Privacy Notice for eStore
This Privacy Notice explains who we are, how and why we collect and use personal information about you when you register with and place orders using our eStore. Please do read this notice to understand our practices and if you have any questions please contact us using the contact details provided below.
Who we are - The Manchester Metropolitan University (‘the University’) is the Controller for the personal data you provide using the eStore.
The personal data we process - When registering and using the eStore to place orders we will typically collect the following personal data from you: e-mail address, title, name, telephone number, organisation (optional), student number (optional and if applicable), address information, financial and payment information (if applicable).
For specific orders additional information may be requested:
- Accessibility information – if your order means attending an event at the University, we will ask for accessibility information in order to facilitate your attendance (where applicable).
- Dietary information – if your order means that catering is provided, we will ask for any specific dietary requirements.
- Prerequisite information – some courses which can be ordered via the eStore may require particular prerequisite experience and qualifications, for the purpose of ensuring suitability of event attendees (where applicable).
- Field trip information - mobile phone number, passport number, next of kin, and medical information (all where applicable). These are available to the event organiser or their representative e.g. Programme Leader and Programme Administrator, for the purposes of safely organising and delivering the service or event.
The purposes of the processing - Unless specifically stated, the personal data you provide when registering for and making purchases with the eStore will only be used to handle orders, deliver products and services, process payments and to communicate with you regarding your order. In short your personal data will only be used for fulfilling your order and facilitating your attendance (where applicable).
The lawful basis for the processing - Our main lawful basis for processing the personal data you provide as described above is to fulfil our contractual obligations to you or in order to take steps at your request prior to entering into a contract and to fulfil a contract to which you are a party.
We process any accessibility and dietary information with your consent and in order to fulfil our legal obligations under equality legislation.
The recipients or categories of recipients of the personal data - We use the services of Flywire, as a processor, to manage and process your orders. For further information about how Flywire use your personal data please see their privacy notice.
We will only disclose your personal data to third parties where your specific order requires it or we are otherwise legally obliged to do so.
Data retention - Unless otherwise stated we will retain your personal data for a period of six years following the submission of your order or the date off the relevant event, whichever is longer.
Your rights in respect of the processing - You have the following data protection rights:
- The right of access to personal information held about you in order to be aware of, and verify, the lawfulness of the processing. In the first instance you are able to access personal data held processed using ‘My Profile’.
- The right of rectification in order to have inaccurate personal data rectified or completed if it is incomplete. In the first instance you should amend your personal data using ‘My Profile’ and ‘Account Info’..
- The right of erasure, also known as the right to be forgotten. Users can request the deletion of their account providing there have been no transactions. Users may request deletion of their customer record by emailing [email protected]
These rights can be exercised by writing to the Data Protection Officer. The University will respond as soon as possible and unless contacted otherwise (if your request is particularly complex) within one month of your request being made.
Contact information
For questions or concerns about this Privacy Notice, or our use of your personal information, please contact [email protected] in the first instance.
Our Data Protection Officer can also be contacted using [email protected], by calling 0161 247 3331 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.
Updates to this privacy notice - We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our privacy notices, we will take appropriate measures to inform you, consistent with the significance of the changes we make.