Data Subject Rights Requests Privacy Notice
Your Personal Data
The University of Glasgow will be what’s known as the ‘Data Controller’ of your personal data processed in relation to the exercise of your rights under Data Protection law. This privacy notice will explain how the University of Glasgow will process your personal data.
Why we need it
We are collecting your basic personal data such as your name, contact details (email address), date of birth, staff/student ID number, a copy of photographic ID and, where relevant, limited special categories data (such as about your disability to facilitate an accessible response) to verify your identity and process your rights request. We will only collect the information we need to take your request forward. Thereafter, we may process further personal and special category data that the University holds about you whilst administering your rights request.
Legal basis for processing your data
We must have a legal basis for processing all personal data. In this instance, the legal bases are:
Legal obligation for any personal data you provide as the University has a legal obligation to respond to data subject rights requests.
For Subject Access Requests where the University uses a third-party processor (Nalytics), the processing is necessary for the purposes of legitimate interests.
For any special category data you provide for accessibility reasons, the legal basis is that is necessary for reasons of substantial public interest to meet legislative requirements placed upon the University.
For all other special category data you may volunteer as part of your request, we will take this as an active demonstration of you providing your explicit consent for the University to process this data.
What we do with it and who we share it with
All the personal data you submit is processed by staff at the University of Glasgow in the United Kingdom*.
The University’s Data Protection & Freedom of Information (DP&FOI) Office may be required to contact other Offices of the University and individual members of staff, where relevant, to facilitate your request.
*For Subject Access Requests only, the University uses a third-party UK-based software (Nalytics) in order to process requests in an accurate and timely manner.
For information on how the University processes Right of Access requests, please visit the DP&FOI Office’s website.
How long do we keep it for
Your rights request data (i.e. your details and the information you provided to us when you made the request) and all information collated for the request response (including email correspondence with and returns from University departments assisting with the request) will be retained by the University on secure servers for 4 years. After this time, all information other than your name and request reference number will be securely destroyed.
As we require a copy of your photographic ID to verify your identity and validate the request, this will be destroyed following closure of the request.
Subject Access Requests (SARs) processed on Nalytics
For SARs only, the University will hold your rights request data (i.e. your details and the information you provided to us when you made the request), and the data produced and collated to respond to your request, on a third-party system called Nalytics.
Your rights request data (i.e. your details and the information you provided to us when you made the request) will be held on Nalytics for a period of no longer than 60 days. The data produced and collated to respond to your SAR will be processed on Nalytics servers (hosted in the UK) whilst your request is live and for an additional 30 days after the closure of your request.
In addition to the above, your rights request data (i.e. your details and the information you provided to us when you made the request) and all information collated for the request response, as detailed above, will be retained by the University on secure servers for 4 years. After this time, a skeleton record (consisting of your name and request reference number) will be retained indefinitely by the University and on the third-party system. All other information will be securely destroyed.
Appeals, complaints and investigations
All appeals, complaints, or investigations relating to data subject rights requests (and the original request case file) will be retained for 7 years.
What are your rights?*
You can request access to the information we process about you at any time. If at any point you believe that the information we process relating to you is incorrect, you can request to see this information and may in some instances request to have it restricted, corrected or erased. You may also have the right to object to the processing of data and the right to data portability. Where we have relied upon your consent to process your data, you also have the right to withdraw your consent at any time.
If you wish to exercise any of these rights, please contact the DP&FOI Office.
*Please note that the ability to exercise these rights will vary and depend on the legal basis on which the processing is being carried out.
Complaints
If you wish to raise a complaint on how we have handled your personal data, please contact the DP&FOI Office in the first instance.
If you are not satisfied with the complaint outcome or believe we are not processing your personal data in accordance with the law, you can complain to the Information Commissioner’s Office (ICO).