Alumni Association Privacy Policy

 

This Privacy Notice relates to personal data processed by the NSPC Alumni Association. The following statement sets out how the Alumni Association uses your data. It should be read in conjunction with our general privacy policy. 

 

How does the Alumni Association collect personal data? 

The Alumni Association collects personal information from you both directly and indirectly. 

Occasions when information is collected directly include: 

  • Filling out a sign-up form. 

We collect information indirectly: 

  • Basic details of your award title and graduation date may be transferred from your prior student record as part of the onboarding process to verify your status as a graduate. 

 

What personal data is collected? 

In order to sign up to the mailing list we will ask for the following information about you: 

  • Your name; 
  • Your award title; 
  • Your Middlesex ID number; 
  • Your email address. 

We will also create a basic alumni record for you automatically on graduation which includes details or your progression and award. This is separate to the alumni association, and more details can be found in our general privacy policy. 

 

How your data is stored 

We will only ever share your data with third parties in the following ways and for the following reasons: 

  • On signing up your details will be stored on Brevo, our mailing list provider; 
  • Our alumni database is hosted on Microsoft 365 cloud services (including SharePoint and Dataverse), where data is currently stored in Microsoft’s United Kingdom data centres and encrypted both in transit and at rest.  

Access to both is controlled on a least-privilege basis and protected by multi-factor authentication. Data is backed up regularly to secure infrastructure, and our backup and restore procedures are tested at regular intervals by our IT providers. All company devices are protected by endpoint cyber-security software, and NSPC holds Cyber Essentials certification, which we renew annually. For more information about how Brevo processes personal data, please see Brevo's Privacy Policy: Brevo's Privacy Policy

 

International transfers 

Your personal data is currently stored in the United Kingdom. Where data is transferred to the European Economic Area (for example through our cloud service providers), this is covered by the UK’s adequacy regulations. Where data is transferred outside the UK or EEA, we ensure an appropriate safeguard is in place, such as the International Data Transfer Agreement. 

 

How and why is your personal data used? 

We will process your personal data in accordance with the framework laid out in this privacy notice, and ensure that it is treated with respect. 

Data that we do store is used to stay in touch with our alumni community in order to: 

  • Request any useful information about your experiences during your studies in order to improve the organisation; 
  • Invite you to events being held by the school; 
  • To invite you to share any career updates with us either privately or for circulation to the wider NSPC student/alumni community; 
  • Notify you of any third-party opportunities that may be of interest to you such as graduate jobs that the school has been notified about; 
  • Notify you of relevant workshops and graduate discounts from our sister company, the Existential Academy; 
  • Notify you of relevant NSPC news including but not limited to new courses and updates from our alumni. 

We may also use digital tracking tools to monitor the impact of our communications for example email tracking to record when an email we send to you has been opened, or you have clicked a particular link. This information helps us to ensure that our communications are as relevant and engaging as possible. 

We will never sell your data to other organisations. 

 

Data controller and contact details 

NSPC Ltd is the data controller for the personal data described in this notice. 

If you have any questions about this notice or wish to exercise your rights, please contact: 

Data Protection Lead: Danny van Deurzen-Smith 

NSPC Ltd, 61–63 Fortune Green Road, London NW6 1DR 

Email: [email protected] 

 

How long does NSPC keep your personal data? 

We will hold your personal data indefinitely, or until you request deletion from the list. You can also update your communication preferences using Brevo, our mailing list provider, which includes the option to unsubscribe. It is important to note that unsubscribing is not the same as deletion of your data. 

Data deletion can be requested via the alumni association email address: [email protected] 

 

Your rights 

Under data protection law you have the following rights, some of which apply only in certain circumstances: 

  • the right to be informed about how we use your data; 
  • the right of access to the personal data we hold about you; 
  • the right to rectification of inaccurate or incomplete data; 
  • the right to erasure of your data; 
  • the right to restrict our processing; 
  • the right to object to our processing; 
  • the right to data portability; 
  • the right to withdraw consent, where our processing is based on consent. 

These rights are not absolute, and we may be entitled to refuse a request where an exception applies. To exercise any of your rights, please contact our Data Protection Lead using the details above. 

If you believe your request has not been handled properly, or you have any other data protection concern, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk. 

 

Our responsibilities 

All staff and students who handle personal data for which NSPC is responsible must follow our Data Protection Policy and any related guidance issued by NSPC or Middlesex University. 

 

Changes to this notice 

We may update this notice from time to time. The current version, and the date it was last reviewed, is shown at the top of this document and published on the NSPC website.