1. Introduction

The Office for Students has commissioned the Careers Research & Advisory Centre (CRAC), supported by the Institute of Student Employers (ISE), to conduct an external evaluation of the Challenge Competition which has provided funding for 16 universities to develop projects supporting local graduates.

The Office for Students is committed to protecting any personal information collected during the evaluation and being clear about any information held about individuals and how it is used.

https://www.officeforstudents.org.uk/ofs-privacy/

The Office for Students is registered with the Information Commissioner’s Office (ICO) – registration number ZA309955.

2. Data controller and processors

For the purpose of this evaluation project, the Office for Students and CRAC are joint Data Controllers. The Office for Students has appointed CRAC to design and manage an online survey of employers within the evaluation project, to be implemented one or more times.

The Office for Students’ Challenge Competition Officer, Jon Baker, is the first point of contact for people who may have concerns about the information being processed. You can contact him by email at Jon.Baker@officeforstudents.org.uk.

3. How we will use your information

We can only use your personal information where we have a specific purpose for doing so and have told you what those reasons are.

This survey/s will collect responses from participants (current students and recent graduates) who took part in activities which received funding from the OfS as part of this Challenge Competition, about their views, experiences and impacts of these schemes.

Results from the survey will be aggregated and summarised in evaluation reports that CRAC will write which will assist the OfS in understanding how a range of interventions may increase the employment outcomes and employability of graduates who remain in the region of the institution. In these reports, all results will be anonymised.

If we want to use personal information for a reason other than those purposes set out above, we will tell you before we start that use and provide further information about the new purpose(s).

4. Legal basis for using personal information

Under data protection legislation, we require a legal basis to be able to process personal information for the purposes set out above. The collection and use of personal information will be based on respondents providing explicit consent.

5. What personal information we will collect

The survey/s will be designed to minimise the amount of personal information collected, but CRAC will be requesting some (non-identifiable, optional) characteristics data to help evidence the effectiveness of interventions designed to improve the employment outcomes of students from certain groups, such as those from disadvantaged backgrounds. The types of personal information CRAC will be seeking are:

• The name of the university you currently study at, or have graduated from
• Gender
• Nationality
• Ethnicity
• Email contact details purely to administer prize draw (optional)

6. Who we give personal information to

Information submitted through the survey will be compiled and temporarily stored by CRAC for these purposes. Aggregate-level results may be published but respondents will not be identifiable from any published output (other than in exceptional circumstances in which case it will only be with explicit agreement). CRAC will not pass  information to any other organisation except where required to do so by law.

7. Where personal information will be stored and for how long

CRAC will create and implement the online survey/s using the Surveymonkey software platform (which is a sub-processor, according to data protection legislation). During data collection, the data may be stored on servers residing outside the UK. Surveymonkey adheres to the highest possible industrial standards for information security:

https://www.surveymonkey.com/mp/legal/privacy-policy/

Information submitted by participants of the surveys conducted will be removed from the online survey platform by 31 December of the year in which they are conducted (or within three months of date of closure of survey if later) and retained by CRAC until 31 March 2023.

8. Rights over personal information

Once personal information has been collected, a survey respondent has certain rights in relation to that information that may be exercised, for example the right to:

• Ask for a copy of the personal information
• Correct inaccurate personal information held
• Ask for personal information to be deleted (within certain limits)
• Restrict processing of the personal information
• Ask for a copy of the information

All these rights have certain limitations depending on the request and the purpose for which the personal information is held. Further information can be found about these rights and the Office for Students’ processes for handling such requests at:

https://www.officeforstudents.org.uk/ofs-privacy/

9. How we protect your personal information

The Office for Students and CRAC have a number of security measures in place to protect your personal information, listed below:

• All staff are required to undertake training in data protection and information security on joining the organisation and then on an annual basis;
• Formal information security policies exist that must be read and understood by all staff;
• Personal information or data are only available to those members of staff who require access as part of their role;
• CRAC’s information and data systems are accredited through the Cyber Essentials scheme;
• CRAC has been accredited with the ISO27001 Information Security standard (accreditation obtained May 2021, certification imminent).

10. Complaints about the use of personal information

If you are unhappy with the way in which you believe personal information has been handled, please contact us via Jon.Baker@officeforstudents.org.uk who will try to resolve your issue informally. If we are not able to resolve the issue to your satisfaction, you can also make a complaint to the data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) and they can be contacted by email at casework@ico.org.uk

12. Changes to this privacy notice

We keep our data processing and privacy notices under regular review.

This privacy notice was last updated on 17 May 2021.