Anglia Ruskin University Higher Education Corporation (ARU) is committed to protecting your personal information when you use our services.
When saying “we”, “our” or “ARU”, we’re referring to Anglia Ruskin University.
It also relates to us using any personal information that you provide by phone, SMS, email, in letters and other correspondence, and in person.
By providing us with your personal data and using our services, you agree to the collection and use of this information in accordance with the purposes described above in this privacy notice or as otherwise explained to you.
We may receive your personal information when you: participate in, access or sign up to any of our services, activities or online content, phone or email us, apply for one of our jobs or create an account on our website.
We will collect the following about applicants for employment:
Once you become a member of staff we will also collect (at different times) some or all of the following:
ARU also collects data about how you use ARU mobile apps, websites or other university-related online content, and the device(s) you use to access these services. This includes collecting unique online identifiers such as IP addresses, which are numbers that can uniquely identify a specific computer or other network device on the web. For more information, please see see the section on cookies within this privacy notice.
In all cases your personal data will be processed confidentially and securely.
This includes information relating to racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life and sexual orientation and criminal convictions and offences.
We may process special categories of personal data in the following circumstances where:
We will use personal data:
We will only collect and use information relating to criminal convictions where:
You can see your employee information we hold by logging into Business World. It is important that the personal data we hold about you is accurate and current so please keep us informed if your data changes during your relationship with us. You can do this by contacting Human Resources.
We may contact you by post, telephone or fax as well as by email, SMS and MMS. If you change your mind about being contacted in the future by any of these means you will be given the option to change your preferences.
We set out in the legal basis section of this policy all the purposes for which we may process your personal data, identifying the legal basis and those external parties to whom we may disclose that personal information
We may contact you by post, telephone or fax as well as by email, SMS and MMS. If you change your mind about being contacted in the future by any of these means then please contact firstname.lastname@example.org.
Any personal data is disclosed to ARU staff with a need to know, Occupational Health, Employee Assistance Programme provider, Disclosure and Barring Service, HMRC, Payroll and Pensions providers, UKVI, Unions and other organisations acting on behalf of ARU in the administration of our employees’ data.
We will share your personal data with third parties where required by law, where it is necessary to administer the working relationship with you (including benefits) or where we have another legitimate interest in doing so. ”Third parties” includes third-party service providers (including contractors and designated agents).
The following activities are carried out currently by or with the assistance of the following third-party service providers at applicant stage:
And once you are a member of staff we will also carry out:
Where we receive notification, from the Office of the Independent Adjudicator (OIA), of a complaint made by a current or previous student we may be required to disclose relevant personal data to the OIA to assist in their investigation.
In addition, we will share anonymised statistical information with the following third-parties: ONS, UCEA, Xpert HR, HESA, DLA Piper, Equality Challenge Unit - Athena Swan and Inclusive Employers.
All our third-party service providers, including any change in provider, are required to take appropriate security measures to protect your personal data in line with our policies.
ARU only permit a third-party service to process your personal data for specified purposes and in accordance with our instructions. We do not allow our third-party service providers to use your personal data for their own purposes.
Unless required or permitted to do so by law, we will not otherwise share, sell or distribute any of the information you provide to us without your agreement.
Your personal data will be held confidentially for as long as necessary to fulfil the purposes for which it was it collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.
The personal data you provide as part of the recruitment process will only be shared with those who need to see your application for administrative purposes, selection, statistical analysis and research. The data will be archived on our e-recruitment system after a period of inactivity and anonymised equality data will only be available for statistical returns.
Should you be appointed to a position, the personal data provided on application (including equality monitoring data) will continue to be held by Anglia Ruskin University as part of its employee records.
Personal data held as part of your employee record, unless otherwise deleted in accordance with the retention schedule, will be archived 1 year after the end of employment and kept for a minimum of 6 years after the end of employment.
Data will be retained in accordance with our retention schedule Records Retention Schedule.
If we wish to retain your personal information on file, on the basis that a further opportunity may arise in future and we may wish to consider you for that, we will write to you separately, seeking your explicit consent to retain your personal information for a fixed period on that basis.
The personal data we obtain from you is used to enter into a contract of employment with you or to perform ARU’s obligations under your contract of employment, to comply with a legal obligation imposed on ARU or where it is necessary for ARU's legitimate interests or those of a third party, provided your interests and fundamental rights do not override them.
The situations in which we will process the following categories of personal data are listed below.
Personal and contact information
Personal contact details such as names, title, addresses, telephone numbers and personal email addresses.
Prior to, throughout and after employment for the purposes of entering into and/or performing its contract with you and/or in compliance with a legal obligation imposed upon Anglia Ruskin University and/or where necessary for the purposes of legitimate interests of ARU in relation to your prospective or actual employment with ARU
Work history, copies of right to work documentation, references, education and qualifications and other information included in a CV or cover letter or as part of the application process.
Copy of driving licence, utility bills, bank statement, birth certificate, marriage certificate, passport.
DBS checks and criminal records details
For the purposes of entering into and/or in compliance with a legal obligation imposed upon ARU and/or where necessary for the purposes of legitimate interests of ARU and/or necessary for the performance of a task carried out in the public interest including but not limited to:
Job titles, start date, grade, salary, employment type, work base, continuous service details, working hours, terms and conditions, department.
Birth Date, Emergency contact details
National Insurance number, Bank account details, payroll and pensions records and tax status information, benefits information.
Maternity, paternity and shared parental leave details
Disciplinary and grievance information. Information about your time at the University and any support provided
Probation and appraisal details
Training records and professional membership.
Conducting performance reviews, managing performance and determining performance requirements.
Assessing qualifications for a particular job or task, including decisions about promotions.
Education, training and development requirements.
DBS checks and criminal records details.
For the purposes of entering into and/or performing its contract with you and/or in compliance with a legal obligation imposed upon ARU and/or where necessary for the purposes of legitimate interests of ARU and/or necessary for the performance of a task carried out in the public interest including but not limited to:
Health and Safety
Absence and sickness details
For the purposes of performing its contract with you and/or in compliance with a legal obligation imposed upon ARU and/or where necessary for the purposes of legitimate interests of ARU and/or necessary for the performance of a task carried out in the public interest including but not limited to:
Equality information including your gender; nationality, marital status, ethnicity, religion, sexual orientation and disability details.
For the purposes of entering into and/or performing its contract with you and/or in compliance with a legal obligation imposed upon ARU and/or where necessary for the purposes of legitimate interests of ARU including but not limited to:
We will only use your personal data for the purposes for which we collected it unless we reasonably consider that it is needed for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose we will notify you and explain the legal basis which allows us to do so.
The information you provide will be treated confidentially. If you fail to provide all the information ARU may not be able to fulfil our contractual obligations to you or may be prevented from complying with our legal obligations.
If you wish to exercise any of the below rights please contact our Data Protection Officer on email@example.com. We will work with you to ensure we respect your wishes.
Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data ARU hold about you and to check that it is being processed lawfully.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). A reasonable fee may be charged if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
As a security measure to ensure that rights are exercised by the correct individual and personal data is not disclosed to any person who has no right to receive it, we may need to request specific information from you to help us confirm your identity. On receipt of this information, if you have made a subject access request, the University will send you copies of data as soon as possible and in any event within 30 days.
The provision of the personal data is subject to exemptions specified by GDPR.
Request correction of the personal data that ARU hold about you. This enables you to have any incomplete or inaccurate information held about you corrected.
Request erasure of your personal data. This enables you to ask ARU to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing for which see below. Your request will be complied with unless it is required to comply with a legal obligation or to perform a task carried out in the public interest or for the establishment, exercise or defence of legal claims.
Object to processing of your personal data where ARU are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
Request the restriction of processing of your personal data. This enables you to ask ARU to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal data to another party.
Withdraw consent: Consent is usually, but not always, obtained where there is no other legal basis on which to process your personal data for a specific purpose. In these limited circumstances you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent to processing please contact firstname.lastname@example.org. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to unless we have another legitimate basis for doing so. This may mean we can no longer offer some services to you.
To complain to the Information Commissioner’s Office (ICO): the ICO is the UK supervisory authority for data protection issues. For more information please visit the following website: https://ico.org.uk/for-the-public/raising-concerns/
Some of ARU's positions have specific qualification requirements and automated processing will be applied at application stage through our e-recruitment system to confirm these are met. All applicants will be asked to confirm whether they meet the specific criteria for the post they are applying for by selecting a Yes/ No answer. They will be allowed to proceed with an application where they confirm the requirement is met. If the applicant disagrees with the decision they have 21 days to request a reconsideration.
ARU is committed to holding your data securely and uses information security best practice to transmit personal data. Data is held in accordance with the Corporate Information Security Policy . For example, your personal data is accessible only by those authorised and who have a business need for access. When shared with third parties, your personal data is shared with encryption or in password protected files.
Where we have given you (or where you have chosen) a password that enables you to access our systems, you are responsible for keeping this password confidential. You must not share passwords with anyone.
Although we maintain a number of safeguards, fraudulent email requests are occasionally delivered to staff and students. We will never ask for your username or password by email. Any message that does so should be treated as a potential breach of security, no matter how legitimate it may appear. If you are in any doubt, do nothing until you have spoken to a member of the IT Services Customer Support Team.
ARU have put in place procedures to deal with any suspected data security incident and will notify you and any applicable regulator where we are required to do so. If you have any concerns that personal data has been compromised please contact email@example.com.