STARS International University® needs to collect and use certain information about individuals. This data may include clients, suppliers, business partners, employees, and other individuals with whom the organization interacts or may need to contact. This policy outlines how personal data should be collected, processed, and stored to comply with company data protection standards and meet legal requirements.

Objectives of this policy:

The Data Protection Policy ensures that STARS International University®:

1. Complies with data protection legislation and follows best practice;
2. Protects the rights of employees, customers, and partners;
3. Demonstrates transparency in how personal data is stored and processed;
4. Protects itself from data breach risks.

Data Protection Law:

Data Protection Law dictates how organisations, including STARS International University®, must collect, process, and store personal information.

These rules apply regardless of whether data is stored electronically, on paper, or in any other format.

To comply with the law, personal information must be collected and used fairly, stored securely, and not disclosed unlawfully.

Data Protection Law is based on eight key principles. Under these principles, personal data must:

1. Be processed fairly and lawfully;
2. Be collected only for specified, lawful purposes;
3. Be adequate, relevant, and not excessive;
4. Be accurate and up to date;
5. Not be kept for longer than is necessary;
6. Be processed in accordance with the rights of data subjects;
7. Be kept secure;
8. Not be transferred to a country or territory outside the European Economic Area (EEA) unless that country or territory ensures an adequate level of protection.

People, Risks and Responsibilities:

Scope of the policy:

This policy applies to:

1. The head office of STARS International University®;
2. All branches of STARS International University®;
3. All employees and volunteers of STARS International University®;
4. All contractors, suppliers, and other individuals working on behalf of STARS International University®.
5. The policy covers all data that the company holds and which relates to identifiable individuals, even if that data does not technically fall under the Data Protection Act. This may include:
6. The names of individuals;
7. Postal addresses;
8. Email addresses;
9. Telephone numbers;
10. Any other information relating to individuals.

Data Protection Risks:

This policy helps to protect STARS International University® from the following risks:

1. Breaches of confidentiality (e.g. inappropriate disclosure of information);
2. Breaches of the right to choose (e.g. all individuals must be able to choose how their data is used by the company);
3. Damage to reputation (e.g. in the event of a successful hacking attack on confidential data).

Data Protection Risks:

This policy helps to protect STARS International University® from the following risks:

1. Breaches of confidentiality (e.g. inappropriate disclosure of information);
2. Breaches of the right to choose (e.g. all individuals must be able to choose how their data is used by the company);
3. Damage to reputation (e.g. in the event of a successful hacking attack on confidential data).

Responsibilities:

Everyone who works for or with STARS International University® has responsibility for ensuring that data is collected, stored, and processed appropriately. Every team that handles personal data must ensure that data is processed in accordance with this policy and the data protection principles.

However, the following individuals are responsible for key areas of responsibility:

1. The Board of Directors has ultimate responsibility for STARS International University® meeting its legal obligations.
2. The Data Protection Officer is responsible for:
3. Advising the Board of Directors on data protection issues, risks, and related concerns;
4. Auditing data protection procedures and policies at agreed intervals;
5. Organising training and advice for all who are covered by this policy;
6. Handling enquiries from employees and others covered by this policy;
7. Dealing with requests from data subjects to access their information (so-called ‘subject access requests’);
8. Reviewing and approving all third-party contracts that may process the company’s confidential data.

IT Manager:

Is responsible for (including local Data Protection Officer responsibilities):

1. Ensuring that all systems, services, and equipment used for storing data meet security standards;
2. Regularly checking and scanning hardware and software to ensure they are robust;
3. Assessing third-party services that the company considers for data storage or processing (e.g. cloud services).

Marketing Manager:

Is responsible for:

1. Approving data protection statements attached to communications such as emails and letters;
2. Dealing with data protection enquiries from journalists or the media;
3. Ensuring that marketing initiatives comply with data protection principles.

General Guidance for Employees:

Only those employees who need access to data to perform their jobs should have access to information covered by this policy.

Data should not be shared informally. To access confidential information, employees should speak to their line managers.

STARS International University® provides training for all employees to help them understand their responsibilities when handling data.

Employees must ensure that all data is protected by taking reasonable precautions and following the following guidance:

Use strong passwords that should never be shared with others;

Personal data must not be disclosed to unauthorised individuals inside or outside the company;

Data must be regularly checked and updated if it becomes out of date. If data is no longer needed, it should be deleted or destroyed.

If in doubt, employees should seek help from their line managers or the Data Protection Officer.

Data Storage:

These rules describe how and where data should be stored securely. Questions about secure data storage can be directed to the IT Manager or the Data Protection Officer.

Storing Data on Paper:

1. Paper documents or files should be stored in a secure location where unauthorised individuals cannot see them.
2. When documents are not in use, they should be locked away in a drawer or cupboard.
3. Paper documents and printouts should not be left where they can be seen by others, e.g. on a printer.
4. Printouts of data should be destroyed in a shredder if they are no longer needed.

Using Data:

Personal data has no value to STARS International University® if the company cannot use it. However, using data carries the greatest risks of it being lost, corrupted, or stolen:

1. When handling personal data, employees must ensure that their computer screens are always locked when left unattended.
2. Personal data must not be shared informally. In particular, it must not be sent by email, as this is not a secure method of data transfer.
3. Data must be encrypted before being transferred electronically. The IT Manager can explain how to transfer data to authorised external contacts.
4. Personal data must never be transferred outside the European Economic Area.
5. Employees must not save copies of personal data on their own computers. Access and updates to data should only occur from the central database.

Data Accuracy:

Subject Access Requests

Every individual whose data is held by STARS International University® has the right to:

1. Know what data is held about them and why;
2. Know how to access the data;
3. Be informed about how to keep data up to date;
4. Know how the company is meeting its data protection obligations.

If an individual contacts the company to request access to their data, this is known as a ‘subject access request’.

Subject access requests should be sent by email to: info@stars.university. The Data Protection Officer can provide a standard request form, although its use is not mandatory.

Subject access requests may be subject to a fee. The Data Protection Officer aims to provide the requested data within 14 days. The identity of the requester must be verified before any information is released.

Disclosure of Data for Other Reasons:

In some cases, Data Protection Law permits the disclosure of personal data to law enforcement agencies without the data subject’s consent. In such cases, STARS International University® will disclose the requested data. However, the Data Protection Officer must ensure the legitimacy of the request, seeking support from the Board of Directors and the university’s lawyers if necessary.

Providing Information

STARS International University® aims to ensure that individuals are aware that their data is being processed and understand:

How their data is being used;

How they can exercise their rights.

To this end, the university has a privacy notice that sets out how the university uses data relating to individuals.