Finance and payments
If you make payment to us by card through our online payment gateway, this system uses up-to-date security authentication tools.Personal details you provide during the payment and authentication process will be used only for the purposes of processing your payment.Your bank may separately require you to use two-factor authentication through its systems.
We process your data in order to make appropriate payments to you and receive funds on your behalf, including:
To comply with legal and audit requirements we keep personal data relating to these Finance matters for a minimum period of seven years after the end of the tax year in which the relevant payment is made.
-
Course Fees
Our Finance team will process your data in order to identify the fees which you need to pay under your contract with AV and obtain payment of those Fees.
For all students, we process information about your nationality, country of residence and immigration status where this is relevant to determining your funding source (if any) and as required to determine your fee status, i.e. whether you are entitled to pay fees at the UK rate or required to pay at the overseas rate.
We then process information about your course/progression, your fees status and your source of funding and method of payment in order to issue invoices for, and receive and process payment of, your fees.
If you apply for and obtain funding from the Student Loans Company (SLC), we will share some of your data with them in line with the terms and conditions of their loan to you. This will include information about your course, progression and attendance/registration, your fees status and your payment status with the SLC as necessary to enable them to enter into and monitor the agreement they have with you and make arrangement for the payment of your course fees. We are required to inform SLC if you do not enrol on your course (after accepting an offer) or if you interrupt your studies or leave your course during the academic year.
If you obtain funding from another source (e.g. sponsor or non-UK government) we may also need to share your data with them in accordance with the terms on which they provide your support.
If you obtain financial support from US Federal funding, we will need to share your data with the US authorities including the US Department for Education, who also require us to retain indefinitely the supporting documentation you provide to us.
If you obtain financial support from other US private loans such as Sallie Mae or Ernst, we will need to share your data with those loan companies who also require us to retain indefinitely the supporting documentation you provide to us.
- Necessary for the performance of the contract between us and/or the terms of an agreement you have entered into for financial support
- Necessary for legitimate interests pursued by the Student Loans Company, i.e. applying their funding eligibility criteria and the terms of their loan agreements
-
Expenses
If you are able to reclaim any expenses incurred, e.g. in the course of a AV research project, we will process information about the relevant activities and your banking details in order to determine whether AV can pay the expenses and to make payment as appropriate.
-
Scholarships, bursaries and AV Financial Support funding
We process your data as necessary to make payment of any scholarships, bursaries or AV Financial Support funding you are awarded. This will include name, contact details, course and award details and payment information (e.g. banking details). This will include sharing data with Sodexo to enable payment by VISA pre-payment card to enable Sodexo to meet banking regulation requirements to “know your client/customer”.
-
Debt collection
If you fail to meet your financial obligations to AV, we will process your data for the purposes of debt collection. If you do not respond adequately to our request to remedy any debt situation when given appropriate opportunity to do so, we may share your data with a third party contracted to provide debt collection services to AV (currently the legal firm Shakespeare Martineau). For these purposes we will process and share information about you, your fee status and fee liabilities, your payment or non-payment of fees, and your contact details.
- Necessary for the performance of the contract between you and AV
- Necessary for legitimate interests pursued by AV: collection of debts owed to AV
To comply with legal and audit requirements we keep personal data relating to these Finance matters for a minimum period of seven years after the end of the tax year in which the relevant payment is made.
Complaints & discipline
If you are subject to the student disciplinary process, we will process your data as required to complete this process. Further information is set out above.
Immigration compliance
If you are from the EU/EEA, your immigration status and the information we will need to process for immigration purposes will depend on when you entered the UK, but you should contact AskAV or [email protected] if you are unsure of your status.
If you have EU/EEA settled or pre-settled status, you will need to provide us with a copy of your passport and evidence of your right to study in the UK (this can be obtained from the Home Office website). You will need to provide this documentation during online enrolment.
If you require any other visa, including a Student visa in order to study in the UK, we will need to process your data for purposes relating to immigration and visa applications to confirm your legal ‘Right to Study’ in the UK.
As described in the Student Recruitment and Admissions Privacy Notice, when you accepted an offer from AV we will have processed your information to issue the Confirmation of Acceptance of Studies (CAS) that you need in order to apply for a Student visa and to comply with our legal obligations under our Student visa sponsor licence. This may have included sharing your data with UK Visas and Immigration (UKVI) which is part of the Home Office within the UK Government.
We will carry out similar processing in respect of any application you make to extend your visa. As for the initial processing to issue a CAS, we may need to share information with UKVI in order to obtain information relevant to your eligibility to extend your visa. For a visa extension we also have to process financial information including bank statements. If your reasons for seeking an extension include an illness you have suffered, we may also have to process information about your health for these purposes.
Where you are given a Student visa, we are also required to report to UKVI on matters which may affect your visa status: this includes any interruption of your studies, change in course, withdrawal from the course or early completion.
We will retain any documentation you provide to us in support of a Student visa application (e.g. financial or medical documents) only for the period during which we are carrying out the assessment of eligibility for a CAS. Once the CAS is issued we destroy/delete this documentation.
We are required to retain some information collected for the purposes of our position as a Student visa sponsor under the immigration legislation for the duration of your studies, and some information must be retained for six years after completion of your studies. We are also required to share retained information with UK Visas and Immigration on request for audit purposes. This is in accordance with the current document retention guidance for student visa sponsors which is issued by UK Visa and Immigration.
More information
- Necessary for compliance with a legal obligation on AV: our obligations as a student visa sponsor/licence holder under the immigration legislation and immigration law requirements with respect to holders of EU settled status.
- Consent: you have agreed to this processing
Audit
Your data which is held within our Finance or other administration teams may be viewed by AV staff carrying out internal audits or staff of external companies or organisations carrying out external audits of our operations. They will process this data only for the purposes of auditing our compliance with AV processes and legal or regulatory requirements. They will not use your data to contact you or take any decisions relating to you as an individual.
- Necessary for the performance of a task carried out in the public interest: AV’s core purpose as a statutory higher education corporation, to deliver higher education and carry out research
- Necessary for compliance with a legal obligation on AV: our obligations as a charity and our obligations to report to Office for Students
- Necessary for legitimate interests pursued by AV: ensuring the appropriate and efficient financial operations and governance within AV.
IT services and systems
We process your data in the course of providing, maintaining and protecting the IT systems and network which we use to hold, access and create the personal data relating to you which is covered by this Notice. Some of this processing will be carried out by third parties who provide those systems to us or provide technical support services to us. These include Tribal which provides the SITS (student records) system used for student records and our provider of out of hours IT support. Your data will be processed in the course of the following activities:
-
Holding data and hosting systems
Much of the personal data described in the rest of this privacy notice will be held in electronic form in systems provided or hosted by AV, including systems we have procured from third party providers. Separate privacy information will be given to you about some of these systems. Some of your information may be held in cloud-based systems. We enter into agreements with IT service providers so that we have appropriate assurances in place regarding the functionality and security of their systems, to ensure that your data is processed in compliance with the data protection laws which apply in the UK.
- Cyber security: protecting systems and data
AV requires students to complete a registration process so that we can use multi-factor authentication for access to AV systems and networks and operate a process where students are required regularly to re-set their AV password using an automatic password re-set service (SSPR). These measures help AV manage on-going cyber security risks and provide appropriate protection for all of the personal data and other information held on AV systems. The registration process asks users to provide personal contact details (personal email address and phone number other than a AV extension) and other personal information which will be used as the answers to security questions, although users can also choose to use an authenticator app on their smartphone (the Microsoft Authenticator app) as an alternative to using personal data for authentication purposes.
The details you provide for these purposes will always be kept securely within the Microsoft Office system (the AV Microsoft Azure tenancy). The information will only be used for authentication. The information will only be accessible to you (via your AV login to Office365) and to a small number of AV privileged administrators.
(These administrators will have access to the contact information you provide but not any answers you provide for security questions). For further information see the separate privacy notice.
If you are withdrawn from study, your AV account will be disabled and access to services will cease. In most cases, the account and all associated data will be deleted after 3 months.
- System development and maintenance
Where your personal data is held within AV IT systems it may be viewed or otherwise processed in the course of work to maintain, test or further develop the functionality or security of our systems. This processing may be done by AV staff or by third party suppliers of the relevant system or service providers. Access to these systems is limited to specific authorised professional AV IT or third-party staff as necessary for the purposes of their current responsibilities within their role at or for AV. This processing does not result in any communications with you or any decisions being taken which relate to you individually. AV is seeking to minimise the use of identifiable data for these purposes, and ensure that third parties carrying out this processing are subject to appropriate contractual requirements to maintain the confidentiality and security of your data.
- IT support services
AV provides an IT support service to students. During standard working hours this service is provided by AV staff. Outside standard working hours (during evenings/nights, weekends and holidays) this service is provided by staff of an external service (currently the NorMAN service provide by Northumbria University).
Your data will be processed by AV IT support staff for the purposes of verifying your identity and responding to any requests for support that you make to this service. This may include accessing your personal AV accounts (e.g. email or Brightspace), following prior notification to you that this is necessary, and collecting information (from you) about you and about the nature of your need for IT support.
To improve the quality of the support provided to customers by IT Service Desk calls may be recorded for training and quality purposes. Callers receive a recorded message before reaching an agent, stating that calls may be recorded. Call recordings are only held for 3 months.
To enable the delivery of the NorMAN out of hours IT support service, Northumbria University have access to our Student Record System to view your name, student and user ID numbers, AV and personal email addresses, home postcode, phone number, and course title. This is to enable NorMAN to verify your identity so that you can use the service, to access your accounts/services on the AV system and to work with you to resolve your IT issue. NorMAN will share with the AV IT Support team information about you (your name and user details) and the query your raised during the out of hours period.
- Necessary for the performance of the contract between you and AV
- Necessary for performance of AV’s core public task, i.e. delivery of higher education and research
- Necessary for compliance with legal obligations on AV, i.e. obligations under data protection legislation to keep personal data secure
- Necessary for legitimate interests pursued by AV, i.e. operating and improving IT systems appropriate to the work of the organisation