Full privacy notice for CACI Limited, NSS Data Portal

1. Introduction

The Office for Students (‘OfS’) is the regulator of the higher education sector in England and has certain statutory functions set out in the Higher Education and Research Act (HERA) 2017. You can find more information about the OfS and the work that we do on our website:  www.officeforstudents.org.uk

The OfS is committed to protecting your personal information and being clear about what information we hold about you and how we use it. This privacy notice tells you what to expect when the OfS collects personal information for access to the National Student Survey (NSS) data portal, hosted by CACI Limited, and to enable contact for any associated communications.

The OfS is registered with the Information Commissioner’s Office (ICO). Our registration number is ZA309955 and you can check our entry details on the ICO’s website: https://ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/.

2. Data controller and Data Protection Officer

The OfS is the ‘data controller’ of any personal information collected within scope of this privacy notice. Our location and contact details are below:

Office for Students
Westward House
Lime Kiln Close
Bristol
BS34 8SR

Tel: 0117 931 7317

Email: dp@officeforstudents.org.uk

Our Data Protection Officer (DPO) is the first point of contact for people whose information is processed. You can contact the DPO using the details above. You should note that this email address is monitored by other members of the OfS’s data protection team. Therefore, please mark any correspondence ‘for the attention of the Data Protection Officer.’

CACI Limited is the ‘data processor’ processing personal data on behalf of the OfS for this activity. CACI Limited have been commissioned by the OfS to host the NSS data portal. CACI Limited was established in the 1982. Headquartered in London with offices around the UK, we support customers in transforming their businesses by bringing together the power of people, data, and technology. CACI Limited is also registered with the ICO.

The NSS data portal disseminates the results of the NSS to contacts at universities and colleges to interrogate and analyse their data and make changes to improve the student experience. They receive parts of the student survey data in a non-identifiable form. The data protection agreement in place between OfS and CACI Limited provides the necessary protection under the law to safeguard students' information.

The OfS has commissioned the NSS data portal on behalf of the Department for Economy, Northern Ireland (DfENI), the Wales's Commission for Tertiary Education and Research (Medr) and the Scottish Funding Council (SFC).

3. What personal information will be collected and used

The following personal information will be collected by the OfS and used by CACI Limited as part of the NSS data portal:

  • First name
  • Last name
  • Email address
  • Telephone number (optional)
  • Login details.

4. Purpose for using the information

We can only use your personal information if there is a specific purpose or purposes for doing so. Any personal data, which exists or you submit via the NSS data portal, will be used for the purposes of the NSS data portal service delivery only.

To achieve the above aims, the specific uses that will be made of your personal information are listed below:

  • To provide user access to the NSS data portal.
  • To run the NSS data portal service and deliver communications to users of the portal.
  • To consult with users of the NSS data portal to improve portal experiences and apply developments to the portal.

If we want to use your personal information for a reason other than those purposes set out above, we will tell you before we start that use and provide further information about the new purpose(s).

5. Legal basis for using your personal information

Under data protection legislation, we require a legal basis to be able to process your personal information for the purposes set out above.

In this case, the legal basis is:

  • Article 6(1)(e) Public task: the processing is necessary to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.

Information we obtain from other sources

Other than the personal information collected from you directly, we also obtain personal information about you from your higher education provider. This is to allow relevant employees from a given provider to have access to the NSS data portal. Each provider has a nominated ‘super-user’ with responsibility to ensure other colleagues at their provider have access to the NSS data portal.

The processing is necessary to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law (see UK GDPR Article 6(1)(e)).

6. How your personal information is shared and why

CACI Limited will share fields of your personal information with the OfS as data controller for specific reasons, as explained below:

  • For resolution of queries sent to the helpdesk
  • For the issuing of communications from the data controller or the UK funding and regulatory bodies.

Your personal data may also be shared with other data processors appointed by the OfS and the UK funding and regulatory bodies to support the development of any future NSS data dissemination portal.

The OfS will not disclose your information to any other organisation other than those outlined above, except where required to do so as part of our functions or by law.

Where personal information is disclosed routinely to another organisation, a contractual agreement will be in place to ensure the protection of your personal information and to ensure it is only used for the reasons described above.

7. How long your personal information is held

The OfS are only able to retain a copy of your personal information as long as it is still needed for the purpose(s) for which it was collected.

Your personal information will be kept for the duration of the contract between the OfS and CACI Limited or until we are advised that access is no longer required.

After that point, your personal information will be confidentially and securely disposed of.

8. Where your personal information will be stored

Your personal information will be stored on servers in the UK and will not be transferred outside that territory unless required by a court order.

9. How we protect your personal information

The OfS has a number of security measures in place to protect your personal information, including:

  • Accredited to the Cyber Essentials Plus standard for cybersecurity
  • All staff are required to undertake training in data protection and information security on joining the OfS and annually thereafter
  • Formal information security policies that must be read and understood by all staff
  • Personal information is only available to those members of staff who require access as part of their role.

You can read more information on the OfS’s approach to information security on our website: www.officeforstudents.org.uk/ofs-privacy/information-security/.

You can also read information about CACI Limited’s approach to information security on their website: https://www.caci.co.uk/data-privacy/privacy-policy/.

10. Your rights over your personal information

Once your personal information has been collected, you have certain rights in relation to that personal information that may be exercised. You have the right to request:

  • A copy of your personal information
  • Inaccurate personal information held about you is corrected
  • Your personal information to be deleted
  • Processing of your personal information is restricted
  • A copy of your information in a format that allows easy transfer (‘data portability’)
  • That you are not subject to automated decision making or profiling (if these take place).

All these rights have certain limitations depending on the request and the purpose for which we are holding your personal information. Further information can be found about these rights and our processes for handling such requests at: www.officeforstudents.org.uk/privacy/individual-rights-under-the-general-data-protection-regulation/.

11. Use of cookies on the website

Cookies are test files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to complete statistical reports on website activity. For further information about cookies on the OfS site visit: www.officeforstudents.org.uk/cookies/.

For further information about cookies on the NSS data portal hosted by CACI Limited visit: https://www.caci.co.uk/data-privacy/cookie-policy/. For further general information visit: www.aboutcookies.org or www.allaboutcookies.org.

12. Complaints about the use of your personal information

If you are unhappy with the way in which your personal information has been handled by the OfS, please contact us via our Data Protection Officer (details in section 2) and we will try to resolve your issue informally.

If you remain dissatisfied, you can complain to the data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) and they can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113

Email: casework@ico.org.uk

13. Changes to this notice

The OfS keep their privacy notices under regular review, and we will inform you of any changes to this notice by placing an update on this portal and writing to you via email.

This privacy notice was last updated on 4 December 2024.