Edinburgh Business School

Data Sharing Policy: Information for Students and Applicants

1. Our role as a Data Controller and why we collect personal data

1.1 In accordance with the Data Protection Act 1998, Edinburgh Business School is
registered as a Data Controller for personal data we hold about students. Edinburgh
Business School collects and processes information, including images, about current
students, potential students and former students, applicants and potential applicants.
Edinburgh Business School will process personal data in accordance with its Data
Protection Policy, the UK Data Protection Act 1998 and other applicable laws. Edinburgh
Business School holds this personal data securely and restricts access to personal data
to staff that need to use it in the course of their duties. Some of this information is
defined as sensitive personal data in terms of the Data Protection Act 1998.

1.2 Edinburgh Business School could not exercise its responsibilities and fulfil its obligations
to students without holding and using personal data. Edinburgh Business School needs
to communicate and share personal data worldwide in the course of its business and
transfers personal data to countries outside the European Economic Area, where
adequate levels of protection are in place.

2. With whom do we share personal data?

2.1 Edinburgh Business School works together with Heriot-Watt University and Edinburgh
Business School’s partners to deliver programmes and support obligations. To ensure
that your programme is managed efficiently, the personal data and images that you
provide and data recorded when you commence your studies and as you progress in
your studies will be shared amongst Edinburgh Business School, Heriot-Watt University
and Edinburgh Business School’s partners. Such data shall be used as follows:

(a) Edinburgh Business School and Heriot-Watt University will each use the data for
academic programme management and for operational and administration
purposes;
(b) Edinburgh Business School’s partners will use the data for programme support,
administration and for the provision of information to students and potential
students;
(a) Edinburgh Business School and Heriot-Watt University may appoint external
organisations to undertake work and contract with them to act as data processors to
manage personal data and communications on their behalf (e.g. examination
centres hosting examinations, payment services, plagiarism detection systems), and
require such organisations to use personal data only for the purpose relevant to the
service.

Edinburgh Business School and Heriot-Watt University act as Joint Data Controllers in
respect of data they collect, use and share about students studying on Heriot-Watt
University programmes delivered by Edinburgh Business School.

3. How is personal data used?

3.1 Data recorded and shared under this Policy will be used as follows:

3.1.1 Partners of Edinburgh Business School will record information and may use the
resulting data for:

(a) Marketing programmes to potential students and providing information to

Edinburgh Business School on marketing and recruitment;
(b) Communicating with, and providing support to, students;
(c) Quality assurance monitoring and the provision of quality assurance reports
to Edinburgh Business School;
(d) The purchase and supply of courses.
 3.1.2 Edinburgh Business School and Heriot-Watt University will record information
and use the resulting data for:

(a) Marketing programmes to potential students;

(b) Recruitment and matriculation;
(c) Communicating with, and providing support to, students;
(d) Processing appeals and complaints;
(e) Alumni relations;
(f) Quality assurance monitoring;
(g) Seeking and acting on student feedback, providing management and
statistical information to monitor and improve our performance and
enhance the student experience
(h) Administering programmes, monitoring performance, conducting
assessments and examinations, and conferring and providing confirmation
of awards;
(i) Monitoring marketing and recruitment activities;
(j) Returns to government or government agencies to comply with statutory
and legal obligations including the Higher Education Statistics Agency
(HESA)* and funding bodies;
(k) Sharing information with and requesting information from UK Visas and
Immigration and other relevant government authorities about potential
students and students who are subject to immigration law in line with
sponsorship duties;
(l) Providing information for Council Tax exemption;
(m) Providing a reference for a potential or current employer;
(n) Providing information to a sponsor;
(o) Providing information to the Heriot-Watt University Student Union;
(p) Archival purposes.

*For information on what data Heriot-Watt University shares with HESA please
refer to the HESA Student Collection Notice. This notice may be subject to
revision from time to time.

3.1.3 Edinburgh Business School and Heriot-Watt University film and publish audio
and visual images of events held worldwide on their websites. Both parties may
also take photographs and other images of students, potential students and
former students for possible use in publicity and promotional material in print
and on their websites. Both parties publish names and awards of all graduands
in the graduation programme and in press releases to the media (unless you ask
us not to do this).

4. How we protect personal data

4.1 Edinburgh Business School and its partners will protect the data that each holds in
relation to any student, potential student or former student by:

4.1.1 Implementing appropriate technical and organisational measures to protect

students’, potential students’ and former students’ data against unauthorised or
unlawful processing and against accidental loss, destruction, damage, alteration
or disclosure;

4.1.2 Using data held in relation to each student, potential student and former student
solely and exclusively for the purposes referred to in clause 3;

4.1.3 Giving students, potential students and former students in relation to whom
each of the parties holds data, a right of access to that data, including the right
to rectify or be given a copy of, the information concerned; and in the case of
potential students, to have information removed; and
 4.1.4 Complying with all Applicable Laws (including specifically the Data Protection Act
1998 and any equivalent laws in the Territory) in connection with the data
processing activities that each party carries out under this Policy.

5. Disclosing personal data to third parties

5.1 Edinburgh Business School and Heriot-Watt University will disclose information to third
parties only:

5.1.1 With a student’s consent;

5.1.2 If requested by an organisation with a statutory function, such as the police, in a
case where disclosure would prejudice law enforcement;
5.1.3 To meet a statutory or regulatory obligation;
5.1.4 Otherwise in accordance with the Edinburgh Business School’s Notification with
the Information Commissioner and in compliance with the Data Protection Act.

6. Your rights
6.1 Students, potential students and former students have the right to:

6.1.1 Find out what personal data we hold about them, why we hold it and what we do
with it, how long we keep it and to whom we may disclose it;
6.1.2 Ask us to correct inaccurate data;
6.1.3 Ask us not to process information about you that causes substantial
unwarranted damage or distress;
6.1.4 Make a request to gain access to personal data which Edinburgh Business School
holds about them (this is known as a ’subject access request’). Any such request
should be submitted to enquiries@ebs.hw.ac.uk.

6.2 Any student, potential student or former student who believes that information held
about them is incorrect or incomplete should contact Edinburgh Business School at:
enquiries@ebs.hw.ac.uk.

7. Changes to our Data Sharing Policy

7.1 Edinburgh Business School may amend this Policy from time to time. If we make any
substantial changes we will notify you by email.

Further Information
If you wish to enquire about Data Protection or this Policy please contact
enquiries@ebs.hw.ac.uk.

Edinburgh Business School March 2015