This Notice explains how we will collect and use your personal data.
We are the Data Controller for the personal data that we process about you.
Throughout this Notice, “University”, “we”, “our” and “us” refers to the University of Leeds. “You” and “your” refers to those data subjects using Sustainability Services.
Change in the law
Until 24 May 2018, we shall process your personal data in accordance with the Data Protection Act 1998 (DPA for short). From 25 May 2018, we shall process your personal data in accordance with the General Data Protection Regulations, as incorporated into UK law (GDPR for short).
This Notice complies with the requirements under the DPA and the GDPR.
Where we get your personal data from
You will be asked to provide personal data when you subscribe to newsletters, sign up to be involved in one of our programmes, hire a bike, register for events organised by Sustainability Services or contact the Neighbourhood Helpline. When you are required to provide personal data the uses of this data will be explained at the point of collection.
From the University’s SAP (staff) and BANNER (student) CRM systems
In order to allow staff and students to use our services including Bike Hub and ServiceNow, the personal data of members will be retrieved from the University’s CRM systems. The data is used to verify your status as a member of staff/student and is held securely on the Sustainability Services’s database.
Student data is also obtained to process complaints in line with the Neighbourhood Helpline Code. The identity of any students involved with a complaint are required in order for the universities and colleges to resolve neighbourhood issues, build better relationships between neighbours and maintain good relations with the local community. The University’s Data Protection Officer has authorised the Sustainability Service to access and process student information for this purpose.
We collect information about students registered as living at an address involved with a complaint reported to the Helpline. This includes student’s names and email addresses only. We will only use this information to respond to a complaint and to determine the level of service we provide and action to take.
We will keep personal information contained in complaint files in line with the University’s retention policy. This means that information relating to students, complaints and the University’s action in response to those complaints will be retained for six years from closure of a complaint. It will be retained in a secure environment and access to it will be restricted to authorised operatives of the Helpline and the Head of Student Cases in the event of disciplinary action.
Student’s personal details will not be shared with any third parties including the complainant unless we are instructed to do so by those students.
We compile and publish an Annual Report showing information including the number of complaints and types of complaint we receive, but not in a form which identifies anyone.
In order to notify you of news and information about car sharing, we retrieve data from external sources deemed to have a legitimate interest in our activities. External sources include Liftshare. This data includes names, email addresses, origin and destination addresses.
Automated collection of personal data
As with most other web servers, when you access Sustainability Services web pages certain information you provide will automatically be recorded by the University. This will include your IP address, browser type, and information relating to the page you last visited. This information is processed to estimate how much usage of the server is made by different categories of users and, in the event of a breach of security, may be used to aid detection.
Find out more about the cookies we use and why:
|Cookie||Information and options|
|Google Universal Analytics cookies|
These cookies are used to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited.
The information stored in the first-party Universal Analytics cookie is simply a randomly generated identifier, for example 12345.67890.
Universal Analytics opt-opt browser add-on: https://tools.google.com/dlpage/gaoptout
|NSC*||NetScaler Appliance session cookie|
These cookies are set by our Citrix NetScaler appliance and are used to ensure your browsing session remains on the same web server. It is deleted when you close your browser.
|PHPSESSID||PHP session cookie|
This cookie stores a unique ID assigned by the web server. It is used to enable some site functionality to work properly. It is deleted when you close your browser.
The purposes for which we process your personal data and the legal basis for that processing
The processing of your personal data is necessary for the performance of the contract that you have entered into with the University to access Sustainability Services provisions.
If you do not want your personal data to be used in the manner described, then you will need to terminate your contract with Sustainability Services.
You may be invited to subscribe to newsletters or other activities with Sustainability Services. When you are required to provide personal data the uses of this data will be explained at the point of collection. Where personal data is requested for marketing purposes you will be given the opportunity to opt-out.
Who might we share your data with?
The information that you provide to the University will be stored securely and access will be restricted to those members of staff who need it. The University will not share your personal data with third parties other than those listed below.
Where credit/debit card details have been requested as part of a transaction between you and us, the details will be encrypted and handled by a secure web server using SSL, the standard security technology for establishing an encrypted link between a web server and a browser.
Sustainability Services use an agency, Creative Concern, in order to update our website. Creative Concern is given access to/holds the email address which you supply.
Sustainability Services use an agency, Digitronix, in order to produce our Annual Sustainability Report. Digitronix is given access to staff and student names, telephone numbers, email addresses where relevant to the purpose of the report.
Sustainability Services use Mailchimp, in order to send out newsletters.
Sustainability Services, use Warp-It to maintain and manage the Reuse@Leeds website.
We will hold your personal information on our systems according to the University retention schedules.
Your rights as a data subject
You have the right to:
- access your personal data;
- request the rectification or deletion of your personal data;
- request the restriction of the processing of your personal data;
- object to the processing of your personal data;
- receive your personal data in a structured, commonly used format and to;
- complain to the regulator (the Information Commissioner’s Office).
Concerns and contact details
If you have any concerns with regard to the way your personal data is being processed or have a query with regard to this Notice please contact, in the first instance, the Sustainability Services team at email@example.com or the University’s Data Protection Officer, David Wardle at firstname.lastname@example.org.
Our general postal address is University of Leeds, Leeds LS2 9JT, UK.
Our postal address for data protection issues is University of Leeds, Room 11.72 EC Stoner Building, Leeds, LS2 9JT.
Our telephone number is +44 (0)113 2431751.
Our data controller registration number provided by the Information Commissioner’s Office is Z553814X.