1. Introduction
The Reflect Service, (“we” “us”, or “our”) respects your privacy and is committed to protecting your personal data.
Please read this Privacy Notice carefully – it describes why and how we collect and use personal data and provides information about your rights. It applies to personal data provided to us, both by individuals themselves or by third parties and supplements the following wider UCL privacy notice(s):
- General privacy notice when you visit UCL’s website
We keep this Privacy Notice under regular review. It was last updated on August 2018.
2. About us
The Reflect Service is part of the Information Services Division at University College London (UCL - University College London, Gower Street, London WC1E 6BT Tel: +44 (0) 20 7679 2000 )
UCL, a company incorporated by Royal Charter (number RC 000631), is the entity that determines how and why your personal data is processed. This means that UCL is the ‘controller’ of your personal data for the purposes of data protection law.
3. Personal data that we collect about you
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you. This may include:
- Your name, email address, UCL ISD userid and password.
- The names and other details about third parties who are involved in the issues we are helping you with.
4. How we use your personal data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- To register you on the Reflect service and manage access to the platform and content.
- To help you with your enquiry.
We may also use anonymised data, meaning data from which you cannot be identified, for the purposes of:
- Service evaluation;
- Education and research; or
- Fundraising and promotional purposes.
Anonymised data may also be used in published reports or journals and at conferences.
5. Who we share your personal data with
Your personal data will be collected and processed primarily by our staff and UCL (Access to your personal information is limited to staff who have a legitimate need to see it for the purpose of carrying out their job at UCL.). We may have to share your personal data with the parties set out below for the purposes outlined in section 4:
- CampusPress – subsidiary of Incsub.com. You can find their privacy policy detailed here: https://campuspress.com/docs/privacy-policy/
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes – we only permit them to process your personal data for specified purposes and in accordance with our instructions.
6. International transfers
We, and third party listed above, do not transfer your personal data outside the European Economic Area (EEA)
7. Information security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have established procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
8. Data retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
We will keep your personal data according to the Records Retention Schedule.
9. Your rights
Under certain circumstances, you may have the following rights under data protection legislation in relation to your personal data:
- Right to request access to your personal data;
- Right to request correction of your personal data;
- Right to request erasure of your personal data;
- Right to object to processing of your personal data;
- Right to request restriction of the processing your personal data;
- Right to request the transfer of your personal data; and
- Right to withdraw consent.
If you wish to exercise any of these rights, please contact the Data Protection Officer.
Contacting us
You can contact UCL by telephoning +44 (0)20 7679 2000 or by writing to: University College London, Gower Street, London WC1E 6BT.
Please note that UCL has appointed a Data Protection Officer. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact our Data Protection Officer using the details set out below:
- Data Protection & Freedom of Information Officer: data-protection@ucl.ac.uk
10. Complaints
If you wish to complain about our use of personal data, please send an email with the details of your complaint to the Data Protection Officer so that we can look into the issue and respond to you.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) (the UK data protection regulator). For further information on your rights and how to complain to the ICO, please refer to the ICO website.
The name and contact details of your organization : University College London, Gower Street, London WC1E 6BT Tel: +44 (0) 20 7679 2000 | ✓ |
The name and contact details of your representative : Annora Eyt Dessus, Digital Education Services Specialist UCL Information Services Division | ✓ |
The contact details of your Data Protection Officer (email and address) : Lee Shailer, Data Protection and Freedom of Information Officer 020 3108 8726 (internal ext 58726) | ✓ |
The purposes of the processing: The blogging Service is used as a platform to showcase student work, as a teaching and learning tool and a blog may be part of course assessment towards attainment of the academic degree. | ✓ |
The lawful basis of the processing: The basis of lawful processing is public task. This work can be used for or form part of UCL research work for various students or academics. | ✓ |
The legitimate interests for the processing (if any) | |
The categories of personal data obtained: Name, email address, User ID and password | ✓ |
The recipients or categories of recipients of the personal data: UCL via CampusPress Network | ✓ |
The details of transfers of the personal data to any third countries or international countries: N/A | ✓ |
The retention periods for the personal data (see if your processing is covered under UCLs record retention schedule) | ✓ |
The rights available to individuals in respect of the processing:
| ✓ |
The right to withdraw consent (if consent is the basis of processing) | |
The right to lodge a complaint with the ICO: | ✓ |
The source of the personal data (if required): The personal data is taken at logon to the Blogging service and also when user subscribe to a blog on the service. | ✓ |
The details of whether individuals are under a statutory or contractual obligation to provide the personal data: Students may be required by their teachers to join a class blog. For personal blogs this is voluntary and staff and students choose whether or not they would like to setup a blog. | ✓ |
The details of the existence of automated decision-making, incliding profiling |