Skip to content Accessibility statement
University of York

Data Protection Statement - Santander Universities SME Internship Programme

Introduction

By taking part in the Santander Universities SME Internship Programme you agree that your personal data is data which by itself or with other data available to us can be used to identify you. We are Santander Universities (a division of Santander UK plc, which is the data controller). This data protection statement sets out how we’ll use your personal data. You can contact our Data Protection Officer (DPO) at 201 Grafton Gate East, Milton Keynes, MK9 1AN if you have any questions.

Where there are two or more people named, this data protection statement applies to each person separately.

The types of personal data we collect and use

By taking part in the Santander Universities SME Internship Programme we’ll use your personal data for the reasons set out below and to manage and provide the services relating to the SME Internship Programme. We’ll collect this indirectly through our partner universities. The personal data we use may include:

  • Full name and personal details including contact information (for example, home address and address history, email address, home and mobile telephone numbers, emergency contact details);
  • Date of birth and/or age (to make sure that you’re eligible to apply);
  • Gender;
  • Nationality;
  • Business financial information (for example, turnover);
  • Subject area, University, degree type, year of study, value of donation/internship, information on your start-up, whether further employment is offered;
  • Education and employment details/employment status for credit and fraud prevention purposes;
  • Photographs and videos in relation to your participation in the SME Internship Programme;
  • Personal data about other individuals, for example emergency contact details. You must have their authority to provide their personal data to us and share this data protection statement with them beforehand together with details of what you’ve agreed on their behalf

Providing my personal data

We’ll tell you if providing some personal data is optional, including if we ask for your consent to process it. In all other cases you must provide your personal data so we can manage and provide the services relating to the internship programme (unless we already hold your details).

Monitoring of communications

Subject to applicable laws, we’ll monitor and record your calls, emails, text messages, social media messages and other communications in relation to your dealings with us. We’ll do this for regulatory compliance, self-regulatory practices, crime prevention and detection, to protect the security of our communications systems and procedures, to check for obscene or profane content, for quality control and staff training, and when we need to see a record of what’s been said.

Using your personal data: the legal basis and purposes

We’ll process your personal data:

1. As necessary to perform our contract or agreement with you for the relevant service / placement:

a) To take steps at your request prior to entering into it;

b) To decide whether to enter into it;

c) To manage and perform that contract; and

d) To update our records.

2. As necessary for our own legitimate interests or those of other persons and organisations, for example:

a) For good governance, accounting, and managing and auditing our business operations;

b) To monitor emails, calls, other communications, and activities relating to our dealings with you;

c) For market research, analysis and developing statistics;

d) To send you marketing communications and for marketing to you in-branch, including automated decision making relating to this;

e) To contact you in relation to competitions; events and initiatives and processes, ie to determine if you have successfully passed to the next stage of the Programme;

f) To contact you to understand and assess the impact the Santander donations funding you have received has had on you;

g) To contact you to request your participation in events relating to the Programme;

h) To contact you to send you communications concerning academic activities such as conferences, courses and congresses, among others, or concerning services, products or activities in connection with research, technology, telecommunications, professional openings and job searches, culture, assistance with study and training, work and projects; and

i) To build address book type sheets for university partners to help manage key contacts.

3. As necessary to comply with a legal obligation, for example:

a) When you exercise your rights under data protection law and make requests;

b) For compliance with legal and regulatory requirements and related disclosures;

c) For establishment and defence of legal rights;

d) For activities relating to the prevention, detection and investigation of crime;

e) To verify your identity, make credit, fraud prevention and anti-money laundering checks; and

f) To monitor emails, calls, other communications, and activities relating to your dealings with us.

4. Based on your consent, for example:

a) When you request us to disclose your personal data to other people or organisations such as a company handling a claim on your behalf, or otherwise agree to disclosures and;

b) To send you marketing communications where we’ve asked for your consent to do so.

I’m free at any time to change my mind and withdraw my consent. The consequence might be that you can’t do certain things for me.

Sharing of your personal data

Subject to applicable data protection law we may share your personal data with:

  • The Santander group of companies* and associated companies in which we have shareholdings;
  • Sub-contractors and other persons who help us provide our products and services;
  • Companies and other persons providing services to us;
  • Our legal and other professional advisors, including our auditors;
  • Government bodies and agencies in the UK and overseas (for example, HMRC who may in turn share it with relevant overseas tax authorities and with regulators such as the Prudential Regulation Authority, the Financial Conduct Authority, the Information Commissioner’s Office);
  • Courts, to comply with legal requirements, and for the administration of justice;
  • In an emergency or to otherwise protect your vital interests;
  • To protect the security or integrity of our business operations;
  • When we restructure or sell our business or its assets or have a merger or reorganisation;
  • Market research organisations who help to improve our products or services;
  • Anyone else where we have your consent or as required by law.

International transfers

Your personal data may be transferred outside the UK and the European Economic Area. While some countries have adequate protections for personal data under applicable laws, in other countries steps will be necessary to ensure appropriate safeguards apply to it. These include imposing contractual obligations of adequacy or requiring the recipient to subscribe or be certified with an ‘international framework’ of protection. Further details can be found in the ‘Using My Personal Data’ booklet.

Your marketing preferences and related searches

We’ll use your home address, phone numbers, email address and social media (for example, Facebook, Google and message facilities in other platforms) to contact you according to your preferences. You can change your preferences or unsubscribe at any time by contacting us. In the case of social media messages you can manage your social media preferences via that social media platform. Other areas of the group may contact you to discuss the internship.

We may search the files at credit reference agencies before sending marketing communications or doing marketing in-branch to you about credit. The credit reference agencies don’t record this particular search or show it to other lenders and it won’t affect your credit rating. We do this as part of our responsible lending obligations which is within our legitimate interests. If you have previously told us that you don’t want information on other products and services or to be included in market research, we’ll continue to respect your wishes.

Criteria used to determine retention periods (whether or not you are accepted onto the programme)

The following criteria are used to determine data retention periods for your personal data:

  • Retention in case of queries. We’ll retain your personal data as long as necessary to deal with your queries (for example, if your application is unsuccessful);
  • Retention in case of claims. We’ll retain your personal data for as long as you might legally bring claims against us; and
  • Retention in accordance with legal and regulatory requirements. We’ll retain your personal data after your account, policy or service has been closed or has otherwise come to an end based on our legal and regulatory requirements.

Your rights under applicable data protection law

Your rights are as follows (noting that these rights don’t apply in all circumstances and that data portability is only relevant from May 2018):

  • The right to be informed about our processing of your personal data;
  • The right to have your personal data corrected if it’s inaccurate and to have incomplete personal data completed;
  • The right to object to processing of your personal data;
  • The right to restrict processing of your personal data;
  • The right to have your personal data erased (the “right to be forgotten”);
  • The right to request access to your personal data and information about how we process it;
  • The right to move, copy or transfer your personal data (“data portability”); and
  • Rights in relation to automated decision making including profiling.

You have the right to complain to the Information Commissioner’s Office. It has enforcement powers and can investigate compliance with data protection law: ico.org.uk.

For more details on all the above you can contact your DPO or request the ‘Using My Personal Data’ booklet by asking for a copy in branch or online at santander.co.uk.

Data anonymisation and aggregation

Your personal data may be converted into statistical or aggregated data which can’t be used to identify you, then used to produce statistical research and reports. This aggregated data may be shared and used in all the ways described above.

*Group companies

For more information on the Santander group companies, please see the ‘Using My Personal Data’ booklet.