The GDPR will make a series of major changes to the rules governing data storage and processing. The Information Commissioner's Office (ICO) will oversee the implementation of these changes as they apply to legal systems in the UK - their GDPR guidance document can be read here, along with further information across their website. The GDPR will be enforced from 25 May 2018.
The University of Stirling's alumni relations and fundraising team (the Directorate for Advancement) will process personal information relating to alumni on the grounds that it is in the 'legitimate interests' of the University to do this and is also beneficial to the individuals concerned (Article 6(1)(f) of GDPR).
This statement applies to external relations data, managed by the Directorate for Advancement, but other departments that may hold your information for different purposes may process data under different grounds.
The data you give us whether online, by email, telephone or post may be made available as appropriate to our academic and administrative departments, recognised University of Stirling alumni clubs and associations. Under the GDPR, the above comments about data processing grounds will be considered when sharing data, to ensure that data subjects' wishes are respected and of course to make sure the data processing is lawful.
This internal data sharing is primarily done to allow University departments to engage with alumni and other contacts who fit a particular set of criteria (e.g. geographic location, graduation year, subject of study). Wherever possible, data shared for such purposes will be anonymised to leave only the information pertinent to the planned activity, with personally identifiable information being removed. Primary responsibility for external engagement data remains with the Directorate for Advancement, whose staff will process communications on behalf of other departments, maintain data security, and process requests for removal from contact lists (or removal from the database itself).
We will not disclose your data to third parties without your consent, except where they are acting as authorised agents for the University for the above purposes or where we are permitted or required to do so by the Act.
We use alumni and stakeholder data to carry out fundraising activities to support the University of Stirling and to improve the efficiency and effectiveness of our fundraising operation. In order to do so, the University may conduct research using publicly available data. This data is used to assess the capacity of a particular individual, or organisation, to donate to the charitable purposes of the institution. The University does not share data with third parties when carrying out this research, nor is any sensitive data involved.
The Directorate for Advancement utilises two applications that store data outwith the EU - Mailchimp and Typeform. The former is used for email marketing, though we are transitioning away from this and onto an EU-hosted emailing system, provided by our CRM database provider (Blackbaud). The database itself is hosted on University servers, on campus in Stirling. Typeform powers our communications preferences survey, found on the alumni pages of the University website.
Both of those are hosted in the USA, and both providers adhere to the EU-US Privacy Shield standard, which has been approved by the European Commission as providing satisfactory protections for data subjects. The Directorate for Advancement continues to monitor developments in this area of data security and law, and will cease to use the above providers if their protections no longer meet the required standards.
We will use the details you have given us to contact you by post, email or telephone about the full range of alumni activities and other relevant University activities or services, including:
You have the right to:
To exercise your rights 1-3 above, you should notify us in writing using the freepost address:
Directorate for Advancement, , University of Stirling, FREEPOST, Stirling, FK9 4LA.
or by email to firstname.lastname@example.org
Further information about point 4 is available here.