Maryvale Institute - Privacy Statement
Version 3, January 2021
1.1 Maryvale Institute is part of the Archdiocese of Birmingham (the "Diocese") which is a charity registered with the Charity Commission in England and Wales with charity number 234216 of Cathedral House St Chad's Queensway Birmingham B4 6EX. In this Notice, references to 'we', 'our', 'us' and 'Maryvale' mean Maryvale Institute as part of the Diocese, and 'you' and 'your' mean any person to whom we provide our services, including: potential students, students, alumni, volunteers, those attending special lectures or conferences, staff and associate staff.
1.2 This privacy notice describes how we collect and use personal information in accordance with the UK General Data Protection Regulation (GDPR), and should be read alongside the Birmingham Archdiocese's general privacy policy available at https://www.birminghamdiocese.org.uk/privacy-policy. Terminology which is defined in the Diocesan general privacy policy is also used in the same way in this notice.
1.3 When you provide us with Personal Data in order to engage with us and/or benefit from our support, we will keep a record of the data you give in order to enable us to comply with our statutory obligations and to achieve our objectives of providing opportunities for lay people, clergy and religious to achieve a deeper understanding of the faith and to appreciate and communicate more clearly its joyful message for the lives of individuals and communities.
1.4 For the purpose of the GDPR, the Archdiocese through its Trustees will be a Data Controller in respect of your Personal Data. In some cases, the Archdiocese may be a joint Data Controller of your Personal Data (e.g. where your data is shared between the Archdiocese and another organisation for a particular purpose, such as validating bodies).
1.5 Where validating bodies and the Diocese are both data controllers, the validating bodies shall be liable for their processing of Personal Data and we shall only be liable for our processing of Personal Data.
1.6 Everyone has rights with regard to how their Personal Data is handled by organisations. Maryvale is committed to ensuring that Personal Data is properly and securely managed in accordance with the relevant data protection laws, and believes this is an important part of achieving trust and confidence with data subjects.
1.7 Maryvale as part of the Diocese is responsible for deciding how we hold and use Personal Data about individuals connected with Maryvale including potential students, students, alumni volunteers, those attending special lectures or conferences, staff and associate staff.
2.1 Data Controller - the entity that determines the purposes, conditions and means of the processing of personal data, i.e. the Archdiocese of Birmingham.
2.2 Data Officer - the individual appointed within the Institute responsible for overseeing the data protection strategy and implementation to ensure compliance with GDPR requirements, i.e. the Institute Academic Registrar. Responsibilities include:
2.2.1 Informing and advising staff on data protection obligations and monitoring compliance;
2.2.2 Advising with the regard to data protection Impact Assessments;
2.2.3 Act as the point of contact for Data Subjects;
2.2.4 Liaise with Data Compliance Managers in the Archdiocese of Birmingham, as necessary.
2.3 Data Subject - a natural person whose personal data is processed by a controller or officer, i.e. students, staff and associates.
2.4 Data Compliance Managers - the individuals appointed within the Diocese responsible for overseeing the data protection strategy and implementation to ensure compliance with GDPR requirements, currently the Diocesan Solicitor and the Diocesan Head of Finance.
3.1 We will comply with data protection law. This says that the personal information we hold about you must be:
3.1.1 used lawfully, fairly and in a transparent way;
3.1.2 collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
3.1.3 relevant to the purposes we have told you about and limited only to those purposes;
3.1.4 accurate and kept up to date;
3.1.5 kept only as long as necessary for the purposes we have told you about; and
3.1.6 kept securely.
4.1 We may Process the following types of Personal Data about you:
4.1.1 name, date of birth, job title, contact details and contact details of next of kin;
4.1.2 information about education, work history, professional qualifications and other information contained on application forms / CVs of potential students, students, staff and associate staff;
4.1.3 information obtained about staff or associate staff as a result of any background checks;
4.1.4 photographs;
4.1.5 information we collect through your use of our website(s) such as IP addresses and other information collected using cookies;
and any other information which you choose to provide to us or that we are provided by others.
4.2 We may also hold Special Categories of Personal Data which in the case of Maryvale is likely to be limited to information about religious beliefs, information about health and wellbeing, trade union membership, information revealing racial or ethnic origins. We may also process information about criminal offences or proceedings.
4.3 We may also receive Personal Data from third parties, for example, those providing references or testimonials or information about your previous education or employment, the police and other law enforcement bodies.
The Personal Data which we hold, whether it is collected directly from you or whether we receive it from a third party, may be Processed in a number of ways, for example:
5.1 From enquiries
5.1.1 From the point of enquiry we collect Personal Data in the form of: name, address and contact details. This data is essential to provide you with the information you require to help you to make an informed decision with regard to applying for one of our programmes.
5.1.2 The Personal Data obtained from those enquiring about courses is held for the current academic year + 1, after which, if you have not applied for a programme, all details are deleted.
5.2 The application process
5.2.1 Personal data, in the form of: name, address, contact information, date of birth, gender, photograph, current or previous occupation, work experience, hobbies, education and qualifications, nationality and, if from outside the EU, passport number and study/residence permit(s) and standard of English.
5.2.2 Special Category Personal Data, such as details of medical conditions or disabilities, which will be revealed only to the Accessibility Co-ordinator and will only be shared with others with your consent.
5.2.3 Applications to our HIRS programmes require information about your ecclesiastical status; which is Special Category Personal Data.
5.2.4 Our bursary application forms ask for a statement of personal circumstances, which will be revealed only to members of the Bursaries Committee in the process of decision making.
5.2.5 All of the above data is essential for the entry into and performance of a contract with you. The information is required to assess your suitability for the programme for which you are applying and what additional support you may require.
5.2.6 If your application is unsuccessful the data will be kept for 6 months after completion of the round of admissions to the programme to allow time for appeal against the decision.
5.2.7 If your application is successful the data will go on to become part of your student file - see "During study" below.
5.3 During study
5.3.1 We hold name, address and contact details on Maryvale's database, to enable us to make contact with you as necessary.
5.3.2 We hold the Personal Data and Special Category Personal Data as listed above, to facilitate the performance of a contract with you.
5.3.3 We also hold details of assignment marks and examination marks as a record of your academic progress.
5.3.4 We keep a record of submission dates and record of attendance at residential elements of the programme*;
5.3.5 We hold a hard copy file on all students studying all or part of our programmes. Typical contents of this file would be:
5.3.6 All of the above are held for the purposes of academic administration and to facilitate your education and use of any support services. All, with the exception of those marked * in clause 5.3 and 5.4, form your semi-permanent file and are retained for 6 years after your completion of study (in accordance with statutory limitations on action). This file is held as a record of your performance as a student, to respond to requests from future employers and/or Higher Education Institutes (HEIs) for references. The records also allow us to monitor and report on Maryvale's performance.
5.3.7 Course work* Students (not in the employ of Maryvale) will own any intellectual property they create in the course of their studies or research activities. An anonymised sample of student work is retained for a review period (5 years) as evidence of academic standards and marking patterns, to be viewed by inspectors and (re)validation panels. The remainder of the work is kept for 6 months after the relevant examination board has ratified the mark, to allow for challenges and then shredded or deleted; this includes recordings of oral examinations. Permission may be sought from authors of exceptional work to share anonymised copies with other students as exemplars.
5.3.8 Consent is sought from each student submitting an undergraduate or postgraduate dissertation or a doctoral thesis for an electronic copy to be kept as a permanent record of scholarly achievement and research at Maryvale.
5.3.9 Library records - records of book loans are kept until the student completes his/her studies or withdraws. Records of inter-library loans are kept for one year after the return of the loan.
5.3.10 We are required to keep records of financial transactions for a minimum of the current year plus 6 years.
5.4 Virtual Learning Environment
5.4.1 We use name, email address, student ID number and course details to create user accounts for Maryvale's Virtual Learning Environment (VLE), which facilitates student access to online course resources.*
5.4.2 For research students only, we store name, email address, course details and progress logs (interactions between students and supervisors) on Maryvale's Research Student Area.
5.4.3 For undergraduate and postgraduate students, we use name and email address to create user accounts for TurnitinUK, Maryvale's online marking and plagiarism detection service. Please note that TurnitinUK is a third party, subscription-based service and, as such, has its own Privacy Policy, for which Maryvale cannot be held accountable or responsible.
5.4.4 For all students, as and when relevant to course, we store name and email address on GoToWebinar, to enable access to lecture recordings and webinars. Please note that GoToWebinar is a third party, subscription-based service and, as such, has its own Privacy Policy, for which Maryvale cannot be held accountable or responsible.
5.4.5 Data which is required to perform a specific task, such as examination entry forms*, assignment submission dates and records of attendance at residentials*, are retained short term in case of queries and then destroyed at the end of the following academic year.
5.5 Completion of studies and beyond
5.5.1 On completion of your studies, whether through graduation, withdrawal or exclusion, your student file will be archived as a "semi-permanent" file, as mentioned above. After the required 6 years, the content of the file will be destroyed, with only the minimum of data retained as a permanent record, that being: name, date of birth as a reference point, list of modules completed and marks awarded. This is retained in order to provide transcripts and references in the future.
5.5.2 Your award and classification will be published in our award ceremony booklet. If you do not want your name to be published, you must let us know when you respond to the graduation invitation. Copies of the award ceremony booklet are kept as a permanent historic record.
5.5.3 You will be contacted within 12 months of your graduation to seek your views of the Maryvale experience and to ask how you have gone on to use your knowledge and skills. The survey will be anonymised. Responses to the survey will be kept until the analysis of the responses has been completed. The outcomes and analysis will be kept for a full review period (5 years).
5.6 Alumni
5.6.1 In common with all HEIs, we maintain an alumni list to stay in contact to support the work of Maryvale through promotion and fundraising. Following the graduation ceremony you will be given the opportunity to ask for your information to be removed from the alumni list. If you choose to be part of the alumni list, you will be given an opportunity to ask to be removed through the annual news bulletin. In addition we have a group called the Friends of Maryvale (FoM), who support the activities and fundraising of Maryvale. After graduation you will be invited to become a member of the FoM. Your name and contact details will be retained only for as long as you wish to remain a member of the group.
5.7 Those who attend special lectures or conferences
5.7.1 From time to time the Institute holds special lectures or conferences to which members of the public are invited. Certain data is required to facilitate the lecture or conference, that of: name and contact details and Special Category Personal Data: eg. dietary or mobility requirements. Sign up sheets for these events will include the opportunity for individuals to opt in to receiving direct information about similar future events, otherwise data will be destroyed three months after the event.
5.8 Covid regulations
5.8.1 In order to support the NHS Test and Trace programme, we are required by law to take contact details (name and telephone number) for all visitors, as well as recording times entering and leaving the building.
5.8.2 In line with guidance issued by the Department for Health and Social Care, we will keep your details safely and in compliance with GDPR legislation for 21 days before securely disposing of or deleting them. We will only share your details with NHS Test and Trace, if asked, in the event that it is needed to help stop the spread of coronavirus. We will not use your details for any other purposes or pass them on to anyone else.
How and why we process your personal data - staff and associate staff
5.9 In connection with the employment or engagement by the Diocese of our staff and associate staff, we will collect and process personal data relating to our employees and other workers. This may include data we receive directly from a member of staff or associate staff (for example, when they complete forms or correspond with us by mail, phone, email or otherwise) or from other sources (including, for example, third parties who provide employment references and others), as well as Governmental and Regulatory or other authorities. Other personal data may be produced within the Diocese, such as employment and disciplinary records, to enable the Diocese to meet its legal obligations as an employer (for example to pay you), monitor your performance and to confer benefits in connection with your position as a member of staff or associate staff.
5.10 The recorded information we hold about you may include contact details, other personal information, photographs, expressions of opinion about you, or indications as to our intentions about you.
5.11 The purposes for which we process the personal data of members of staff or associate staff, and the legal basis on which we do so, will vary according to the category of personal data concerned. In most cases, the processing we carry out will be necessary:
5.11.1 for the performance of the contract of employment or engagement to which the member of staff or associate staff is party, or in order to take steps at your request prior to entering into the contract; or
5.11.2 for compliance with a legal obligation to which we are subject; or
5.11.3 for the purposes of the legitimate interests pursued by the Diocese or by a third party, provided such interests are not overridden by your interests or fundamental rights and freedoms which require protection of personal data.
5.12 In certain cases, we will process the personal data where you have given consent to the processing of your personal data for one or more specific purposes.
5.13 In exceptional cases, processing may be necessary in order to protect your vital interests or those of another natural person.
6.1 We will only process "special categories of data" about ethnic origin, political opinions, religious or similar beliefs, trade union membership, health, sex life, criminal proceedings or convictions, where a further condition is also met. Usually this will mean that you have given your explicit consent, or that the processing is necessary for the purposes of performing our obligations as the data controller or to enable you to exercise your rights under employment law, social security law or the law relating to social protection, or for health or social care purposes.
6.2 Examples of how we may process special category personal data relating to members of staff and associate staff include, as appropriate:
6.2.1 where we process information about your physical or mental health or condition in order to monitor sick leave and take decisions as to your fitness for work; or
6.2.2 where we process information about your racial or ethnic origin or religious or similar information, in order to monitor compliance with equal opportunities legislation.
6.3 Information about criminal convictions will only be relevant in the case of members of staff or associate staff with responsibilities which mean that special checks are justified.
7.1 We collect and use information under the following lawful bases:
7.1.1 where the activities are within our legitimate interests of promoting and providing lifelong learning for all in Catholic evangelisation, catechesis, theology, philosophy and religious education. (Article 6 (1)(f)).
7.1.2 where it is necessary for compliance with a legal obligation (Article 6 (1)(c));
7.1.3 where Processing is necessary to protect your vital interests or another person's vital interests (Article 6(1)(d));
7.1.4 where Processing is necessary to perform a contract (Article 6 (1) (b))
7.1.5 where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e)); or
7.1.6 where we have your consent (Article 6 (a));
7.2 Where the Personal Data we collect is Special Category Personal Data, we will only process it where:
7.2.1 the Processing is carried out in the course of the legitimate activities of Maryvale as part of the religious charity which is the Diocese, and you are a member or former member of the Catholic church or have regular contact with Maryvale or the Diocese;
7.2.2 the processing is necessary for carrying out the Diocese's employment and social security obligations;
7.2.3 processing is necessary to protect your vital interests or of another natural person where you are physically or legally incapable of giving consent;
7.2.4 you have made the information public;
7.2.5 where the processing is necessary for the establishment, exercise or defence of legal claims;
7.2.6 processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and your interests; or
7.2.7 we have explicit consent.
7.3 We envisage that we will hold information about criminal convictions. We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. We have in place an appropriate policy and safeguards which we are required by law to maintain when processing such data. We will use information about criminal convictions and offences where we have a further lawful basis for the processing, for example:
7.3.1 where the Diocese is exercising obligations or rights which are imposed or conferred by law on us or you in connection with employment, social security or social protection and the Diocese has an appropriate policy document in place (e.g. to undertake appropriate checks on individuals prior to taking up a role);
7.3.2 where it is necessary for the prevention or detection of an unlawful act (e.g. passing on information to the Police or other investigatory body);
7.3.3 where we are or the Diocese is complying with or assisting others to comply with regulatory requirements relating to unlawful acts or dishonesty (e.g. passing on information to the Police or other investigatory body);
7.3.4 where it is carried out in the course of safeguarding children or other individuals at risk e.g. making a safeguarding disclosure;
7.3.5 where an individual has given their consent to the processing;
7.3.6 where the Diocese is establishing, exercising or defending legal claims (e.g. providing information to our insurers or lawyers in connection with legal proceedings);
7.3.7 where it is necessary to protect the vital interests of an individual (e.g. passing on information to the Police); or
7.3.8 where it is carried out in the course of the Diocese's legitimate activities as a not-for-profit body with religious aims (e.g. carrying out pastoral activities).
8.1 We may have to share your data with third parties, including third-party service providers and other organisations. In particular, we may share your data with organisations including, but not limited to:
8.1.1 our validating bodies, if you are a student, in relation to your name, contact details, academic progress and awards as these are required by our validating bodies to ensure that you can be given your final award;
8.1.2 our validating bodies if you are a member of associate staff, in relation to your up to date CV, which our validating bodies require as evidence of academic qualification;
8.1.3 HMRC if you are a member of staff or associate staff;
8.1.4 the Home Office, as Maryvale is required to report details of students subject to immigration control who fail to attend as expected, to assist in preventing immigration fraud. We may also be required to provide the Home Office, the Police or UK Immigration with other information about our students;
8.1.5 for students of the B.Divinity, pathway B, studying for the Scottish permanent diaconate - The director of studies for the Scottish Diaconate Commission needs regular updates (as per the Agreement signed between the Scottish Bishops and Maryvale) in order that he can monitor their progress and be in a position to report to the Commission the progress of each of the diaconal candidates in his charge;
8.1.6 For students on FE courses delivered outside Maryvale, in local dioceses or elsewhere, personal and special category personal data is held only by us and not shared with those bodies. Local organisers wishing to hold records of these students must make their own arrangements to hold data and create their own records;
8.1.7 the Disclosure and Barring Service;
8.1.8 the Police or other law enforcement agencies;
8.1.9 external IT providers;
8.1.10 our legal advisors / other external consultants;
8.1.11 insurance providers;
8.1.12 any marking and plagiarism detection service used by us; and
8.1.13 any provider used by us to enable access to lecture recordings and webinars.
8.2 Other data - lectures
8.2.1 Lectures are routinely recorded for uploading onto our website / VLE. You need to be aware that in the course of these recordings we may capture your voice; this cannot be avoided or amended.
8.2.2 Recordings are made available to students on relevant courses via the Virtual Learning Environment (VLE) for one academic year. These lecture recordings are then stored on a secure network area, accessible only to authorised staff, for historical and research purposes.
8.2.3 The recordings may be made available to future students on the VLE at the discretion of the Course Director if, for instance, a particular lecture was deemed relevant to that year's students. Similarly, contractual reasons can be cited if, for example, a lecturer was unable to deliver their session/s and, thus, a previous year's content was made available online to fulfil our commitment to students to provide a particular module.
8.2.4 If a lecture is deemed to be of significant academic or historical interest, the annual Redford lectures for example, it will be held as part of Maryvale's archives under processing condition 6(1)(f).
8.3 Other data - photos
8.3.1 Now and then we take photographs of the activities which take place at Maryvale, including lectures and the graduation ceremony. We do not identify you by name. We may use photographs or videos for Maryvale's websites and social media accounts to show prospective students what we do and to advertise Maryvale. We may continue to use these photos and videos after you have left Maryvale. We sometimes publish graduation and other celebratory photos in the Catholic media to tell people what we have been doing.
8.3.2 To maintain a continuing historical record of Maryvale, we keep photographs indefinitely. Exceptions to this include those taken for student ID cards, which are kept for one year after graduation or withdrawal.
8.4 We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.
9.1 We will endeavour to only keep Personal Data for as long as is necessary and to delete it when it is no longer so.
9.2 We have a data retention policy with which we can supply you on request.
Staff are expected to maintain data security through:
10.1 Careful selection and use of computer passwords;
10.2 Secure use of post and emails, including considered use of bcc and encryption;
10.3 Care taken over what is left visible on desks or left uncollected on the printers;
10.4 Adherence to the Institute retention schedule by carrying out an annual review and cull of data held;
10.5 Ensuring personal data which is no longer required is disposed of carefully, using the shredder or permanent delete function;
10.6 Adherence to the policies for use of data when remote working.
See also the diocesan "GDPR Do's and Don'ts" poster.
11.1 Induction training and annual refresher training is provided by the Diocese.
11.2 The Institute Data Officer has access to additional level training through membership of the Association of University Administrators (AUA) at the association's annual conference.
12.1 Individuals have rights in respect of the Personal Data we Process. In particular:
12.1.1 the right to access information we hold about the individual concerned, and if that right is exercised we have an obligation to respond without undue delay and at the latest within one month of receipt of the request or (if later) within one month of receipt of any information we request to confirm the individual's identity. We can extend the time to respond by a further two months if the request is complex or if we have received a number of requests from the individual. In that case we must let the individual know within one month of receiving their request and explain why the extension is necessary.
12.1.2 the right to correct and update the information we hold;
12.1.3 the right request to have information erased;
12.1.4 the right to object to the Processing of their data;
12.1.5 the right to data portability where it is feasible to do so, within one month of the request being received;
12.1.6 the right to withdraw consent to the Processing at any time for any Processing of data to which consent was sought;
12.1.7 the right to object to the Processing of Personal Data where applicable; and
12.1.8 the right to lodge a complaint with the Information Commissioner's Office.
12.2 When exercising any of the rights listed above, we may need to verify the identity of the individual making the request for security, as rights may only be exercised by the individual whose information is being held or with that individual's express permission.
13.1 A breach is defined as a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of or access to personal or sensitive data, which is likely to result in a high risk to the rights and freedoms of individuals.
13.2 We implement appropriate technical and organisational measures to protect the rights of data subjects.
13.3 Any breach, or suspected breach, must be reported to the Institute Data Officer, who will refer to the Diocesan Data Compliance Managers for support and advice.
13.4 If the breach is likely to result in a risk to the rights and freedoms of individuals, eg. result in discrimination, damage to reputation, financial loss, loss of confidentiality or any other significant economic or social disadvantage, it will be reported by one of the Diocesan Data Compliance Managers to the Information Commissioner's Office (ICO) within 72 hours of discovery.
13.5 Breaches will be investigated by the Data Officer, with the assistance and support of the Diocesan Data Compliance Managers as necessary, unless the breach was caused by the Data Officer, in which case it will be investigated by the Diocesan Data Compliance Managers.
13.6 The Diocesan Data Compliance Managers and Data Officer will review the circumstances in which the breach occurred and implement any remedial actions and changes to practice required.
13.7 A record is kept by the Diocesan Data Compliance Managers of any breaches, reported or not reported, and the action taken in response to the breach.
14.1 Maryvale Institute does not use automated decision making processes.
15.1 We may make changes to this Notice from time to time as our organisational practices and/or applicable laws change, however, we will notify you in advance wherever possible.
16.1 If you have any questions, require further information about how we protect your Personal Data, if you wish to exercise any of the above rights or if you would like to provide feedback or make a complaint about the use of your information, please contact the Data Officer for Maryvale Institute at dataofficer@maryvale.ac.uk or by post to Data Officer, Maryvale Institute, Old Oscott Hill, Kingstanding, Birmingham B44 9AG.
16.2 We hope that we can satisfy any queries you may have about the way in which we Process Personal Data. However, if you have unresolved concerns you also have the right to complain to the Information Commissioner ('ICO') (www.ico.org.uk).