PASE maintains a record of all former students of the University and, as such, we hold education records in perpetuity. Graduation information is published each year in graduation books and is therefore considered to be in the public domain. The personal data we store and process, the majority of which is given to us by our alumni and supporters, may include:

• name, title, gender, nationality and date of birth;
• contact details including postal address, email address, phone number and links to social media accounts;
• information about your time at the University and other academic institutions, including qualifications held and courses studied;
• your occupation and professional activities;
• your recreations and interests (for example your membership of student sports clubs);
• family and spouse/partner details and your relationships to other alumni, supporters and friends;
• records of donations and Gift Aid status, where applicable (as required by HMRC);
• records of communications sent to you by PASE or received from you;
• volunteering by you on behalf of the University;
• information about your wealth;
• media articles about you;
• information on your engagement in University meetings, events, groups or networks;
• information about your use of the University and alumni website and the Lancaster Online Directory in accordance with our Privacy and Cookies notice;
• information about your activity on University social media channels (e.g. the LinkedIn alumni group and the alumni Facebook page).

Tools may be used to help us improve the effectiveness of the University’s communications with you, including tracking whether the emails we send are opened and which links are clicked within a message. We monitor website visits and use tools such as Google Analytics to improve our website and services.

The University does not store any credit/debit card details and is fully PCI-DSS compliant. Bank details used for processing Direct Debits are stored by a trusted third-party, under the Direct Debit Guarantee scheme.

Initially, data about students is transferred into the University’s alumni database from the University’s student record system. This transfer is based on legitimate interest and the University has done a balance of interests test to ensure that its interests are not overriding your own rights and freedoms.

The vast majority of the information we hold is obtained directly from you; and if you interact with any other departments, divisions, schools or faculties within the University we may receive data from these areas.

We always aim to keep your details up to date, and we will conduct projects to check the contact details we have for you are correct, and, where appropriate, update them. As a result, some of the data may also have been obtained from publicly available sources – for example, we may find a new address for you by using the Royal Mail’s National Change of Address database (NCOA). We may also use information from publicly available sources, such as public LinkedIn profiles to gain up-to-date information about you, to carry out research to assess your inclination and capacity to support the University financially or by volunteering your time. We may use trusted third-party partners to carry out this type of data collection to automate some of this work.

The University may also use trusted third-party partners to support other PASE activities. If you interact with the University through a third party (for example, supporting the University via JustGiving or a crowdfunding page) then we may obtain information about you from that third party, but only if you have given your explicit consent to that third party sharing your information. The receipt of data by PASE in this manner is subject to the third party’s own privacy policy. A list of parties with whom we partner in this way is available on request. Data obtained in this way is treated no differently to any other once held by PASE, and is bound by the terms of this privacy statement as soon as it is received.

Lancaster University’s foundation, growth and success have been supported by philanthropy, and philanthropy continues to make an enormous impact at our University. As we are a fundraising institution, we may gather information about you from publicly available sources – for example, Companies House, the Electoral Register, the media and public LinkedIn profiles – to help us to understand more about you as an individual, your interests and your ability to support the University. We may use trusted third-party partners to carry out this type of data collection to automate some of this work.

We may carry out wealth screening, a process which uses trusted third-party partners to automate some of this work. We may use information gathered from public sources or other departments, schools or faculties within Lancaster University, alongside the information you provide, to undertake analysis of who might support the University and to understand the preferences of our alumni about events, communication and services. By doing this, we can ensure that conversations we have with you about fundraising and volunteering are focused in the most effective way, and ensure that we provide you with an experience as an alumnus, donor or potential donor which is appropriate for you. We also use publicly available sources to carry out due diligence on donors in line with the University’s Gift Acceptance Policy and to meet money laundering regulations.

Fundraising is a key part of PASE’s work, and we are committed to working in a transparent, ethical, responsible and honest way. To reflect this commitment, we are a member of the Fundraising Regulator and committed to the Regulator’s Code of Practice.

We value our relationship with you and we use your personal data to ensure we contact you in the most appropriate way, improve our services and to ensure we work efficiently and effectively.

Your data will be used for a full range of alumni engagement and fundraising purposes. These include the following communications and marketing activities, which may be delivered by mail, email, telephone and social media:

• Sending University publications and news;
• Notification of alumni events;
• Fundraising programmes;
• Promotion of discounts and services for alumni;
• Academic course information and alumni benefits;
• Promotion of alumni and student careers mentoring programmes;
• Information about alumni and marketing activities based in faculties, departments and colleges.
• To facilitate the assessment and improvement of services that the University offers, to assess the effective management of the University and to ensure the efficient running of the University via internal and external audit. (Legitimate Interest)

Where we communicate with you as Alumni we do so in the legitimate interests of the University. In doing so we have conducted a balancing test of the legitimate interests of the University against your own rights and interests.

You can opt out of receiving communications from Philanthropy, Alumni and Supporter Engagement at any time by emailing alumni@lancaster.ac.uk or by logging into Lancaster Online.

Subject to suitable security checks, the University provides access to alumni information to relevant government departments including HESA and its agencies. This is for the purpose of compiling graduate destination and outcomes data. The legal basis for sharing the data in this way is as a legal obligation.

Information such as a list of people who were members of clubs and societies of the University will be shared with the Lancaster University Student Union on request. This is in order that the Union can arrange events and other activities such as reunions and anniversaries. The legal basis for sharing the data in this way is legitimate interest.

We will also share data with appropriate third parties for the purposes of internal and/or external audit in order to facilitate the assessment and improvement of services that the University offers, to assess the effective management of the University and to ensure the efficient running of the University. The legal basis for sharing the data in this way is legitimate interest.

We also share data with IT providers delivering externally hosted services such as Microsoft. The lawful basis for this is Legitimate Interests.

With the exception of the access provided to government departments outlined above, we will not disclose your data to individuals, organisations or other entities outside the University other than those which are acting as agents for the University (for example, the company which prints and sends our annual alumni magazine). All external entities with whom data is being shared must sign a contract or confidentiality and non-disclosure agreement before any data transfer takes place. We do not sell to or trade your data with any other organisations.

The University will ensure that these organisations use your data in line with data protection legislation. In many cases the University does not need to seek your consent to share this information, in particular when there is a legal or statutory obligation to provide the information.

We are committed to holding your data securely and treating it with sensitivity. All data is held securely and in accordance with the Data Protection Act 2018 & the UK General Data Protection Regulation (UK GDPR). Your data is held on a database in the Microsoft Azure cloud hosting data service, managed by our database supplier, Blackbaud, and located within the European Economic Area. The database is protected by multi-level authentication and access is restricted to individuals who need to see the data to carry out their duties at the University and at the database supplier, Blackbaud. This is limited to:

• members of staff and student members of staff in PASE;
• assigned IT support;
• colleagues from other areas within the University who work closely with PASE on the provision of services to alumni, such as the Careers Service, academic departments and Colleges; and
• Blackbaud systems and database administrators

User access rights to the database are restricted according to individual job roles in order to ensure that users only see information relevant to them. This access is reviewed on a regular basis. We have a UK GDPR-compliant contract with Blackbaud. Where Blackbaud provide services that use affiliates outside the EEA, where data transfer is required, appropriate safeguards are in place as required by Article 46 of the UK GDPR.

For further information please refer to the University’s Information Security Policy.

Although most of the information we store and process stays within the UK, some information may be transferred to countries outside the European Economic Area (EEA). This may occur if, for example, one of our trusted partner’s servers are located in a country outside the EEA. Where these countries do not have similar data protection laws to the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law.

We will hold your educational record in perpetuity unless you request to have your data deleted from the Alumni database. Please see below for how to request that your data is deleted.

You have the following rights regarding your personal data:

• To have access to your personal data - for further information see the Subject Access webpage;
• To have inaccurate or incomplete personal data amended
• To have your personal data deleted – this will only apply when there is no legitimate reason for the University to continue to use your personal data
• To restrict the use of your personal data
• To request personal information in a digital form so that you can provide it to other organisations
• To object to automated decision making and profiling
• To withdraw consent when we have used consent as the basis for using your information

The University has a range of policies to support these rights.

If you wish to exercise your rights you are advised to first read these policies as there are some exceptions to using your rights. For example, the University is required to keep permanently your basic student record which includes your name, date of attendance, degree classification, record of modules taken and marks for these. If the University received a request from you to be forgotten it would withhold the request for deletion of your basic record, but could agree to the deletion of more wider information that it holds on you.

Any requests to use your rights over your personal data should be made to Lancaster University's designated Data Protection Officer.

You are required to read this Privacy Notice so that you understand how we use your personal information and the rights that you have.

We may seek new contact details for alumni with whom we are not in contact, to ensure the University can remain in touch with as many of its alumni as possible. Many of our alumni choose to manage and update their own details, which you can do online at Lancaster Online.

If you have any questions about this Privacy Notice then please contact:

Philanthropy, Alumni and Supporter Engagement
University House
Lancaster University
Bailrigg
Lancaster
LA1 4YW
alumni@lancaster.ac.uk
+44 (0)1524 594109

Lancaster University’s designated Data Protection Officer is:

Mike Abbotts, Information Governance Manager
Email: information-governance@lancaster.ac.uk

Contact Mike if you have any concerns or complaints about this Notice or about the way your personal data is being used.

Lancaster University is the Data Controller for the personal data that it holds about you. The University’s contact details are:

Lancaster University
Bailrigg
Lancaster
LA1 4YW
United Kingdom

If you are not happy with the way the University has handled your concern or complaint then you may submit a complaint to the Information Commissioner’s Office.

This Notice has been developed to be compliant with the General Data Protection Regulations (GDPR). This Notice is regularly reviewed and sometimes updated. It is important that you check for updates to this Notice. If we make significant changes we will contact you to inform you of this.