Executive Education Privacy Notice

What data do we hold and why?

The type of personal data the University may process about you includes:

• Contact details – for example your full name, email address, telephone number, your address including city and/or country of residence, job role, sector and job title, company name and invoice address.
• Your LinkedIn Profile
• If you are over or under the age of 18.
• Optional marketing preferences (follow-ups to enquiries or expressions of interest/alumni membership/ future event promotion).
• Proof of University of Exeter education obtainment, if applicable (to demonstrate Alumni status for discount rate).
• Your academic submissions.
• Your course attendance.
• How your studies are funded, including fee information and any sponsorship details.
• Any information you choose to give us about your personal circumstances that may be relevant to your enquiry or registration which may include sensitive personal data.
• Any special requirements you have for communication methods, building access or parking for workshops and events so that we can meet any individual needs.

How we source and maintain this data

This data will be gathered from our Enquiry Form or Registration Forms online, the company supporting your learning, from information you supply by email and/or by telephone or any other contact channel you have used including social media and organisations we are contracted to deliver programmes through.

We are required to ensure that data we hold about you is as accurate as possible; therefore we may update your details based on reliable publicly available sources. For example, we may update your address, telephone number or business details. We will also update your details whenever you tell us they have changed.

We use a wide variety of sources either directly or via internet search engines, some on a subscription basis, to augment, update and validate the data we hold about you. Where relevant to your enquiry, these may include:

• LinkedIn
• Twitter/X
• Reliable news and press reports
• Companies House and other business-related resources including company websites

We will retain your data for the duration of your relationship with the University, unless it needs to be kept for a longer period for another legitimate purpose or until you ask us to do otherwise and we have no other valid legal reason to retain it.

If you visit our website we may use cookies to store information about your visit to recognise your preferences, track progress through online applications and make content and our online advertisements more relevant to you.

Special category personal data

In some circumstances, we may collect and process special category personal data that you choose to provide to us. This may include information relating to health conditions, disabilities, accessibility requirements, dietary requirements, religious beliefs or other information necessary to support your participation in a programme, event or activity.

We will only process special category personal data where there is a lawful basis to do so under UK data protection legislation. This will normally be because:

• You have provided your explicit consent;
• The processing is necessary to provide reasonable adjustments, support services or accessibility arrangements;
• The processing is necessary for reasons of substantial public interest; or
• Another lawful condition under Article 9 UK GDPR applies.

We ask that you only provide special category personal data where it is relevant to your participation in the programme or where requested by the University.

How do we use your data?

Your personal data is collected to enable the University to fulfil its contractual obligations.

The University collects your personal data from the following sources:

• Information contained on your Expression of Interest and/or Registration Form through our website or through a digital advertisement or posts on social media
• Information contained on your shortlist application form
• Information provided by you in relation to your studies
• Information provided by your company for engagement in any bespoke programme contracted with them.
• To record certain online programmes. Please note that before recording, your consent will be sought, and you will have the opportunity to opt-out of the recording
• Course feedback surveys.

These are some of the ways we will use your personal data:

Please note that this list is not exhaustive:

• To provide you with any information you have requested about the courses you have applied for or expressed an interest in. Where appropriate you will be given the opportunity to opt-out of receiving continued communications from us should you no longer be interested in the course/s you requested further information or registered for.
• The administration and delivery of the course.
• To communicate effectively with you by email, phone, post and social media channels including the distribution of relevant newsletters containing information we consider necessary to support your experience at The University of Exeter. Where appropriate you will be given the opportunity to opt-out of receiving some communications from us.
• We may also contact you by social media channels and applications where you have joined social networks set up specifically for your programme or initiated contact with us in this way.
• We may use personal data (where anonymisation is not possible) for management and organisational planning including statistical analysis to enhance your educational experience at the University.

This processing is necessary for:

• The performance of the contract in place between you and the University for the administration and delivery of the course.

How will we share your data?

Your data may be shared with other Directorates and Colleges at the University of Exeter in order for you to benefit from wider opportunities and services

In processing your personal data and/or sensitive personal data, the University may have reason to share your personal data and/or sensitive personal data with a third party. Some of these circumstances are as follows:

• Limited data will be shared with the organisation who you indicate on your registration form will be financing your course. This will only be information necessary to confirm your place and ensure appropriate funding.
• Should you fall into arrears of payment to the University, we may disclose your personal data to a third party (e.g. solicitors, debt recovery agents, Courts) to help pursue and recover the debt.
• It might be necessary to share your name, registration, email address and further limited details such as whether the course was successfully completed with your employer.
• We may use third-party supplier applications to provide IT or Learning Platform services on our behalf. The data sharing with the third-party suppliers will operate in accordance with appropriate data privacy laws and regulations.
• Where you enrol in a programme which we are contracted to deliver by another party. In such circumstances a separate enquiry or registration form may be used with links to an alternate set of policies.  

The University does not sell data to third parties or allow third parties to sell on data where data is shared with them.

International transfers

Some of the University's third-party service providers, including providers of learning platforms, customer relationship management systems, social media platforms and cloud-based services, may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, the University will ensure that appropriate safeguards are in place to protect your personal data in accordance with applicable data protection legislation. These safeguards may include transfers to countries recognised as providing an adequate level of protection for personal data or the use of approved contractual safeguards.

Further information about international data transfers and the safeguards used by the University is available on request from the University's Data Protection Officer.

How long do we store your data?

The University retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to meet our legal, regulatory and operational requirements.

Enquiry data

If you enquire about a Professional Education or CPD programme but do not register, we will retain your personal data for two years after the end of the calendar year in which your enquiry was made. This allows us to respond to ongoing enquiries, provide information about relevant programmes and maintain records of our engagement with prospective learners.

Programme participant data

If you enrol on a Professional Education or CPD programme, we will retain your personal data for the duration of your relationship with the University and thereafter in accordance with the University's Records Retention Schedule. This may include retaining records relating to attendance, assessment outcomes, certification and programme administration.

Financial and invoicing records

Information relating to fees, payments, sponsorship and invoicing will be retained for the period required by applicable financial, accounting and legal obligations.

Marketing data

Where you have consented to receive marketing communications, we will retain your marketing preferences until you withdraw your consent or unsubscribe from communications. We will maintain a minimal suppression record where necessary to ensure your preferences are respected.

Recorded sessions, webinars and presentations

Recordings of webinars, presentations and online learning sessions will normally be retained for two years following the end of the programme cohort, unless a longer retention period is required for educational purposes or a shorter period is requested and can be accommodated.

When the applicable retention period expires, personal data will be securely deleted, anonymised or otherwise disposed of in accordance with the University's Records Retention Policy.

How do we protect your data?

Your data is held securely on the University’s Executive Education SharePoint site or the university's CRM (Customer Relationship Management system).

The sites are accessible to a limited number of University staff. All staff who access the site have completed the University’s data protection training.

Your rights and preferences

The University may contact you by telephone, text, post, email or other electronic means as you have previously consented. If you no longer want to receive communications by the above, please contact Executive Education at executive-education@exeter.ac.uk.

When contacting us, please provide your name, organisation name (if appropriate), address (if appropriate) and email address. Please also specify if you wish to unsubscribe from all communications or from specific communication types or channels. If you ask us to delete your data, we will remove your data from the appropriate databases.

You have the right to:

• Request to see, correct or delete the data we hold about you
• Object to specific data uses, as described above
• Object to receiving communications and direct marketing
• Ask for the transfer of your data electronically to a third party

The University’s Data Protection Officer (DPO) is responsible for monitoring compliance with relevant legislation in relation to personal data and can be contacted at informationgovernance@exeter.ac.uk. You can also contact the DPO if you have any queries or concerns about the University’s processing of your personal data. You have the right to lodge a complaint with the Information Commissioner’s Office.

Additional rights

In addition to the rights listed above, you also have the right to:

• Request that the University restrict the processing of your personal data in certain circumstances.
• Withdraw your consent at any time where processing is based on consent.
• Request information about any automated decision-making or profiling carried out by the University.
• Complain to the Information Commissioner's Office (ICO) if you believe your personal data has been processed unlawfully.

Legal basis for processing personal data

The University processes your personal data under one or more of the following lawful bases:

• Steps prior to entering into a contract: where you enquire about, apply for, or express an interest in a Professional Education or CPD programme.
• Performance of a contract: where processing is necessary to administer, deliver and manage your participation in a programme, including communications, assessments, attendance records, certification and fee administration.
• Legal obligation: where the University is required to comply with legal or regulatory requirements.
• Legitimate interests: where processing is necessary for the University's legitimate interests, including service improvement, programme evaluation, business development, statistical analysis, maintaining accurate records, fraud prevention and maintaining relationships with learners and sponsoring organisations.
• Consent: where you have chosen to receive marketing communications, participate in recordings, or where consent is otherwise required by law.

You may withdraw consent at any time where consent is the basis for processing. This will not affect the lawfulness of any processing carried out before consent was withdrawn.