Online Card Sort Privacy Notice

Privacy Notice for Promotion (£10 Amazon Voucher)

6 May 2026

Introduction

• This Privacy Notice applies to the opportunity to be offered by Bath Spa University to sixth form students (“Students”, “you”, “your”) to complete an online questionnaire in return for a £10 Amazon voucher (“Promotion”). Bath Spa University (the “University”, “we”) is a public university which has its main campus at Newton Park, Newton St Loe, Bath, BA2 9BN.
• We are committed to safeguarding the privacy of Students; this Notice sets out how the University will treat your personal information when you participate in the Promotion. We are the data controller which means we are responsible for deciding how we collect and use your personal information.
• Please see the policy section of our website to access our full Data Protection Policy and our further privacy notices (including privacy information for our website users).

What data do we hold?

• We collect and process your name and email address from you for the purposes of the Promotion, for the sole purpose of sending you the £10 Amazon voucher as a thank you for completing the questionnaire.

Why do we process your personal data, and what is the legal basis for that processing?

• The legal basis we are relying on for collecting and processing the information for the purposes is as follows:

Who has access to your personal data?

• Your personal data will only be shared internally or to third parties who have been appointed by the University to provide a specific service on behalf of the University in connection with the Promotion.
• We will share your personal data with third parties where required by law, where it is necessary to administer the University's relationship with you in connection with the Promotion or where we have another legitimate interest in doing so.
• We may share your personal data with third party service providers who act on our behalf such as IT services providers and our professional advisers. Where it is necessary to do so, we may need to share your information with them, so that they can carry out the services we have requested.

Information Security and Retention Period

• Your personal data is collected and stored in line with relevant Data Protection law and is stored securely using processes and systems that comply with the University's strict information security and Data Protection principles.
• We will only keep the information that you provide for as long as is necessary for the purpose for which it is processed and in accordance with relevant legislation. We will then dispose of your information by deletion from our and our service provider’s servers.

Your rights

• You have various rights in relation to your information, including:
  • The right to access the information we hold;
  • The right to request rectification or erasure of the information that we hold;
  • The right to request that we restrict what we are doing with your information;
  • The right to object to what we are doing; and
  • The right to request your information in a portable format.
• Please note that some of these rights may not apply to the information that we hold about you, and we may need to collect some form of proof of identity before acting on your request.
• Where we have relied upon your consent to process your information, you also have the right to withdraw your consent at any time. If you do so, we will not be able to process your information for the purpose set out above.
• If you would like to exercise any of these rights, or have any other questions about this Notice, please contact the University's Information Compliance Team at data-protection@bathspa.ac.uk.
• You also have the right to make a complaint to the Information Commissioner’s Office about how we use your information, although we would ask that you get in touch with us first in order that we can try to put things right. How to contact the Information Commissioner's Office can be found at https://ico.org.uk/concerns/.