The Newton Room concept and Newton platform have been procured to provide Students with access to STEM learning in order for them to enhance their educational experience and gain a better understanding and grasp of the subjects within the scope of its purpose.

Students have the same rights and freedoms as adult data subjects under the General Data Protection Regulation (GDPR) and the UK Data Protection Act (DPA) and as such, do not have to engage with the services being provided in any way should they not wish to. 

This privacy statement has been produced to provide information on why, and how the Highlands and Islands Enterprise Science Skills Academy processes the personal data of users of the Newton Room platform.

Who are we

Highlands and Islands Enterprise (HIE) is one of Scotland's economic development agencies and a non-departmental public body of the Scottish Government, having its registered office at An Lòchran, 10 Inverness Campus, Inverness, IV2 5NA, Scotland.

HIE is registered as a data controller with the Information Commissioner (Registration number: Z6346473).

The Science Skills Academy (SSA) is a project led by HIE that aims to inspire children and young people across the Highlands to become engaged with the core STEM subjects: Science, Technology, Engineering and Maths.

The SSA wants to encourage more young people to study STEM subjects and raise awareness of STEM-related careers. The SSA will establish a network of five Newton Rooms (STEM education rooms) across Highland, which will be visited by classes of P6-S2 school pupils (approx. 10-14-year olds) where they will take part in practical STEM activities. In addition to activities to school groups and young people, Newton rooms are accessible to the local community, such as family science events, community outreach and teacher professional development, to inspire a wider audience in STEM

In 2017, the SSA project undertook a procurement exercise and secured an agreement with FIRST Scandinavia, an established STEM delivery provider who had the expertise in developing STEM learning centres, could provide access to a suite of STEM learning modules for young people and could provide access to a virtual learning platform (Newton Platform). 

HIE (SSA) is the Data Controller for the purposes of the Newton platform STEM delivery to both students and adult participants.

We take data privacy seriously and it is important to us that your personal data integrity and confidentiality are protected always. 

What information do we collect about you

We will only ever collect the essential information needed for the purpose for which we collect it in all cases.  The personal data we will ask for and process is:

• Attendees full names
• Students age
• Parent or Carer’s full name, contact telephone number and email address
• Secondary emergency contact name, telephone number and email address
• Schoolteachers full name, email address and contact telephone number
• Any significant medical and allergy information for the attendees (we will not ask for any specific medical information only a Y/N and how many)
• Any additional support needs the attendees may have (we will not ask for any specific medical information only a Y/N and how many)

Why do we need this information

In order to provide STEM learning activities we must collect a basic amount of information in order to provide those services effectively.  In addition to the attendee information we also require a limited amount of personal information pertaining to the teacher or class leader who will book the Newton platform for students.  In some cases it may be necessary to ask for a Parent or Carer’s personal details in order to provide additional services through the Newton Platform such as after school clubs, community, family or public events or teacher training and holiday events outside of the normal school scheduled day.

It should be stressed that only the essential information needed to provide STEM learning activities is collected in all cases.

The Newton Platform is provided in partnership with FIRST Scandinavia who are the creators of the platform. A copy of FIRST Scandinavia’s privacy policy can be found here:

https://newtonroom.com/privacy-policy

FIRST Scandinavia, the data processor, will collect the following information in accordance with their own privacy policy which is also compliant with the GDPR and the UK DPA:

• IP Address
• Browser type and Language
• Operating System and Screen size
• Access times and referring URL’s
• Cookies*

*FIRST Scandinavia makes use of Google Analytics in order to collect information about how visitors interact with the website through the collection of cookies.  This information is used solely to enhance the users experience, the cookie information is not directly identifiable.  The use of this information by FIRST Scandinavia is for internal use only and is not shared with any third parties.

It should be noted that ‘tests’ are completely anonymous with the results only being presented back to the user at the time of undertaking.  No behavioural or educational decisions of any kind are taken as a result.

Cookies are stored by FIRST Scandinavia for 2 years only.

After participating in an event, HIE (SSA) will ask you to complete a post-event evaluation using an SSA owned iPad in order to ask you about your experience, in all cases we will not ask you for any other additional information.

How we collect and store that information

HIE (SSA) and FIRST Scandinavia take all necessary technical and organisational measures to ensure that information disclosed to us is at all times secure, accurate and up to date.  Unique usernames and complex passwords are mandated for all users.  We will also ensure that it is only kept for as long as it is needed.  Data will only ever be processed in the European Economic Area (EEA) and will never under any circumstances be transferred outside the EEA.

All data is stored for 1 year only and is deleted after 12 months.

What is the legal basis for processing

As the Data Controller, HIE (SSA) uses the following legal basis for the processing of personal information in regard to the Newton Platform:

• Delivery of Newton platform STEM services in the normal school day to students:
  
  Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6.1.(e))
  
  
• Out of school hours delivery of Newton Platform services:
  
  At certain times the Newton Room will be utilised for extracurricular activities such as after school clubs and holiday events and may also at times include community, family and public events or teacher training.  These activities will be for both mixed age children and adults alike and in some cases such as family events will include a mixture of all age groups.
  
  
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6.1.(e))
  
  
• Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Article 6.1 (f))

What are your rights

Data subjects still retain the same rights and freedoms as for any data processing activity under the GDPR and are presented with bespoke targeted privacy notices on the platform.

Schoolteachers, parents and carers, Students and adult participants all have the right to use the established HIE Data Subject Access Request (DSAR) process by contacting the HIE Data Protection Officer at dataprotectionofficer@hient.co.uk.

And, retain the same ability to have their data corrected, erased and to be forgotten if required.

• Access to personal data: You can at any time contact HIE (SSA) and request data on personal information we hold
• Rectification: If you believe that any information, we currently hold is incorrect or incomplete, you may contact us at any time and request this information be corrected
• Objection: You may, at any time contact HIE (SSA) to inform us that you no longer want us to process your personal information
• Withdrawal of Consent: You may contact HIE(SSA) at any time to withdraw your consent for processing
• Erasure: If at any time you wish to object to the processing of personal information or you withdraw your consent to processing, you may also request that your personal information be immediately erased and you may also ask to be completely forgotten, in which case we will never contact you again
• Portability: Should you wish we will provide you or a third-party (at your instruction) with a copy of all the personal information we process in any format within reason
• Restriction of Processing: Should you wish, you may contact HIE (SSA) to request that we do not process certain aspects of your personal data

Who we share your information with

We never exchange or sell your information to any third party.

We use data processors who provide elements of services for HIE (SSA). We have robust contracts in place with our data processors.  This means that they cannot do anything with your personal information unless we have instructed them to do so.  They will hold it securely and retain it for the period of time we instruct them to do so.

Our third-party processors are listed below, these may change from time to time and we will update this table as necessary.

Changes to our privacy policy

From time to time we may change or update this privacy policy.  If changes are made, we will update the version and date at the top of the policy.

This privacy policy does not replace the HIE high-level privacy policy for the organisation, this is a supplementary policy which is focused on the Newton Platform.  Both the HIE and the FIRST Scandinavia privacy policies provide more granular and technical detail about the processing of personal data by HIE and FIRST Scandinavia.

How can you contact us

You may at any time contact the HIE (SSA) Data Protection Officer in writing at the following address:

Highlands and Islands Enterprise
An Lòchran,
10 Inverness Campus
IV2 5NA

Or, by emailing: dataprotectionofficer@hient.co.uk