Privacy Notices
University of Stirling Privacy Notices
The University of Stirling (a university established in Scotland and registered as a charity with registration number SCO11159) of Stirling FK9 4LA, is a data controller in terms of the UK General Data Protection Regulation (UK GDPR). All of your personal data will be treated strictly in accordance with the terms of the UK GDPR. This means that confidentiality will be respected and that appropriate security measures will be taken to prevent unauthorised disclosure.
This privacy notice together with our (i) Data Protection Policy, (ii) Guidance Handbook, and (iii) any additional documents referred to within, sets out how and the extent to which the University shall process your personal data. Please read these documents carefully to fully understand our views and practices regarding your personal data and how we will treat it. If you have any questions in relation to the University’s processing of your personal data, please contact our Data Protection Officer.
For information about how and why we process your personal information please select the section relevant to you:
- Privacy notice for students
- Privacy notice for applicants to study
- Privacy notice for staff
- Privacy notice for applicants for employment
- Privacy notice for users of the University's website
- Privacy notice for enquirers
- Privacy notice for alumni and supporters
- Privacy notice for research participants
- Privacy notice for research impact evidence collection
- Privacy notice for University of Stirling Sport users
Your rights
You have a number of rights in relation to the way we handle your personal information.
You also have the right to see any of the personal information about you held by the University, you can request this by making a subject access request.
The University strives to ensure that all personal data remain current and accurate. If you become aware of any incorrect information held by the University, you have the right to request that this is rectified. This should be done via the contact details in the relevant section above.
You may also have a number of other rights depending on the legal basis being used to process your personal data. Details of the legal basis being used are included in the relevant sections below. The rights available may include:
- Right to Object – you may have the right to object to specific types of processing and you can always object to processing for direct marketing.
- Right to be forgotten (erasure) – you may have the right to have your data erased in certain situations such as where the data are no longer required for the purpose for which the data was collected, you withdraw your consent, or the information is being processed unlawfully. You can ask the University to ‘restrict’ processing of the data whilst complaints (for example, about accuracy) are resolved or the processing is unlawful.
- Rights in relation to automated decision making and profiling – The right relates to automated decisions or profiling that could result in significant affects to you. Profiling is the processing of data to evaluate, analyse or predict behaviour or any feature of behaviour, preferences or identity.
- Right to Portability – in some circumstances you may be able to request certain information about you is provided in electronic format so it can be sent to another data controller.
The availability of rights largely depends on the legal justification for processing (which are detailed in the relevant drop-down sections below). The table below summarises when rights are available.
|
Legal Justification |
Right to Object |
Right to Be Forgotten (Erasure) |
Right to not be subjected to Automated Decision Making |
Right to Portability |
|
Consent |
X but can withdraw consent |
✔ |
X but can withdraw consent |
✔ |
|
Contract |
X |
✔ |
X |
✔ |
|
Legal Obligation |
X |
X |
X |
X |
|
Vital Interest |
X |
✔ |
X |
X |
|
Public task |
✔ |
X |
✔ |
X |
|
Legitimate Interests |
✔ |
✔ |
✔ |
X |
Requests relating to any of these rights should be sent to the Data Protection Officer.
Contact details and further information
For further information on Data Protection please see the Data Protection Policy and Guidance Handbook.
If you have any issues about this statement or the way the University has handled your personal data, please contact the University Data Protection Officer in the first instance. If you are dissatisfied with the response from the University, you have the right to lodge a complaint with the Information Commissioner’s Office.
For further information please contact the University’s Data Protection Officer:
Joanna Morrow
Data Protection Officer
University of Stirling, Stirling, FK9 4LA
Changes to our Privacy Notices
We may amend our privacy notices from time to time. If we make any substantial changes in the way we use your personal information we will notify you directly where possible or by posting a prominent notice on our website. However, you should review these privacy notices on a regular basis to check for any changes made.
The Privacy Notice for Research Participants should be read in conjunction with the University’s overall Privacy Notice and the Participant Information Sheet/Consent Form (PIS) which you will have been provided with by the researchers involved in the project you are participating in. If you have not been provided with a PIS or have mislaid it, please get in touch with your contact at the University to request a copy.
This section of the Privacy Notice applies to individuals who have agreed to take part in a research project involving researchers at the University of Stirling.
Sources of Data
The way the University obtains your personal data will be different for each research project. Some common methods of obtaining personal data include activities such as interviews, questionnaires, surveys, focus groups or monitoring. The circumstances for your research project will be explained in your PIS.
What Personal Data we process about you
Details of your personal data processed as part of the research project will be explained in your PIS.
Purpose of Processing
The University will use your personal data to help achieve the objectives of the research project you are participating in. Further information about the project background, how your personal data will be used and the benefits of the research are included in your PIS.
Lawful Basis for Processing Your Personal Data
Unless stated otherwise in your PIS, the lawful basis the University uses to process your personal data will be public interest/the official authority of the University (Article 6(1)(e) of UK GDPR). The University’s Charter and Statutes give the University official authority to carry out certain functions including undertaking research.
If the research project includes the processing of special category data such as health data, racial or ethnic origin, data concerning your sex life or sexual orientation etc. the lawful basis for processing this special category data will be that it is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (Article 9(2)(j) of UK GDPR). If an alternative lawful basis under Article 9 is used, this will be specified in your PIS.
Sharing your personal data with other bodies
Research is often carried out in collaboration with other external organisations such as other Universities and research organisations. Where this is the case the details of the other organisations involved in the research project will be specified in your PIS.
The University will sometimes have to use third party organisations to help with the processing of your data. For instance, this could be an external transcriber or the provider of specialist software. Where a third-party processor is used this will be specified in your PIS. The University will always have an appropriate contract in place with organisations processing your personal data which ensures that they are processing your data securely and in accordance with data protection laws.
Retention of your personal data
The length of time your personal data is held will vary depending on the research project and may be influenced by the requirements of the research funder. Details will be specified in your PIS.
Contact information for research participants
If you have any further questions about how your personal data will be processed as part of the research project, please get in touch with the research project contact you have been given, details should be in your PIS. If this is not possible queries can be addressed to researchdatamanagement@stir.ac.uk.