The laws around data privacy are changing

A new data privacy law, called the General Data Protection Regulation (GDPR), is being introduced in the UK and other countries on May 25. Switzerland agreed to comply with these laws and thus impacts also the SMAAS.

If you are a member of our alumni network some of your personal details are stored on our secure database, so we wanted to share some information about how we collect and use the data we hold about you.

This Privacy Notice covers the service the alumni team provide to you as a graduate of Strathclyde University and you’ve formally applied to the Alumni network. It is effective from May 25 2018, which is the date the GDPR come into force.

To make sure we send our information to the correct email or postal address you can keep your details up to date through this website with your login (smaas.ch) and checking from time to time that none of your details have changed. You can also email us, or give us a call about the alumni network on +41 (0)43 816 44 70, info@strathclyde-mba.ch.

You can opt out of receiving communication from us at any time, just let us know by emailing  info@strathclyde-mba.ch, or clicking unsubscribe at the end of any email we send you. You can change your mind at any time and sign up again by getting in touch with us.

If you have any questions about the privacy notice, or any service the Alumni team provides, drop us an email, or give us a call on the above number.

Privacy Notice (Alumni)

Respect for the privacy and security of your data is of great importance to the Alumni Team at SMAAS.

All personal data is held and processed in accordance with the General Data Protection Act (the GDPR).

This notice specifically relates to personal data processed by the Alumni team. This notice should be read in conjunction with the University’s Data Protection Policy and Privacy Policy, and the Alumni team’s data retention policy (see below).

In brief this privacy notice explains:

• The data we hold about you, why we use your data to provide the best experience possible as an alumnus and to keep a permanent record of your time at Strathclyde University Switzerland

• Your rights regarding the data we hold about you  

• When your data is shared

• That we may send you content that is interesting or relevant about the work of the University and the Alumni or how you can help students, but we will stop contacting you if you ask us to.

What data do we collect and for what purpose do we use it?

“All personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.” (Article 5 (1) (a) of the GDPR.)

We collect information you provide, like your name, email address, and postal address when you sign up or provide updates to SMAAS. We also collect information about you from your student record via a transfer from the University’s Student Records System. This happens shortly after you graduate and we ask you to update the information we hold about you then, and at least annually from then on.

In some circumstances we may also search for information about you from third parties to help us understand how we can provide the best experience for you as an alumnus and how to best connect with you.

This information includes your updated contact details where they’re available (so we don’t waste the Alumni’s money sending mailings to the wrong home, or spending time trying to reach you at the wrong email address).

We only search for information you have made publically available. You can opt out of receiving information about us at any time, and if you’d rather we didn’t use third party information about you just let us know by contacting info@strathclyde-mba.ch

The data the alumni team may process could include:

• Your title, name (including former name), gender and date of birth

• Your year of study

• Your contact information including address, telephone number, email and social media details

• Your business details including positions, organisation, professional memberships and qualifications

• Your career highlights and other lifetime achievements

• Your outside interests and membership of groups

• Information from articles in the media about you

• Family details including spouse or partner, relationships with other alumni etc if provided by you

• Events you have been invited to and whether or not you responded or attended

• Your donations of time, expertise or money

• A record of interactions with you

• Any other information you have provided us with

Other than the information contained within your Alumni profile, the majority of information listed above is only available to us if you have chosen to share it with us, for example by being interviewed for an article or profile or by linking a social media account with your profile.

How we use the data we collect about you

We will use your data to help us maintain an engaged alumni community.

We use your contact information to send you information about the University, the Alumni, invitations to events, invitations to mentor or support students or other alumni, careers information or postgraduate courses you may be interested in. We may also share information about scholarships and bursaries and alumni benefits..

We will only process your personal data to send you this information if we have carried out a legitimate interest assessment, or in other cases gained specific consent from you to do this.

We may also process personal data for the following purposes:

• To verify an account when you register for SMAAS

• To verify you are an alumnus if you register to use any of our benefits

• To register you to attend an event

• To process a gift you have given us

• To process and organise any mentoring, volunteering or speaking activity you have agreed to undertake for us

• To keep a record of communications between you and us

Under the GDPR, we have to meet one of the conditions set out in Article 6 for processing your data. We use the information we collect only in compliance with this privacy notice.

In some cases, we may be obliged to process your data for statutory and contractual purposes.

Communications to you may be sent by post, telephone or electronic means (usually email), depending on the contact details we hold and the preferences expressed by you about the types of communications you wish to receive. If you provide us with contact details for a particular method of communication we will assume you have given us your consent for us to update your record and communicate with you using this information, unless you have told us otherwise.

Why we process your data

We process your personal data in connection with our own internal reporting and analysis because we believe it is necessary for our legitimate organisational interest as specified in the GDPR in Article 6.  By using your data in this way we are creating an alumni network that advances the aims of the University and alumni, increase opportunities for alumni to develop in their careers, in subject knowledge and skills and as contributing members of society.

When we process your information we conduct a legitimate interest assessment to ensure that this processing isn’t overridden by your rights or interests.

To opt out of this processing, please see our section on Your Rights.

We also process data in carrying out a task in the public interest and in the exercise of our official authority. We always handle your personal data securely and minimise its use and your interests are not overridden by using your personal information for these purposes. In addition, there is no statutory or contractual requirement for you to provide us with any personal data.

What happens if you do not provide data

You are not required to provide personal data to us yourself – there is no statutory or contractual requirement for you to provide us with any personal information. However should you decide not to provide data or update your previous information we may be less able to provide the services you request at a later date.

Automatic decision making using your data

Currently, we do not use automated decision making or updating of your information from third parties or any other source. We may however use third party information (such as LinkedIn or similar) to contact you for certain request for events or other activities.

Updating your data

We will update the data we hold on you from time to time or ask you to do so. For example, if you provide us with updated details or change your details on websites or social media sites like Linkedin. We ask you regularly to keep it up to date yourself by visiting smaas.ch

We do not use targeted internet searches to maintain the accuracy of the data held about you, but will ask you to do so yourself.

Further processing

When you give us your personal information in connection with attending an event, please note that we may also use this information for internal analysis to determine how successful our events have been or how to better target them in future.

We may also use your information to evaluate the success of schemes you have been involved in such as mentoring and ambassadors and to investigate employability opportunities or identify speaking or profile opportunities, amongst others. You can opt out of this processing at any time by contacting us.

Who do we share your information with?

We do not share your information with other parties unless there is a legal or statutory requirement to do so. We will never sell, rent or trade your personal data. We may disclose your data to service providers who render services to us or you on our behalf, for example mailing houses (all of which are contractually obligated to act only on our instructions and in accordance with applicable laws, including GDPR). We may disclose your information if required by law or to enforce our legal rights.

The company that provides the SMAAS Membership service, Wild Apricot, is based in the US  and has its servers located outside the European Economic Area (“EEA”), where the laws may not give the same level of protection to personal data as within the EU and CH. Notwithstanding, we confirm that any transfer of personal data of EEA data subjects to outside of the EEA, will be undertaken only using a method specifically permitted under UK and European Union law.

How do we keep your information safe?

We will not sell your personal data to third parties under any circumstances and we do not permit third parties to sell on the data we have shared with them.

The data we hold about you is stored in secure, password protected systems, and can only be accessed by trained SMAAS staff working on alumni tasks.

As part of our service to you, we facilitate communications between individual alumni and release personal contact details only to them.

How long do you keep my information?

We will retain your data indefinitely in support of your lifelong relationship with the University and SMAAS, or until you request us to do otherwise. We remove or delete some information when it is replaced with updated information.

Where you exercise your right to erasure, we will continue to maintain a core set of personal data to ensure we do not contact you inadvertently in the future. We may also need to retain some financial records about you for statutory purposes if you have donated money to SMAAS (anti-fraud and accounting matters).

Our current Retention Policy states how long we will keep your data for.

Your rights

You have the right to access and be informed what personal data SMAAS holds about you and what it is used for. You can correct or update your data at any time by visiting your profile on smaas.ch or contacting the alumni team directly. You can also restrict processing of your data. We may amend this privacy notice from time to time, any significant changes to this notice or to the way we treat your data will be communicated via the SMAAS Website or by contacting you directly through the most appropriate means.

You have the right to lodge a complaint with SMAAS

Retention of Alumni Data

This policy covers the retention of all Alumni and stakeholder information created and/or maintained by SMAAS.

The General Data Protection Regulation places more emphasis on being accountable for and transparent about your lawful basis for processing. Article 5 states that “personal data shall not be kept for longer than is necessary” and “every reasonable step must be taken to ensure that personal data is accurate and where necessary, kept up to date”.

Alumni Data

Record Series	Minimum Retention Period	Action	Comments
Alumni membership records	Permanent retention	Retained while current unless individual requests their details are removed	Responsibility – Alumni. Retention must comply with the GDPR.
Anonymised statistical records of alumni	Current year +10 years	Review for archive and analytical value
Enquiries from alumni and the responses provided by the University	Last action on enquiry + 1 year	Dispose
Feedback from alumni, handling of feedback and responses provided	Last action + 1 year	Dispose
Communication to alumni	Date of issue + 5 years	Review for archive value
Interviews and notes taken when preparing alumni communications	Date of first note + 5 years	Disposal
Donation records and payments – including books and event tickets	Current financial year + 10 years	Dispose
Records documenting the planning and impact/results of events organised for alumni	Completion of event +5 years	Review for archive and analytical value
Records documenting the organisation and administration of institutional events	Completion of event +5 years	Review for archive value
Records documenting the administration and support given to alumni societies	Superseded +5 years	Review for archive value
Records documenting event attendees and analysis of this data	Completion of event + 10 years	Dispose
Records and analysis of event non-attendees (booked but did not attend)	Completion of event + 10 years	Dispose
Anonymised statistical records of event attendees and non-attendees (booked but did not attend)	Completion of event + 10 years	Dispose