OpportunityHub privacy notice

This page sets out how The Open University collects and uses the personal data of anyone who has enrolled and registered to study with the Open University, including undergraduates, postgraduates and research students, as well as qualifiers who have completed a module or a qualification within the last three years.

This page will be updated from time to time in order to ensure compliance with data protection legislation.

Policy

1.Who we are

The Open University is the data controller in relation to the processing activities described below.

Where this policy refers to “we”, “our” or “us” below, unless it mentions otherwise, it is referring to The Open University, and organisations in the Open University Group.

If you have any questions about our use of your personal information, or wish to exercise your rights, please contact the Information Rights Team:

• Email: data-protection@open.ac.uk
• Telephone: +44(0)1908 653994
• By post: The Data Protection Officer, PO Box 497, The Open University, Walton Hall, Milton Keynes MK7 6AT.

2.What information do we collect about you and how do we collect it?

The Open University’s central systems inform the data that is stored in OpportunityHub. We hold general information about you and this includes:

• Your name, address and contact details, including email address and telephone numbers.
• The services you have engaged with in OpportunityHub
• Modules and qualifications studied and module outcomes.

Where necessary, we will collect more sensitive information about you, called “special category” personal data, including:

• information about your race or ethnicity, disability, physical or mental health and socio-demographic status (if you provide these) for the purposes of equality monitoring and fulfilling our duties under the Equality Act.

3.Our lawful basis for using your personal data

Processing your personal information is necessary for us to personalise your experience and provide the right support to effectively meet your needs, or because it is in our legitimate interest.

The lawful basis for processing special category equality monitoring data you provide is that equality monitoring is in our legitimate interest, and the condition for processing is that it’s necessary for reasons of substantial public interest, specifically monitoring equality of opportunity or treatment.

Our lawful basis for processing special category data you provide about reasonable adjustments under the Equality Act 2010 is that it is necessary to comply with our Public Task.

4. How do we use your personal data?

The provision of Careers and Employability support services is in the public interest, and it is for this reason that we use your data:

We will use the contact details you give us to send you relevant and appropriate careers-related events, opportunities and information.

We will use ‘special category’ data (racial or ethnic origin, disability and physical or mental health and socio-demographic) to ensure we can personalise your experience and provide the right support to effectively meet your needs.

We will use personal data (including engagement data) and your education information to analyse and assess how best to improve and tailor our services to your needs and support your success in achieving your goals.

5. Who do we share your information with?

5.1 We share data with another organisation for specific purposes

Where necessary, we will also share information when required to by law or in the public interest, with, for example, the police or HM Revenue and Customs, or to exercise or defend our legal rights.

5.2 Third party suppliers and service providers

We use a third party to supply the OpportunityHub service for our students.

It is in our legitimate interest to use third party suppliers to maintain cost effective and efficient operations, and it is necessary for our contract with you, to share data with this third-party supplier.

When we use third party service providers, we only disclose to them any personal information that is necessary for them to provide their service. We have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.

5.3 Other ways we may share your personal information

We may transfer your personal information to a successor organisation if The Open University ceases to exist. We may also disclose your personal information in order to report a crime, to comply with legal obligations or to enforce or apply the terms of our contracts or to protect the rights, property or safety of our staff, students and visitors.

6. Do we transfer information outside the European Economic Area (EEA)?

Generally, information you provide to us is stored on our secure servers, or on our cloud-based systems which are located within the EEA.

However, there are times when we do need to store information outside the EEA. If we transfer your information outside the EEA, we will take steps to ensure that appropriate security measures are taken to protect your privacy rights as outlined in this policy. We generally impose contractual obligations on the recipient of your personal information, i.e. EU international standard contractual clauses with the UK addendum. We may ensure that the recipients are subscribed to international frameworks that ensure adequate protection, e.g. the US data privacy framework. Occasionally we may ask for your consent to share data outside the EEA.

7. How long do we keep your personal information for?

We keep your personal information in OpportunityHub for the time you are eligible to continue using the service. Our retention schedule states that after three years from the end of your undergraduate and/or postgraduate studies, your student details will be removed from OpportunityHub.

Anonymous aggregated demographic data about Opportunity Hub users may be retained for a longer period for reporting purposes.

8. Your rights

You have a number of rights in relation to your personal information, which apply in certain circumstances. In order to exercise any of these rights, please contact us using the details below.

You have the right to:

• access the personal information that we hold about you
• correct inaccuraciesin the personal information that we hold about you.

In certain circumstances, you have the right to:

• have your data deleted when it is no longer required
• limit how we use your personal information
• obtain a copy of your personal data in a structured electronic data file (data portability)
• object to the use of your personal data

You also have rights relating to automated decision making, where in certain circumstances you have the right to not be subject to automated decision making and can request human intervention.

If you are concerned about the way we have processed your personal information, you can complain to the Information Commissioner’s Office (ICO). Please visit the ICO’s website for further details, or you can use their online tool for reporting concerns.

For more information, see also our Privacy and Cookies page.

9. Automated decision-making

Automated decision-making means making decisions about you using no human involvement e.g. using automated models or calculations to identify and provide tailored services.

10. Contact details

If you have any questions about our use of your personal information, or wish to exercise your rights, please contact the Information Rights Team:

• Email: data-protection@open.ac.uk
• Telephone: +44(0)1908 653994
• By post: The Data Protection Officer, PO Box 497, The Open University, Walton Hall, Milton Keynes MK7 6AT

This page will be updated from time to time in order to ensure compliance with data protection legislation.

Glossary

Personal data

According to the General Data Protection Regulation, ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data Controller

A data controller determines the purposes for which and the manner in which any personal data are processed. In essence, this means that the data controller decides how and why personal data are processed.

Special categories of data

The General Data Protection Regulation sets out “special categories” of data which have to be given additional protection. These comprise your racial or ethnic origin, religious beliefs, political opinions, trade union membership, genetics, biometrics (where used for ID purposes) physical or mental health, sex life and sexual orientation. Information about criminal offences or criminal proceedings are treated similarly.

Cookies

A cookie is a small amount of data, which often includes a unique identifier that is sent to your computer or mobile phone browser from a website’s computer and is stored on your computers or mobile phone’s hard drive. Each website can send its own cookie to your browser if your browser’s preferences allow it, which the site can then access when you visit it again to track online traffic flows, for example. A website cannot access cookies sent by other websites.

The Open University Group

For the purposes of this document, this refers to Open University Worldwide (OUW), Open University Student Budget Accounts (OUSBA) but not The Open College of the Arts (OCA).