Student Application Portal Data Privacy Notice

Introduction
Data protection is concerned with safeguarding the privacy rights of individuals in relation to the processing of their personal data. Personal data is defined as any information relating to a living individual which allows the identification of that individual. This may, for example, include your name, your email address, and your date of birth or your contact number.

To complete your application, you will need to submit some of your personal data to Dublin City University (DCU) via an online portal – the Student Application Portal (CRM Recruit) - referred to as the Student Application Portal from here in. This Data Privacy Notice relates to the privacy practices in connection with the DCU Student Application Portal. Where they exist, links to other websites are clearly identifiable as such on the portal and DCU is not responsible for the content or privacy practices of those websites.

Why DCU needs your data
The data you provide will be used by DCU to assess your application to be admitted to a DCU programme. It will only be used for this purpose and for no other reason.
Please note that DCU retains the right to make final decisions on admissions to its programmes.
Registration on the Student Application Portal and/or applying to a course may require the submission of personal data such as (but is not limited to) your name, addresses, phone numbers, email address, PPSN, date of birth, Higher Education Student Numbers etc.
In addition, completing an application may require you to upload copies of (or otherwise forwarding) documents containing personal information such as (but is not limited to) your birth certificate, passport, profile photo, examination results etc.
The application process may also require personal information about related third parties such as referees.

Legal Basis
The legal basis invoked for the processing of your personal data on the Student Application Portal is consent. If you do not wish to provide your consent you have the right to do so. However, to submit a valid application some personal details are necessary and by not doing so you may invalidate your application.

Retention of personal data
Once you are registered on the Student Application Portal, DCU will retain your information whether or not you apply for a course. This data will be held on the Student Application Portal for 3 years before being erased. However, the personal data of the applicants who go on to study at DCU will continue to be held for as long as the student has a relationship with DCU. This duration is chosen to allow for an applicant to apply for, and complete, a standard length postgraduate course and to subsequently apply for another without the need to re-register on the site which could normally hinder or cause delay to subsequent application processing and management. In the case that you apply to a course then DCU will keep the data for up to 3 years from the last date of either application, acceptance of offer, or other decision action such as withdrawal or deferral.
In the case of an applicant applying to the Professional Master of Education (PME), personal will be kept indefinitely. This is done to allow for scrutiny or legal challenges to an applicant’s eligibility as per the requirements set down by the Teaching Council.
In the case of technical information such data will also be stored for 3 years.

Location of the Processing
The processing of your data will take place in the offices of DCU and in an EU-based data centre where the solution to support the Student Application Portal is being hosted. The primary data centre is located in Dublin with a secondary data centre based in Frankfurt, Germany.

Sharing of data with third parties
DCU will transfer your personal data to other organisations. These transfers are normally required for the purpose of making payments through a third party payment provider. Where applicable the exact nature and purpose of these transfers will be listed on the Student Application Portal.

Data protection rules
DCU must comply with of the General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988-2018 when it collects and uses your personal data. DCU acts as a ‘Data Controller’ in respect of your personal data and complies with its responsibilities under these laws.

Your Data Privacy Rights
Under data protection legislation you have certain rights as follows:
1.    Right to be informed - You have the right to be informed about what happens to your personal data in accordance with articles 12-14 of the GDPR.
2.    Right of access - You have the right to request a copy of the information that DCU holds about you in accordance with article 15 of the GDPR.
3.    Right of rectification - You have a right to correct data that DCU holds about you that is inaccurate or incomplete in accordance with article 16 of the GDPR.
4.    Right to erasure - In certain circumstances, you can ask for the data DCU holds about you to be erased from our records in accordance with article 17 of the GDPR.
5.    Right to restriction - Where certain conditions apply to have a right to restrict the processing of your data by DCU in accordance with article 18 of the GDPR.
6.    Right of portability - Subject to certain restrictions, you have the right to have the data DCU holds about you transferred to another organisation where it is held in electronic form. This right of data portability applies to:
(i)    personal data that DCU processes automatically (i.e. without any human intervention);
(ii)    personal data provided by you; and
(iii)    personal data that DCU processes based on your consent or in order to fulfil a contract.
7.    Right to object - You have the right to object to certain types of processing, such as direct marketing.

General information on how DCU collects, uses and discloses personal data as well as your data protection rights is available within the DCU Privacy Policy .

Exercising your rights, queries and complaints
If you have any questions in relation to your personal data, you may contact the DCU Data Protection Officer, Mr Martin Ward, on 01-7007476 or email data.protection@dcu.ie. For further information, please visit the DCU Data Protection Unit Website.

The Data Protection Commission (DPC) is the official authority overseeing data protection in Ireland. If you wish to lodge a complaint to the DPC please visit dataprotection.ie

End.