Who we are and our approach to personal data
Varsity Ventures Ltd is registered in Northern Ireland and our registered office is 38 Glenside Park, Belfast, BT14 8BG. All references to ‘our’, ‘us’ or ‘we’ within this policy are deemed to refer to Varsity Ventures Ltd, our subsidiaries or affiliates. Varsity Ventures Ltd is the data controller for this website and has responsibility for the proper functioning of our suite of software products. If you are a user of one of our software products, you are only able to be a user because we have been asked by your organisation (university, college or support org), also known as our ‘Platform Partner’ to grant you access. Therefore, we act as a data processor for any personal data about you provided by you or your organisation (our ‘Platform Partner’) who is responsible as your data controller.
It also describes the choices available to you regarding our use of your personal information and how you can access and update this information. Varsity Ventures Ltd operates in accordance with the latest data protection principles enshrined in Article 5 of the General Data Protection Regulation (EU) 2016/679 GDPR as these are applied in the UK – including the principles of purpose-limitation, storage-limitation, data accuracy, data security and integrity and data minimisation.
The personal data we collect about you
We collect personal and non-personal data from you when you use our Services. Personal Data is data that includes a personal identifier like your name, email or address, phone number, IP address or device identifier, or is data that could reasonably be linked back to you. It also may include demographic information, geolocation information, educational information, or commercial information as described below.
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
How your personal data is collected
We use different methods to collect data from and about you. We collect data as follows:
How we use your personal data
We will only use your personal data when the law allows us to. We have set out in the table below all the ways we are allowed to process your personal data under the GDPR, followed by a summary of the key “lawful bases” which apply most to Varsity Ventures Ltd.
Processing Personal Data under Data Protection Law: The 6 Lawful Bases
To fulfil our contract with you: By creating an account on one of our software products, we will be required to collect, store, use and otherwise process information about you for any purposes deemed necessary for your use of our software products and for the performance of your agreement with Varsity Ventures Ltd including:
With your Consent: For some uses, we will obtain consent from you to provide additional services. Such uses include:
For our legitimate interests: Processing of your personal data may also be necessary for the pursuit of our legitimate interests – but only where the processing is not unwarranted and will not cause a prejudicial effect on your rights and freedoms, or legitimate interests. Examples are:
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Disclosures of your data
With respect to personal data, we will only share your personal data with third parties under the following circumstances:
See below the third-party vendors used by Varsity Ventures Ltd:
Customer groups used for
Where the Data is Stored
Description / Purpose
Analytics and data services
Platform Partners and Users
We use google analytics to understand user behaviour in aggregate to inform our platform engineering and product work.
Platform Partners and Users
We use the Amazon Web Services platform to power our products. Note that all data transferred to Amazon Web Services is encrypted at rest and in transmission and no data is shared directly with Amazon Web Services.
We use Send Grid to send personalised emails to users of the platform in accordance with their preferences. Examples include sending personalised digests of their user dashboard.
With respect to non-personal data, which is data that itself cannot reasonably be linked back to you or data that is combined with other data in a way that cannot reasonably be linked back to you. We use and share your non-personal, de-identified or aggregated data in a variety of ways to help our Platform Partners and the public understand trends in entrepreneurship and new venture creation through analytics reports, statistics and other metrics and guides. For example, to understand:
Our software products use a range of established international service providers to operate our services, some of whom may carry out processing outside of the EEA. We ensure through our supplier contracts that if data is exported then it is protected to the standards required by UK legislation. If you would like more details on this, please contact our appointed Data Protection Officer at email@example.com
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instruction and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. Varsity Ventures Ltd follows industry leading security procedures that meet the ten steps to cyber security outlined by the UK government. All data processed by Varsity Ventures Ltd is encrypted at rest and in transmission. Varsity Ventures Ltd uses TLS 1.2 or above for data in transmission and AES 128 or higher for data at rest.
Varsity Ventures Ltd uses security certificates as far as possible for all development tasks, any locally stored passwords used for user authentication follow OWASP guidelines. Every build of the platform is checked against the OWASP guidelines and a database of known/common web vulnerabilities.
We will retain User Provided data for as long as you use our software product and for a reasonable time thereafter. We will retain Automatically Collected information for up to 24 months and thereafter may store it in aggregate for the purpose of analytics and our legitimate business interests. If you’d like us to delete User Provided Data that you have provided via one or more of our software products, please contact our Data Protection Officer at firstname.lastname@example.org
Please note that some or all of the User Provided Data may be required in order for our software products to function properly. As a corporately responsible business, mindful of the data protection principle of storage-limitation and data-minimisation, we perform a disposal and archiving exercise at least once per annum, at which all data sets will be reviewed and obsolete data will be deleted from our systems (including our back up facilities).
Third party sites
You have certain rights in respect of your personal information:
You may contact our Data Protection Officer with questions or requests regarding your personal information. Please note that we may request additional information from you to verify your identity before we disclose any personal or account information.
Varsity Ventures Ltd uses (i) Strictly necessary (essential) (ii) Functional (iii) and Analytical (measuring performance) types of cookies.
Cookies may be delivered by us directly to you (first-party cookies) or delivered by one of our partners. Cookies can be either session cookies or persistent cookies. Session cookies enable sites to recognise and link the actions of a user during a browsing session and expire at the end of each session. Persistent cookies help us recognise you and these are stored on your system or device until they expire, although you can delete them before the expiry date.
For our products:
For our websites: