ESIF privacy notice for students, graduates and individuals

Important update:
This ESIF-funded project has now ended. However, Liverpool John Moores University continues to process limited personal data for audit, compliance and reporting requirements associated with ESIF funding. The information below explains how your personal data continues to be used for these purposes.

Information you need to know

Liverpool John Moores University (LJMU) works with undergraduate students, graduates and other individuals on projects funded through the European Structural and Investment Funds (ESIF). These projects support activities that deliver public benefit and must comply with the conditions set out in the funding agreements.

ESIF provides funding to help local areas grow. For the 2014 to 2020 programme, two funds support investment in innovation, business, skills and employment, and help to create jobs:

  • European Regional Development Fund (ERDF) which supports research and innovation, small and medium-sized enterprises, and the transition to a low-carbon economy. The Department for Levelling Up, Housing and Communities (DLUHC), formerly the Ministry of Housing, Communities and Local Government (MHCLG), administers ERDF funding and determines what personal data is collected and how it is shared.
  • European Social Fund (ESF) which focuses on improving employment opportunities, promoting social inclusion, and investing in skills by supporting individuals to reach their potential. The Department for Work and Pensions (DWP) administers ESF funding and determines what personal data is collected and how it is shared.

Each project is part-funded by one of these funds.

For every ESIF project, a lead partner is responsible for administering the funding and providing oversight on behalf of the UK Government. Projects may also involve delivery partners.

As a ‘partner’ or ‘lead partner’, LJMU processes personal data for these projects on the documented instructions of DLUHC or the DWP, who act as data controllers. This means they determine what personal data must be collected and how it must be processed.

For more information about how DLUHC uses and shares personal data for ERDF-funded projects, please see their privacy notice. You can contact DLUHC at esif@communities.gsi.gov.uk.

For more information about how DWP uses and shares personal data for ESF-funded projects, please see their Personal Information Charter. You can contact DWP at data.protectionofficer@dwp.gov.uk.

This privacy notice explains how we use your personal data for ESIF-funded projects and your rights in relation to that data. We are committed to being transparent about how we collect and use personal data and to meeting our data protection obligations.

For information about how the wider university uses personal data please see the Privacy notice section of our website.

Information we are collecting

We collect and process a range of personal data about you where this is necessary. This includes:

  • contact details such as:
    • your name
    • address
    • date of birth
    • email address
    • telephone number
  • information about:
    • your nationality
    • employment status

Where required, we may also collect evidence of your right to live in the UK, such as a:

  • passport
  • birth certificate
  • identity card

We may also process information about your skills, qualifications and household circumstances where this is relevant to the activity you are participating in.

In some cases, we may collect special category personal data, including information about your gender, ethnicity and disability status, where this is necessary for monitoring, reporting or equality purposes.

Source of the personal data

We usually collect personal data directly from you when you register for or take part in an ESIF-funded project.

In some cases, we may also receive personal data about you from other organisations involved in delivering the project. This may include partner organisations, referring organisations such as Jobcentre Plus or an employer, and education or application services, where they are supporting your participation in the project.

Why we are collecting your data and the legal basis for this

We process personal data in accordance with the principles of the GDPR and only where there is a valid lawful basis to do so.

We collect and use your personal data to assess your eligibility to take part in ESIF-funded projects and to deliver the support provided through those projects. Your information is also used to meet contractual and reporting requirements under ESF or ERDF funding agreements, including monitoring participation, identifying which groups of individuals have received support, and supporting audit, assurance and statistical analysis. This information may also be used to inform future policy development.

Personal data for ESIF-funded projects is processed under Article 6(1)(e) of the UK GDPR, as it is necessary for the performance of a task carried out in the public interest.

Some of the data we process, such as information about ethnicity or disability, is classed as special category data. This is processed under Article 9(2)(g) of the UK GDPR, where processing is necessary for reasons of substantial public interest and appropriate safeguards are in place.

As part of the governance of ESIF-funded programmes, the Department for Levelling Up, Housing and Communities (DLUHC) and the Department for Work and Pensions (DWP) act as data controllers for certain aspects of processing. They determine how personal data must be collected and used in line with programme requirements.

The information you provide may be used by DLUHC and DWP to meet audit and compliance requirements set by the European Commission, and to support monitoring and statistical analysis of ESIF programmes.

Who has access to this data

Access to your personal data within LJMU is restricted to staff who need it in order to carry out their roles in relation to the ESIF-funded project.

Your personal data may also be shared with partner organisations involved in delivering the project where this is necessary to record the support you have received, meet reporting requirements, and support monitoring, audit and evaluation of the programme. These organisations may include:

  • other higher education institutions
  • NHS bodies
  • the Liverpool City Region Local Enterprise Partnership
  • local authorities
  • regional growth organisations
  • other government departments

How the university protects your data

We are committed to keeping your personal data safe in line with data protection legislation and the university’s information security and data protection policies.

Project documentation has been securely archived. Hard copy records are stored in a secure off-site facility (Iron Mountain), and electronic records are held on the university’s secure network drives. Access to this information is restricted to authorised staff and relevant project partners on a need-to-know basis, for example to support audit and assurance requirements.

Where personal data is shared with project partners, this is governed by formal data sharing agreements which set out the responsibilities of each party in handling and protecting personal data.

How long the university keeps your data

Your personal data will only be retained for as long as necessary to meet the requirements set out in the ESIF funding agreement and to comply with audit and regulatory obligations.

European document retention requirements state that original documents relating to the implementation and financing of ESIF projects must be retained, either electronically or in paper form, for a minimum of two years after the Audit Authority submits the Annual Control Report for the programme as a whole.

Based on current guidance, this means that personal data will be retained until at least 31 December 2033.

Your rights

As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request - this could be in a portable electronic format
  • request that the university changes incorrect or incomplete data if you think that it is inaccurate or out of date
  • request that the university delete or stop processing your data, for example where the data is no longer necessary or legally required for the purposes of processing.
  • request transfer of your data to another party

If you would like to exercise any of these rights, please contact the Data Protection Officer at DPO@ljmu.ac.uk.

If you do not provide data

We need to collect personal data from you to assess your eligibility for support and to meet our contractual obligations under the funding agreements for the ESIF-funded project. If you do not provide the required information, we may not be able to offer you support through the project.

You are not required to provide monitoring information, such as your gender, ethnicity or health data. Choosing not to provide this information will not affect your ability to receive support.

Transfers of data outside the UK

We normally keep your personal data within the UK. In some cases, however, we may need to transfer it to another country - for example, to deliver a contract with you or to work with a partner organisation such as a university based overseas.

Whenever this happens, we make sure your information stays protected. This could be through a UK “adequacy regulation” (which confirms that the other country’s data protection laws are up to UK standards) or by putting strong safeguards in place.

These safeguards might include:

  • model contractual clauses
  • formal data sharing or processing agreements
  • binding corporate rules

In short, even if your data travels abroad, it will continue to be treated with the same care and respect as it would under UK law.

Automated decision-making

We do not use computers to make decisions about you based solely on your personal data. Any decisions that affect you will always be made by a human, ensuring that you are treated fairly.

How to complain to the university

You have a right to complain to the university if you think it has not properly responded to your request for personal information or feel it has not handled your personal data responsibly.

If you are not satisfied with how your request for information or how your personal data has been handled, you should set out your complaint in writing to:

Maria Burquest
University Secretary and General Counsel
Legal and Governance Services
2nd Floor Exchange Station
Tithebarn Street
Liverpool
L2 2QP

or by email via DPO@ljmu.ac.uk.

How to complain to the Information Commissioner’s Office

You have the right to complain to The Information Commissioner if you believe that our processing of your personal data does not meet our data protection obligations. The Information Commissioner can be contacted using the following details:

  • Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF.
  • Telephone: 0303 123 1113.
  • Email: contact can be made by accessing the ICO website.