Privacy Notice - communications and collaboration activity

This Privacy Notice explains the types of personal data we may collect about you. It also explains why we (Örebro University’s central communications and collaboration team - including student communications and external relationship building with our business, social and alumni contacts) do this, how we’ll store and handle that data, and how we keep it safe.

The law on data protection sets out a number of relevant reasons for why organisations and businesses may collect and process your personal data. For Örebro University’s engagement with students, alumni, collaboration activity and fundraising, the legal bases we rely on are:

a) Consent

At times, we collect and process your data with your consent.

For example, when you register to attend a University event.

b) Contractual obligations

In certain circumstances, we collect and process your personal data so that we can comply with contractual obligations.

For example, if you sponsor or support University activity, we’ll need to record the transaction and the conditions relating to it – such as our contractual obligations to you and how we should keep you informed about the activity.

c) Public interest or the exercise of official authority

When we carry out tasks relating to our statutory duties as a university – around research, education and collaboration with society – then the legal basis for collecting and processing your personal data is that we do so in the public interest or the exercise of our official authority.

For example, collecting and maintaining alumni records helps us disseminate information about our research, promote life-long learning opportunities, and improve awareness of how society can engage and work with us.

Likewise, collecting and maintaining student records allows us to ensure our student communications are effective and relevant, contributing to to the quality and impact of the education experience at Örebro University.

d) Legal compliance

If the law requires us to, we may need to collect and process your data.

For example, if cooperating with a government enquiry.

• When you are a participant in or support a University project, as an individual or as a contact within an organisation.
• When you provide your details for a University event or other activity.
• When you become a student with us parts of your student record are used to inform our communications with you (for example, which programme you are enrolled on).
• When you become an alumn (once you’ve stopped studying with us) we use parts of your student record to create your alumni record.
• When you join University forums online.
• When you act on a University communication – such as opening an email, clicking on a link etc.
• When we search for potential partners and supporters for our education, research and collaboration activities – information sources might include yourself, social media and other publicly available resources.
• When you contact us with questions, ideas or offers.
• When you participate in University surveys, polls or competitions.
• When you meet with us.

If you’re a student or alumnus we’ll have some or all of this information: Which programme(s) you study/have studied as well as your current postal address (if you live in Sweden), the years you started or finished your studies, your total academic points from Örebro, your telephone number, email and birthdate. This allows us to be more relevant with our communications and reduce instances of spam, for example, helping us identify ‘socionom’ alumni to invite a socionom anniversary event, inviting NT students to a Hackathon event on campus, or alumni living around Göteborg to a Göteborg social event. It also makes sure we can verify who is who when alumni share the same name.

For all our contacts, we record communication preferences when they’re known. For example, if you’d prefer not to receive communications by email, or if you’d prefer not to receive any communications at all. Contacts can change their communication preferences at any time. This means we don’t get in touch with people who don’t want us to. It helps us reduce wastage and make sure that our contacts are in control of how and if we stay in contact.

For all our contacts, we record professional details when known. When this happens we might collect some or all of this information: Job-title, industry, work contact details, profession, sector and employers. This helps us reduce spam within our communications and increase relevance – for example inviting lawyers to a briefing on an area of law, or requesting feedback about an education programme from professionals in a related industry area.

For all our contacts, if we’re aware of a connection between them and an organisation (e.g. as an employee, supporter or member) or to another individual on the database (e.g. as a friend, family member or mentor) then we may record this. This helps us find points of contact when we’re searching for potential research, collaboration or education partners, help us match opportunities to people who are most likely to be interested in that activity, helps us be professional when we meet people by being aware of key relationships, and helps us understand the total impact from collaborations with a group or organisation.

For all our contacts, we may record participation in University events and projects, support of any University activities (e.g. as a mentee, mentor or donor), and the marketing we’ve sent to people. This allows us to evaluate the success of our activity, analyse levels of engagement with our alumni and friends, know who to thank and identify potential partners for future activity.

For potential partners and supporters, we may record details about their general interests, philanthropy activity, their relevance to University research and education projects, and their financial capacity to support these. As we build relationships with these potential supporters, we may record details about our engagement with them. If we are considering accepting or asking for significant support, we may be required to conduct due diligence, using publicly-available information to assess any ethical, legal or other concerns. Whilst Örebro University doesn’t really fundraise from individuals at the moment, we’ve included this in our Privacy Notice because we might in the future. It’s an increasingly common activity for established universities and helps them attract additional revenue to support research, education and collaboration (and therefore helps improve their total contribution to society).

By creating, maintaining and strengthening relationships within society (including our alumni, supporters, businesses, organisations and government) and within the University (including our students and staff) we are better able to deliver our statutory duty as a University – to conduct research and education, and interact with society to maximise the impact of our (and your) work and expertise.

We use personal data so we can send out communications – by post, email, via web groups, text, phone or other means – and make these communications as relevant and efficient as possible, for example inviting only alumni around Malmö to an event being held in Malmö, or Law students to a networking mingle.

Of course, you can opt out (and back in) of direct communications at any time.

Typically, the kind of activities and events we are responsible for and conduct include public lectures; subject-based workshops; briefings for professional groups (such as lawyers); course anniversaries; eNewsletters about research and University activity; course-/school-/area-based events; professional or social networking; group forums on public social media (such as Facebook and LinkedIn); surveys about courses, your interests or industry needs; mentorship opportunities; requests for work experience or similar support for students; campus visits and reunions; volunteering opportunities; funding opportunities; requests for feedback; commercial education support; learning-for-life activities; participation in research programmes or education programme initiatives; and advisory boards.

When we are looking for potential partners or supporters for University activities and projects, then personal data helps us identify and approach those for whom the activity may be most relevant.

We might also combine different sets of information we hold, such as event attendance, support given, communications responded to and so on to gain insights on an individual’s overall level of engagement to help indicate who might be most interested in opportunities to support research or education projects.

By collecting and processing personal data in a professional and safe way we reduce duplication, waste and instances of spam. At the same time, we increase the likelihood that our engagement with you is relevant and interesting, as well as more meaningful for the University and its strategic goals.

It also means that when you contact us, or we you, we have a better awareness and overview of your previous engagement with us. This helps improve the quality of the engagement for both you and the University and ensures that knowledge of your engagement with us (and our obligations regarding it) remains when the specific University staff involved move on.

We know how much data security matters. With this in mind we will treat your data with the utmost care and take all appropriate steps to protect it. Access to your data at the University is limited to authorised staff and is password-protected. The external data management systems we use have appropriate trust and compliance safeguards.

The length of time we retain personal data depends on its source and purpose.

For example, students and alumni share a life-long relationship with the University, a relationship that will ebb and flow over time but essentially represents a continuous association and connection. This means we do not remove student or alumni personal data. However, we will anonymise your data if you request it.

Similarly, where we have a contractual basis for collecting and processing data (e.g. donors and sponsors), or the activity involves internal coordination and engagement (e.g. with University staff), then the personal data is maintained indefinitely.

Personal data for other types of contact (such as non-alumn of the University) are kept for five years from the date of our last contact with them.

After this point, data is either deleted completely, or anonymised in a way that prevents identification, allowing it to be bundled with other data and contribute to general analysis.

Like most organisations, we may use third parties to help us deliver an activity. For example, we might use mass-emailing or postal services, catering services, research specialists, marketing consultants and so on.

There may also be times when we share your data with University-owned companies – such as Örebro universitet Holding AB, Uppdrag AB and Enterprise AB, where the services and support they offer may be of relevance to you and contribute to our ability to deliver our statutory goals.

Whilst we may use third parties in the delivery of our mission;

• We will never sell your data.
• We provide only the information they need to perform their specific services.
• They may only use data for the exact purposes we specify with them.
• We work closely with them to ensure that your privacy is respected and protected at all times.

Examples of the kind of third parties we work with are;

• IT companies who support our database and business systems.
• Operational companies such as mailing services, mass-emailing supporters and caterers.
• Communications specialists who may help us manage our communications.

Sharing your data with third parties for their own purposes:

We will only do this in very rare circumstances, for example:

• With your specific consent, we may pass your data to a third party to help them with their organisational purposes. For example, if you take part in a breakfast briefing being jointly-hosted with a local firm or restaurant, we may ask your permission to share your name, job title and email ahead of the event so they can tailor the content of the briefing, and contact you after the event to request evaluation or provide further information. In these circumstances, we will always ask for your consent to do this when you register, clarifying what information has requested by the third party and how it will be used.
• We may also be required to disclose your personal data to the police or other enforcement, regulatory or Government body, in Sweden or elsewhere, upon a legally valid request to do so. 

If you take part in a University activity where it is necessary to share your contact details with another individual – such as mentoring – then we will always secure your approval before sharing.

Your data is collected and managed in the European Economic Area (EEA) which includes all EU member countries as well as Iceland, Liechtenstein and Norway. If we need to do this activity outside of the EEA, then it will be with countries whom the EU have recognised as having comparative standards of data protection (e.g. Switzerland, the United Kingdom).

You have the right:

• To ask for access to the personal data we hold about you. To ask for your information please contact The Data Protection Officer, Örebro University, 701 82 Örebro, Sweden, or email dataskyddsombud@oru.se.
• To ask that we correct, update or add your personal data. To ask for your information to be amended please contact our Collaboration team via alumn@oru.se
• To ask that we stop communicating with you (either through specific channels, or all channels). To do this, you can either follow the links to change your communication preferences within our digital communications or contact our Collaboration team via alumn@oru.se
• If you have given consent, then you can withdraw it at any time.

If for some reason we do not act on your request, we will explain the reasons for not doing so. At any time, you can lodge a complaint with the Swedish Authority for Privacy Protection, whose details you can find on https://www.imy.se

This Privacy Notice will change from time-to-time and we’ll communicate significant changes through the University website.

There are several ways you can stop receiving marketing communications from us:

• Click the ‘unsubscribe’ link within any email communication that we send you, this will stop further emails from the part of the University that sent you the email.
• Email our Collaboration team via alumn@oru.se from the email account concerned.
• Write to us at Alumni Engagement and Collaboration, Örebro University, 701 82 Örebro, Sweden

Please note that you may continue to receive communications for a short period after changing your preferences while our systems are updated.

This Privacy Notice will be available in English and Swedish. In case of any dispute about its meaning, the Swedish version will take precedence.

Please note that when you study with us, engage with our work and providing your personal data to us, we will collect and process your data in exactly the same way as if you lived you in the EU – with the same guidance, processes and safeguards as above – even if you live outside of the EU.

We hope this Privacy Notice has been helpful in setting out how we handle your personal data and your rights to control it. If you have questions that haven’t been covered, please contact our Data Protection Officer who will be pleased to help you:

• Email us via dataskyddsombud@oru.se
• Or write to us via: Data Protection Officer, Örebro University, 701 82 Örebro, Sweden.