Privacy Notice - Alumni and Supporters

Part 1: Generic Privacy Notice Information

Durham University has a responsibility under data protection legislation to provide individuals with information about how we process their personal data. We do this in a number of ways, one of which is the publication of privacy notices. Organisations variously call them a privacy statement, a fair processing notice or a privacy policy.

To ensure that we process your personal data fairly and lawfully we are required to inform you:

• Why we collect your data
• How it will be used
• Who it will be shared with

We will also explain what rights you have to control how we use your information and how to inform us about your wishes. Durham University will make the Privacy Notice available via the website and at the point we request personal data.

Our privacy notices comprise two parts – a generic part (ie common to all of our privacy notices) and a part tailored to the specific processing activity being undertaken.

Data Controller

The Data Controller is Durham University. If you would like more information about how the University uses your personal data, please review these pages or contact Information Governance Unit:

Email: information.governance@durham.ac.uk

Information Governance Unit also coordinate response to individuals asserting their rights under the legislation. Please contact the Unit in the first instance.

Data Protection Officer

The Data Protection Officer is responsible for advising the University on compliance with Data Protection legislation and monitoring its performance against it. If you have any concerns regarding the way in which the University is processing your personal data, please contact the Data Protection Officer:

Andrew Ladd, email: info.access@durham.ac.uk 

Part 2: Tailored Privacy Notice for Alumni and Supporters

Durham University’s Development and Alumni Relations Office (DARO) supports a global community of stakeholders (students, alumni, parents, donors, mentors, employers, researchers, policy-makers, and advocates) related to the research, engagement and outreach activities pursued by Durham University and its peer organisations. In order to deliver all of the related products, services and opportunities in a bespoke manner and to ensure each individual and constituency receives relevant information, DARO process personal data of stakeholders. This helps to ensure that you are getting the best contact available from DARO for your purposes. This also helps us, where appropriate, to ask for your support with the things we believe you care about the most.

Alumni and Supporters: Type(s) of personal data collected and held by the University and method of collection

If you are a student/graduate, some of the personal data that the University holds about you is transferred from your student record to the University’s alumni database, Raiser’s Edge. This personal data will have been collected from you as part of your studies application process or provided by you via updates to your department or college during your time as a student and will include:

• Your name, title, gender preference, nationality and date of birth;
• Your home or parental address, email address and telephone numbers;
• Your former school and/or university;
• Your familial relationships (parents, grandparents and siblings);
• UCAS Number.

Some of the personal data the University holds about you has been created by us as part of your education record, namely:

• Mode of study (e.g. full-time, part-time, distance learning);
• Academic department and programme of study;
• Start, end and graduation dates;
• Reason for leaving, type and classification of degree;
• The college you attended and your membership of a Junior or Middle Common Room (JCR/MCR)/clubs/societies/sporting teams.

Some of the personal data the University holds about you is provided by you during your transactions with us (contact details updates, www.dunelm.org.uk  website activity, event registration, volunteer activity or making/soliciting a donation), namely:

• Your bank account number, name and sort code (used for processing Direct Debits);
• Gift amount, purpose, date and method of payment including cheque numbers or payment references. At no point do we store payment card details if you donate, or pay for an event, using a payment card;
• Tax status and Gift Aid Declaration information;
• Your spouse/partner’s name and whether they are also a Durham alumna/nus;
• Updates to your contact details;
• Children’s names, gender and year of birth;
• Record of verbal or email conversations/meetings including any personal interests;
• Dietary preferences;
• Web activity whilst visiting www.dunelm.org.uk.

The University may hold personal data relating to your professional history. This data may have been provided by you, or it may have been obtained from social media (e.g. LinkedIn, Facebook) or publicly available sources (Companies House and other business-related resources, the World-Wide-Web, publications and news articles such as Queen’s Honours List, Times Rich List, and the National Change of Address File and other services that provide email addresses and telephone numbers), namely:

• Your employment status (e.g. part-time, full-time, retired);
• Your current job title and work email address;
• Your previous role(s) and job title;
• Your current and past employers, name, address and telephone number;
• The dates that you have been employed in any particular role;
• Your photograph;
• Your income band.

The University may hold personal data that has been created by Durham University from other personal data that we already hold (i.e. name, address, postcode, employment data), either through internal or external research/profiling, namely:

• Your estimated asset worth, property value and shareholdings;
• Qualification of prospective level of giving;
• Philanthropic interests and gifts to other charitable organisations;
• Internal classifications and ratings as a major gift prospect;
• A rating of your level of engagement which is created from a mix of your event attendance, donation history and other interactions with the University.

Alumni and Supporters: Lawful basis

When processing your personal data the University relies on a combination of Consent, Contract, Legal Obligation or Legitimate Interests as the legal basis under the GDPR, as detailed in the table below. Where the University relies on Legitimate Interest you have the right to object to your data being processed for the purposes stated (see section entitled How to object to the processing of your personal data). However, if the University stops processing data for the stated purposes this may impact our ability to undertake certain activities that you have asked us to undertake, such as claiming Gift Aid on your donations if you object to your name and address being processed. If this is likely to happen, we may refer back to you to obtain clarification that this is what you intend.

The Legitimate Interests that are being pursued in the processing of personal data are:

• To establish, maintain and enhance our relationship with alumni in the pursuance of a life-long mutually beneficial partnership that benefits the alumni community and the University’s student community;
• To attract and retain donors and supporters in the pursuance of the University’s strategic objectives to generate philanthropic income and to diversify income streams.

Responding to our obligations in relation to the Higher Education Statistics Agency.

Consent

Processing Activity	Legal basis
Creating your record in our relationship management system (Raiser’s Edge)	Legitimate Interests or Consent
Verifying your identity (alumni)	Legitimate Interests or Contract
Processing your contact preference forms	Consent
Meeting our obligations in relation to the Telephone Preference Service	Legal Requirement
Sending you direct mail by post	Legitimate Interests
Processing your gifts	Contract and Consent
Processing our Gift Aid claims	Consent and Legal
Event registration and management	Contract and Consent
Volunteer registration and management	Contract and Consent
Career mentor/mentee registration and management	Contract and Consent
Donor stewardship	Legitimate Interests, Contract and Consent
Conducting our telephone campaigns (fundraising)	Legitimate Interests
Identifying potential major gift supporters and qualifying prospective levels of giving	Legitimate Interests
Conducting due diligence on prospective major donors	Legal Requirement or Legitimate Interests
Major donor cultivation and solicitation	Legitimate Interests
Making legacy estimates/valuations	Legitimate Interests
Analysis of visits to our website www.dunelm.org.uk	Legitimate Interests
Analysis of the effectiveness of our email communications	Legitimate Interests
Reporting and benchmarking DARO performance	Legitimate Interests
Responding to our obligations in relation to the Higher Education Statistics Agency	Consent
Participating in higher education ranking or league tables providers with whom we hold a data sharing agreement	Consent

Alumni and Supporters: How personal data is stored

Personal data of alumni, donors and other stakeholders is stored DARO in a propriety cloud-based database supplied by Blackbaud, Inc. called Raiser’s Edge (RE) under a contract for service. RE is hosted by Blackbaud on their servers located in the EEA. Access to personal data is restricted to the staff in DARO and any other members of the University staff who have a requirement to maintain a relationship with you, and is controlled through password protection and user security profiles. Blackbaud Inc. do not permit their staff to have access to the personal data stored in RE.

The personal data of some alumni and supporters may be stored in a proprietary software application used to manage fundraising campaigns conducted by telephone. This software is hosted in the 'cloud' by the third party supplier only for so long as is necessary for the period of the telephone campaign. Access to the sotware is restricted to students emplolyed under a contract to make calls to alumni and supporters, the campaign manager and DARO staff and is controlled throught user name and password. 

All University employees, contractors and volunteers that are given access to personal data receive mandatory Data Protection training and have a contractual responsibility to maintain confidentiality.

Alumni and Supporters: How personal data is processed

Personal data is processed by the Development and Alumni Relations Office and the University’s colleges, departments and Durham Student Organisations to:

• Promote events;
• Send news and updates;
• Recruit alumni volunteers and mentors;
• Acknowledge gifts and to keep donors updated on the impact of their gift(s);
• Make fundraising appeals by email, direct mail, telephone and face-to-face meetings and ensure that we only send you communications about events or fundraising appeals that would be of interest to you;
• Report internally and externally and to undertake benchmarking.

Automated decision-making and profiling

Personal data is processed by the University for a variety of purposes (detailed above) for which, in the interests of efficiency or effectiveness, or to meet the specific preferences of data subjects, profiling takes place. For example:

• To communicate with alumni from a particular college/department;
• To inform event hosts about attendees and their relationship to the University;
• To qualify prospective levels of giving;
• To undertake due diligence on prospective major donors;
• To produce summary data to report internally and to undertake benchmarking.

Automated decision-making takes place in only a limited number of instances (for example, to produce ask amounts for the periodic telephone campaigns) but there would be no legal or significant impact on you as a result of this decision making.

Alumni and Supporters: Who the University shares data with

Personal data is shared with third party organisations in a limited number of instances.

If you are a member of the alumni community of, or have donated to, either of the independent colleges of St John’s and St Chad’s, which are charities in their own right your personal data held by Durham University will be shared with those colleges under a Data Sharing Agreement which requires the colleges to provide assurances of protection of the data.

If you are a member of our alumni and/or donor community and our records show that you reside in the United States of America (USA), your personal data may be shared with the North American Foundation for the University of Durham (Dunelm USA) who have an independent 501c3 status in the USA, for the purpose of alumni relations and fundraising. For students, prospective students/parents, alumni and donors who have interacted with DunelmUSA, a reciprocal data sharing agreement is in place whereby the University may receive personal data relating to you.

The University is required to disclose some personal data of graduates to the Higher Education Statistics Agency (HESA) for the purpose of a survey of new graduates.

Additionally, we share data on a considered and confidential basis, where appropriate, with affiliated organisations and individuals which support and provide services to alumni and supporters, such as volunteer partners closely related to us (e.g. development and advisory board members).

DARO may share personal data with other third party organisations which carry out contracts on behalf of the University (such as a venue hosting a University event). The University will only share personal data that is relevant and proportionate. The University’s partners are subject to contractual agreements which help to ensure compliance with Data Protection legislation. This will happen in the following circumstances:

• To send you a copy of our printed alumni magazine or other newsletters;
• To send you direct mail relating to our fundraising appeals;
• To maintain your contact details so that we can keep in touch by letter, email or telephone;
• To populate software used to manage our telephone campaigns;
• To assess prospective levels of giving;
• To provide consultancy services when undertaking a major fundraising appeal.
• To engage with higher education ranking/league table providers.

When DARO shares personal data as detailed above we ensure that security is maintained, using tools such as encryption and secure file transfer protocols.

Personal data is NEVER sold on to third parties.

Alumni and Supporters: How long personal data is held by the University

This information is additional to the information in Part 1 about Retention.

DARO considers its relationship with alumni, donors and other stakeholders to be life-long. This means that we will maintain a stakeholder record for you until such time as you tell us that you no longer wish us to keep in touch. In this instance the University will delete the majority of your personal data it holds, but will maintain basic personal data to ensure that we do not inadvertently create a new or duplicated record in the future.

Alumni and Supporters: How to object to the processing of your personal data

Individuals have the right to object to DARO processing their personal data for any or all of the purposes set out in this Privacy Notice; they may do so at any time. To exercise this right, please email daro.privacy@durham.ac.uk giving clear details of the processing activities and/or types of personal data to which your objection applies (see sections above for descriptions).

Alumni and Supporters: Visitors to our websites/webpages

When someone visits www.dunelm.org.uk we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be transparent about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

Alumni and Supporters: Use of cookies

A cookie is a simple text file that is stored on your computer or mobile device by a website's server and only that server will be able to retrieve or read the contents of that cookie. Cookies allow websites to remember user preferences, choices and selections, such as what's in your shopping basket. Durham University Alumni Online Community also make use of the Google Analytics service to understand how you navigate around our site.

Durham University do not use cookies to collect personal information about you.

For more information about Durham University Alumni Inline Community's use of cookies, including cookie preference and removal, please see our Cookies Policy.

Alumni and Supporters: Links to other websites

This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

Alumni and Supporters: Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated on 20 November 2018

Alumni and Supporters: Further information about this privacy notice

If you have any questions which you feel have not been covered by this Privacy Notice, please do not hesitate to email us or write to:

Senior Data Officer, Development and Alumni Relations Office, Palatine Centre, Durham, DH1 3LE

daro.privacy@durham.ac.uk