The University is required to inform you how personal data collected by you will be used and to provide other information, including details of with whom personal data may be shared and your rights.
The identity and the contact details of the controller
University of St Andrews, College Gate, North Street, St Andrews, KY16 9AJ, Fife, Scotland, UK. The University is a charity registered in Scotland, No SC013532.
Mr Christopher Milne, Head of Information Assurance and Governance, University of St Andrews, Butts Wynd, North Street, St Andrews, KY16 9AJ, Fife. Email email@example.com
Then University will use your personal data to provide you with the services and facilities which you have booked/requested of us. This includes:
Managing your stay with us.
Name and contact details that were provided when an arrangement stay with us was made.
All guests, aged over 16 years of age will be required to complete a registration card with their name and nationality. Guests who are not citizens of the: Commonwealth; Territories protected by the Crown or the Republic of Ireland, will be required to provide additional details i.e. the number and place of issue of their passport, certificate of registration or other document establishing identity and nationality; and details of their next destination if it is known.
Your name, contact and bank details will be used to process payments for services provided by the University. The University will pass credit/debit card details to a third party payment provider, who will process payments.
The legal bases for processing personal data
- Booking details – contract or preparation for entry into a contract; and
- Guest registration – Legal obligation.
|Disclosure to for the purposes of||Details|
|University staff and or agents/suppliers of the University; to prepare for and manage your stay at the University.||Booking details.|
|Payment processor||Bank/credit card details.|
|Law enforcement agencies; inspection of guest registrations.||Guest registration details.|
The period for which personal data will be stored, or if that is not possible, the criteria used to determine that period
The University will retain customer/booking data for a period of 6 years, after which time records will be destroyed.
Guest registration cards will be destroyed 12 months after the period of residency has ended.
European and UK data protection legislation provides individuals with a number of rights regarding the management of their personal data, in relation to guests making use of University accommodation your rights are:
- The right of access to your personal data, commonly referred to as a subject access request, which involves the following being carried out within a calendar month:
- Confirmation that personal data is being processed.
- Access being given to your personal data (provision of a copy), unless an exemption(s) applies; and
- The provision of supplementary information e.g. an explanation of how your personal data is processed and who this is shared with.
- The right to rectification, which may involve:
- The University working to correct any inaccuracies in personal data or to address any omissions, which may require personal data to be annotated to acknowledge that this is incomplete.
- The right to erasure (the deletion of personal data, in specific circumstances), which is commonly referred to as the right to be forgotten, which may involve:
- The University destroying specific personal data. However, that right does not extend to guest registration records, as the University is required by law to collect and retain those details.
- The right to restrict processing, which may involve:
- The University agreeing to stop making use of your personal data where those data are contested, in terms of accuracy.
- The right to data portability, which may involve:
- The University providing you with a copy of elements of your personal data that exist in machine readable form that you have given to the University.
- The right to object. Individuals have the right to object to the University making use of contact details for direct marketing – in such circumstances the use of personal data must stop when an objection is received.
These rights have to be met by the University and any other organisation that takes decisions about how or why your personal data is used. Details on how to access those rights are available from the University website, or you can contact firstname.lastname@example.org.
The University may ask you for your permission to be contacted in the future, via any contact details you have provided to:
- Ask you about your stay and your experience, to help us improve the quality of our services and the customer experience guest surveys; and
- Provide you with details of accommodation services and offers.
Consent is optional. Individuals are under no compulsion to provide their consent, and where consent is provided, you will have the right to withdraw consent at any time, from which point the University’s use of your personal data will stop.
If you believe that the University has not made use of your personal data, in line with the requirements of the law, you have the right to raise this with the regulator i.e. the UK Information Commissioner Office’s (“the ICO”).
Details on how to contact the ICO are available online, at:
Contractual requirement to provide personal data and the consequence where no personal data are provided
In order to secure accommodation from the University, you must provide details about you and fellow guests in order to secure facilities.
This Privacy Notice will be reviewed at regular intervals. Any significant change to relevant legislation, University policy or procedures primarily concerned with the protection of personal data may trigger an earlier review.
This Privacy Notice will be published on the University website; a summary of this notice will have been provided when individual’s make accommodation bookings. Copies will also be available from the University on request.
Should a copy of this Privacy Notice be required in another form, including orally i.e. an audio recording, please contact email@example.com.