Privacy Notice – NextStepSupport.org
This privacy notice tells you about the information we collect from you when you register via one of our websites. In collecting this information, we are acting as a Data Controller and, by law, we are required to provide you with information about us, about why and how we use your data, and about the rights you have over your data.
We will be processing your personal data in accordance with the General Data Protection Regulations (GDPR).
Who are we?
We are Group GTI and our main address is:
The Fountain Building, Howbery Park
Benson Lane, Wallingford
You can contact us by post at the above address, or by via email at firstname.lastname@example.org or by telephone on +44 (0)1491 826262.
NextStepSupport.org is a non-for-profit industry run site with various partners. The aim is to support students through the virus. This will include virus relevant careers advice, skills development (using time wisely) and wellbeing – with employer and university updates and content. Additionally, the site will contain webinars, podcasts and a forum for students to communicate with their peers or ask questions.
We are not required to have a data protection officer, so any enquiries about our use of your personal data should be addressed to the contact details above asking for the person responsible for data protection.
What personal data do we collect?
We collect only minimal personal contact details if you subscribe to our alerts and updates for the site, or if you wish to participate in the forum. Similarly if you are an employer or university we ask for a name and contact details for the purposes of getting in touch if there is a query about your submission.
Personal data requested does not contain “special category data” as defined in the GDPR.
Where else may we get your data from?
We do not obtain data from anywhere else in relation to the running of this site. All personal data used is submitted by you.
Why do we collect this information?
We collect information to be able to inform you about information updates posted to the site (should you request it), and for administrative purposes should you choose to participate in the forum. For employers and universities, we collect personal contact information separately in case we need to get in touch about a submission to the site.
Where is my information stored?
Your information is stored in the database for our website located on storage which are located within our data centre facility in the UK.
What do we do with your information?
The personal data collected will solely be used for the purposes expressly stated. We will not use the information collected on this site for any other contact with you in relation to our products or offerings.
Who we might share your data with?
Where you have requested it by providing your consent and have provided us with the details of your university, we will pass on your details to your Careers Service so that can provide you with the additional support you may require.
Automated processing and profiling
There are no automated decision making processes that would impact you as a result of any automated processing. No judgements or decisions are made of an individual as a result of any processing that may take place.
Legal basis for processing your data
The legal basis for processing under both the DPA and GDPR across our sites are outlined in the table below:
|Data Category||Description||Legal Basis|
|Personal details obtained for alerts and updates, and participants in the forum||Minimal contact information including university (if provided)||
Legitimate interest (Article 6(1)(f)).
Where consent have been given for the transfer of your contact information to your Careers Service then the legal basis for processing is consent under Article 6(1)(a) in relation to the transfer
Where you have agreed to have the personal data you provided (as part of registering for the alerts and updates) to be transferred to your university’s Careers Service, then the processing of your data for this purpose will be with your consent.
GTI may also process your data when it is in our legitimate interest to do so and in doing so it does not override any of your data protection rights.
You have the right to object to the processing of your data under legitimate interest should you feel that such legal basis is not warranted or feel that it overrides any of the rights that you may have. Please note that once your data has reached a stage when it has been anonymised it will no longer be identifiable for restricted processing to take place.
How long do we keep your information for?
|Data Category||Min. Period|
|Personal details||Person identifiable information (eg. name, mobile and email address) is kept for a minimum period of 12 months, but no longer than 24 months. After which this information is deleted.|
Your rights over your information
By law, you can ask us what information we hold about you, and you can ask us to correct it if it is inaccurate.
You can also ask us to give you a copy of the information and to stop using your information for a period of time if you believe we are not doing so lawfully.
To submit a request by email, post or telephone, please use the contact information provided above.
In addition to the above you have the following rights under GDPR:
- The right to ask what personal data is held without charge.
- The right to ask to update and correct any out of date or incorrect personal data that we hold free of charge.
- The right to erasure of personal data where consent is the only legal basis for processing and that consent has been withdrawn.
- The right to data portability in the sense that personal data provided directly by the data subject is exportable in an open format like CSV where the legal basis for processing is based on either contract or consent.
- The right to restrict or object to the processing of your personal data where:
- You contest the accuracy of the personal data and the accuracy needs to be verified;
- You object to the processing under legitimate interest ground and consideration needs to be made whether GTI’s legitimate interest overrides that of the individuals;
- The processing was unlawful and you request restricted processing over erasure;
You can withdraw consent at any time where consent has been relied upon. If consent is the sole legal basis for processing, we will stop processing the data after the consent is withdrawn. The data will then be placed in a restricted processing mode until you have asked to exercise your right to erasure or the personal data falls outside stated retention period (whichever comes first).
Please note that the above rights are only applicable to the extent that the data provided by you is able to identify you as an individual. Once we anonymise the data we will no longer be able to identify you and therefore may not be able to comply with such an exercise of rights.
Our communications with you
We may communicate with you by email for the purposes of email alerts, or confirming details relating to your submission as an employer or university contact.
However, should you be concerned about the content of these communications you can contact us by telephone or letter at the details provided above.
'Connect me with my University Careers team'
If you have asked NextStepSupport to provide your name and email address to your university for further support.
Unsubscribing from emails
If you have subscribed to email updates, you will be able to unsubscribe by clicking on 'Unsubscribe' at the bottom of any email that you receive from NextStepSupport. Or, if you have requested text messages, by responding to text messages as instructed in the text.
Alternatively, you can email info@NextStepSupport.org to unsubscribe.
Where applicable, we will direct your instruction to the appropriate university to action.
Changes to this privacy notice
From time to time we may need to make changes to this notice. We will attempt to inform you of any changes that are made either through both email notifications or through associated websites. You can obtain the most recent version of this notice by contacting us directly. This privacy notice was last updated on the 15th of April 2020.
Your right to complain
If you have a complaint about our use of your information you can do so with the relevant supervisory authority within the EU to which you are a resident, whom may refer the complaint to the UK supervisory authority.
Complaints in the UK can be made to the Information Commissioner's Office via their website at ico.org.uk/make-a-complaint/ or write to them at:
Information Commissioner's Office