Privacy Policy
How we use information about you
The University of Edinburgh holds information about students who apply for, who are offered and who enter into a contract for University-owned and managed accommodation. We use the information to administer your application(s), to generate contract(s), to communicate with you, to gather feedback from you and to inform operational and strategic planning needs. In addition, we use this information so you can be invited to join community networks during your stay with us.
We are using information about you mainly because:
- it is necessary for the performance of your accommodation contract(s) with us (contract);
- you might wish to provide us with additional optional information, typically relating to disabilities, which might influence your allocated accommodation (consent)
- we will use this information to invite you to participate in student surveys, with the aim of helping improve the student experience (legitimate interest).
Information about you will be shared, only if necessary, with other specific departments within the University, including the Disability Office and relevant academic departments. We will not share your data with any other third party unless there is a legal obligation to do so.
We will hold the personal data you provide to us for a maximum of 7 years (the current year plus 6 previous years), although we will archive your data after 4 years.
We do not use profiling or automated decision-making processes. Some processes are semi-automated (such as anti-fraud data matching or allocation of study bedrooms) but a human decision maker will always be involved before any decision is reached in relation to you.
Mandatory data sharing
In addition to the primary purposes, we are also legally obliged to share certain data with other public bodies and will do so where the law requires this; we will also generally comply with requests for specific information from other regulatory and law enforcement bodies where this is necessary and proportionate.
Transfers outside the EEA
The University will only transfer data to countries outside the EEA when satisfied that both the party which handles the data and the country it is processing it in provide adequate safeguards for personal privacy. Details of such transfers and safeguards are on our website.
Your rights
You have the right to request access to, copies of and rectification or erasure of personal data held by the University and can request that we restrict processing or object to processing as well as the right to data portability (i.e. the right to ask us to put your data into a format that it can be transferred easily to a different organisation). If you wish to make use of one of these rights, please email your local contact at accom.allocations@ed.ac.uk
How to make an information request
If any information held by us is incorrect, you have the right to ask for this to be corrected and updated. Please help us keep our records updated by informing us of any changes to your email address and other contact details. You have the right to ask us not to process your personal data for marketing purposes. We will usually inform you (before collecting your personal data) if we intend to use your personal data for such purposes or if we intend to disclose your information to any third party for such purposes.
Most areas of the University manage their collection and retention of personal information independently. You will typically need to contact a school, college, unit or service directly. All our schools and units abide by the privacy policy outlined in this section of the website, but may also publish additional information related to their specific activities.
To update your personal information, you will typically need to get in touch with the school, unit or service which holds it.
Data controller and contact details
For data collected under this privacy policy, the University of Edinburgh (the “University”) is the Data Controller (as that term is defined in the UK General Data Protection Regulation and the Data Protection Act 2018), registered with the Information Commissioner’s Office, Registration Number Z6426984.
You can contact our Data Protection Officer at dpo@ed.ac.uk. Our data protection policy is on our website at http://www.ed.ac.uk/records-management/data-protection/data-protection-policy
Complaints
If you are unhappy with the way we have processed your personal data you have the right to complain to the Information Commissioner’s Office at casework@ico.org.uk but we ask that you raise the issue with our Data Protection Officer first.