1.1 Maryvale Institute is part of St Mary's College Oscott, CIO (Oscott) (charity number 1172979) of St Mary's College Oscott, Chester Road, Sutton Coldfield, B73 5AA. In this Notice, references to 'we', 'our', 'us' and 'Maryvale' 'The Institute' mean Maryvale Institute as part of Oscott, and 'you' and 'your' mean any person to whom we provide our services, including; potential students, students, alumni, volunteers, those attending special lectures or conferences, staff and associate staff.
1.2 This privacy notice describes how we collect and use personal information in accordance with the UK General Data Protection Regulation (GDPR), and should be read alongside Oscott's general privacy policy available at https://www.oscott.org/privacy. Terminology which is defined in the Oscott general privacy policy is also used in the same way in this notice.
1.3 When you provide us with Personal Data in order to engage with us and/or benefit from our support, we will keep a record of the data you give in order to enable us to comply with our statutory obligations and to achieve our objectives of providing opportunities for lay people, clergy and religious to achieve a deeper understanding of the faith and to appreciate and communicate more clearly its joyful message for the lives of individuals and communities.
1.4 For the purpose of the GDPR, Oscott through its Trustees will be a Data Controller in respect of your Personal Data. In some cases, Oscott may be a joint Data Controller of your Personal Data (e.g. where your data is shared between the Archdiocese and another organisation for a particular purpose, such as validating bodies).
1.5 Where validating bodies and Oscott are both data controllers, the validating bodies shall be liable for their processing of Personal Data and we shall only be liable for our processing of Personal Data.
1.6 Everyone has rights with regard to how their Personal Data is handled by organisations. Maryvale is committed to ensuring that Personal Data is properly and securely managed in accordance with the relevant data protection laws, and believes this is an important part of achieving trust and confidence with data subjects.
1.7 Maryvale, as part of the Oscott, is responsible for deciding how we hold and use Personal Data about individuals connected with Maryvale including potential students, students, alumni volunteers, those attending special lectures or conferences, staff and associate staff.
2.1 Data Controller — the entity that determines the purposes, conditions and means of the processing of personal data, i.e. the Archdiocese of Birmingham.
2.2 Data Officer — the individual(s) appointed within the Institute responsible for overseeing the data protection strategy and implementation to ensure compliance with GDPR requirements, i.e. the Institute Academic Registrar.
Responsibilities include:
2.3 Data Subject — a natural person whose personal data is processed by a controller or officer, i.e. students, staff and associates.
2.4 Data Compliance Managers — the individuals appointed within Oscott responsible for overseeing the data protection strategy and implementation to ensure compliance with GDPR requirements.
3.1 We will comply with data protection law. This says that the personal information we hold about you must be:
4.1 We may Process the following types of Personal Data about you:
and any other information which you choose to provide to us or that we are provided by others.
4.2 We may also hold Special Categories of Personal Data which in the case of Maryvale is likely to be limited to information about religious beliefs, information about health and wellbeing, trade union membership, information revealing racial or ethnic origins. We may also process information about criminal offences or proceedings.
4.3 We may also receive Personal Data from third parties, for example, those providing references or testimonials or information about your previous education or employment, the police and other law enforcement bodies.
The Personal Data which we hold, whether it is collected directly from you or whether we receive it from a third party, may be Processed in a number of ways, for example:
5.1.1 From the point of enquiry we collect Personal Data in the form of: name, address and contact details. This data is essential to provide you with the information you require to help you to make an informed decision with regard to applying for one of our programmes.
5.1.2 The Personal Data obtained from those enquiring about courses is held for the current academic year + 1, after which, if you have not applied for a programme, all details are deleted.
5.2.1 Personal data, in the form of: name, address, contact information, date of birth, gender, photograph, current or previous occupation, work experience, hobbies, education and qualifications, nationality and, if from outside the EU, passport number and study/residence permit(s) and standard of English.
5.2.2 Special Category Personal Data, such as details of medical conditions or disabilities, which will be revealed only to the Accessibility Co-ordinator and will only be shared with others with your consent.
5.2.3 Applications to our HIRS programmes require information about your ecclesiastical status; which is Special Category Personal Data.
5.2.4 Our Student Financial assistance forms ask for a statement of personal circumstances, which will be revealed only to members of the Student Hardship Committee in the process of decision making.
5.2.5 All of the above data is essential for the entry into and performance of a contract with you. The information is required to assess your suitability for the programme for which you are applying and what additional support you may require.
5.2.6 If your application is unsuccessful the data will be kept for 6 months after completion of the round of admissions to the programme to allow time for appeal against the decision.
5.2.7 If your application is successful the data will go on to become part of your student file — see "During study" below.
5.3.1 We hold name, address and contact details on Maryvale's database, to enable us to make contact with you as necessary.
5.3.2 We hold the Personal Data and Special Category Personal Data as listed above, to facilitate the performance of a contract with you.
5.3.3 We also hold details of assignment marks and examination marks as a record of your academic progress.
5.3.4 We keep a record of submission dates and record of attendance at residential elements of the programme*;
5.3.5 We hold a hard copy file on all students studying all or part of our programmes. Typical contents of this file would be:
5.3.6 All of the above are held for the purposes of academic administration and to facilitate your education and use of any support services. All, with the exception of those marked * in clause 5.3 and 5.4, form your semi-permanent file and are retained for 6 years after your completion of study (in accordance with statutory limitations on action). This file is held as a record of your performance as a student, to respond to requests from future employers and/or Higher Education Institutes (HEIs) for references. The records also allow us to monitor and report on Maryvale's performance.
5.3.7 Course work* Students (not in the employ of Maryvale) will own any intellectual property they create in the course of their studies or research activities. An anonymised sample of student work is retained for a review period (5 years) as evidence of academic standards and marking patterns, to be viewed by inspectors and (re)validation panels. The remainder of the work is kept for 6 months after the relevant examination board has ratified the mark, to allow for challenges and then shredded or deleted; this includes recordings of oral examinations. Permission may be sought from authors of exceptional work to share anonymised copies with other students as exemplars.
5.3.8 Consent is sought from each student submitting an undergraduate or postgraduate dissertation for an electronic copy to be kept as a permanent record of scholarly achievement and research at Maryvale.
5.3.9 Library records — records of book loans are kept until the student completes his/her studies or withdraws. Records of inter-library loans are kept for one year after the return of the loan.
5.3.10 We are required to keep records of financial transactions for a minimum of the current year plus 6 years.
5.4.1 We use name, email address, student ID number and course details to create user accounts for Maryvale's Virtual Learning Environment (VLE), which facilitates student access to online course resources.*
5.4.2 For undergraduate and postgraduate students, we use name and email address to create user accounts for TurnitinUK, Maryvale's online marking and plagiarism detection service. Please note that TurnitinUK is a third party, subscription-based service and, as such, has its own Privacy Policy, for which Maryvale cannot be held accountable or responsible.
5.4.3 For all students, as and when relevant to course, we store name and email address on GoToWebinar, to enable access to lecture recordings and webinars. Please note that GoToWebinar is a third party, subscription-based service and, as such, has its own Privacy Policy, for which Maryvale cannot be held accountable or responsible.
5.4.4 Data which is required to perform a specific task, such as examination entry forms*, assignment submission dates and records of attendance at residentials*, are retained short term in case of queries and then destroyed at the end of the following academic year.
5.5.1 On completion of your studies, whether through graduation, withdrawal or exclusion, your student file will be archived as a "semi-permanent" file, as mentioned above. After the required 6 years, the content of the file will be destroyed, with only the minimum of data retained as a permanent record, that being: name, date of birth as a reference point, list of modules completed and marks awarded. This is retained in order to provide transcripts and references in the future.
5.5.2 Your award and classification will be published in our award ceremony booklet. If you do not want your name to be published, you must let us know when you respond to the graduation invitation. Copies of the award ceremony booklet are kept as a permanent historic record.
5.5.3 You will be contacted within 12 months of your graduation to seek your views of the Maryvale experience and to ask how you have gone on to use your knowledge and skills. The survey will be anonymised. Responses to the survey will be kept until the analysis of the responses has been completed. The outcomes and analysis will be kept for a full review period (5 years).
5.6.1 In common with all HEIs, we maintain an alumni list to stay in contact to support the work of Maryvale through promotion and fundraising. Following the graduation ceremony you will be given the opportunity to ask for your information to be removed from the alumni list. If you choose to be part of the alumni list, you will be given an opportunity to ask to be removed through the annual news bulletin. In addition we have a group called the Friends of Maryvale (FoM), who support the activities and fundraising of Maryvale. After graduation you will be invited to become a member of the FoM. Your name and contact details will be retained only for as long as you wish to remain a member of the group.
5.7.1 From time to time the Institute holds special lectures or conferences to which members of the public are invited. Certain data is required to facilitate the lecture or conference, that of: name and contact details and Special Category Personal Data: eg. dietary or mobility requirements. Sign up sheets for these events will include the opportunity for individuals to opt in to receiving direct information about similar future events, otherwise data will be destroyed three months after the event.
5.8 In connection with the employment or engagement by Oscott of our staff and associate staff, we will collect and process personal data relating to our employees and other workers. This may include data we receive directly from a member of staff or associate staff (for example, when they complete forms or correspond with us by mail, phone, email or otherwise) or from other sources (including, for example, third parties who provide employment references and others), as well as Governmental and Regulatory or other authorities. Other personal data may be produced within Oscott, such as employment and disciplinary records, to enable the Oscott to meet its legal obligations as an employer (for example to pay you), monitor your performance and to confer benefits in connection with your position as a member of staff or associate staff.
5.9 The recorded information we hold about you may include contact details, other personal information, photographs, expressions of opinion about you, or indications as to our intentions about you.
5.10 The purposes for which we process the personal data of members of staff or associate staff, and the legal basis on which we do so, will vary according to the category of personal data concerned. In most cases, the processing we carry out will be necessary:
5.11 In certain cases, we will process the personal data where you have given consent to the processing of your personal data for one or more specific purposes.
5.12 In exceptional cases, processing may be necessary in order to protect your vital interests or those of another natural person.
6.1 We will only process "special categories of data" about ethnic origin, political opinions, religious or similar beliefs, trade union membership, health, sex life, criminal proceedings or convictions, where a further condition is also met. Usually this will mean that you have given your explicit consent, or that the processing is necessary for the purposes of performing our obligations as the data controller or to enable you to exercise your rights under employment law, social security law or the law relating to social protection, or for health or social care purposes.
6.2 Examples of how we may process special category personal data relating to members of staff and associate staff include, as appropriate:
6.3 Information about criminal convictions will only be relevant in the case of members of staff or associate staff with responsibilities which mean that special checks are justified.
7.1 We collect and use information under the following lawful bases:
7.2 Where the Personal Data we collect is Special Category Personal Data, we will only process it where:
7.3 We envisage that we will hold information about criminal convictions. We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. We have in place an appropriate policy and safeguards which we are required by law to maintain when processing such data. We will use information about criminal convictions and offences where we have a further lawful basis for the processing, for example:
8.1 We may have to share your data with third parties, including third-party service providers and other organisations. In particular, we may share your data with organisations including, but not limited to:
8.2.1 Lectures are routinely recorded for uploading onto our website / VLE. You need to be aware that in the course of these recordings we may capture your voice; this cannot be avoided or amended.
8.2.2 Recordings are made available to students on relevant courses via the Virtual Learning Environment (VLE) for one academic year. These lecture recordings are then stored on a secure network area, accessible only to authorised staff, for historical and research purposes.
8.2.3 The recordings may be made available to future students on the VLE at the discretion of the Course Director if, for instance, a particular lecture was deemed relevant to that year's students. Similarly, contractual reasons can be cited if, for example, a lecturer was unable to deliver their session/s and, thus, a previous year's content was made available online to fulfil our commitment to students to provide a particular module.
8.2.4 If a lecture is deemed to be of significant academic or historical interest, the annual Redford lectures for example, it will be held as part of Maryvale's archives under processing condition 6(1)(f).
8.3.1 Now and then we take photographs of the activities which take place at Maryvale, including lectures and the graduation ceremony. We do not identify you by name. We may use photographs or videos for Maryvale's websites and social media accounts to show prospective students what we do and to advertise Maryvale. We may continue to use these photos and videos after you have left Maryvale. We sometimes publish graduation and other celebratory photos in the Catholic media to tell people what we have been doing.
8.3.2 To maintain a continuing historical record of Maryvale, we keep photographs indefinitely. Exceptions to this include those taken for student ID cards, which are kept for one year after graduation or withdrawal.
8.3.3 When providing an image for your student ID cards you may be asked if you consent for your name and image to be shared with your tutors.
8.4 We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.
9.1 We will endeavour to only keep Personal Data for as long as is necessary and to delete it when it is no longer so.
9.2 We have a data retention policy with which we can supply you on request.
Staff are expected to maintain data security through:
10.1 Careful selection and use of computer passwords;
10.2 Secure use of post and emails, including considered use of bcc and encryption;
10.3 Care taken over what is left visible on desks or left uncollected on the printers;
10.4 Adherence to the Institute retention schedule by carrying out an annual review and cull of data held;
10.5 Ensuring personal data which is no longer required is disposed of carefully, using the shredder or permanent delete function;
10.6 Adherence to the policies for use of data when remote working.
11.1 Induction training and annual refresher training is provided by Oscott.
11.2 The Institute Data Officer has access to additional level training through membership of the Association of University Administrators (AUA) at the association's annual conference.
12.1 Individuals have rights in respect of the Personal Data we Process. In particular:
12.2 When exercising any of the rights listed above, we may need to verify the identity of the individual making the request for security, as rights may only be exercised by the individual whose information is being held or with that individual's express permission.
13.1 A breach is defined as a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of or access to personal or sensitive data, which is likely to result in a high risk to the rights and freedoms of individuals.
13.2 We implement appropriate technical and organisational measures to protect the rights of data subjects.
13.3 Any breach, or suspected breach, must be reported to the Institute Data Officer, who will refer to Oscott's Data Compliance Managers for support and advice.
13.4 If the breach is likely to result in a risk to the rights and freedoms of individuals, eg. result in discrimination, damage to reputation, financial loss, loss of confidentiality or any other significant economic or social disadvantage, it will be reported by one of Oscott's Data Compliance Managers to the Information Commissioner's Office (ICO) within 72 hours of discovery.
13.5 Breaches will be investigated by the Data Officer, with the assistance and support of the Oscott Data Compliance Manager as necessary, unless the breach was caused by the Data Officer, in which case it will be investigated by the Oscott Data Compliance Manager.
13.6 The Oscott Data Compliance Manager and Data Officer will review the circumstances in which the breach occurred and implement any remedial actions and changes to practice required.
13.7 A record is kept by the Oscott's Data Compliance Managers of any breaches, reported or not reported, and the action taken in response to the breach.
14.1 Maryvale Institute does not use automated decision making processes.
15.1 We may make changes to this Notice from time to time as our organisational practices and/or applicable laws change, however, we will notify you in advance wherever possible.
16.1 If you have any questions, require further information about how we protect your Personal Data, if you wish to exercise any of the above rights or if you would like to provide feedback or make a complaint about the use of your information, please contact the Data Officer for Maryvale Institute at privacy@oscott.org or by post to Data Officer, Maryvale Institute, St Mary's College Oscott, Chester Road, Sutton Coldfield, B73 5AA.
16.2 We hope that we can satisfy any queries you may have about the way in which we Process Personal Data. However, if you have unresolved concerns you also have the right to complain to the Information Commissioner ('ICO') (www.ico.org.uk).