Alumni and Development - Privacy Notice

Published January 2020

We are committed to protecting your privacy and keeping you informed of how your information is used.

Edinburgh Napier University is a leading modern university, a community connected with the world around us, brimming with energy, drive, passion and ambition, evidenced through its teaching excellence and world-class research programmes. Our wide network of alumni and supporters are driving economic, social and cultural development in Scotland and around the world.

The University aims to keep in touch with all alumni so that we can continue to keep you up to date on services and support available to you, any university news, events, along with activities about the development and progress made by fellow students and researchers and the evolution of the University. We would also like to stay in touch with non-alumni such as friends, donors and potential donors and be able to maintain and build our relationship with you. Our alumni include former students who attended the University and its antecedent institutions who received a degree, certificate or award, or individuals who completed at least one term, one trimester, or degree-credit course with passing grades. Honorary graduates are also members of our alumni body as are visiting students, such as study abroad students.

Edinburgh Napier University is the Data Controller. Edinburgh Napier University is a charitable body registered in Scotland (Charity Number SC018373) incorporated under the Universities (Scotland) Acts. Edinburgh Napier University Development Trust (charity Number Charity Reg. No. SC030225) exists to support students and research development across the university. Under data protection legislation, we have a legal duty to protect any personal information you provide to us whether online, via phone, email, in letters or any other correspondence. We will ensure the information is used for the purpose for which it is provided and also ensure it is held securely. By developing an understanding of our alumni, friends, existing and potential volunteers and supporters, we use the data you provide to help us develop relevant communications with you, and use our resource efficiently to engage support in order to deliver impact for society.

This privacy policy explains how we use the information we collect about you and the procedures we have in place to safeguard your privacy.

We value our relationship with you and we will use your personal data to ensure we contact you in the most relevant and appropriate way to improve our services and ensure we work effectively and efficiently. We really appreciate you letting us know when your details change. Please remember it is easy to update or check your details and preferences for how you want us to stay in touch with you or if you want to stop receiving communications. Call 0131 455 6382, email alumni@napier.ac.uk or fill in our online form which can be found here.

We regularly review this privacy policy. If we make significant changes they’ll be updated within this policy and published on our website.

1. Why we collect your information:

Your information enables us to improve support to our alumni and supporters, and to engage you in the advancement of Edinburgh Napier University. We will use the details you have given us to contact you by post, email, telephone or social media such as LinkedIn about relevant University activities or services. These may include:

• the sending of alumni publications
• the promotion of benefits and services available to alumni
• notification of and distribution of information about events and reunions
• facilitating the establishment of networking groups
• University fundraising and other supporter engagement programmes
• requests to complete relevant surveys
• careers path information
• volunteering opportunities

Where you have told us your preferences, we will communicate with you using your preferred channel. To help us contact you in the best way possible, please make sure your preferences are up to date. You can do this by telephone 0131 455 6382, email alumni@napier.ac.uk or fill in our online form which can be found here.

Your information is used to help us understand how we can help and better support you and it also helps us identify engagement and/or fundraising programmes which may be of interest to you.

Before seeking or accepting major donations, we conduct due diligence by reviewing publically available data to ensure no gift is related to criminal activity and compliant with the University’s ethics policy for gift acceptance.

We may process personal data, including data from the public domain (such as reputable sources such as Companies House, LinkedIn and company websites) for due diligence purposes, if you are being considered for an award, or speaking at or attending an event. Your data will never be used for any automated decision making such as wealth screening.

2. The lawful basis for processing your information

Depending on the activity your data is used for, we will rely on one of the following conditions for processing: a legitimate interest; a legal obligation; or your consent to process your data, as explained below.

"GDPR Article 6(1)(f ) – Necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject."
For alumni, we will hold data relating to any courses you undertook as a student, including your name, course details, and dates of attendance for the purpose of monitoring our academic services and to better tailor information, news and events to you based on this information
"GDPR Article6 (1)(c) – Processing is necessary for compliance with a legal obligation"
If you make or have made a charitable donation to the Edinburgh Napier University Development Trust, we will process your name, address, and donation information for the purpose of administering your donation and claiming Gift Aid on your behalf.
"GDPR Article 6(1)(a) – Consent of the data subject"
We will only email you about our events and services, or call TPS registered numbers, if we have your express consent to do so. We may send you post, unless you have asked us not to.

For the purposes detailed in this privacy notice, the main lawful basis is legitimate interest. Before using legitimate interest as a basis, we are required to ensure that our interests are balanced with yours. We process your data for the following activities:

Maintaining a record of your relationship with the university. This will help ensure we are providing you with the information relevant to you and that you have told us you are interested in
Sending you communications via post and electronically (where we have your consent)
Tailoring the benefits and services we offer to you and communicating with you about these. For example, careers guidance and support, details of continued professional development that you may wish to consider
To further the University’s educational charitable mission which includes fundraising and the support of volunteers. We run an annual giving programme to help raise support for students who would otherwise struggle to come to university or make the most of the opportunities such as travel to enhance their studies and research
Enable the university to achieve strategic and operational goals
Using publicly available information. This enables us to send you information that is most relevant to you.
Data cleansing (ensuring your contact details are up to date). This helps ensure we have your correct details so we save resources and ensures we don’t waste resource sending post to the wrong address.
To ensure we are providing you with the service and engagement you want. For example, processing survey responses and feedback.

Your personal data is handled securely. Only relevant information is collected on the basis there will be no overriding prejudice to you.

3. Your Information

The Alumni and Development office maintains records of all former students of the University indefinitely. Additionally, we maintain details about you if you are a friend, volunteer, supporter or potential supporter. The data held can include:

Name, title, gender and date of birth
Contact details including postal address, email address, phone number and links to social media accounts
Information about your time at the University and other academic institutions
Your career highlights and life achievements
Your recreations and interests
Family and spouse/partner details and your relationship to other alumni, supporters and friends
Records and donations and Gift Aid status, where applicable (as required by HMRC, IRS and the CRA)
Records of communications sent to you by the Alumni and Development team or received from you
Volunteering activity you undertake at the University
Information about any professional activities or philanthropic giving, for example from other charity websites who mention your support so we gain an understanding of the areas of support you may be more interested to hear about
Media articles about you
Information about your engagement in University meetings, events, groups and networks
Sensitive personal data (e.g. data relating to physical disabilities, accessibility or dietary requirements) which will only be held if it has been provided by you for a specific purpose (e.g. event planning)

4. Information sources

Most information we store is provided directly by alumni, friends, supporters and volunteers. After graduations, new alumni personal and education data is transferred to the Alumni and Development team from the University’s Student Services team. We also record personal information when you interact with the University e.g. event registration, making a donation, professional activities or updating your details. We will ask you from time to time to update your contact details, communication preferences, location, and interests. We may obtain some data from publically available sources. These include:

public sources for companies such as Companies House and company websites
public sources for charities such as the Charity Commission and OSCR
public sources for individuals such as the Queen’s Honours Lists. National change of address services and professional networking sites such as LinkedIn
reputable press platforms
your activity on Edinburgh Napier University social media pages

5. Managing your information

It is easy to update or check your details and preferences for how you want us to stay in touch with you or if you want to stop receiving communications. Call 0131 455 6382, email alumni@napier.ac.uk or fill in our online form at https://www.napier.ac.uk/alumni/communications-preferences

Data protection laws give you a number of rights as set out below, but please note that these are dependent on our legal basis for processing. If you would like to exercise any of your rights, please contact us using the details located above.

Access your personal information: you may request access to a copy of your personal information. All requests for access to personal information should be made to us in writing.
Withdraw consent: if you have given us consent to use your personal information to send you communications, you can withdraw your consent at any time. Every email communication will contain an ‘unsubscribe’ link and an opportunity to adjust your preferences.
Rectification: you may ask us to rectify and update any inaccurate information we hold about you or to complete any information that is incomplete
Erasure: you may ask us to delete your personal information. See below for more details
Portability: you may ask us to provide you with the personal information that we hold about you in a structured, commonly used, machine-readable format, or ask for us to send such personal information to another data controller.
Restriction: you can ask us to restrict the personal information we use about you where you have asked for it to be erased or where you have objected to our use of it.
Object: you may object to our processing of your personal information in accordance with this Notice. Please contact us, providing details of your objection.

Where you exercise your right to erasure, we will continue to maintain a core set of data (name, subjects, matriculation and graduation details, unique university identification number and date of birth) to ensure we do not contact you inadvertently in future. If you are not a member of the alumni community, your personal data will be deleted, except for minimal identification details to prevent you inadvertently being added again to the Alumni and Development Office records. If you do not respond to a series of communication attempts or if you tell us that you have no wish to learn more about the University, we will delete your record, again retaining minimal details so that we do not inadvertently add your detail to the database again in the future. We may need to retain some financial details of donations to comply with statutory reporting requirements and processing e.g. HMRC, anti-fraud and Gift Aid.

For more information please see: www.staff.napier.ac.uk/accessyourinfo

We take our responsibilities under data protection legislation very seriously and would urge you to contact us at dataprotection@napier.ac.uk in the first instance if you would like to make a complaint about the way the University has processed your personal data. Alternatively, you may make a complaint to the UK supervisory authority, which is the Information Commissioner's Office, by visiting their website at www.ico.org.uk/concerns, by phoning 0303 123 1113 (local rate) / 01625 545 745 (national rate), or by writing to the:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

6. Data Analysis

The University has a longstanding history of philanthropic support to assist research and teaching excellence. As a fundraising institution, we may collect and record information about you that helps us understand more about you as an individual and your ability to support the University’s advancement financially and or non-financially so that we can contact you with relevant information.

We may collect and record information from publically available sources such as those listed above in Information Sources section, such as career history, directorships and interests. This information helps us to gain a picture of what might interest you about the University and your capacity to support so that any proposal put to you regarding volunteering your time or supporting financially is more likely to be tailored to align to your situation and your preferences. It also ensures that individuals are not needlessly approached for any philanthropic gifts or considered for any other opportunities within the university that would be irrelevant. This is known as prospect research.

Throughout your life, it is likely that you will change jobs or move house which you may not tell us about. We can combine the information you provide with information from external publically available sources like the ones listed above in the Information Sources section so that we can re-connect with you. This is known as data-appending.

Through third parties like the Post Office National Change of Address database and using a contractually bound service provider, we are able to check contact details are correct and relevant.

7. When and how we share data

Your data may be shared with the following groups in order to communicate with you about news and activities:

our academic and administrative departments
recognised Edinburgh Napier University alumni clubs and associations (including those overseas)
external agents contracted by the University such as mailing houses and software providers

The University will never sell your data or share your data with someone for their own purposes. We will not disclose your data without your consent to third parties, except where they are acting as authorised agents for the University or where we are permitted or required to do so by GDPR.

Third parties are contracted to act on behalf of the university to deliver marketing, fundraising and systems software support. Limited information is shared only for the fulfilment of the contracted activity e.g. Alumni magazine mailing, where the contractor destroys the data they hold after fulfilment is complete.

For the Graduate Outcomes Survey, we are required, like all other universities to submit contact details of students for a survey of recent graduates to Higher Education Statistics Agency (HESA) in order to construct a survey of graduate completer destinations. If you opt-out of Alumni and Development communications we are still required to include your details in the information we send to HESA. HESA will then contact you to give you the option to opt-out of their communications.

When hosting an event, we may work with an external organisation to deliver it. For example, we might provide delegate names and University education details to a hotel or conference centre where the event is being held. No personal details will be shared.

8. Communicating with you

We will communicate with you whichever way you prefer. We will ask you for your preference and we will record this when you let us know. We will contact you by mail, email, telephone or social media according to your preference. If you have given us permission to contact you by phone, this will override any registration you may have made with the Telephone Preference Service (TPS).

If you want to change how we communicate with you, it is very easy to do this and we welcome hearing from you whenever you wish to update your details. If you want to stop hearing from us that is perfectly fine too. Call 0131 455 6382, email alumni@napier.ac.uk or fill in our online form at https://www.napier.ac.uk/alumni/communications-preferences

9. How long is your information kept?

Edinburgh Napier University considers its relationships with its alumni, supporters and stakeholders to be life-long.

If you do not wish us to stay in touch or continue to support the University, please let us know. Details and links to do this are on all our communications so that you can update your preferences at any time.

We need to comply with other regulations governing our records retention policy and we retain information according to the university’s Records Retention Schedules. For example, financial gift information is stored for 7 years in line with HMRC requirements.

If you provide dietary or accessibility information when you attend an event then this information will be deleted from our system after the event.

We will keep your information only for as long as we need it to provide you with the goods, services, or information you have required, to administer your relationship with us, to comply with the law, or to ensure we do not communicate with you after you have asked us not to. When we no longer need information we will always dispose of it securely.

10. How secure is your information?

All Edinburgh Napier University staff who have access to your information have received thorough data protection training. Access is restricted to those staff or authorised agents who require it and on a ‘need to know’ basis. We only use third party systems to store and process your data who are risk assessed to ensure your data is secure.

We only work with partners who abide to the University’s privacy policy and who are under contract to deliver defined activity on behalf of the University.

We are signatories of the Scottish Fundraising Panel Fundraising Guarantee. We also abide by our Supporter Promise.

For services provided locally by the University's Information Services department, information is stored on servers located in secure University datacentres. These datacentres are resilient and feature access controls, environmental monitoring, backup power supplies and redundant hardware. Information on these servers is backed up regularly. The University has various data protection and information security policies and procedures to ensure that appropriate organisational and technical measures are in place to protect the privacy or your personal data. The University makes use of a number of third-party, including “cloud”, services for information storage and processing. Through procurement and contract management procedures the University ensures that these services have appropriate organisational and technical measures to comply with data protection legislation. The University is Cyber Essentials Plus accredited.

11. Further information about the software we use to process your data

Databases

The University’s alumni and donor database, Raiser’s Edge, is hosted in The Netherlands by Blackbaud Inc, a global non-profit software provider, operating under EU laws and with a formal agreement with the University. The University takes its obligations with your data very seriously and will ensure that all appropriate safeguards and security provisions are in place, and Blackbaud’s compliance with its agreements and privacy notice are monitored.

Your details may be transferred to third party providers and held there e.g. during telephone campaigns, or when we contact you by email. We only use third party systems to store and process your data for which we have completed a risk assessment exercise to ensure your data is secure.

Data Lists

We use the National Change of Address services to identify contact details that are no longer correct. We may use third parties to carry out list checking on our behalf. We only use third parties for which we have completed a risk assessment exercise to ensure your data is secure.

Event Registration

Please note that by registering for an event via a service such as Eventbrite (which will host your data out with the EEA) or Bookitbee (which will host your data in the EEA) you will be supplying your personal data to the company/website and as such you are accepting and consenting to the practices in their Privacy Policies.

Edinburgh Napier University is not affiliated with Eventbrite or Bookitbee in any way and is using their services solely for the purposes of facilitating event ticketing and registration and does not accept any responsibility or liability for personal data which you have chosen to provide to such third party sites.

Online Giving

When donating online you will be directed to Edinburgh Napier University’s dedicated secure payment site hosted externally by Blackbaud Inc for credit or debit card donations or SmartDebit Services for direct debits. The personal information you provide and the amount of your donation will be reported to the University’s External Relations and Development department and held securely. We will use this information to administer your donation, compile anonymous statistics, and respond to Freedom of Information requests.

12. Who keeps your information updated?

You have the right to update your own information at any time by logging into the alumni portal, emailing alumni@napier.ac.uk, or writing to Development and External Relations, Edinburgh Napier University, Sighthill Campus, Sighthill Court, Edinburgh, EH11 4BN.
Development and External Relations staff also update your data.

12. Further Information

You can find out who to contact if you have any further queries about Data Protection and about your rights using the following link: http://www.napier.ac.uk/privacy-policy

Contact details

Alumni and Development Office

Edinburgh Napier University

Sighthill Campus

Sighthill Court

Edinburgh EH11 4BN

Tel. +44 (0)131 455 6382

Email: alumni@napier.ac.uk