‘Alumni records’ is how we describe all personal data kept by OPPA for the University of York and Hull-York Medical School. Alumni records are kept by OPPA for the following groups of people: 

• Alumni and current or former students of undergraduate, postgraduate and accredited programmes delivered or part-delivered by the University of York.
• Donors and volunteers for the University of York and the University of York in America.
• Current, former and retired staff of the University of York.
• University of York event registrants and attendees.
• Students, alumni and staff of Hull-York Medical School.
• Others in contact with OPPA, including prospective donors and volunteers.

• From you: Your alumni records contain the information you provide when you interact with us, eg through surveys, sign-up forms, and other contact with us before, during and after graduation.
• From the University or HYMS: Some parts of your alumni records are taken from student and staff records, eg your name, contact details and details of your award. Much of this data originally comes from your undergraduate or postgraduate application form. Additional information may also have been provided by you as part of your interactions with the University/HYMS, eg when enrolling for your course or applying for scholarships.
• From third parties: Some parts of your alumni records may be drawn from data given to us by a third party, eg your sponsor, agent, referee or previous employer, college or university, family member or classmate.
• From publicly available sources: Some relevant information may be added to your alumni records from information you have chosen to publish in the public domain, eg your LinkedIn profile.

Your alumni record contains personal data about you including the following:

• Basic details for example, name, title, gender, date of birth and student number. We need these to identify you when we are communicating and so we know how to address you.
• Addresses and contact details for example, phone, email and LinkedIn profile. We need these to contact you in accord with your Communication Preferences.
• Consent, privacy and communications preferences including Telephone Preference Service (TPS) registrations. We need these to make sure we only contact you in ways that are acceptable to you.
• Course and educational attainment details, eg what qualification you received and some of the extracurricular opportunities you participated in. We need this to identify you when we are communicating, to confirm your achievement when asked (eg by employers seeking a reference), and to personalise our communications to you.
• Professional details, eg the profession you work in and your employer. We need this for statistical and research purposes and to personalise our communications to you.
• Information about your interests you provide to us. We need this to personalise our communications to you.
• Information about your ability to support the University, such as details of your income if you have told us, and publicly-available wealth or remuneration data.
• Payment and financial data you provide to us. We need this to process payments, eg a donation or an event booking, to claim Gift Aid, and to carry out other processes related to finance and taxation.
• A record of your engagement with us for example, enquiries, event participation, volunteering, donations, and any other interactions you have with us. We need these to respond to your enquiries, process your payments, provide you with services and handle complaints or problems.

Special category data – which is especially sensitive data such as health records, ethnicity and religious views – is not kept as part of your alumni records. We may record your student memberships of sports clubs and societies, but only if you gave your consent at the time you joined the club or society.

We keep your data in line with legal requirements or where there is a business need. Retention timeframes are determined in line with the University’s Records Retention Schedule.

Our services are not directed at children, and we do not have alumni records for you if you are under the age of 16.

We keep and use your alumni records, including your contact details, for the following purposes:

1. to distribute publications, newsletters and other communications from the University, Departments, Colleges and clubs and societies;
2. to promote University events, benefits and services;
3. to provide information about alumni groups and professional opportunities; to operate surveys, censuses and research projects for the benefit of the University and alumni community;
4. to promote and manage University volunteering opportunities;
5. to carry out University fundraising operations, except where you have asked not to be included;
6. to provide you with and manage your use of University facilities and services and your participation at events;
7. to administer the financial aspects of our relationship with you and any funders including processing any payments made by you to the University;
8. to manage academic progress (including the provision of references and the processing of student complaints and appeals, academic misconduct investigations and student disciplinary cases);
9. to operate the University’s quality assurance processes and arrangements;
10. for legal, personnel, administrative and management purposes;
11. to enable effective communication with you including without limitation, providing you with information relating to University services and products, funding and/or sponsorship opportunities as well as links to relevant surveys and information on York student organisations;
12. to identify ways to enhance learning, teaching, assessment and the broader student experience;
13. to monitor equal opportunities;
14. to compile statistical and personal returns which the University may be required to publish or pass to government bodies or the Higher Education Statistics Agency (HESA).

You can control which communications and information you receive from us here: Communication Preferences.

In addition, please note:

• Photography: While on campus or at events you may be captured in photographs or video footage as part of a wider group shot. These images/recordings may be used by the University for promotional purposes (for example, in the development of the University’s alumni magazine). If you have any concerns about the use of your image, please contact the Data Protection Officer for more information at dataprotection@york.ac.uk 
• Profiling: We analyse alumni records to target and personalise our communications with you and to promote our services to those who are most likely to be interested. You can opt out of this here: Communication Preferences. To support this activity our staff may undertake wealth-screening, which may include reviewing trustworthy public sources such as Companies House. We may use your LinkedIn profile, and other publicly-available sources, to keep employment details up to date, and to carry out research to assess your capacity to support the University financially or through volunteering. We sometimes use trusted third party partners such as Live Alumni and iWave to assist with this process, however we do not share any of your personal data with these partners. By doing this work, we can focus the conversations we have with you about our fundraising and volunteering opportunities in the most effective way, and ensure that we provide you with an experience as an alumnus, donor or potential donor which is appropriate for you.
• York For Life Platform: York For Life is an online service provided free of charge for University of York alumni, staff, students and friends. All potential users will be verified during the registration process before being granted access to the site. The University of York reserves the right to refuse access to anyone who misuses the site in any way, as per the Conditions of Use, available via the platform at registration and thereafter. This service is operated under contract by Aluminati Network Group Ltd. (Aluminati) acting under instruction as our Data Processor under the Data Protection Act 1998. Aluminati will process personal data strictly for the purposes of operating this service. Aluminati is registered with the Information Commissioner under membership number Z8393842.

• on the grounds of contractual requirement or to take steps to enter into a contract with you (for example, to allow you to access a University event);
• because it is necessary for the performance of a task carried out in the public interest (for information on our public task see our function as set out in our charter);
• because it is necessary for a third party’s legitimate interests;
• to allow us to comply with our legal obligations;
• to protect your or another person’s vital interests;
• to monitor equality and diversity;
• because you have given us your consent.

Storage

Alumni records may be stored outside of the UK and EU, with appropriate safeguards and security provisions such as the EU–US Privacy Shield. At the time of writing, most alumni records are stored in the United States.

We take information security extremely seriously. We have both technical and organisational measures in place to protect your alumni records. Access to your records are restricted on a need-to-know basis and security arrangements are regularly reviewed to ensure their continued suitability. For further information see IT Security.

Transfers

Your alumni records may also be transferred to other countries in certain circumstances, eg to allow staff and volunteers to access records when working internationally.

Any storage or transfer of your alumni records will comply with our obligations under data protection law, and we will ensure an adequate level of protection for all transferred data.

Under the General Data Protection Regulation, you have a right of access to your data, a right to rectification, erasure (in certain circumstances), restriction, objection or portability (in certain circumstances). You also have a right to withdraw any consent you have given.

Preferences and Consent

You can update your communications preferences and what you have consented to here: Communication Preferences.

Updating alumni records:

You can check and correct any part of your alumni records by contacting us at alumni@york.ac.uk.

Right of access:

You can receive a copy of your full alumni records by submitting a Subject Access Request. To do this, email your request to dataprotection@york.ac.uk

Right to object:

In instances where we keep or use your data without explicitly asking for consent, you have the right to object. To do this, email your objection to alumni@york.ac.uk. Please give as much information as possible – the right to object is not absolute, so by stating your reasons for objecting you can help us to handle your objection appropriately.

Right to object to marketing:

You have the absolute right to object to our use of your data for direct marketing. If you do this, you will not receive any kind of newsletters, event invitations, appeals, career opportunities or other marketing contacts from us. To object to all direct marketing, email your objection to alumni@york.ac.uk. Alternatively, you can use the Communication Preferences page to opt out of specific types of communication from us while still keeping the communications you are interested in.

In addition to the above options for your alumni records, you can verify or correct information in your student record at any time by following the guidance here: Your Student Record. For all other requests, see GDPR Individual Rights.

Your alumni records may be shared with:

• organisations that process data on behalf of the University to support it in fulfilling its obligations and responsibilities to and relationship with you (such as software and system providers);
• other organisations involved in delivery of services to you, such as partners in events you attend;
• employers and other organisations (such as professional and regulatory bodies) to confirm your qualifications and other activities on your course, with your permission;
• government departments/agencies and other relevant authorities to fulfil our legal duties (see How do we respond to legal requests? below);
• current or potential employers of our students or current or potential providers of education (to provide references and verify details of your qualifications). The University is a member of the Higher Education Degree Datacheck Service: a shared service which allows employers or statutory bodies and their agents to verify basic degree and enrolment information about you, having sought your consent. These checks are most commonly made if you register with an employment agency or are offered a job.

• The University may also disclose parts of your alumni records to other third parties not listed above on a case-by-case basis. Disclosures will be made in full accordance with data protection legislation and only where necessary. Consent will be sought from you where appropriate and you will be told about such disclosures where possible, unless exceptional circumstances apply.

  Parts of your student records may also be shared by the University after you have graduated. This is documented in the Student Privacy Policy.

In addition to our usual information-sharing arrangements (see above), we may be required by law to share your records with:

• government departments/agencies to whom we have a statutory obligation to release information (including the Office for Students, Higher Education Statistics Agency, the UK Research Councils, the Education and Skills Funding Agency, the Quality Assurance Agency for Higher Education, the Home Office UK Visas and Immigration, HM Revenue and Customs and Council Tax and Electoral Registration Offices;
• current or potential employers of our students or current or potential providers of education (to provide references and verify details of your qualifications). The University is a member of the Higher Education Degree Datacheck Service: a shared service which allows employers or statutory bodies and their agents to verify basic degree and enrolment information about you, having sought your consent. These checks are most commonly made if you register with an employment agency or are offered a job;
• law enforcement agencies such as the police or relevant authorities dealing with emergency situations (only as required or appropriate and in line with Data Protection legislation). 

If you are a Canadian National: For the purposes of maintaining our Prescribed University status with the Canadian Revenue Agency (CRA) to enable donors in Canada to give tax efficiently, your information will also be passed to the CRA. This information is required by the CRA as proof that the University of York educates Canadians. The data will remain with the Canadian Revenue Agency and is given solely for purposes of verification. To opt out of this process please contact the OPPA Information Manager at alumni@york.ac.uk.

We may revise this privacy policy from time to time. .

If we make a change to the policy that we believe to be significant, we will notify you by email (unless you have asked us not to or we do not have your email address) and announce the change on our website, york.ac.uk/alumni. You can update your email address and contact preferences.