Students Privacy and Collection Statement

A. What is the purpose of this document?

The University of Divinity is committed to protecting the privacy and security of your personal information (‘personal data’).

This Privacy and Collection Statement describes how we collect and use your personal data during and after your studies with us, in accordance with the Australian Privacy Principles (APPs), the General Data Protection Regulation (GDPR) and related Australian data protection legislation.

It applies to all individuals who have or have had a contract for study with the University of Divinity including all current and former undergraduate and postgraduate students. It is important that you read this Privacy and Collection Statement, together with any other privacy policy or statement we may provide on specific occasions when we are collecting or processing information about you, so that you are aware of how and why we are using the information. We may update this Privacy and Collection Statement at any time.

Information about how we use the data of former students for alumni relations or fund raising purposes is covered in a separate document.

In addition, each College will have its own privacy framework.

B. Glossary

Where we refer in this Privacy and Collection Statement to your ‘personal data’, we mean any recorded information that is about you and from which you can be identified, whether directly or indirectly. It does not include data where your identity has been removed (anonymous data).

Where we refer to the ‘processing’ of your personal data, we mean anything that we do with that information, including collection, use, storage, disclosure, deletion or retention.

C. Who is using your personal data?

The University of Divinity is the “Australian Privacy Principles entity” or “data controller” for the information that we hold about you as a current or former student. This means that we decide how to use it and are responsible for looking after it in accordance with relevant legislation.

Access to your student record and other data will be provided to the University’s academic and support staff, including those based in Schools and Colleges, who need to view it as part of their work in carrying out the purposes set out in Section F. It will also be shared with the third parties described in Section H.

D. The types of data we hold about you

As a current student of the University, we will keep a record of the details you provided in your application and any supporting documents requested as part of your admission. This will become part of your student record. Your student record also includes information about academic progress and standing, exclusion, assignments and examinations, results and details of practical and clinical placements (if applicable to your course of study). It will also unique personal identifiers assigned to you (e.g. your student number) and details of any disciplinary or conduct issues.

We process personal data directly from you through a variety of forms, including about your use of the University’s academic and non‐academic facilities, and services that we offer to you as a student of the University, when you agree to participate in user experience research or provide feedback and during our communications with you.

The information we hold about you may include, but is not limited to, the following:

Personal details such as name, title, address, telephone number, email address, marital status, nationality, date of birth, sex and gender identity, ID Photograph, household income, parental status, details of dependants;
Emergency contact information;
Unique Student Identifier (USI);
Tax File Number (required if fees are to be put on HELP);
Commonwealth Higher Education Student Support Number (CHESSN);
Education information (including the school(s) and other colleges or universities you have attended, the courses you have completed, dates of study and examination results);
Other personal and socio‐economic background information collected during the admissions process, e.g. country of origin, languages spoken, citizenship and details of your parents’ education;
Admissions records, including information such as your test and interview scores and admission decisions;
Examination records (including records relating to assessments of your work, details of examinations taken, and your predicted and actual examination grades);
Information captured in your student record including progression, achievement of milestones and progression reports;
Visa, passport and immigration information;
Fees and financial support record (including records relating to the fees paid, transactions and financial support, scholarships, and sponsorship);
Supervision, teaching, and tutorial activities including engagement with online tools such as the VLE; and training needs analysis and skills acquisition records;
Recordings of teaching and learning or research activities in which you were aparticipant
Placement and internship record or study at another institution as an established component of your course of studies, or career development opportunity;
Your feedback on course provision, university services and the student experience, collected through surveys, focus groups and other activities;
Information about your use of library facilities, including borrowing and fines;
Information about your involvement in any University procedure, including the disciplinary procedure (which includes academic and non‐academic misconduct), the academic appeals, complaints, fitness to study, fitness to practise, fitness to teach and academic integrity procedures and applications for extensions, periods of suspension or dispensations from regulations;
Attendance records at University degree and award ceremonies;
Photographic and video graphic data taken at events captured for the purpose of livestreaming and future publicity materials;
Information about your use of our information and communications systems, including your communication preferences and your website and system interaction (cookies and similar technologies); and
Information gathered through CCTV and building access information.

As part of this, we may process the following “special categories” of more sensitive personal data:

Information about your race or ethnicity and your religion and beliefs;
Information about your health, including any disability and/or medical conditions;

Where you provide the University with the personal data of others (e.g. emergency contact details) you are encouraged to inform them that:

you are disclosing that information to the University;
the information will be retained; and
they can access that information by contacting the University’s Data Protection and Privacy Office.

Your personal data is created, stored and transmitted securely in a variety of paper and electronic formats. This includes databases that are shared across the University. Access to your personal data is limited to University and University affiliates’ representatives who have a legitimate interest in it for the purpose of carrying out their duties.

E. How the University Obtained Your Data

We collect the vast majority of the information directly from you, through the application process and during online registration. We may also collect additional information from third parties, including colleges, former schools and higher education institutions, and government departments and agencies, or information which is in the public domain. We will collect and generate additional information about you throughout the period of your study.

F. How the University Uses Your Data

We use your data for a number of purposes connected with your studies, including, but not limited to, the provision of:

teaching, academic assessment and supervision;
welfare and pastoral support including ensuring the health and safety of students, staff and others;
funding and financial support;
support services (such as course advice, careers and language and academic development);
research related administration to support our equality responsibilities, quality assurance and planning processes;
the administration of University procedures including in relation to discipline, complaints, appeals, academic integrity, fitness to study, applications for extensions and/or suspension;
supporting the provision of facilities and services e.g. access to IT facilities, libraries, etc.; and
understanding the educational and wider student experience and evaluating the University’s projects and activities in relation to admissions, outreach, teaching and learning and the student experience.

We set out below those circumstances where it is necessary for us to use your data. (These cir‐ cumstances are not mutually exclusive; we may use the same information under more than one heading.)

F1. Because we have a contract with you

We need to process your data in order to meet our obligations or exercise rights under our contract with you. Information processed for this purpose includes, but is not limited to, the data listed in section D. We also need to process your data under this heading where the University is working with a third party in order to offer you services, for example, those offered by the LibraryHub, sponsors (such as research councils) or scholarship benefactors. See section H for further information on the sharing of data with third parties.

F2. Where it is necessary to meet a task in the public interest

As indicated above, we need to process your data for the purpose of teaching and related activities, such as academic assessment and supervision. This may include processing data within the Digital Learning Environment ARK (DLE). Information provided to regulatory bodies is also provided for this purpose. Teaching is a task that we perform in the public interest in order to fulfil our responsibility as a charity for promoting the advancement of learning. Information processed under this heading includes, but is not limited to, the data listed in section D.

F3. Where we need to comply with a legal obligation

Information processed for this purpose includes, but is not limited to, information relating to the monitoring of equal opportunities. We are also required by law to provide data to various Australian Government departments through the Department of Education and Tertiary Collection of Student Information (TCSI).

F4. Where it is necessary to meet our legitimate interests

We need to process your data in order to meet our legitimate interests relating to student administration, alumni relations, business continuity or similar activities; or to meet the legitimate interests of others. Examples include, but are not limited to, the following:

we pass your home address to the University’s colleges to assist with their outreach projects;
- we may use email addresses to contact students to invite them to make use of opportunities related to their studies, and other university‐related activities;
we use your phone and email address for system authentication and access;
we pass your contact details to the University’s Alumni Office so that they can contact you about their activities before you leave the University; and
we use your data held within our student records systems for system testing, training and support purposes, allowing us to provide support to users across the University and to maintain effective upkeep of our records systems.

F5. Where we have your consent

There may be situations where we ask for your consent to process your data e.g. where we ask you to volunteer information about yourself for a survey or where we ask for your permission to share sensitive information. For example, the University’s School of Indigenous Studies aims to increase opportunities for access for students who, historically, have been underrepresented at the University, and, to monitor and improve this, the University collects data (from applicants and students) including information on your racial or ethnic origin, health/disabilities, previous education, socio‐economic background and academic progress at University.

F6. Where it is necessary in order to protect your vital interests or the vital interests of another person

There may be circumstances in which it is necessary for us to process your data to protect an interest which is essential for your life or that of another person or where the processing serves important grounds of public interest and your vital interests for example, humanitarian purposes which may include monitoring epidemics and their spread or in emergencies where there is a risk of serious harm or death to yourself or others.

If you fail to provide personal information under F1 or F3 above

If you fail to provide certain information when requested under the circumstances described in F1 and F3 above, we may not be able to meet our contractual obligations to you or comply with our other legal obligations.

Change of purpose

We will only process your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will seek your consent to use it for that new purpose. Please note that we may process your data without your knowledge or consent, where this is required or permitted by law.

G. Special Category Data

Special category data require a higher level of protection. Listed below are examples of processing activities that we regularly undertake in respect of these types of data. In addition to the activities listed below, it may sometimes be necessary to process this sort of information for exceptional reasons, for example, because it is necessary to protect your vital interests (including in relation to health and safety) or those of another person or for safeguarding purposes. This may include sharing such data with third parties as identified in section H below. In some instances (for example responding to a request from police investigating an alleged criminal offence) this may be necessary even if data has been provided to the University in confidence.

G1. Health (Including disability)

We will process data about your health where it is necessary to make reasonable adjustments for disability and/or to monitor equal opportunities, for example to arrange reasonable adjustments for examinations or use of facilities such as libraries. Processing of this nature is necessary to meet contractual or other legal obligations. We may also process data about your health in accordance with the terms of our contract with you, to protect our legitimate interests and/or to comply with legal obligations where it is relevant to a particular University procedure, including the disciplinary, complaints appeals, fitness to study or in relation to an application you have made for a suspension, extension or dispensation, or where the outcome of such a procedure is referred to a regulatory body. There may be situations where we ask for your explicit consent to process or share information about your health, e.g. as part of an internal monitoring project. There may also be limited circumstances where your health and safety, or that of others, is at serious risk where your health data may need to be shared whether or not you have given consent (subject to data minimisation, limiting recipients of such data to those people or agencies able to assist (e.g. Department of Health or emergency services staff) or pseudonymisation where possible). Examples of these limited circumstances include: (a) Where you are at risk of causing serious harm to yourself or others (e.g. threats or attempts at suicide or violence to yourself or others) and (b) as a result of testing positive for any other serious and easily transmissible infectious illness (including Covid‐19) where track and trace or other health and safety measures must be taken.

G2. Racial or ethnic origin and religion and beliefs

Data about your racial and ethnic origin, and religion and beliefs will only be processed where you have volunteered it, including in order to identify your eligibility for certain scholarships in accordance with our legitimate interests, and/or where we need to process it in order to meet our statutory obligations under equality and/or other legislation, and/or where you consent. We may also process data about your racial or ethnic origin and/or religious belief in accordance with the terms of our contract with you, to protect our legitimate interests and/or to comply with legal obligations where it is relevant to a particular University procedure, including the disciplinary, complaints or appeals procedures (for example, in relation to an allegation of racially motivated harassment) or where the outcome of such a procedure is referred to a regulatory body. This processing is considered to meet a substantial public interest, and will be subject to suitable safeguards.

H. Data Sharing with Third Parties

In order to perform our contractual and other legal responsibilities or purposes, we may, from time to time, need to share your information with the following types of organisation:

Colleges;
External institutions or organisations that the University has collaboration or partnership agreements with (e.g. organisations where some students complete placements or who deliver specialised units);
External organisations providing services to us, such as those providing student records services and the VLE;
External organisations offering University‐sponsored services including student surveys;
External libraries with an affiliate relationship with the University;
Your funders and/or sponsors, including research councils;
If you have or are seeking a particular relationship with a third party, for example, other universities or schools;
Employers or prospective employers and other educational institutions;
The Department of Education and TCSI. These use your data to provide information on higher education and share your data with public authorities to carry out statutory or public functions;
Relevant public bodies and law enforcement authorities, including but not limited to the Department of Home Affairs; the Australian Tax Office; the Police (including in relation to investigations into alleged criminal offences); and local authorities;
In limited circumstances, to respond to a valid request under the Freedom of Information Act.

Where information is shared with third parties, we will seek to share the minimum amount necessary. For example, we may in appropriate cases share only your student number and not your name (this is known as pseudonymisation).

All third‐party service providers that process data on our behalf are required to take appropriate security measures to protect your data in line with our policies. We do not allow them to use your data for their own purposes. We permit them to process your data only for specified purposes and in accordance with our instructions.

I. Transfers of Your Data Overseas

There may be occasions when we transfer your data overseas, for example, if we communicate with you using a cloud based service provider that operates outside Australia. Such transfers will only take place if one of the following applies:

the country receiving the data is considered by Australia to provide an adequate level of data protection;
the organisation receiving the data is covered by an arrangement recognised by Australia as providing an adequate standard of data protection e.g. transfers to companies that are certified under the EU US Privacy Shield;
the transfer is governed by approved contractual clauses;
the transfer has your consent;
the transfer is necessary for the performance of a contract with you or to take steps requested by you prior to entering into that contract;
the transfer is necessary for the performance of a contract with another person, which is in your interests;
the transfer is necessary in order to protect your vital interests or of those of other persons, where you or other persons are incapable of giving consent;
the transfer is necessary for the exercise of legal claims; or
the transfer is necessary for important reasons of public interest.

K. Retention Period

We will retain your data only for as long as we need it to meet our purposes, including any relating to legal, accounting, or reporting requirements.

Details of the retention periods for different types of student data are available on the University policy webpages.

L. Your Rights

In addition to your rights to access and correct your personal data and lodge a complaint relating to how we handle your personal data, if the GDPR applies, you may, under certain conditions, have the following rights available:

to object to any processing of your personal data that we process on the lawful basis of legitimate interests, unless our reasons for the underlying processing outweighs your interests, rights and freedoms;
to withdraw your consent where we have processed any of your personal data based on consent;
to object to direct marketing (including any profiling) at anytime;
to ask us to delete personal data that we no longer have lawful grounds to process; and
to object to the use of automated decision making.

M. Keeping Your Data Up-to-Date

It is your responsibility to check and ensure that your personal data is kept up‐to‐date. This is important in enabling us to be certain that the data we hold about you is accurate and current.

N. Changes to this Privacy and Collection Statement

We reserve the right to update this Privacy and Collection Statement at any time, and will seek to inform you of any substantial changes. We may also notify you in other ways from time to time about the processing of your personal data.