Information from the College is released for many reasons and to many people on a daily basis.
In addition to the release of general information in response to routine enquiries the College is required to deal with requests arising from statutory rights of access provided by the General Data Protection Regulation (GDPR), the Data Protection Act 2018, the Freedom of Information Act 2000 and the Environment Information Regulations 2004. Compliance with each piece of legislation places obligations on the College about how requests are processed and handled.
The College has a Data Protection Policy.
Under the GDPR you have a number of rights when it comes to your personal data.
The right to be informed
When we collect your data, either directly from you or via a third party, we have a responsibility to provide you with information about what we will do with your data, how long we will keep it and who we might share it with. The document we use to provide you with this privacy information may be called a collection notice, a privacy notice or covered in a privacy policy.
You can only exercise this right if we have not provided this information to you already.
The right of access
You have the right to access your personal data which the College holds.
The right to rectification
You have the right to have personal data rectified if it is inaccurate or incomplete. If we have disclosed the data to third parties, they will also be informed of the rectification where possible.
The right to erasure
Also known as ‘the right to be forgotten’, the broad principle underpinning this right is to enable you to request the deletion or removal of personal data where there is no compelling reason for its continued processing. This is not an absolute right and in some cases we will need to keep processing some of your personal data.
The right to restrict processing
You have a right to block or suppress processing of personal data. When restricted, the College will store the personal data but not further process it, in addition to this we shall retain only enough information about you to ensure that the restriction is maintained in the future. This is not an absolute right and in some cases we will need to keep processing some of your personal data.
The right to data portability
In certain circumstances you can request that the personal data you have provided to us be transmitted to another data controller.
The right to object
You can object to us processing any of your personal data which is done on the basis of our legitimate interests, in performing a task in the public interest or if we are processing your data for the purpose of research and statistics. You can also object to any direct marketing you receive from the College.
Rights in relation to automated decision making and profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or has a similarly significant impact unless this processing is necessary for entering into, or facilitating the performance of, a contract between the you and the College.
We can also process your data in this way if the activity is authorised by law which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests or if you have given your consent.
If you wish to exercise the right of access (make a subject access request) please complete this form.
If you wish to exercise any of these rights other than the right of access, please complete this form.
If you have any questions about data protection at Royal Holloway or wish to contact the Data Protection Officer, please email dataprotection@royalholloway.ac.uk
Read our Applicant Privacy Notice.
Read our Enquirer Privacy Notice.
