Enlitened App Privacy Notice

The Student Room Group Ltd (‘TSR’) respects your privacy and is committed to protecting your personal data when you use the Enlitened app. This privacy notice will inform you how we look after your personal data. It will also tell you about your rights and how UK data protection law protects you.

1. Data controller and Data Protection Officer (DPO)

Your university or institution is the controller for data collected through use of the Enlitened app and responsible for your personal data.

 

You can contact your university through the privacy notice available on their website.

 

Depending on the exact relationship, TSR is either a data processor or a data controller for data collected through use of the Enlitened app. The specific privacy policy available to you in the Enlitened app will tell you which is correct.

 

TSR Postal address: International House, Queens Road, Brighton, BN1 3XE

TSR phone: 0800 999 3222

Data protection officer: Warren Oates

DPO Email address: data.protection@thestudentroom.com

2.    Data collection and data uses

The Enlitened app tracks a student’s wellbeing and student engagement by asking them questions on a regular basis. These responses can then be processed to create a profile about the student and identify how the student is doing.

This allow for interventions to help the student, either through content suggestions in the app or other recommendations and suggestions.

Aggregation of the responses will also happen to enable the education provider to see overall wellbeing, while benchmarking will allow comparison against other universities.

Participation in the app will allow the student to gain points, which can be redeemed for discounts and vouchers.

Students will also be able to share ideas on how the education provider can do things better and vote or leave comments on other people’s ideas.

Usage of the app therefore requires the collection and processing of different types of personal data. Below are the details of the categories of personal data involved with each processing activity and the reasons for processing it.

Education provider records

      Categories of data will include some or all of:

·       Contact data: full name, institution email address, student ID

·       Education data: course of study, level of study (undergraduate or postgraduate), mode of study (full time or part time), fee status, campus, course start date, year group, school type

·       Accommodation data: term time address, whether the accommodation is managed by the university

·       Demographic data: gender, ethnicity, disability, age group, participation in HE

      Special categories of data: ethnicity, disability

      We will receive this data from your education provider to create your Enlitened profile.

      We will only receive this data if you have consented to using the Enlitened app, and to your education provider providing the data; or in situations where we are relying on carrying out a task in the public interest or legitimate interest as the legal basis for the processing.

 Communications with you

      Categories of data: contact data, usage data

      We will periodically send you further emails or push notification to when there are new questions to answer, new recommended content, updates to your ideas and similar service updates for you on the app

      You will be able to opt out of these communications via links in the messages or by using the settings in the app

 Enlitened questions and profiling

      Categories of data: contact opinion data, health data

      Special categories of data: health data

      When registering on the app, you will be asked to enter contact details to match you to your transferred profile.

      You will also be asked at registration for consent about how you wish your data to be used.

      Finally, registration will also ask you to select a randomly generated anonymous a username, which may be published on the app against any ideas or comments you leave.

      While using the app, we will ask you a series of questions and we will record the answers

      You have the choice to skip any question you do not wish to answer, including those asking about health data.

      The answers you provide will be processed to create a profile about how you are doing at university against a number of key indicators:

·       Learning experience – how you feel about the academic side of your life at uni

·       Feeling connected – how you feel about your uni relationships and community

·       Wellbeing – how you feel about your well being

·       Transition – how you feel about your experience joining university, or at other key transition points

·       Overall engagement – combining the above

      The profiling will be used to make decisions in a number of areas including;

·       deciding which questions to ask next

·       recommending content to you

·       deciding when to send emails and/or push notifications

·       updating aggregated anonymous reporting and trend

 

Aggregated & anonymised reporting

      Categories of data: demographic data, education data, accommodation data, opinion data, health data

      Special categories of data: health data

      Aggregated reports will combine data from all students at an education provider to inform the education provider, via a web interface, on how their students are doing overall.

      Anonymous data may also be used in formal research to gain insights on and improve the efficacy of the Enlitened App

      We will fully anonymise these reports, removing any personal IDs

      We will also ensure breakdowns are never smaller than 5 people to avoid indirect identification

 General app usage data

      Categories of data: usage data, technical data

      While using the app, we have a legitimate interest to collect standard analytics data on how the app is used in order to maintain and improve the app and the services related to it.

      This will include the times you use the app, any clicks, any screen views and general browsing habits.

      Unique device IDs may also sometimes be collected and used an additional security measure if you’ve logged in to more than one device.

      IP addresses may also sometimes be collected.

      Where possible, any personal data will be pseudonymised or fully anonymised.

 Ideas, voting and comments

      Categories of data: contact details, opinions

      You will be able to share ideas on the app with your education provider and other students

      With your consent, the ideas will be published on the app for all to see, but you can choose to post anonymously.

      If you indicate support for someone else’s idea, your upvote will be recorded.

      Any comments you leave on ideas will also be published on the app, again with the option to post anonymously.

 Offers and discounts

      Categories of data: usage data

      Your usage of the app will be translated in to points, which can be redeemed for discounts or offers.

      No personal data will be shared during the redeeming off points, but there is a legitimate interest to track which discounts and offers you use, in order to inform us on what we might offer in future and ensure you retain the correct number of points on your account.

 Your personal data will not be used for any other purpose without your explicit consent, unless permitted or required by law.

In some cases, we may collect special categories of personal data, including ethnicity and health data. Ethnicity data will only be collected and used with your explicit consent for the purposes listed above and the giving of health data is optional.

 

 3.    International transfers

Your personal data will not be transferred outside of the European Economic Area (EEA), unless expressly included in a contract with a third-party data processor. If data is transferred outside the EEA, then adequate safeguards will be in place and details will be included in section below on sharing your data.

 

 4.    Sharing your data

We will not routinely be sharing any of the personal data we process for the Enlitened app, except in the following circumstances:

a)     Third-party data processors

We may appoint a third-party data processor to carry out specific processing activities. In all uses of data processors, we will ensure contracts are in place containing all the clauses required by data protection law. To date, our data processors in place are:

 

      AWS (Amazon Web Services)

  AWS is a cloud data services company. The Enlitened app uses this service to store all of the data used to run the app and service.

  The chosen data centres are based in the EEA

      Google Cloud

  Google Cloud is a cloud data services company. The Enlitened app uses this service to store all of the data used to run the app and service.

  Based in the EEA and the US – transfers covered by Privacy Shield

      Google Firebase

  We use Google Firebase to identify improvements that could be made to the app as well as to report on crashes. It collects usage data and crash reporting.

  Based in the US – transfers covered by Privacy Shield

      Braze

  Used to create and send emails and push notifications.

  Based in the US – transfers covered by Privacy Shield

      Professional advisors

  When necessary for legal reasons we may be required to share data with our professional advisors such as lawyers and insurers.

  Based in the EEA

 

b)     Regulators or other authorities

Under some circumstances official regulators or other authorities may require, by law, information about our data processing activities. This will rarely require us to share personal data and would only ever share the minimum personal data that we are legally obliged to do so.

Your personal data will not be shared with any third parties outside of The Student Room Group Ltd or those listed above.

 

5.    Data security

We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instruction and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

 

6.    Data retention

Your personal data will be kept in the Enlitened system throughout your time as a student at your education provided and for up to 1 month after you finish (should it be needed for any purpose by you, the education provider or ourselves).

This will include all responses to questions, profiling outcomes and app usage data.

The aggregated reports are no longer classed as personal data, and so will be kept indefinitely.

There are two exceptions to this:

1)     You request the deletion of all your personal data in the Enlitened system

2)     There is another legal basis for keeping any of the data for longer, for example, the establishment or defence of a legal claim

7.    Children’s Information

The Enlitened app is not intended to be used by people below the age of 15. In the UK a child is defined as being under the age of 13 for data protection laws.

We therefore do not knowingly process the personal data of any children. In addition, this privacy notice and other privacy information on the app has been reviewed to ensure it is understandable by people aged 15 or above.

8.    Your legal rights

Under certain circumstances, you have rights under UK law in relation to your personal data. We will usually respond within one calendar month unless the request is particularly complex. We may also require more information from you to confirm your identity and ensure the security of personal data, if you exercise these rights.

      Informed: you have the right to be informed about what personal data is processed, what it is used for, why we are processing it, who is processing it and your legal rights. This privacy notice and the information provided at registration on the Enlitened app is our way of informing you of this.

      Consent: where we rely on your explicit consent as the legal basis for processing your data. You have the right to withdraw that consent at any time and object to us processing your data. This can be done via the Enlitened app.

      Access: you have a right to request a copy of the personal data we hold about you at any time. This can be done via the Enlitened app.

      Correction: you have the right to request we correct any incomplete or inaccurate data we hold about you. This can be done via the Enlitened app.

      Erasure: you have the right to request we delete any personal data we hold about you. This can be done via the Enlitened app. Sometimes this might not be possible, eg if we are required by law to keep certain records, in which case we will tell at the time of your request.

      Restriction of processing: you have the right to request we stop processing your data if:

·       You want us to establish the data’s accuracy

·       Where our use of the data is unlawful, but you don’t want us to delete it

·       Where you need us to hold the data, even if we no longer require it, as you need to establish, exercise or defend a legal claim

·       You have objected to our use of your data, but we need to verify overriding legitimate grounds.

      Objection to processing: in situation where we are relying on legitimate interests or carrying out a task in the public interest to process personal data, you have the right to object to the processing.

      Object to automatic decision making or profiling: this is the core of the Enlitened app. However, you have the right to object to this happening with your personal data at any time. This can be done via the Enlitened app.

      Data portability: you have the right to receive a copy of the personal data you have provided us with in a structured machine-readable format, should you wish to transfer it to another data controller. This only applies to the data you have provided to us and does not include any profiling we have done with that data.

 

You have the right to make a complaint at any time to the Information Commissioner's Office ("ICO"), the UK supervisory authority for data protection issues (www.ico.org.uk).

We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.