within Data Protection Law.
Sometimes it is necessary for your personal information to be shared:

• with competent authorities (such as the police, NCA) or Action Fraud for law enforcement purposes (for substantial public interest reasons – Article 9(2)(g) – for preventing or detecting unlawful acts, safeguarding or fraud purposes

• with our professional advisors where it is necessary for the establishment, exercise or defence of legal claims – Article 9(2)(f).

Occasionally the University may, if appropriate, legitimate and necessary, rely on relevant exemptions to UK GDPR provisions as are allowed under the Data Protection Act 2018 (in relation to crime and taxation). 

Transfer of your information outside of the UK

When it is necessary for us to transfer your personal information across national boundaries to a third party data processor, such as one of our service providers, we will ensure this safeguards your personal information by requiring such transfers are made in compliance with all relevant data protection laws.

How long your personal data will be kept

All records, paper or electronic, are destroyed 6 years after you leave the University unless there is a specific reason for them to be held for longer (e.g. you are still in contact with us about an outstanding issue or you have informed use that you are likely to return to study in the near future).

Security

We will ensure that security measures are in place to prevent the accidental loss of, unauthorised use of or access to your data. Access is given to staff on a ‘need to know’ basis. Our staff are required to keep your data safe and complete data protection training.
We have procedures in place to deal with any data security incidents and will notify you and the ICO in the event of a data breach where we are required to do so.
SSW keeps electronic files on a secure, encrypted system, which no member of staff outside SSW can access. Paper documents are scanned into the system and the paper copy is kept in secure filing cabinets. Information may also be stored in secure directories on the University’s central server and in Outlook email folders. Copies of any letter which we have written on your behalf are also stored on our system, together with meeting notes relating to any meeting between you and SSW.

Your rights

Please be aware of the following rights which can be accessed free of charge by contacting dataprotection@kent.ac.uk:
• know how we are using your personal information and why (right to information)
• access the personal data held by us (subject access request)
• ask for correction of any mistakes (rectification)
• to object to direct marketing
• to complain to the ICO.
In some circumstances you also have the right to:
• object to how we are using your information
• ask us to delete information about you (the right to be forgotten)
• have your information transferred electronically
• object to automated decisions which significantly affect you
• restrict us from using your information.
For further guidance regarding your rights please see our Assurance and Data Protection website page on data protection rights or the ICO website.

Your rights- if you have given consent or explicit consent for a specific use of your personal data

You can withdraw your consent at any time.
You can do this by contacting us by emailing kentssw@kent.ac.uk with your request to remove consent
This does not affect the lawfulness of the processing based on consent before its withdrawal.
Your right to complain to the Information Commissioner
You have the right to lodge a complaint with the Information Commissioner's Office.
Their helpline telephone number is: 0303 123 1113.

Contacts

If you have any questions or concerns about the way the University has used your data, or wish to exercise any of your rights, please consult our website.
The University’s Data Protection Officer can be contacted at: dataprotection@kent.ac.uk.

Document review date

This privacy notice will be reviewed at least annually.