Directorate for Advancement Data Protection Statement
The Directorate for Advancement is primarily responsible for alumni relations and fundraising at the University of Stirling. The directorate complies with the terms of the University’s Data Protection Policy and Guidance. That policy applies to data held across the University for any purpose. This page is intended to clarify storage, processing and usage of data by the Directorate for Advancement.
Selected personal information that you provide to the University will be held securely by the Directorate for Advancement for the purposes of alumni relations and fundraising. This data will be used strictly in accordance with the Data Protection Act 1998 (the Act).
The Directorate for Advancement does not store any information that would be defined as ‘sensitive personal data’ under the Act. These 8 categories of data are listed on page 3, paragraph 11 of the University’s Data Protection Statement. This type of data may be stored in the student enrolment database (under terms described in paragraphs 12-15), but it is not used in alumni relations and fundraising work, and it is not accessible to Directorate for Advancement staff. The exception to this is cases where you provide us with such data for a specific purpose and allow us to store that information. For example, information about a disability may be disclosed for the purposes of ensuring that access requirements are met when attending an event, with permission given to record those requirements for subsequent events.
Our response to the General Data Protection Regulation 2018 (GDPR)
The GDPR will make a series of major changes to the rules governing data storage and processing. The Information Commissioner's Office (ICO) will oversee the implementation of these changes as they apply to legal systems in the UK - their GDPR guidance document can be read here, along with further information across their website. The GDPR will be enforced from 25 May 2018.
The University of Stirling's alumni relations and fundraising team (the Directorate for Advancement) will process personal information relating to alumni on the grounds that it is in the 'legitimate interests' of the University to do this and is also beneficial to the individuals concerned (Article 6(1)(f) of GDPR).
This statement applies to external relations data, managed by the Directorate for Advancement, but other departments that may hold your information for different purposes may process data under different grounds.
Use of data by other University departments
The data you give us whether online, by email, telephone or post may be made available as appropriate to our academic and administrative departments, recognised University of Stirling alumni clubs and associations. Under the GDPR, the above comments about data processing grounds will be considered when sharing data, to ensure that data subjects' wishes are respected and of course to make sure the data processing is lawful.
This internal data sharing is primarily done to allow University departments to engage with alumni and other contacts who fit a particular set of criteria (e.g. geographic location, graduation year, subject of study). Wherever possible, data shared for such purposes will be anonymised to leave only the information pertinent to the planned activity, with personally identifiable information being removed. Primary responsibility for external engagement data remains with the Directorate for Advancement, whose staff will process communications on behalf of other departments, maintain data security, and process requests for removal from contact lists (or removal from the database itself).
Sharing your data
We will not disclose your data to third parties without your consent, except where they are acting as authorised agents for the University for the above purposes or where we are permitted or required to do so by the Act.
We use alumni and stakeholder data to carry out fundraising activities to support the University of Stirling and to improve the efficiency and effectiveness of our fundraising operation. In order to do so, the University may appoint a Wealth Screening agency as a Data Processor in line with the Act. Data may be supplied to the agency who may append information concerning publicly verifiable wealth, and return to the University. The agency does not hold any data from the charity and the only data that it retains is a record of results with no disclosure of data to the agency. The University does not buy names from a third party, nor is any sensitive data involved.
Data storage outside the EU
The Directorate for Advancement utilises two applications that store data outwith the EU - Mailchimp and Typeform. The former is used for email marketing, though we are transitioning away from this and onto an EU-hosted emaling system, provided by our CRM database provider (Blackbaud). The database itself is hosted on University servers, on campus in Stirling. Typeform powers our communications preferences survey, found on the alumni pages of the University website.
Both of those are hosted in the USA, and both providers adhere to the EU-US Privacy Shield standard, which has been approved by the European Commission as providing satisfactory protections for data subjects. The Directorate for Advancement continues to monitor developments in this area of data security and law, and will cease to use the above providers if their protections no longer meet the required standards.
How and why we may contact you
We will use the details you have given us to contact you by post, email or telephone about the full range of alumni activities and other relevant University activities or services, including:
Your rights under the Act
You have the right to:
To exercise your rights 1-3 above, you should notify us in writing using the freepost address:
Directorate for Advancement, , University of Stirling, FREEPOST, Stirling, FK9 4LA.
or by email to firstname.lastname@example.org
Further information about point 4 is available here.