Enquirers and Website Users Privacy Notice

The IOU needs to collect and process personal data in order to process your admission, respond to your queries, provide academic services, manage  operations effectively, and meet legal requirements. The IOU’s legal title is International Open University registered in The Gambia.

This document explains how we use the personal data of enquirers and registered website users. It includes information required by the General Data Protection Regulation (EU Regulation 2016/679) and related data protection legislation.

We have separate privacy notices for students (Students Privacy Notice) and alumni and supporters (Supporters and Alumni Privacy Notice).

Policy

1. The IOU is the data controller in relation to the processing activities described below. This means that the IOU decides why and how your personal information is processed.
2. As soon as you contact us or register with us, we create a record in your name. We then add to that record information that you give us whenever you contact us. We are likely to hold your name and contact details, details of enquiries you have made, and your study interests. You may give us information about “special categories” of data, if they are relevant to an enquiry. These include your racial or ethnic origin, religious beliefs, political opinions, membership of a trade union, physical or mental health. Information about criminal offences or criminal proceedings are treated similarly.
3. If you become a student, then we add the information you give to us when you register and throughout your studies to this record. For further information, see the Students Privacy Notice.
4. If you have registered with us, we will add to your record any activities that you carry out on our website.
5. If you receive email marketing communications, we record if you open them.
6. We record chat conversations and monitor other communications between you and the IOU to make sure that we have carried out your instructions correctly and to help us improve our services.
7. We may automatically collect technical information when you browse our website. Further information about this is provided in our [Cookies Policy].
8. We may enhance our enquirer records with data received from third parties, in order to ensure we have up to date contact details for you, and in order to offer you more relevant communications. We will not contact you using details received from third parties unless we already have your consent for marketing communications.
9. If you have given your consent to receive marketing communications, then we may contact you with marketing information, or show you targeted advertising on third party sites. Nb. if you apply to become a student and you had not previously set any preferences for marketing, then you may receive marketing information from us.
10. You are able to change your marketing preferences by contacting the Data Protection Officer whose details appear below. If you do not want to be shown targeted advertising messages from the IOU, some third party sites allow you to request not to see messages from specific advertisers on that site in future.
11. Where the activity relates to our public task of delivering higher education qualifications, and promoting the educational wellbeing of the community we will use and process your personal information to provide our services, activities and online content, to provide you with information about them, and to deal with your requests and enquiries.
12. Our legitimate interests are to provide and improve our services, to manage our operations efficiently, and to increase our student numbers
    • To give you relevant information about our services
    • To analyse our enquirers and registered users to inform our marketing strategy, and to enhance and personalise your customer experience
    • To identify others like you who would may be interested in our academic programs . We may use your email address to identify people like you -­ “a lookalike audience” -­ who are users of social media sites, and who may be interested in our services and our qualifications. These people would receive IOU adverts in, for example, their news feeds
    • To verify the accuracy of data that we hold about you and create a better understanding of you as a customer.
    • To maintain network and information security
    • For testing and maintaining our systems
    • To help us improve our services via staff training
    • We may ask you to take part in specific research activities to either help us plan and improve our services, or for academic research purposes.
    • We might contact you ourselves or ask outside research agencies to do so on our behalf.
    • To assess and improve our service to customers through recordings of any communications
    • To manage complaints

13. We use third party suppliers and service providers for a number of activities, from sending bulk text messages and providing IT systems, to using agents for contacting international students and conducting market research. We also use third parties to identify audiences for advertising: We may temporarily transfer an encrypted version of your email address to social media platforms in order to identify a target audience with the same interests as you. This target audience would receive targeted advertising delivered online through social media and platforms operated by other companies.
14. When we use third party service providers, we only disclose to them any personal information that is necessary for them to provide their service and we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.
15. We may transfer your personal information to a successor body if the IOU ceases to exist. We may also transfer your personal information if we are under a duty to disclose or share it in order to comply with legal obligations, to detect or report a crime, to enforce or apply the terms of our contracts or to protect the rights, property or safety of our enquirers, visitors and students. However, we will always take steps with the aim of ensuring that your privacy rights continue to be protected.
16. Generally, information you provide to us is stored on our secured cloud based systems which are located in different regions around the world.
17. If you are based in the European Economic Area (‘EEA’) and we transfer your data outside of the EEA, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as set out in this policy. These steps include imposing contractual obligations on the recipient of your personal data, or ensuring that the recipients are subscribed to ‘international frameworks’ that aim to ensure adequate protection.
18. If we collect your personal information, the length of time we retain it is determined by a number of factors, including the purpose for which we use that information and our obligations under other laws. We will hold your personal information on our systems for as long as is necessary for the relevant activity. Note:
    • If you have an IOU user account, this will exist until you ask for it to be deleted.
    • We will keep your record until an appropriate time after your last meaningful contact with us (this is set by business rules)
    • Records of specific interactions, e.g. enquiries you have made, are likely to be kept for between […] and [ …] years, depending on how relevant they are to your future study.
    • If you register as a student, then we will collect more data about you and keep it for longer – please see the Students Privacy Notice.

19. You have various rights regarding your personal data. For information about your rights or in order to exercise those rights, you may contact the Data Protection Officer whose details appear below.
    You have the right to:
    • access the personal information we hold about you -­ a “subject access request” enables you to receive a copy of your data and to check that we are lawfully processing it.
    • correct inaccuracies in the information we hold about you -­ enables you to ask us to correct any incomplete or inaccurate information we hold, though we may verify the accuracy of the new data you provide to us.
    • request erasure of your personal data – enables you to ask us to delete or remove your data under certain circumstances, for example, if you consider that there is no good reason for us continuing to process it, where we may have processed your information unlawfully or where we are required to erase your personal information to comply with the law. We may not always be able to comply with your request of erasure for specific reasons of which you will duly be informed.
    • request that we stop sending marketing communications to you.
      
      You may also have the right to:
    • restrict the processing of your personal data in certain ways – you may request that we suspend the processing of your personal data, firstly, if you want us to establish the data’s accuracy;; secondly, where our use of the data is unlawful but you do not want us to delete it;; thirdly, where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims;; or fourthly, you have objected to our use of your data but we need to verify whether we have overriding legitimate reasons to use it.
    • obtain a copy of your personal data in a filing system
    • object to certain processing of your personal data by us – where we (or a third party) are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground as feel it impacts on your rights and freedoms. In certain situations, we may assert that we have compelling legitimate grounds to process your data which override your rights and freedoms.
    • request a transfer of your data to a third party – we will provide to you, or a third party on your behalf, your personal information in a structured, commonly used, machine readable format. This right only applies to automated data which you initially provided consent for us to use or where we used the information to perform a contract with you.
    • withdraw consent where we are relying on consent to process your personal data – but this will not affect the lawfulness of processing carried out before you withdraw consent. If you withdraw your consent, we may not be able to provide certain services or products to you. Should this happen, we will advise you at the time you withdraw your consent.
    • request a review by a human of any automated decision.

20. If you have concerns about the way we have processed your personal information, you could write to our Data Protection Officer
21. Like many other websites, our website uses cookies and similar technologies to obtain an overall view of visitor habits and visitor volumes, and to provide you with more useful and relevant adverts on our website and other websites. For more detailed information on how we use cookies and how to switch them off see our [Cookies Policy].
22. If you have any queries about this policy or about the way in which we collect or process personal data, please contact our Data Protection Officer:
    Email:  dataprotection.officer @iou.edu.gm
    Post: Data Protection Officer,Student Affarirs Division.

This document will be updated from time to time in order to ensure that it complies with data protection legislation.