Privacy Policy

This is a statement of the practices of Trinity College Dublin, The University of Dublin (the “University”) of College Green, Dublin 2, Ireland in connection with the capture and the use of personal data and the steps taken by the University to protect your personal data and respect your right to privacy.

The University fully respects your right to privacy and actively seeks to preserve the privacy rights of those who share information with the University. Any personal information which you volunteer to the University will be treated with the highest standards of security and confidentiality, in accordance with Irish and European Data Protection legislation. The University shall process your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 and the Data Protection Act 2018.

The privacy notice explains the following

• How do we collect and use personal data?
• The purpose and legal basis for collecting personal data
• How do we store and secure personal data?
• Details of third parties with whom we share personal data
• What are your rights?
• How and why do we collect personal data?

The data we collect from you will be used by the University in accordance with the purposes outlined in this privacy notice. We collect personal data via website forms, written application forms and documents, email and phone enquiries and surveys. We also collect information via third parties such as the CAO and international affiliates.

Students

We process data relating to students as detailed in the table below. Additional privacy information for students is available from the Academic Registry website and will be included with the student’s terms and conditions at registration. Personal data and occasionally sensitive personal data may be collected directly from students who avail of specific services e.g. College Health Centre, Counselling or Disability Services. If you provide the University with your data for these purposes, then specific privacy information will be provided at the point of collection.

Purpose for processing personal data	Category	Legal basis for processing
Admission and registration. Administration of your education. Administration of University policies. Administration and provision of IT and Library Services. Provision of data to the Higher Education Authority and Department of Education. The provision of data to the Department of Justice to support visa applications for international students. To provide student ID cards and TCard services.	Administrative	Necessary to carry out the objects and functions under the Universities Act 1997. Performance of a contract. Statutory requirements.
Academic assessment and supervision and monitoring of attendance. Graduation and granting of awards. Processing of appeals, complaints and disciplinary issues. Audio recording of lectures. Administration of research programmes and funding. Administration of placements. Surveys and student feedback	Academic	Necessary to carry out the objects and functions under the Universities Act 1997.
The provision of medical, counselling and disability and equality services The provision of reasonable accommodations. The provision of careers services and mentorship. The use of sports and recreational facilities. The provision of University accommodation.	Student Services	Consent or explicit consent. Vital interests of the individual. Necessary to carry out the objects and functions under the Universities Act 1997.
If necessary due to a medical emergency. The protection of vital interests. The protection of public health.	Duty of Care	Vital interests of the individual. Statutory requirement.
Processing and recovery of fees and payments Administration of TCard	Financial	Necessary to carry out the objects and functions under the Universities Act 1997.
The administration of campus CCTV for security. Provision of a safe environment for educational activities.	Health & Safety	Legitimate interest of the University. Statutory requirement.
Garda Vetting for placements on specific courses. For the purposes of criminal investigations. when requested by An Garda Síochána. Exercise or defence of legal claims.	Legal	Statutory requirement. Legal claims.
Provide information about University events and activities.	Communications	Necessary to carry out the objects and functions under the Universities Act 1997.
Retention of academic data and data of archival value in the public interest.	Archives	Necessary to carry out the objects and functions under the Universities Act 1997. Permitted by section 42 of the Data Protection Act 2018.
Provision of education and contact data to Trinity Development & Alumni for the purposes of alumni engagement and fundraising.	Alumni	Necessary to carry out the objects and functions under the Universities Act 1997.
Provision of contact data to the Students Union.	Students Union	Necessary to carry out the objects and functions under the Universities Act 1997.

Staff

We collect personal data for the purposes of recruitment and for the formation and administration of the contract of employment and employee relationship. The detailed privacy notice for staff is available on the Human Resources website and is provided to new members of staff with their contract. Additional data may be collected from staff when they register to use other services within the University e.g. Sports or Health Centre.

Research Participants

One of the objectives of The University as defined in the Universities Act, 1997 is to carry out and support research. Where personal data is processed by the University for the purposes of research, detailed information about how personal data will be used will be provided to research participants prior to the collection of the relevant personal data or shortly after if the data is obtained from a third party. Where possible personal data collected for research purposes will be pseudonymised so that the participant is no longer identifiable. The use of personal data for research will often involve sensitive personal data including health or genetic data and will, therefore, be subject to higher standards of security and protection.

Following the publication of the Health Research Regulations, 2018 further information relating to the processing of personal data for research purposes will be added to this statement in due course.

Members of the Public and Consumers

We collect data from members of the public in order to respond to enquiries, process transactions, administer services and accept bookings for events. We may add your personal data to a relevant mailing list if you have made an enquiry in relation to a service, if a transaction has taken place or if you have specifically requested to be added to a mailing list in order to receive information that is of interest to you. In the event that we do record your data on a mailing list, you will be provided with the opportunity to opt-out from the outset and in all our communications with you and we will only send you information relevant to your initial enquiry or transaction.

Website Users

Information on internet traffic is collected routinely by the University and also at other points along the route on the internet (e.g. HEAnet). This technical information is used to ensure the smooth running of the computer network in the University and for statistical or administrative purposes. It is NOT used to gather identifiable personal information on individual website visitors, except in so far as this is permitted by law and may be necessary in order to prevent or detect problems or offences in relation to the operation of the website.

Children

We sometimes collect data from children under the age of 18. Children’s data is collected for the purposes of providing information on courses and admissions. We will also collect children’s data when they access services such as the Sports Centre, College Day Nursery and camps such as the Trinity Walton Club. Further information on processing will be provided on the applicable University website or at the point of collection.

CCTV

CCTV cameras are in operation on Campus in consultation with the Gardai in order to provide enhanced protection for students, staff and visitors as well as University buildings and facilities in the context of an open campus.

You can find more information in our CCTV Policy.

Photography

Photographs or videos of staff and students may be taken on Campus at official events such as graduation ceremonies. As a number of public events also take place on Campus the University will frequently take photographs or videos at these events which may be shared on the University website or social media accounts. Where the use of photographs or video may not be reasonably expected by individuals the University will seek consent to publish photographs or video where it is practical to do so. Individuals have the right to object to the use of their photograph and should contact the event organiser in the first instance or the University Data Protection Officer, see contact details below.

Citizen Science Application

SPOTTERON: A Citizen Science Web Application integrated into the website enables the display of spatial data and community content from the Citizen Science App toolkit of the project.

Processed data may include, in particular, IP addresses and location data of users, which are not collected without their consent (usually within the context of user registration and user contributions). Service provider: SPOTTERON Gmbh; Faßziehergasse 5/16, 1070 Vienna, AT;

• Website: https://www.spotteron.net
• Privacy Policy: https://www.spotteron.net/privacy

OpenStreetMap: We integrate the maps of the service “OpenStreetMap” in apps and websites, which are offered by the OpenStreetMap Foundation (OSMF) based on the Open Data Commons Open Database License (ODbL). OpenStreetMap utilizes user- and visitor data exclusively to display maps, map functions, and temporarily store selected settings. The processed data can include, in particular, IP addresses and location data of users, which are not collected without their consent (usually within the context of the settings of the accessing device).

Service provider: OpenStreetMap Foundation (OSMF);

• Website: https://www.openstreetmap.de;
• Privacy Policy: https://wiki.openstreetmap.org/wiki/Privacy_Policy.

HERE Satellite Map: We can use Satellite Maps provided by HERE.com as an optional layer in integrated map applications.

Service Provider: HERE Global B.V. Kennedyplein 222-226, 5611 ZT Eindhoven, Netherlands,

• Terms of use: https://legal.here.com/en-gb/terms/here-end-user-terms,
• Privacy Policy: https://legal.here.com/en-gb/privacy

Cookies

We use information gathered from cookies to help improve your experience of noveleco.eu. Some cookies are essential so you can move around the website and use its features.

Our website also contains third-party cookies. You can refuse or consent to third-party cookies when you first visit our website or by following the guidelines in our Cookie Policy.

You can find more information in our Cookie Policy.

The purpose and legal basis for collecting your data

In order for the use of personal data to be lawful, it should be processed on the basis of either the consent of an individual concerned or another legal basis as set out in the General Data Protection Regulation or in the Data Protection Act 2018.

The University will ensure that your data is processed fairly and lawfully in keeping with the principles of data protection and will process personal data under various legal bases depending on the purpose for which the data is collected.

Specific information on the legal basis for processing your personal data will also be provided at the point of collection of personal data. These may include:

• Where the processing of personal data is a statutory function of the University as a public authority. The statutory functions of the University are set out in sections 12 and 13 of the Universities Act 1997.
• Where the University is required to process personal data by law including the sharing of data with the Higher Education Authority or for complying with employment law.
• Where the processing of personal data is necessary for the formation of a contract with you;
• Where the processing of personal data is not related to the official functions of the University we may sometimes process personal data based on legitimate interests e.g. for the administration of events, purchasing of tickets and the use of our services.
• Generally, when using sensitive personal data the University will seek explicit consent for the processing of data except where another condition applies e.g. employment law, legal claims or medical diagnosis when using the College Health Centre.

How we store and secure your data

Any data we collect from you will be stored confidentially and securely as required by the University Information Security Policy. The University is committed to ensuring all accesses to, uses of, and processing of University data is performed in a secure manner.

In keeping with the data protection principles we will only store your data for as long as is necessary and in accordance with our Records Management Policy and Records Retention Schedule (PDF).

When we store your personal data on our systems the data will primarily be stored either on the University premises and secure IT platforms within the European Economic Area (EEA) which are also subject to European data protection requirements.

We may store or share your data outside the EEA in the following circumstances:

• For processing international applications and sharing data with partner Universities.
• When using cloud services for the secure storage of data. Some cloud service providers store data in international data centres e.g. the US. The University will only use services that are compliant with the European General Data Protection Regulation and that satisfy the conditions for processing personal data outside the EEA.
• For research projects with other research partners where we have your consent to do so.
• If we are required to do so by law.

Details of third parties with whom we share personal data

The University will share your data with third parties where necessary for purposes of the processing and where there is a legal basis to do so. The University may share relevant personal data with the following categories of third parties:

• State or regulatory bodies include the Higher Education Authority, CAO, Department of Education and Skills, Department of Justice and Equality, Department of Social Protection.
• IT or cloud service providers that provide essential services to the University e.g. Microsoft.
• Firms that provide professional services to the University such as legal firms and auditors.
• Firms that provide archiving and storage and disposal of confidential waste.
• Research and academic partners.
• Organisations include hospitals and public services that provide placements for students.
• An Garda Síochána when we are required to do so by law.

When we share your data with the third parties outlined here the University will endeavour only to share the data that is needed, that the data is only processed according to our specific instructions and that the same standards of confidentiality and security are maintained. Once the processing of the data is complete any third parties with whom data was shared will be required to return the data to the University save where they are required to retain it by law.

University Archives

One of the functions of the University is the curation of the University Archives, which comprise the University’s administrative, legal and historical records of archival value. This collection – whose earliest record is the foundation charter of 1592 – represents the corporate memory of TCD and is of important historical value. The University will process personal data of archival value in accordance with section 42 of the Data Protection Act 2018 which permits that personal data of archival value in the public interest may be retained. Personal data retained by the University for archival purposes in the public interest will be stored and secured in accordance with the principles of data protection.

What are your rights?

You have the following rights over the way we process your personal data.

Right of Access

You have the right to request a copy of the personal data we are processing about you and to exercise that right easily and at reasonable intervals.

Consent

You have the right to withdraw your consent where that is the legal basis of our processing.

Rectification

You have the right to have inaccuracies in personal data that we hold about you rectified.

Erasure

You have the right to have your personal data deleted where we no longer have any justification for retaining it subject to exemptions such as the use of anonymised data for scientific research.

Object

You have the right to object to processing your personal data if:

We have processed your data based on legitimate interest or for the exercise of the public tasks of the University if you believe the processing to be disproportionate or unfair to you.
The personal data was processed for the purposes of direct marketing or profiling related to direct marketing.
We have processed the personal data for scientific or historical research purposes or statistical purposes unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Restriction

You have the right to restrict the processing of your personal data if:

You are contesting the accuracy of the personal data;
The personal data was processed unlawfully;
You need to prevent the erasure of the personal data in order to comply with legal obligations;
You have objected to the processing of the personal data and wish to restrict the processing until a legal basis for continued processing has been verified.

Portability

Where it is technically feasible you have the right to have a readily accessible electronic copy of your data transferred or moved to another data controller if we are processing your data based on your consent and if that processing is carried out by automated means.

Contact

If you have any queries relating to the processing of your personal data or if you wish to make a complaint or escalate an issue relating to any of your rights you can contact the Data Protection Officer at [email protected] or at:

Data Protection Officer
Secretary’s Office, Trinity College Dublin,
Dublin 2, Ireland.
+353 1 896 8486

Finally, if you are not satisfied with the information we have provided to you in relation to the processing of your data or you can also make a complaint to the Data Protection Commissioner via the link in their website Making a Complaint to the DPC.