Students Privacy Notice

The IOU needs to collect and process personal data in order to process your admission, respond to your queries, provide academic services, manage  operations effectively, and meet regulatory and legal requirements. The IOU’s legal title is International Open University registered in The Gambia.

This document explains how we use the personal data of Students. It includes information required by the General Data Protection Regulation (EU Regulation 2016/679) and related data protection legislation.

We have separate privacy notices for Enquirers and Website Users (Enquirers and Website Users Privacy Notice) and alumni (Supporters and Alumni Privacy Notice).

Policy

1. The IOU is the data controller in relation to the processing activities described below. This means that the IOU decides why and how your personal information is processed.
2. As soon as you contact us or register with us, we create a record in your name. We then add to that record information that you give us whenever you contact us and information that you give us when reserving, registering or enrolling and throughout your studies. We keep records of your participation in academic programs and use the data in numerical form for our statistical and marketing analysis.
3. We hold general information about you, such as your name and contact details, details of enquiries made, program courses and qualifications studied and fee payments, as well as data relating to examinations, assessments and course results. You may give us information about “special categories” of data, if they are relevant to an enquiry. These include your racial or ethnic origin, religious beliefs, physical or mental health or sexual orientation. You might also give us information about criminal offences or criminal proceedings.
4. We automatically collect information about your participation in online learning and assessment activities, your use of module and related websites, and all forms of assessment activities (, module tests, assignments, exams, etc.). We will also add to your record any activities that you carry out on our website.. If you use an IOU email address, then we collect log data about your use of the service. We may automatically collect technical information when you browse our website. Please see our [Cookies Policy] for further information. We keep record of chat conversations and monitor other communications between you and the IOU to make sure that we have carried out your instructions correctly and to help us improve our services through staff training. If you receive email marketing communications, we record if you open them.
5. We may receive information about you from third parties.
6. We may contact other educational institutions to confirm the qualifications you have obtained.
7. If your fees are paid by a funding authority or government agency, such as a loan or grant, we will receive basic information from the funding provider. If your fees are paid by another organisation, they may provide some information about you to us.
8. If not currently studying, we may enhance our records with data received about you from third parties, in order to ensure we have up to date contact details for you, and in order to offer you more relevant communications. We will only send you marketing communications if your communications preferences allow this.
9. We collect and process a broad range of personal data about you in order to deliver our services and support you, to manage our operations effectively, and to meet our legal requirements.
10. If you do not provide some of the information we need at registration, then we may not be able to effectively provide administration or support services to enable you to succeed in your studies.
11. We use your “special categories” of data for activities including: equal opportunities monitoring, identifying if you need support, informing academic research, providing you with relevant opportunities, and ensuring that views of students with specific protected characteristics are represented. Information about any disabilities and special requirements you have will also be used to inform the provision of reasonable adjustments and other provisions for your study.
12. You may submit additional “special category” information to us, for example medical evidence for funding, information about your religion relating to special circumstances for an examination, or information pertinent to an enquiry or complaint. We only use this information for the purpose for which it was provided.
13. Further information on the purposes we use your information for is provided in Appendix 1
14. We are committed to the data protection principles of good practice for handling information. All personal information is held securely and we will only transfer data within the IOU on a restricted basis so that we can support our academic and other services to you.
15. We will contact you in connection with your studies or for administration or support purposes. We may also send you marketing information, or invite you to take part in research to improve our services. If you do not wish to receive these communications, you can change your communications preferences by contacting the Data Protection Officer whose details appear below.
16. We share data with a number of organisations for specific purposes. For example,
    • We share data with other organisations where we have a legal or regulatory obligation to do this, for example with the [ … ], and with government departments.
    • We share data with organisations that provide funding,
    • We may disclose your information to our third-­party service providers and agents for the purposes of providing services to us, or directly to you on our behalf. When we use third party service providers, we only disclose to them any personal information that is necessary for them to provide their service. We have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.
    • If you are studying towards a qualification that leads to professional recognition we may share some information with the relevant professional body.
17. Further information on who we share your personal information with is available in Appendix 2
18. We may transfer your personal information to a successor entity if the IOU ceases to exist. We may also transfer your personal information if we are under a duty to disclose or share it in order to comply with legal obligations, to detect or report a crime, to enforce or apply the terms of our contracts or to protect the rights, property or safety of our enquirers, visitors and students. However, we will always take steps with the aim of ensuring that your privacy rights continue to be protected.
19. Generally, information you provide to us is stored on our secured servers or on our cloud­ based systems which are located in different regions in Europe and America.
20. If you are based in the European Economic Area (‘EEA’) and we transfer your data outside of the EEA, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as set out in this policy. These steps include imposing contractual obligations on the recipient of your personal data, or ensuring that the recipients are subscribed to ‘international frameworks’ that aim to ensure adequate protection. For instance, […]
21. If we collect your personal information the length of time we keep it for is determined by a number of factors including our purpose for using the information and our legal obligations.
22. We have a retention schedule for data and keep identifiable records only for as long as they have a legal or business purpose:
    1. We keep academic transcript data at least until student date of birth plus [130 years], in order to provide references and verify your study with us.
    2. We keep some information relating to the program or qualification, and related queries and communications, until [6 years] after you have completed the program or qualification, in order to inform our ongoing relationship with you, and in case it is necessary to establish, bring or defend legal claims.
    3. We destroy some information within [3 years], where it does not have a longer term impact, and is not required for business purposes. For example, we will destroy some data that is relevant to your live class attendance.

23. Students are not usually expected to collect or use personal data as part of their IOU studies, but if you need to do so you must get the agreement of your tutorial assistant or supervisor that the processing is necessary, for example for your assignment or research. In this case you must also inform our Data Protection Officer whose details are set out below.
24. If you do need to process personal data, the IOU will be the data controller for these activities as long as you have followed the advice in the preceding paragraph. Otherwise, you will be the data controller for the personal data you process, and will be fully responsible for it. You should consult your local supervisory or similar authority for more information.
25. You have various rights regarding your personal data. For information about your rights or in order to exercise those rights, you may contact the Data Protection Officer whose details appear below.
    You have the right to:
    • access the personal information we hold about you -­ a «subject access request» enables you to receive a copy of your data and to check that we are lawfully processing it.
    • correct inaccuracies in the information we hold about you -­ enables you to ask us to correct any incomplete or inaccurate information we hold, though we may verify the accuracy of the new data you provide to us.
    • request erasure of your personal data – enables you to ask us to delete or remove your data under certain circumstances, for example, if you consider that there is no good reason for us continuing to process it, where we may have processed your information unlawfully or where we are required to erase your personal information to comply with the law. We may not always be able to comply with your request of erasure for specific reasons of which you will duly be informed.
    • request that we stop sending marketing communications to you.You may also have the right to:
    • restrict the processing of your personal data in certain ways – you may request that we suspend the processing of your personal data, firstly, if you want us to establish the data’s accuracy;; secondly, where our use of the data is unlawful but you do not want us to delete it;; thirdly, where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims;; or fourthly, you have objected to our use of your data but we need to verify whether we have overriding legitimate reasons to use it.
    • obtain a copy of your personal data in a filing system
    • object to certain processing of your personal data by us – where we (or a third party) are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground as feel it impacts on your rights and freedoms. In certain situations, we may assert that we have compelling legitimate grounds to process your data which override your rights and freedoms.
    • request a transfer of your data to a third party – we will provide to you, or a third party on your behalf, your personal information in a structured, commonly used, machine readable format. This right only applies to automated data which you initially provided consent for us to use or where we used the information to perform a contract with you.
    • Withdraw consent where we are relying on consent to process your personal data – but this will not affect the lawfulness of processing carried out before you withdraw consent. If you withdraw your consent, we may not be able to provide certain services or products to you. Should this happen, we will advise you at the time you withdraw your consent.
    • request a review by a human of any automated decision.

26. If you have concerns about the way in which we have processed your personal data, you should consult your local supervisory or similar authority for more information.
27. If you have any queries about this policy or about the way in which we collect or process personal information, please contact our Data Protection Officer:
    Email: Dataprotection.officer@iou.edu.gm
    Post: Data Protection Officer, Student Affairs Division.

APPENDIX 1 – using your personal data

1. Data processing activities relating to your contract with the IOU
   The following data processing activities are necessary for the contract we have with you, as set out in your Registration Conditions and Agreement:
   • Registering you as a student
   • Administering your fee payment
   • Maintaining your student record
   • Administering your study, including your learning, access to systems and assessments etc.
   • Providing support services which are necessary for your study, e.g. IT helpdesk services, [Library resources and support services]
   • Managing queries, complaints, appeals and allegations of misconduct
   • Providing academic support
   • Ensuring a safe environment. For instance, if you give us any information about your criminal convictions, or restrictions you are subject to, we may use the information to restrict your access to services where required.
2. We may use and process your personal data where it is necessary for us to pursue our legitimate interests for the following purposes
   1. Communications and marketing purposes
      1. To send you marketing communications about our,programs, qualifications, or other services, or to show you targeted advertising on third party sites. You are able to opt out of receiving marketing communications by contacting the data protection officer. If you do not want to be shown targeted advertising messages from the IOU, some third party sites allow you to request not to see messages from specific advertisers on that site in the future.
      2. To stay in touch with you after you graduate. You will be contacted when you graduate with further details. For further information, please see the Supporters and Alumni Privacy Notice.
      3. To analyse our student body to inform our marketing strategy and to enhance and personalise your customer experience
      4. To verify the accuracy of data that we hold about you and create a better understanding of you as a customer. We may use your email address to identify people like you -­ “a lookalike audience” -­ who are users of social media sites and who may be interested in our services and our qualifications. These people would receive IOU adverts in, for example, their news feeds.
      5. To obtain an overall view of visitor habits and volumes to our website, and to provide you with more useful and relevant adverts on our website and other websites. We use “cookies” and similar technologies to do this, in order to improve our websites, and to provide relevant advertising. For more detailed information on how we use cookies and how to switch them off on your device, see our [Cookies Policy] page.
   2. Internal activities
      1. To prevent fraud and other criminal activities
      2. To audit our activities in order to ensure legal and regulatory compliance
      3. To monitor use of IT services and ensure network and information security
      4. To test and maintain our systems and to ensure robust performance
      5. To help us improve our services via staff training
      6. To record concerns about people being drawn into terrorism

APPENDIX 2 – sharing your personal data

2. We have obligations to share information about students to other organisations under further and/or higher education laws. We are required to send some information to:
   1. accreditation bodies
   2. membership organisations
3. The obligations are governed by laws made under The Gambia jurisdiction.…
4. We will share your personal data under your study contract. For example, if your fee is paid by sponsorship then we may share your information with the sponsoring body.
5. With your permission, we will provide academic references and confirmations of study to current or future employers.
6. We will share information with the emergency services where there is an emergency situation such as illness or serious injury, where this is in someone’s vital interest.
7. We will share information with the police and other agencies where necessary for the prevention and detection of crime, including under our counter-­terrorism duty.
8. We use third party suppliers and service providers for a number of activities, from [providing IT systems to acting as agents for contacting international students and conducting market research]. It is in our legitimate interest to use third party suppliers to maintain cost effective and efficient operations. When we use third party service providers, we only disclose to them any personal information that is necessary for them to provide their service and we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.

This document will be updated from time to time in order to ensure that it complies with data protection legislation.