Data Protection and Privacy

Data Protection

Teesside University is a registered Data Controller and is subject to the UK General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 (DPA); two pieces of legislation that control the way organisations use personal data in order to protect the privacy of individuals. The legislation balances an individual's right to privacy with the need of organisations to use information about an individual for legitimate purposes.

Teesside University aims to process all personal data in accordance with the requirements and safeguards of Data Protection legislation. The University's approach to Data Protection is set out in our Data Protection Policy and Code of Practice . This Policy and Code of Practice contains links to other key Information Governance Policies, including Information Security which deals with how the University keeps your data safe.

• Data Protection Code of Practice
• Data Protection Policy
• Students' Union Data Sharing Agreement

---

Privacy

The University has a wide range of functions and services which necessitate the processing of personal data. The University processes personal data of students, staff, alumni, research participants, visitors and individuals who work with the University.

We are committed to be open and transparent about how we deal with your information. You may have been given privacy information (in the form of privacy notices or fair processing notices) at various points in your contact with the University. The privacy notices below provide general privacy information for specific groups of individuals.

• General University Privacy Notice
• Layered Privacy Notice
• Alumni Privacy Notice
• Student Privacy Notice
• Student Privacy Notice – Prague City
• Outreach and Recruitment Activities Privacy Notice
• Staff Privacy Notice
• Research Portal Privacy Notice
• Non-accredited CPD and Short Course Store and Payment Gateway Privacy Notice
• MIMA Privacy Notice

Your rights (including requests to access personal data)

As a data subject, you have a number of rights in relation to your personal data as listed below. You can exercise your rights free of charge at any time by writing to the Data Protection Officer dpo@tees.ac.uk or by completing our Data Subject Rights Request form.

We may require proof of your identity, or request further information to allow us to handle your request. Once in receipt of the information we require, we will normally respond to you within one calendar month unless otherwise described below.

Right to be informed and access your data

You have the right to know what personal data we hold about you and to receive a copy of it. It is not a general right of access to documents, therefore information about other people or information that does not relate to you may be removed using redaction. Most requested will be responded to within one calendar month, but this may be extended to a maximum of three months for complex requests - we will inform you where this is necessary.

Right to complain

• To the University: If you have any concerns about how the University has handled your personal data, you have the right to make a complaint to us directly by contacting the DPO as described above. We will acknowledge your complaint within 30 days and respond without undue delay.
• To the Supervisory Authority: You also have the right to raise your concerns with the Information Commissioner's Office (ICO). However, we would encourage you to contact us in the first instance so we can try to resolve the issue.

Right to rectification

You have the right to have inaccurate or incomplete personal data corrected without undue delay.

Right to erasure (right to be forgotten)

You have the right to request that we erase your personal data without undue delay in certain circumstances. This is not an absolute right, and we may not be able to comply where we have a lawful reason to retain the data (for example, where it is still required for the original purpose or to meet legal obligations).

Right to restrict processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, for example where you contest its accuracy.

Right to object

You have the right to object to the processing of your personal data. We will consider your request, but we may continue to process your data where we have compelling legitimate grounds or where processing is necessary for legal claims.

Right to withdraw consent

If we rely on your consent to process personal data, you have the right to withdraw this at any time.

Right to data portability

Where applicable, you can request that we transfer your personal data directly to another organisation. The right to data portability only applies in limited circumstances, for example where we process your personal data based on your consent or as part of a contract, and where processing is carried out by automated means. It does not generally apply where we process personal data as part of our public tasks or legal obligations (the majority of the activities we undertake as a University).

---

Data Protection Officer

The University has appointed a Data Protection Officer (DPO) in compliance with Article 37 of the UK GDPR.

Our DPO can be contacted by email at dpo@tees.ac.uk by telephone on 01642 342093 or in writing to the following postal address:

The Data Protection Officer
Legal & Governance Services
Teesside University
Middlesbrough
TS1 3BX