Shaping Futures is committed to protecting the privacy and security of the personal information we collect. This privacy notice explains how we collect and use your personal information when you visit our website or take part in any of our activities, in accordance with the General Data Protection Regulation (GDPR). It applies to all learners, teachers and advisors and parents who take part in our activities, and visitors to our website.
Shaping Futures is based at The University of Liverpool and is required to comply with data protection policies put in place by The University of Liverpool.
The University of Liverpool will be what is known as the ‘Data Controller’ of the personal data we hold about you. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice. We may update this notice at any time.
It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). There are “special categories” of more sensitive personal data which require a higher level of protection.
We may collect, store, and use the following categories of personal information about you:
We may also collect, store and use the following ‘special categories’ of more sensitive personal information:
We may collect, store, and use the following categories of personal information about you:
We may collect, store, and use the following categories of personal information about you:
We may collect, store, and use the following categories of personal information about you:
We may also collect, store and use the following ‘special categories’ of more sensitive personal information:
We collect personal data about you through the following routes:
We collect personal data about you through the following routes:
We collect personal data about you through the following routes:
As a condition of our funding, we use the HEAT monitoring and evaluation database to track the education journey of the learners we work with and to support evaluation and research in relation to the work undertaken.
The University of Liverpool has a Controller-Controller relationship with HEAT regarding learners’ personal data. HEAT is an independent controller.
HEAT’s privacy notice can be found here.
HEAT shares non-anonymous information with HESA (Higher Education Statistics Agency) and reports back on Higher Education progression. HESA’s privacy notice can be found here.
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
To process personal data, we must have a lawful basis from data protection legislation which allows us to do so. For the purposes of the Shaping Futures programme, we rely on the following lawful basis from the UK GDPR: Article 6(1)(e), which allows us to process personal data where it is necessary to perform a task in the public interest. Where the University processes special category personal data for research or statistical purposes for this project, we rely on the lawful basis under Article 9(2)(j) in accordance with Article 89(1) of the UK GDPR and Schedule 1 part 1(4) of the Data Protection Act 2018.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Automated decision making takes place when an electronic system uses personal information to decide without human intervention. Shaping Futures do not use automated decision making.
We may have to share your data with third parties, including third-party service providers. We require third parties to respect the security of your data and to treat it in accordance with the law.
Your data will not be transferred, stored or processed outside of the UK or EU.
We may share the personal information we collect and process with one or more of the following receiving organisations:
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymize your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
Once we no longer need the personal data we have collected, or have reached the date of deletion as outlined in our Records Retention Schedule, it will be securely destroyed in accordance with the Records Retention Schedule in line with our host institution which is available here.
Shaping Futures are committed to protecting the privacy and security of the personal information we collect and process, and take this responsibility very seriously. We have a robust data breach reporting process in place, of which all Shaping Futures staff members are aware.
We also have the following security measures in place to avoid data breaches from occurring:
Any data breaches or suspected data breaches will be inspected and reported appropriately to the ICO within 72 hours of discovery. Where the data breach relates to individuals, we will do our best to notify those involved.
Under GDPR, all individuals have the following eight rights:
This means you have the right to be given information about how and why your data is being processed
When you provide your information directly to Shaping Futures, you will be informed at that time how it will be used. This will include the purpose of processing, how long it will be held, and details of any recipients of your data (who it may be shared with)
You have the right to receive confirmation that your data is being processed and to access it by request
You can access your personal data by submitting a Subject Access Request to Shaping Futures and, after your identity has been verified, you will receive a response within one month
You can submit a Subject Access Request by emailing us at admin@shaping-futures.info
You have the right to correct your personal data if it is inaccurate or
Shaping Futures will respond to requests for rectification within one month or, in the case of a complex request, up to three months. If your data has been shared with a third party, Shaping Futures will inform them of the rectification where
You can request a rectification by emailing us at admin@shaping-futures.info
You have the right to request that your personal data is removed, so long as there is no compelling reason for it to continue to be
This does not mean that you have an absolute right ‘to be forgotten’, but that you can have personal data erased or prevent its processing in the following circumstances:
Shaping Futures can refuse a request for erasure for the following reasons:
You have the right to restrict the processing of your personal data so that it may continue to be held but no longer processed
Shaping Futures will restrict processing in the following circumstances:
You will be informed when Shaping Futures decides to lift a restriction on processing
You can make a request to restrict the processing of your personal data by emailing admin@shaping-futures.info
You have the right to obtain your personal data in an easily transferable format to reuse for your own purposes
This right only applies:
Shaping Futures will respond to requests within one month or, in the case of a complex request, up to three months
You can make a request of data portability by emailing admin@shaping-futures.info
You have the right to object at any time to the processing of your personal data for the purposes of direct marketing; processing based on ‘legitimate interests’ or; processing for research or statistical purposes. Please note, Shaping Futures will not use your personal data for direct marketing
This right relates only to the following specific purposes for processing, there is no right to object to processing in general:
Processing based on legitimate interests – you must have grounds relating to your particular situation in order to object to your personal data being processed for this purpose. Shaping Futures must stop processing your data unless it can demonstrate compelling legitimate grounds which override your interests, rights and freedoms as an individual
Processing for research or statistical purposes – you must have grounds relating to your particular situation in order to object to your personal data being processed for this purpose. If the research being conducted requires the processing of your personal data for the performance of a public interest task, Shaping Futures is not required to comply with an objection
You can make an objection by emailing admin@shaping-futures.info
You have the right not to be subjected to a decision that is based on automated processing which results in a legal impact upon you
In such a circumstance Shaping Futures must ensure that you are able to have human intervention in the decision, express your views and receive an explanation of the decision so that you may challenge it
This right does not apply if a decision does not have a legal effect on you, or if a decision:
The right to erasure and the right to portability do not apply when the legal basis for processing is public
You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. ICO contact details: https://ico.org.uk/make-a-complaint/
You have the right to raise concerns about how the University uses your personal data
Who can I complain to if I am unhappy about how my data is used?
If you have any concerns about how we use your personal data, you can make a complaint using the process set out on our website: https://www.liverpool.ac.uk/legal/data_protection/make-a-complaint/
You can contact the data protection team by:
Email: legal@liverpool.ac.uk
Post: Legal & Governance, University of Liverpool, Hart Building, Mount Pleasant, Liverpool L3 5TQ
If, having first raised a complaint with the University, you’re not satisfied with our response, you can escalate your complaint to the Information Commissioner’s Office (ICO). Guidance on how to do this is available at https://ico.org.uk/make-a-complaint/ .
Shaping Futures is based at The University of Liverpool, and is required to comply with data protection policies put in place by The University of Liverpool. Therefore, our Data Protection Officer is based at and works for The University of Liverpool. You can contact the Data Protection Officer at legalservices@liverpool.ac.uk. Full details of The University of Liverpool Information Governance and Security Policy to which we are required to adhere can be found here: https://www.liverpool.ac.uk/legal/data_protection/policy/
