Privacy Policy

Educational Research Centre (ERC) Privacy Policy

 

The Educational Research Centre’s (ERC) Privacy Policy must be read in conjunction with our Data Protection Policy. We respect your right to privacy and we comply with the obligations set out under the Data Protection Acts 1988, 2003 and 2018 and the General Data Protection Regulation (GDPR) 2018. Please note that, by visiting our websites, you are accepting the terms of this Privacy Policy.

There are links from the ERC website to other external sites. Please note the ERC is not responsible for the content or the privacy policies of any external websites.

 

What data are collected by the ERC website?

Cookies can be defined as small text files placed on your computer or device when you visit certain parts of a website or use certain features on a website.

  • The ERC website www.erc.ie does not use cookies and therefore does not gather information from you when visiting our site.
  • The ERC websites trythetests.erc.ie and takethetest.erc.ie are hosted externally and both these sites gather data to enable functionality.
    • takethetest.erc.ie gathers the following information
      • Two cookies are gathered during a test taker session. Both cookies are created once the user logs in and they are stored on the local client PC for the session duration.
        • Cookie #1: .ASPXAUTH: Determines if user is authenticated
        • Cookie #2: ASP.NET_SessionId: Tracks the session of user.
      • The cookies are deleted when the user;
        • finishes the test, or
        • logs out or
        • revisits the home screen without logging out or
        • the browser session ends.
    • trythetests.erc.ie – as for the takethetest.erc.ie web site outlined above.

From time to time, we will use analytics tools (Google, Twitter, etc.) to understand how to communicate better with our community of users and followers, for example to learn the total number of times users have engaged with particular tweets, to understand which reports are accessed most frequently.

 

Other data collected & what we do with it:

We gather data to perform tasks carried out on behalf of the Department of Education and Skills under S.I. No. 392 of 2015 and amendment, S.I. No. 309 of 2017 and some data gathering is done in conjunction with participating schools or in conjunction with other agencies. Data are gathered under the lawful processing conditions, public interest for personal data, and substantial public interest for special category data, as follows:

  1. School Level Data – we use school roll numbers, school names and contact information to
    1. process and deliver any goods or services you have ordered and/or
    2. contact you in connection with any goods or services ordered.
    3. respond to any enquiry or any application form you submit.
  2. School and Student Level Data are gathered for processing Drumcondra test scores using the Machine Scoring Service
  3. School, Teacher, School Coordinator, Student and Parent Level Data are gathered for national and international studies required to inform educational policy and practice.
  4. Personal Data are gathered to process any application for ERC vacancies advertised and to assist with the selection process.
  5. Personal Data are gathered from ERC employees and ERC temporary staff for the purposes of fulfilling employment obligations, e.g. to enable payment, to apply appropriate taxes and deductions to payment, etc.
  6. Personal Data and Special Category Data are gathered to fulfil the ERC’s obligations under S.I. No. 392 of 2015 and amendment, S.I. No. 309 of 2017. The S.I., or Statutory Instrument, outlines the functions and responsibilities of the Educational Research Centre http://www.irishstatutebook.ie/eli/2015/si/392/made/en/print

 

How do I make a Subject Access Request (SAR) for my data?

Before submitting a Subject Access Request, we encourage students, parents and teachers to visit the SAR Frequently Asked Questions page on our website. This will provide information about the level of detail or the types of response the ERC will be able to provide.

In order to confirm the identity of the data subject (the person to whom the data belongs) and to ensure the protection of your data, where the request is in relation to a student’s data, we would ask you to contact the school directly to initiate your request. The school will liaise with the ERC to submit the completed request form on your behalf.

  • A parent or guardian must submit the SAR via their child’s school where the data subject is a child under the age of 13.
  • Where the data subject is 13 years or older, the request is submitted by the student, via their school.

If you would like to access your personal data, please complete our Subject Access Request Form, which can be found in the Subject Access Request section of our Data Protection & Corporate Governance pages on our website.

 

NOTE: If your data have been anonymised or deleted in accordance with our Retention and Destruction Policy, we will not be able to facilitate your request to access your data.

 

How do I update, verify or delete my data?

You may contact us directly to inform us of any changes in your data and we undertake to update your data in accordance with our obligations under current Data Protection legislation.

  • In order to confirm the identity of the data subject (the person to whom the data belongs) and to ensure the protection of your data, where the request is in relation to a student’s data, we would ask you to contact the school directly to initiate your request. The school will liaise with the ERC to make the necessary changes on your behalf.
    • A parent or guardian must submit the request via the child’s school where the data subject is a child under the age of 13.
    • Where the data subject is 13 years or older, the request is submitted by the student, via their school.

 

NOTE: The ERC advises study participants that there is generally a four-week window from the date of testing or from the date of completing a questionnaire to make changes to their factual data. This does not apply to test answers or to questionnaire data intended to capture views at a particular point in time. After this four-week window, data are submitted for processing and it is not possible to delete or make changes to data from that point. Student data are pseudonymised or anonymised as early in the process as possible, to make it difficult or impossible to link the answers back to an individual.

  • If you wish to amend or delete data we have stored in our systems, please send an email to data.protection@erc.ie with your name, email address and contact information, outlining the information you would like to amend or delete. Please put ‘Personal Data – Change Request’ or ‘Personal Data – Delete Request’ in the subject heading of the e-mail. We may need to contact you in order to complete any request in order to verify your identity and/or clarify any requests.
  • If your data have been anonymised or deleted in accordance with our Retention and Destruction Policy, we will not be able to facilitate your request to make changes or delete your data.

 

Will this data be shared with any Third Parties?

The ERC may use third parties to complete processing of our data. Any third parties will be engaged in compliance with data protection legislation.

The ERC will publish reports using aggregated data in accordance with our obligations under S.I. No. 392 of 2015 and amendment, S.I. No. 309 of 2017. Individual student test results and data are not shared with any external bodies. However, where reliable individual data have been generated, e.g. test scores, these are typically shared with the relevant school.

 

The ERC will disclose your personal data if required in order to comply with any applicable law, summons, search warrant, court or regulatory order, or other statutory requirement.

 

Is my personal data secured?

Your personal data are held on ERC secure servers. Data associated with taking the online tests are stored on third party secure servers based in Ireland.

We will take all reasonable steps to protect your personal data. However, the nature of the Internet is such that we cannot guarantee or warrant the security of any information you transmit to us via the Internet. No data transmission over the Internet can be guaranteed to be 100% secure.

 

Changes to the Privacy Policy

Any changes to this Privacy Policy will be posted on our website so you are always aware of the information we collect, how we use it, and under what circumstances, if any, we disclose it.