188体育

Data subjects have a range of specific rights in relation to their personal data, that they can exercise under UK data protection legislation (also known as UK General Data Protection Regulation (GDPR) or Data Protection Act 2018 (DPA 2018).

There are 8 fundamental data subject rights:

• The right to be informed
• The right of access;
• The right to rectification;
• The right to erasure (also known as the right to be forgotten);
• The right to restrict processing;
• The right to data portability;
• The right to object; and
• Rights related to automated decision making including profiling.

Except for the right to be informed and rights relating to automated decision making and profiling, the Student Loans Company (SLC) has one month (from receipt) in order to respond to your request. This can be extended by a further two months if we consider the request to be complex, however we will notify you within one month if we require to extend the response time.

There is no charge applicable in relation to these requests unless in exceptional circumstances (please see the section Manifestly Unfounded or Excessive requests).

All requests can be made by:

• Writing to; Subject Access Requests, Verification Operations (4th Floor), Student Loans Company Limited 10 Clyde Place Glasgow G5 8DF
• Emailing [email protected]
• Contacting one of these numbers (depending on where you live); England 鈥� 0300 1000607; Northern Ireland 鈥� 0300 1000077; Wales 鈥� 0300 2004050; and Scotland 鈥� 0300 1000609.

1. Right to be informed

You have a right to be informed about the collection and use of your personal data.

SLC provides customers, employees, and applicants, with information including:

• the purposes for processing their personal data;
• the retention periods for that personal data;
• who it will be shared with.

SLC accomplishes this through use of a Privacy Notice. SLC has Privacy Notices for both customers, employees, and applicants, and we regularly review/update these Privacy Notices.

SLC is obliged to bring any new uses of your personal data to your attention before we start any processing.

2. Right of access

You have a right to request a copy of your personal data being held by SLC. You can request this by making a Data Subject Access Request (DSAR), which is sometimes known as a Subject Access Request or SAR.

SLC provides a Data Subject Access Request Form for individuals to use. This form is designed to help you give as much detail as possible to aid us in locating the information being requested. Although it is not mandatory to use this form, its use could reduce or prevent the need for clarifications on the request and allow us to respond to your request as quickly as possible.

Under the Equality Act 2010, reasonable adjustments will be made for those unable to submit a request in writing eg. in certain circumstances, the requester has the right to receive their information verbally. If you require a reasonable adjustment to be made, then please inform us as part of your request.

3. Right to rectification

You have a right to have inaccurate personal data rectified or completed if it is incomplete. If you become aware that any of the data which SLC holds about you is inaccurate, you should contact us as soon as possible.

SLC may refuse a request for rectification if we are satisfied the personal data held is accurate. Should that be the case, we will inform you that we will not be amending the data and explain our decision. We will also place a note on the system to indicate that you have challenged the accuracy of your data and your reason for doing so.

You are obliged to notify SLC immediately on becoming aware of any change of circumstances which require changes to be made to any of the personal data which SLC holds about you, see Terms and conditions of student loans.

If you wish to update your personal data (as opposed to asserting your right to correct or rectify any data SLC holds), you can confirm/update your personal data using SLC鈥檚 customer portal.

4. Right to erasure

The right to erasure is also known as 鈥榯he right to be forgotten鈥�.

You have the right to request the erasure of your personal data to SLC if:

• the personal data is no longer necessary for the purpose for which it was originally collected;
• we are relying on your consent as our lawful basis for holding the data and you withdraw this consent;
• you object to the processing of your data and there is no overriding legitimate interest to continue this processing;
• we are processing the personal data for direct marketing purposes and you object to that processing;
• we have processed the personal data unlawfully.

5. Right to restrict processing

You have the right to request that processing of your personal data is restricted or suppressed by SLC in the following circumstances:

• you are contesting the accuracy of your personal data, and we are verifying the accuracy of the data;
• we have processed the personal data unlawfully;
• we no longer need the personal data, but you need us to keep it in order to establish, exercise or defend a legal claim; or
• you have objected to us processing your data and we are considering whether our legitimate grounds override those of yours.

6. Right to data portability

You have a right to obtain and re-use your personal data for your own purposes across different services. This allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability.

The right to data portability only applies:

• to personal data you have provided to SLC;
• where the processing is based on consent or for the performance of a contract;
• when processing is carried out by automated means.

SLC will provide the personal data in a structured, commonly used and machine-readable form e.g a CSV file. Machine readable means that the information is structured so that software can extract specific elements of the data. This will enable other organisations to use the data. If requested, SLC will transmit the data directly to another organisation if this is technically feasible.

7. Right to object

You have the right to object to the processing of your personal data in certain circumstances:

• processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority;
• direct marketing;
• processing for research purposes.

8. Rights in relation to automated decision making and profiling

You have a right to information about the reasoning behind any decisions taken by automated means, including profiling:

• you should be informed when an automated decision has been taken;
• you can ask SLC to reconsider a decision taken by automated means.

You can exercise your rights in relation to automated decision-making and profiling by contacting the appropriate support team via Guidance on contacting the Student Loans Company

9. Manifestly Unfounded or Excessive requests

SLC reserves the right to refuse any request which we consider to be manifestly unfounded or excessive. In such cases where we consider a request to fall into any of these categories, we may proceed but request a reasonable fee for its completion and any reasonable fee will be based on the administrative costs of complying with the request. If SLC decides to charge a fee, then we will contact you within one month, and once we have received the fee, we will action your request.

10. Data subjects have additional rights under UK data protection legislation, including:

The right to withdraw consent

In the limited circumstances where you have provided consent to SLC for the processing of your personal data for a specific purpose, and consent is the legal basis for the processing of your personal data, then you have the right to withdraw your consent for that specific processing at any time.

To withdraw your consent, please contact one of the below numbers (depending on where you live):

• England 鈥� 0300 1000607
• Northern Ireland 鈥� 0300 1000077
• Wales 鈥� 0300 2004050
• Scotland 鈥� 0300 1000609

Once SLC has received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we are required to do so by law, or have another legitimate basis for doing so in law.

The right to complain

You have the right to make a complaint at any time to the Information Commissioner鈥檚 Office (the UK supervisory authority for data protection legislation), about the way SLC processes (or has processed) your personal data.

The Information Commissioner鈥檚 Office can be contacted by:

• Writing to; Information Commissioner鈥檚 Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
• Calling 0303 123 1113
• Visiting their website Information Commissioner鈥檚 Office (ICO)