Research Mobile Applications Privacy Notice

Overview

The following notice provides information regarding the use of all Research-focused mobile applications published by Flinders University on the Apple App Store and Google Play Store.

It contains clarification around the data that we collect, how and where we store it, how you can access or update it and how you can ask to have it removed.

Policy Library

An expanded version of the information below can be found in the Flinders University Policy Library.

Flinders University Personal Information Access Procedures

Flinders University Privacy Policy

Definitions

Personal Information

Means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not, or as otherwise defined by applicable data protection laws

Sensitive

Information

Any personal information that is about a person’s:

health, health treatment, or other medical needs
race, ethnicity or religion
professional or political affiliations and memberships
criminal record
sexuality
disability status
religious or philosophical beliefs
trade union membership
genetic or biometric data

Personnel

For the purposes of these procedures, personnel includes staff, students, academic status holders, volunteers, contractors, University agents and associated third parties

What Information We Collect

We might collect and hold different personal information depending upon how an individual interacts with us. For example:

if you access our website, we may collect information about how you have used our website
if you contact us for any reason, we may collect your name, address, email address, phone number or contact details.

We may also collect information about:

your demographic
your participation in research projects
your studies and academic career, including teaching and learning interactions
your grades and course feedback
your enrolments
your preferences or opinions
police checks, e.g., if required for your course of study
your transactions with us
your bank account details and financial records with us
your tax file number
your records of donations
your photograph or video recording (e.g., identity card, lecture capture, CCTV footage)
your vehicle registration and contact details
your health and your Medicare number
the frequency of your enquiries
your location and your access to, and use of, our equipment and infrastructure (such as IT networks)
your employment status, professional history and reference check information
other information relating to your employment with Flinders
the technology you use to access our services
how and when you use our services
sensitive information

When you visit our websites, our server logs may automatically log some or all of the following information:

the type of browser and operating system you are using
your top level domain name (for example .com, .gov, .au, .uk etc)
the address of the referring site (for example, the previous site that you visited)
your server's IP address (a number which is unique to the machine through which you are connected to the Internet: usually one of your service provider's machines)
your computer's geographic location
the date and time of your visit
the address of the pages accessed and documents downloaded
the date and time of your visit and how long you spend on them
the address of the pages accessed, form submissions you make on our site, and documents downloaded

Storage and Protection

The University uses digital data storage providers located both inside Australia and overseas and has agreements with its storage providers to ensure the protection of Personal Information they store. Arrangements with these providers are reviewed and assessed periodically.

In addition to storing data in Australia, the University also stores Personal Information with providers located in the following countries:

United States
Canada
Singapore
United Kingdom (and European Union)

Many of our mobile apps that data is directly entered into use back-end storage platforms such as Google Firebase or our internal secure Research Survey platform REDCap.

Accessing Your Own Information

In most cases and subject to verification of identity, all individuals have a right to access, correct, or update their personal information held by the University.

University personnel must respond to requests for access or correction in a timely manner (and in any event within 30 days).

Individuals can seek access or request a correction or update as follows:

Current and former students can access their personal information in accordance with the relevant provisions of the Student Information Management Procedures.
Employees and academic status holders can contact People and Culture to make an appointment to view their staff file in the presence of a People and Culture officer. Requests to view or access other employment-related information should be directed to the relevant data controller (such as the administrator of the IT system in which the data is held).
Persons other than staff, affiliates or current or former students seeking access to personal information held by the University about them should contact the relevant business area to whom the information was provided in accordance with section 11 of the University's Privacy Policy:

Person making the request	Submit to:
Alumni or donor	Alumni and Advancement
Research participant	the relevant researcher
Student	Flinders Connect
Staff	People & Culture
Not listed above	The area which holds your personal information

Identity verification requirements include:

In person—picture ID e.g., student or staff card or driver’s licence
By telephone—questions to verify a range of details, e.g., FAN, Student or staff ID, Date of Birth, Course, address
Via email, other than a Flinders University e-mail address—the person will be asked to log in using their FAN and password to authenticate themselves and submit their request via their Flinders email. If the person no longer has a Flinders email address, verification will be by asking a series of questions, as above.

Limitations on Access

Documents may be withheld or redacted if the University determines that it would not be appropriate for access to be granted. Access by an individual to their personal information may be denied for the following reasons:

there would be an unreasonable impact on the privacy of other individuals (e.g. personally identifying information of referees on a staff appointment file)
the request for access is frivolous or vexatious
the documents are subject to confidentiality obligations or legal professional privilege
granting access would compromise the University in anticipated legal proceedings or commercially sensitive decision-making processes
there is a potential threat to life, health or safety

An individual who is denied access to a document or who has had their correction request refused must be given reasons for the refusal and should be advised of their entitlement to submit a Freedom of Information application.

Data Deletion and Right to Erasure

This Procedure applies only to personal information collected in respect of individuals located in the European Union (EU), due to the application of Regulation EU (2016/679)–General Data Protection Regulation (GDPR).

Under the GDPR, there is a right for individuals to have their personal information that has been collected by the University erased from the University's records. This right is often referred to as the "right to be forgotten" or "right of erasure". The right is not absolute and only applies in certain circumstances.

The steps required for the University to give effect to an individual's right to erasure will vary depending on:

where the personal information that is the subject of the request is held
to whom it has been disclosed

The timeframe for responding to the individual in respect of the request for deletion must not exceed one month from the date on which the request was first received by the University.

Any request for personal information to be deleted must be submitted within 48 hours to the Privacy Officer via email at privacy@flinders.edu.au.

The Privacy Officer will be responsible for reviewing and assessing the request, including by:

identifying whether the request relates to EU Personal Data
liaising with the relevant business unit to determine what personal information is held by the University and in what databases or locations the information is located
consulting with the relevant stakeholders in respect of the personal information held and the purposes for which it is held
making an assessment of whether the University is required to delete the personal information under the GDPR, including whether any exemption applies
providing advice to the relevant senior manager as to whether or not deletion of the individual's personal information (in whole or in part) is required
approving the response to the individual who made the request for their personal information to be deleted

Once erasure is approved by the Privacy Officer, Information & Digital Services will be responsible for undertaking searches and/or erasure of electronic information.

The relevant senior manager/s of the business unit/s holding personal information about the applicant must provide prompt assistance to the Privacy Officer and IDS in respect of any request for deletion of personal information.

Any recommendation to delete personal information in accordance with this procedure, and any communication to the relevant individual making the request, must be approved in writing by the Privacy Officer.