Enlitened App Privacy Notice
The Student Room Group Ltd (‘TSR’) respects your privacy and is committed to protecting your personal data when you use the Enlitened app. This privacy notice will inform you how we look after your personal data. It will also tell you about your rights and how UK data protection law protects you.
1. Data controller and Data Protection Officer (DPO)
Your university or institution is the controller for data collected through use of the Enlitened app and responsible for your personal data.
You can contact your university through the privacy notice available on their website.
TSR Postal address: International House, Queens Road, Brighton, BN1 3XE
TSR phone: 0800 999 3222
Data protection officer: Warren Oates
DPO Email address: firstname.lastname@example.org
2. Data collection and data uses
The Enlitened app tracks a student’s wellbeing and student engagement by asking them questions on a regular basis. These responses can then be processed to create a profile about the student and identify how the student is doing.
This allow for interventions to help the student, either through content suggestions in the app or other recommendations and suggestions.
Aggregation of the responses will also happen to enable the education provider to see overall wellbeing, while benchmarking will allow comparison against other universities.
Participation in the app will allow the student to gain points, which can be redeemed for discounts and vouchers.
Students will also be able to share ideas on how the education provider can do things better and vote or leave comments on other people’s ideas.
Usage of the app therefore requires the collection and processing of different types of personal data. Below are the details of the categories of personal data involved with each processing activity and the reasons for processing it.
Education provider records
● Categories of data will include some or all of:
· Contact data: full name, institution email address, student ID
· Education data: course of study, level of study (undergraduate or postgraduate), mode of study (full time or part time), fee status, campus, course start date, year group, school type
· Accommodation data: term time address, whether the accommodation is managed by the university
· Demographic data: gender, ethnicity, disability, age group, participation in HE
● Special categories of data: ethnicity, disability
● We will receive this data from your education provider to create your Enlitened profile.
● We will only receive this data if you have consented to using the Enlitened app, and to your education provider providing the data; or in situations where we are relying on carrying out a task in the public interest or legitimate interest as the legal basis for the processing.
Communications with you
● Categories of data: contact data, usage data
● We will periodically send you further emails or push notification to when there are new questions to answer, new recommended content, updates to your ideas and similar service updates for you on the app
● You will be able to opt out of these communications via links in the messages or by using the settings in the app
Enlitened questions and profiling
● Categories of data: contact opinion data, health data
● Special categories of data: health data
● When registering on the app, you will be asked to enter contact details to match you to your transferred profile.
● You will also be asked at registration for consent about how you wish your data to be used.
● Finally, registration will also ask you to select a randomly generated anonymous a username, which may be published on the app against any ideas or comments you leave.
● While using the app, we will ask you a series of questions and we will record the answers
● You have the choice to skip any question you do not wish to answer, including those asking about health data.
● The answers you provide will be processed to create a profile about how you are doing at university against a number of key indicators:
· Learning experience – how you feel about the academic side of your life at uni
· Feeling connected – how you feel about your uni relationships and community
· Wellbeing – how you feel about your well being
· Transition – how you feel about your experience joining university, or at other key transition points
· Overall engagement – combining the above
● The profiling will be used to make decisions in a number of areas including;
· deciding which questions to ask next
· recommending content to you
· deciding when to send emails and/or push notifications
· updating aggregated anonymous reporting and trend
Aggregated & anonymised reporting
● Categories of data: demographic data, education data, accommodation data, opinion data, health data
● Special categories of data: health data
● Aggregated reports will combine data from all students at an education provider to inform the education provider, via a web interface, on how their students are doing overall.
● Anonymous data may also be used in formal research to gain insights on and improve the efficacy of the Enlitened App
● We will fully anonymise these reports, removing any personal IDs
● We will also ensure breakdowns are never smaller than 5 people to avoid indirect identification
General app usage data
● Categories of data: usage data, technical data
● While using the app, we have a legitimate interest to collect standard analytics data on how the app is used in order to maintain and improve the app and the services related to it.
● This will include the times you use the app, any clicks, any screen views and general browsing habits.
● Unique device IDs may also sometimes be collected and used an additional security measure if you’ve logged in to more than one device.
● IP addresses may also sometimes be collected.
● Where possible, any personal data will be pseudonymised or fully anonymised.
Ideas, voting and comments
● Categories of data: contact details, opinions
● You will be able to share ideas on the app with your education provider and other students
● With your consent, the ideas will be published on the app for all to see, but you can choose to post anonymously.
● If you indicate support for someone else’s idea, your upvote will be recorded.
● Any comments you leave on ideas will also be published on the app, again with the option to post anonymously.
Offers and discounts
● Categories of data: usage data
● Your usage of the app will be translated in to points, which can be redeemed for discounts or offers.
● No personal data will be shared during the redeeming off points, but there is a legitimate interest to track which discounts and offers you use, in order to inform us on what we might offer in future and ensure you retain the correct number of points on your account.
Your personal data will not be used for any other purpose without your explicit consent, unless permitted or required by law.
In some cases, we may collect special categories of personal data, including ethnicity and health data. Ethnicity data will only be collected and used with your explicit consent for the purposes listed above and the giving of health data is optional.
3. International transfers
Your personal data will not be transferred outside of the European Economic Area (EEA), unless expressly included in a contract with a third-party data processor. If data is transferred outside the EEA, then adequate safeguards will be in place and details will be included in section below on sharing your data.
4. Sharing your data
We will not routinely be sharing any of the personal data we process for the Enlitened app, except in the following circumstances:
a) Third-party data processors
We may appoint a third-party data processor to carry out specific processing activities. In all uses of data processors, we will ensure contracts are in place containing all the clauses required by data protection law. To date, our data processors in place are:
● AWS (Amazon Web Services)
● AWS is a cloud data services company. The Enlitened app uses this service to store all of the data used to run the app and service.
● The chosen data centres are based in the EEA
● Google Cloud
● Google Cloud is a cloud data services company. The Enlitened app uses this service to store all of the data used to run the app and service.
● Based in the EEA and the US – transfers covered by Privacy Shield
● Google Firebase
● We use Google Firebase to identify improvements that could be made to the app as well as to report on crashes. It collects usage data and crash reporting.
● Based in the US – transfers covered by Privacy Shield
● Used to create and send emails and push notifications.
● Based in the US – transfers covered by Privacy Shield
● Professional advisors
● When necessary for legal reasons we may be required to share data with our professional advisors such as lawyers and insurers.
● Based in the EEA
b) Regulators or other authorities
Under some circumstances official regulators or other authorities may require, by law, information about our data processing activities. This will rarely require us to share personal data and would only ever share the minimum personal data that we are legally obliged to do so.
Your personal data will not be shared with any third parties outside of The Student Room Group Ltd or those listed above.
5. Data security
We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instruction and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
6. Data retention
Your personal data will be kept in the Enlitened system throughout your time as a student at your education provided and for up to 1 month after you finish (should it be needed for any purpose by you, the education provider or ourselves).
This will include all responses to questions, profiling outcomes and app usage data.
The aggregated reports are no longer classed as personal data, and so will be kept indefinitely.
There are two exceptions to this:
1) You request the deletion of all your personal data in the Enlitened system
2) There is another legal basis for keeping any of the data for longer, for example, the establishment or defence of a legal claim
7. Children’s Information
The Enlitened app is not intended to be used by people below the age of 15. In the UK a child is defined as being under the age of 13 for data protection laws.
We therefore do not knowingly process the personal data of any children. In addition, this privacy notice and other privacy information on the app has been reviewed to ensure it is understandable by people aged 15 or above.
8. Your legal rights
Under certain circumstances, you have rights under UK law in relation to your personal data. We will usually respond within one calendar month unless the request is particularly complex. We may also require more information from you to confirm your identity and ensure the security of personal data, if you exercise these rights.
● Informed: you have the right to be informed about what personal data is processed, what it is used for, why we are processing it, who is processing it and your legal rights. This privacy notice and the information provided at registration on the Enlitened app is our way of informing you of this.
● Consent: where we rely on your explicit consent as the legal basis for processing your data. You have the right to withdraw that consent at any time and object to us processing your data. This can be done via the Enlitened app.
● Access: you have a right to request a copy of the personal data we hold about you at any time. This can be done via the Enlitened app.
● Correction: you have the right to request we correct any incomplete or inaccurate data we hold about you. This can be done via the Enlitened app.
● Erasure: you have the right to request we delete any personal data we hold about you. This can be done via the Enlitened app. Sometimes this might not be possible, eg if we are required by law to keep certain records, in which case we will tell at the time of your request.
● Restriction of processing: you have the right to request we stop processing your data if:
· You want us to establish the data’s accuracy
· Where our use of the data is unlawful, but you don’t want us to delete it
· Where you need us to hold the data, even if we no longer require it, as you need to establish, exercise or defend a legal claim
· You have objected to our use of your data, but we need to verify overriding legitimate grounds.
● Objection to processing: in situation where we are relying on legitimate interests or carrying out a task in the public interest to process personal data, you have the right to object to the processing.
● Object to automatic decision making or profiling: this is the core of the Enlitened app. However, you have the right to object to this happening with your personal data at any time. This can be done via the Enlitened app.
● Data portability: you have the right to receive a copy of the personal data you have provided us with in a structured machine-readable format, should you wish to transfer it to another data controller. This only applies to the data you have provided to us and does not include any profiling we have done with that data.
You have the right to make a complaint at any time to the Information Commissioner's Office ("ICO"), the UK supervisory authority for data protection issues (www.ico.org.uk).
We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.