Register with us to view a personalised homepage and to receive emails relating to your interests.
Register hereThe Scottish Funding Council (SFC) is committed to processing personal data fairly, transparently and in accordance with the law.
This privacy notice advises what personal data we collect, how we use it, what your rights are in relation to your personal data and how to contact us if you have any questions or concerns about the use of personal data.
SFC ensures that its data processing is compliant with applicable data protection laws including:
The Data Protection Act 2018 (DPA).
The EU General Data Protection Regulation (GDPR).
The Privacy and Electronic Communications Regulation (PECR).
SFC collects personal data of students in Scotland’s colleges in order to carry out our public tasks. These include to appropriately allocate funding to colleges, monitor their performance and to improve the student experience.
SFC collects personal data of students in Scotland’s colleges in order to carry out our public tasks. These include to appropriately allocate funding to colleges, monitor their performance and to improve the student experience.
SFC collects this data directly from colleges.
SFC collects the following categories of personal data about college students:
SFC processes college student data so far as it is necessary for:
SFC processes college student data so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.
SFC processes college student special category data so far as it is necessary for reasons of substantial public interest, on the basis of law under:
SFC shares student data with other public sector bodies to allow them to carry out their tasks in the public interest and to carry out their statutory functions. SFC may share personal data with:
SFC uses third parties for some of its IT systems which are used to hold and process personal data.
SFC collects personal data of staff in Scotland’s colleges in order to carry out our public tasks. These include to appropriately allocate funding to colleges, monitor their performance and to improve the student experience.
SFC collects core staffing data directly from colleges.
Aggregate staff salary data is collected from the Colleges Development Network. While this is generally not identifiable, in some instances where there are small categories of individuals involved identification may be possible.
SFC collects the following categories of personal data about college members of staff:
SFC processes college staff data so far as it is necessary for:
SFC processes college staff data so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.
SFC processes college staff special category data so far as it is necessary for reasons of substantial public interest, on the basis of law under:
SFC shares college staff data with other public sector bodies to allow them to carry out their tasks in the public interest and to carry out their statutory functions. SFC may share personal data with:
SFC uses third parties for some of its IT systems which are used to hold and process personal data.
SFC collects personal data of students in Scotland’s universities in order to carry out our public tasks. These include to appropriately allocate funding to universities, monitor their performance and to improve the student experience.
The Higher Education Statistics Agency (HESA) collects personal information on university students(/staff) directly from universities and shares this data with SFC.
HESA is the principal body responsible for collecting and analysing data about the higher education institutions in the UK. More information on how HESA use personal data can be found on the privacy information page of their website.
Data Lab collects personal data of European Social Fund Students on behalf of SFC. Data Lab is an innovation centre within the University of Edinburgh. Please refer to the Data Lab privacy notice for more information.
SFC collects the following categories of personal data about university students:
SFC processes university student data so far as it is necessary for:
SFC processes university student data so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.
SFC processes university student special category data so far as it is necessary for reasons of substantial public interest, on the basis of law under:
SFC shares university student data with other public sector bodies to allow them to carry out their tasks in the public interest and to carry out their statutory functions. SFC may share personal data with:
SFC uses third parties for some of its IT systems which are used to hold and process personal data.
SFC collects personal data of students in Scotland’s universities in order to carry out our public tasks. These include to appropriately allocate funding to universities, monitor their performance and to improve the student experience.
The Higher Education Statistics Agency (HESA) collects personal information on university staff directly from universities and shares this data with SFC.
HESA is the principal body responsible for collecting and analysing data about the higher education institutions in the UK. More information on how HESA use personal data can be found on the privacy information page of their website.
SFC also collects data directly from universities for the provision of European Social Fund funding and to monitor the institutional governance and sustainability.
SFC collects the following categories of personal data about university members of staff:
SFC processes university staff data so far as it is necessary for:
SFC processes HE staff data so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.
SFC processes HE staff special category data so far as it is necessary for reasons of substantial public interest, on the basis of law under:
SFC uses third parties for some of its IT systems which are used to hold and process personal data.
SFC funds research and innovation projects in Scotland in collaboration with Scotland’s universities. We collect the personal data of key stakeholders to allow us to carry out this task.
The data is collected from universities.
SFC processes the personal data of university members of staff, business contacts and other key stake holders to assess, to validate the funding of Innovation Centres and to grant Innovation Vouchers and to allow us to process funding for research purposes.
SFC processes the data of university members of staff, business contacts and other key stake holders so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.
SFC shares contact details and validation of claims with other public sector bodies to allow them to carry out their tasks in the public interest and to carry out their statutory functions.
SFC may share personal data with:
SFC also shares personal data collected for the issuing of Innovation Vouchers with Interface to allow for links between businesses, SFC and universities to be established.
SFC uses third parties for some of its IT systems which are used to hold and process personal data.
Scottish Funding Council is providing you with this information to comply with data protection law and to ensure that you are fully informed, and we are transparent in how we collect and use your (personal) data.
Scottish Funding Council is the Data Controller. We have an appointed Data Protection Officer (DPO), Emma Pantel who can be contacted by emailing: info@sfc.ac.uk.
The data will be used by SFC and/or the UK REF Team within Research England as the official institutional contact for REF 2029 and to keep institutions up to date with development of the Research Excellence Framework (REF) 2029.
Forename
Surname
Job title
Institution
Work email address
The data is provided by universities.
SFC processes the data of university members of staff so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.
SFC shares contact details and validation of claims with other public sector bodies to allow them to carry out their tasks in the public interest and to carry out their statutory functions.
SFC may share personal data with:
SFC uses third parties for some of its IT systems which are used to hold and process personal data.
Personal information will be stored on servers in the UK and will not be transferred outside that territory unless required by a court.
SFC will hold the data until the REF 2029 process and evaluation is complete.
Under data protection law, individuals have rights in relation to the processing of their personal data. These rights are as follows
Some of these rights may only apply in certain circumstances and are not absolute. Requests will be assessed on a case by case basis.
To exercise these rights, please contact SFC via info@sfc.ac.uk.
If you are concerned about how your personal data is being used by the Council, in the first instance please can you contact their Data Protection Officer at info@sfc.ac.uk. If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here.
You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:
Customer Contact
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
The Scottish Funding Council is providing you with this information to comply with data protection law and to ensure that you are fully informed, and we are transparent in how we collect and use your (personal) data.
The Scottish Funding Council is the Data Controller. We have an appointed Data Protection Officer (DPO) who can be contacted by emailing: info@sfc.ac.uk.
We use Jisc Survey to process your data as our data processor on our behalf.
We use personal information you give to us, via JISC Survey for the following purposes:
We collect a range of information about you including:
We collect your personal data directly from you via JISC Survey and store on secure SFC networks.
The lawful basis we rely on for processing your personal data are article 6(1)(e) of the UK GDPR, which relates to processing necessary to perform our public task(s) and article 6(1)(f) for the purpose of our legitimate interests.
If you provide us with any information about reasonable adjustments you require under the Equality Act 2010, the lawful basis we rely on for processing this information is article 6(1)(c) to comply with our legal obligations under the Act.
If your application is unsuccessful but you are subsequently invited to participate in the diffuse network, the lawful basis we rely on to communicate with you is article(6(1)(a) – explicit consent.
Consent must be a clear positive action that you have given your agreement to the use of your personal information, and consent can also be withdrawn at any point if you are no longer happy with the use of your personal information for a specific reason. If you to wish to withdraw consent, please do so by emailing: info@sfc.ac.uk.
Once consent is withdrawn, we will destroy all relevant personal information unless we are relying on a different legal basis to justify keeping your personal information. If that is the case, we will tell you in writing. However, withdrawing your consent does not affect the lawfulness of processing based on consent before you withdrew consent.
Your information will be shared internally only. This includes: colleagues in the R&I Team responsible for the Working Group; Finance staff to process any payments (where applicable), if required and IT staff if access to the data is necessary for the performance of their role.
For unsuccessful applicants who have not agreed to be contacted in regards to the diffuse network) we will retain your data for a period of 4 weeks at which point your data will be deleted.
If you have consented to be part of the diffuse network and have been invited to it, we will retain your name and email address for the duration of the Working Group lifecycle, at which point your data will be deleted.
Successful candidates’ data will be kept for the duration of the Working Group lifecycle, at which point your data will be deleted.
If you receive an honorarium payment, your financial details will be retained for a period of 7 years, as part of our statutory retention period for financial transactions.
Under data protection law, individuals have rights in relation to the processing of their personal data. These rights are as follows:
Some of these rights may only apply in certain circumstances and are not absolute. Requests will be assessed on a case by case basis.
To exercise these rights, please contact SFC via info@sfc.ac.uk.
If you are concerned about how your personal data is being used by the Council, in the first instance please can you contact their Data Protection Officer at info@sfc.ac.uk. If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website at: https://ico.org.uk/your-data-matters/raising-concerns/
You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:
Customer Contact
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
Scottish Funding Council is providing you with this information to comply with data protection law and to ensure that you are fully informed, and we are transparent in how we collect and use your (personal) data.
Scottish Funding Council is the Data Controller. We have an appointed Data Protection Officer (DPO) who can be contacted by emailing: info@sfc.ac.uk.
Our survey responses are collected by Jisc on behalf of SFC via Online Survey (OS) and therefore act as a Data Processor.
We use the personal information you give to us as a means of corresponding with you in relation to your reporting return.
We may summarise and/or publish case studies provided as part of the RAA return. No personal data such as individuals’ names, addresses or other contact details will be included.
We collect this information directly from you, the data subject.
The lawful basis we rely on for processing your personal data is article 6(1)(e) of the UK GDPR, which relates to processing necessary to perform our public task(s).
Your personal information will be stored securely on SFC’s network, within the UK and will not be transferred outside that territory unless required by a court order.
Information collected through Jisc Survey is stored on secure servers in the UK or EU and does not leave Europe at any point.
Your information will be shared internally only.
A copy of the return will be provided to your institution upon submission.
We will only retain your personal data for as long as it is necessary to fulfil the purpose it was collected for.
Under data protection law, individuals have rights in relation to the processing of their personal data. These rights are as follows:
Some of these rights may only apply in certain circumstances and are not absolute. Requests will be assessed on a case by case basis.
To exercise these rights, please contact SFC, email: info@sfc.ac.uk
If you are concerned about how your personal data is being used by the Council, in the first instance please can you contact their Data Protection Officer at info@sfc.ac.uk. If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website at: https://ico.org.uk/your-data-matters/raising-concerns/
You can email them at casework@ico.org.uk or call them on 0303 123 113 or you can send a letter to them at the following address:
Customer Contact
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
SFC collects personal data of key stakeholders in colleges and universities as well as the wider education sector, individuals in the media, individuals involved in local and national government in order to facilitate business communications with them.
SFC will collect the data directly from the data subject directly or from publicly available sources such as institution websites.
SFC processes this data in order to communicate with relevant individuals in the sector, to promote the work we carry out and to ensure that we are able to carry out our tasks in a transparent matter.
SFC processes the data of key stake holders so far as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in SFC.
We collect personal data from our website users so we can:
SFC allows interested individuals to subscribe to updates about our activities. This helps SFC promote the work it carries out and to be transparent in carrying out our functions.
SFC’s purpose for collecting your contact details is so we can provide you with a service and let you know about our work, guidance and events.
The lawful basis we rely on for processing your contact details and interest preferences is your consent under article 6(1)(a) of the UK GDPR. You can withdraw your consent at any point by emailing webmaster@sfc.ac.uk.
SFC uses online forms to collect data, including personal data, for any of the following purposes:
Cookies are small files that a site or its service provider transfers to the user’s computer’s hard drive through a Web browser (if allowed) that enables the sites or service providers’ systems to recognize the browser and capture and remember certain information.
Cookies are used for a variety of purposes, including storing registered usernames (subscribers only) for logging in, collecting visitor statistics using Google Analytics, and social media sharing tools. Some third party cookies are used to hold and process personal data – see what cookies are stored on the website.
SFC processes the data collected by cookies so far as it is necessary for the performance of a task carried out in the public interest.
SFC is not responsible for the content of any third party websites linked to. These websites may collect your personal data, please see the relevant privacy notices of any of these sites for further information.
We occasionally embed YouTube videos on our website using YouTube’s privacy-enhanced mode. This mode may set cookies on your computer (including Flash) but YouTube will not store personally-identifiable cookie information if you play the video.
Please visit the YouTube website for further information from embedding YouTube videos.
The data collected by the Google Analytics cookies is hosted by Google. For more information please see Google Analytics Privacy Policy.
Enquiries, information requests and complaints contain personal data of the enquirer as well as third parties in some circumstances. We will use this personal data in order to respond to the query, request or complaint.
SFC processes this personal data in order to adequately respond to enquiries and to advise the sector and wider public about our activities. We also process this information in order to identify trends in enquiries received by the organisation.
SFC carries out this data processing as it is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) of the GDPR)
The contents of general enquiries shall be shared with members of SFC staff in order to adequately respond to your request.
SFC uses third parties for some of its IT systems which are used to hold and process personal data.
A Subject Access Request is a request for your own personal data under the GDPR/DPA. SFC has a legal duty to respond to such requests in accordance with the law.
SFC processes the information supplied in Subject Access Requests in order to respond to the request in line with legislative requirements including to confirm the identity of the requester. We also process this information in order to identify trends in enquiries received by the organisation.
SFC carries out this data processing as it is necessary for compliance with a legal obligation under the GDPR and DPA.
Your data will be shared with relevant members of staff in the organisation as necessary for us to respond to your request.
If the personal data you have requested is processed by any third party providers on behalf of SFC, we will share the necessary data with those third parties in order to respond to the request.
We may also share subject access request information with the Information Commissioner’s Office in the event of a complaint being made about the handling of the request.
SFC uses third parties for some of its IT systems which are used to hold and process personal data.
A Freedom of Information request is a request for information held by SFC under the Freedom of Information (Scotland) Act 2002 (FOISA) or the Environmental Information (Scotland) Regulation 2004 (EIRS). SFC has a legal duty to respond to such requests in accordance with the law.
SFC processes the information supplied Freedom of Information requests in order to respond to the request in line with legislative requirements including verifying the validity of the request. We also process this information in order to identify trends in enquiries received by the organisation.
SFC carries out this data processing as it is necessary for compliance with legal obligations under FOISA and EIRS.
Your data will be shared with relevant members of staff in the organisation as necessary for us to respond to your request.
We may also share the content of your request with relevant third parties such as contractors employed by SFC and other public bodies who have an interest in the information requested in order to consult them on our proposed response. We remove as much personal data as possible when sharing requests for this purpose.
We may also share subject access request information with the Office of the Scottish Information Commissioner in the event of a complaint being made about the handling of the request.
SFC uses third parties for some of its IT systems which are used to hold and process personal data.
A complaint is an expression of dissatisfaction by one or more members of the public about the Scottish Funding Council’s action or lack of action, or about the standard of service provided by or on behalf of the Scottish Funding Council.
SFC processes complaints information in order to adequately respond to complaints from members of the public, to identify improvements in how we carry out our services and in order to comply with the requirements of the Scottish Public Services Ombudsman.
SFC processes complaints data as it is necessary for compliance with legal obligations under the Scottish Public Services Ombudsman Act 2002 and as it is necessary for carrying out a task in the public interest.
Your data will be shared with relevant members of staff in the organisation as necessary for us to respond to your complaint.
We may also share the content of your request with relevant third parties such as contractors employed by SFC and other public bodies who have relevant to your complaint in order to consult them for our response.
We may also share complaint information with the Scottish Public Services Ombudsman in the event of an appeal being made about the handling of the complaint.
SFC uses third parties for some of its IT systems which are used to hold and process personal data.
We use personal information you give to us to facilitate the job application and recruitment process.
Our full Recruitment Privacy Policy is available on our Pinpoint Application Portal.
Individuals have right under data protection law which serve as checks and balances on data processing in accordance with the law. This section covers:
If you believe that SFC has handled your personal data in a way that is not consistent with data protection law, you have the right to complain to the Information Commissioner’s Office (ICO).
You can report your concern on the ICO’s website or by calling their office on 0303 123 1113.
Data Subjects have a right to have access to the personal data which we hold about them (subject to certain limitations).
If you would like a copy of your information, you can submit a request to SFC by contacting us using the details at the end of this notice.
We are obliged to respond to any such request within a calendar month of receipt. If the request is complex we can extend this by a further two months. We will only extend the deadline if necessary and in line with the law. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.
We will inform the applicant in writing following receipt of your request and if necessary, seek additional information about them and their request in order to help us locate the information.
Individuals have a right to have your personal data rectified if it is inaccurate or incomplete.
We are obliged to comply with any such request within one month of receipt. This may be extended two months where the rectification request is complex.
Individuals have a right to request the deletion or removal of their personal data where there is no compelling reason for its continued processing.
The right to make such a request will arise in specific circumstances for example, where data is no longer necessary for the purpose for which it was collected or where consent is withdrawn and consent is the sole basis on which data is processed.
Individuals have a right to block or suppress the processing of personal data in certain circumstances.
If, for example, the accuracy of the personal data SFC processes; that processing may be restricted until the accuracy of the personal data has been verified. This will also apply if the processing of the data is unlawful.
Individuals have the right to object to processing of their personal data if it is based on the performance of a public task or for research purposes.
To exercise this right, please submit a written request outlining your grounds of objection. We will then consider this request in accordance with our obligations under data protection law.
SFC will process data for purposes other than which it was originally requested in certain circumstances. Data processed for any of the below purposes will be kept to a minimum and shall be anonymised wherever possible.
SFC has an archival transfer agreement in place with the National Records of Scotland. SFC may keep limited personal data for archival purposes in accordance with the GDPR and DPA.
Sections of core data sets may also be kept for statistical purposes even once it is no longer required for the purpose it was initially collected for.
SFC may share personal data with external partners for research purposes. SFC will take all appropriate steps to ensure that data shared is necessary for those purposes and is kept securely.
SFC retains personal data in line with its General Privacy Notice – Retention schedule.
Unless otherwise stated, the Scottish Funding Council is the Data Controller of all personal data described in this notice.
SFC’s office is based at:
Scottish Funding Council
Apex2
97 Haymarket Terrace
Edinburgh
EH12 5HD. Contact us
Tel: 0131 313 6500
Email: info@sfc.ac.uk
To contact the Data Protection Officer, please email info@sfc.ac.uk.
SFC Strategic Plan 2022-27
Building a connected, agile, sustainable tertiary education and research system for Scotland.