Privacy Policy - Full Version

At Professional HE Services Limited we are committed to safeguarding and preserving the privacy of our members, employees and visitors. This privacy policy explains what happens to any personal data that you provide to us, or that we collect from you and how we use cookies on this website.

1. Who are we?

In this policy, whenever you see the words ‘we’, ‘us’, ‘our’, ‘PHES’, it refers to Professional HE Services Limited, a company limited by guarantee registered in England 08080702.

PHES is an umbrella company for membership organisations in Higher Education. Currently PHES is the corporate “parent” of seven Special Interest Organisations (SIOs); the Association of University Directors of Estates (AUDE), Association of University Legal Practitioners (AULP), the British Universities Finance Directors Group (BUFDG), College & University Business Officers (CUBO), Council of Higher Education Internal Auditors (CHEIA), the Higher Education Strategic Planners Association (HESPA) and Universities Human Resources (UHR). BUFDG also includes the Higher Education Procurement Association (HEPA), although HEPA is not an SIO of the company. 

2. What personal data we collect and how we use it?

What we need

We collect your name, job title, institution, contact details, photo and other profile related data if you are a member or customer. If you are booking onto an event, we may ask you for any special dietary or access requirements.

From November 2022, we will be collecting optional EDI data from our members, to optimise our service delivery, to tailor our CPD offering and to adapt our services where we notice a group being underrepresented or disadvantaged.

Why we need it

We will collect and process your personal information for a range of purposes, including the following:

• To provide the best possible membership service to our member institutions, and to support the HE sector
• To deliver services, training and benefits to you and where appropriate, to monitor your use of those services, training and benefits
• To optimise our communications with you, tailoring them where necessary
• To tailor our CPD offering to our members
• To adapt our services where we notice a group being underrepresented or disadvantaged
• To fulfil and monitor our responsibilities under equalities legislation
• To compile statistics and conduct surveys and research for internal monitoring purposes
• To share anonymised data (rounded where necessary) with other sector bodies and/or collaborators, where appropriate and in the interests of our members

What we will not do:

• Use personal characteristics data to target individuals or groups of individuals or include/exclude certain groups from training or other opportunities

If you choose to withhold requested information, we may not be able to provide you with certain services.

We will also hold information about you so that we can respect your preferences for being contacted by us.

We may combine data from our database, your interest areas (that you have told us about) and your browsing habits to the make our communications relevant to you.

You can of course change your contact preferences by visiting the MY PROFILE page on this site.

Any special dietary or access requirements are only used to provide you with the best experience at an event or meeting.

When do we collect your personal data?

We collect your personal information in a number of ways:

• When you provide it to us directly
• When you provide permission to other organisations to share it with us
• When we collect it as you use our websites or apps
• When you have given it to a third party and you have provided permission to pass your information on to us
• From publicly available sources (where possible) to keep your information up to date

3. What lawful bases will we use to process the data?

Under the new data protection law starting in May 2018 we have a number of lawful reasons that we can process your personal information. One of those lawful bases is Legitimate Interests, which means:

‘we can process your personal information if we have a genuine and legitimate reason and we are not harming any of your rights and interests’

This means when you provide your personal details to us, we use your information for our legitimate business interests to carry out our work supporting our members and the HE sector. Before doing this, though, we will also carefully consider and balance any potential impact on you and your rights.

Sometimes, with your consent, we will process your personal data to provide you with information about our work or our activities that you have requested or are expecting. You can control your interests and preferences from the MYSITE section of this website.

On other occasions, we may process personal data when we need to do this to fulfil a contract (for example, if you have booked a ticket from our website) or where we are required to do this by law or other regulations.

4. How do we protect your personal data?

Information system and data security is extremely important to us, to ensure that we are keeping our members, customers and employees safe. We will treat your data with the utmost care and take all appropriate steps to protect it.

By using strong encryption when your information is stored or in transit we minimise the risk of unauthorised access or disclosure; when entering information on our website, you can check this by right clicking on the padlock icon in the address bar.

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff.

Our staff complete mandatory data protection training on employment and annually thereafter to reinforce responsibilities and requirements set out in our information security policies.

The EDI data will be stored in our central database, and only accessed by PHES staff through a small number of anonymised reports.

We sometimes use external companies to collect or process personal data on our behalf. We do comprehensive checks on these companies before we work with them and put an agreement in place that sets out our expectations and requirements, especially regarding how they manage the personal data they have collected or have access to. 

Some of our suppliers run their operations outside the European Economic Area (EEA).  Although they may not be subject to same data protection laws as companies based in the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law. By submitting your personal information to us you agree to this transfer, storing or processing at a location outside the EEA.

We may need to disclose your details if required to the police, regulatory bodies or legal advisors.

We will only ever share your data in other circumstances if we have your explicit and informed consent.

5. How long will we keep your personal data?

Whenever we collect or process your personal data, we’ll only keep it for as long as is necessary for the purpose for which it was collected.

At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning.

If decide you no longer wish to be a member, we will keep some basic information in order to avoid sending you unwanted materials in the future and to ensure that we don’t accidentally duplicate information.

We will update your personal data such as job title, institution and contact details when you tell us they have changed, when we receive an automated email from you or when we find out from another source.

6. Who do we share your personal data with?

Where we use an external service provider to act on our behalf, we will disclose only the personal information necessary to deliver the service and will have an agreement in place that requires the provider to comply with our data protection and information security requirements.

We do not sell or share your personal information for other organisations to use.

We may disclose your personal information to third parties if we are legally obliged to; or in order to enforce or apply our terms of use for this website or other agreements; or to protect the rights, property or safety of PHES or others. This includes exchanging information with other companies and organisations for the purposes of fraud detection and protection.

7. How do we handle your direct debit or credit card information?

PHES uses external Payment Card Industry (PCI) compliant providers to collect this data on our behalf. We do not store PCI data on our own systems.

8. Cookies

Cookies are small text files stored on your computer when you visit certain websites. We use first party cookies (cookies that we have set, that can only be read by our website) to personalise your online experience. We also use third party cookies (cookies that are set by an organisation other than the owner of the website) for the purposes of website measurement. You can control the use of cookies via your browser.

9. What are your rights

A new data protection law, starting in May 2018, gives everyone a number of very important rights. These are:

• Transparency over how we use your personal information (right to be informed).
• Request a copy of the information we hold about you, which will be provided to you within one month (right of access).
• Update or amend the information we hold about you if it is wrong (right of rectification).
• Ask us to stop using your information (right to restrict processing).
• Ask us to remove your personal information from our records (right to be 'forgotten').
• Object to the processing of your information for marketing purposes (right to object).
• Obtain and reuse your personal data for your own purposes (right to data portability).
• Not be subject to a decision when it is based on automated processing (automated decision making and profiling).

If you would like to know more about your rights under the data protection law, see the Information Commissioners Office website.

Remember, you can change the way you hear from us by using our MYSITE pages on this website.

10. Changes to the privacy policy

We may change this Privacy Policy from time to time.  If we make any significant changes in the way we treat your personal information we will make this clear on this website or by contacting you directly.

11. How to contact us

If you have any questions in relation to this privacy policy or how we use your personal data they should be sent to dataprotection@phes.ac.uk or addressed to:

Data Protection
Professional HE Services Ltd
3 Holywell Drive
Loughborough University
Leicestershire
LE11 3TU

If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you can complain to the Information Commissioner’s Office (ICO).

This policy was last updated on 19th November 2022.