HESA Identity System

Higher Education Statistics Agency Ltd¹ ("HESA") Identity System Terms and Conditions

1. Background
   1. Our goal is to operate a safe and secure environment for our services and therefore we require all users to abide by these terms when using our services.

2. Agreement
   1. By registering a HESA Identity you agree to abide by this agreement. If you do not agree, do not register a HESA Identity.
   2. HESA may, from time to time, change or amend these terms. If we do, we will notify you, either through the user interface, in an email notification, or through other reasonable means. Your continued use of your HESA Identity after notification will be your consent to the changed terms. If you do not agree to the changes, you must stop using your HESA Identity.

3. HESA Identity
   1. You need a HESA Identity to access some of the services HESA provides. A HESA Identity provides the credentials for you to authenticate your use of these services. You are responsible for keeping your account information and password confidential. You are responsible for all activity that occurs under your account. You must inform HESA immediately if you believe that there has been any compromise of your HESA Identity.
   2. If you've forgotten your password or otherwise can't access your HESA Identity, you can recover your HESA Identity by visiting the Account Recovery webpage and providing account recovery information. You are responsible for setting up account recovery information and for keeping that information confidential. If you cannot recover your HESA Identity using the method above you may reset your HESA Identity by visiting the Account Reset webpage.

4. HESA Identity Organisation Role
   1. As well as requiring a HESA Identity to authenticate, access to some of our services is further restricted to only those people who act in a relevant capacity on behalf of an organisation and have appropriate authorisation. Such services will require your HESA Identity to show you as holding the appropriate HESA Identity Organisation Role before access to these service is authorised. You may be invited to hold such a role or you may request such a role. You must be authorised to act in such a capacity for that organisation before accepting or requesting a role. You will be required to accept any additional responsibilities that holding a role may entail.
   2. If you cease to work for an organisation in the same capacity you must remove the non-applicable roles from your HESA Identity. If you cease to work for an organisation completely you must remove all the roles you hold for that organisation from your HESA Identity.
   3. If you reset your HESA Identity, as described above, all roles and associated information will be removed from your HESA Identity. If you require a role in order to fulfil your or your organisation's obligations to HESA you will have to re-acquire it. You accept that any delay or inability to carry out your activities caused by an account reset is your responsibility.

5. Privacy
   1. HESA will be a data controller in common of the personal data and sensitive personal data that is submitted to it.
   2. We may use your personal data to provide services and/or goods you or your organisation have requested, to inform you about changes and improvements to our systems, operational documentation, website, and to let you know about other HESA services and goods which you may be interested in receiving from HESA and/or its wholly owned subsidiary HESA Services Limited for example training, data and publications. If you wish to opt out of receiving details of other HESA and HESA Services Limited services and goods please contact customer.services@hesa.ac.uk.
   3. We may also use your personal data to monitor the use of our website, to record traffic flows and to carry out research about our visitors' and customers' demographics, interests and behaviour. We do this to better understand our visitors, customers and potential customers. We confirm that HESA and HESA Services Limited's systems use cookies. We do not use cookies to share information about your use of our services with any third parties.
   4. When you give us personal data, those data may be sent electronically to servers anywhere in the world and may be used, stored and processed anywhere in the world, including countries outside the European Economic Area. Whenever and wherever we collect, process or use personal data, we take stringent steps to ensure that it is treated securely and in accordance with the Data Protection Act.
   5. We may pass your personal data to anyone who needs those data in order to provide our services to you. For example:
      • If you request or accept a HESA Identity Role in order to act on behalf of an organisation we will provide information about you to members of that organisation so that they may contact you, manage their role delegation and review your activity.
      • If you hold a role that means you approve or reject role requests for an organisation we will provide information about you to people requesting roles so that they may contact you in connection with their request.
      • If we use Royal Mail to deliver your order we will provide them with your address.
      • If we use a payment processor to process your card payment we will provide them with your card details.
      • If we use an external venue for training we may provide them with a list of attendees.
      Some of these people may be located outside the European Economic Area (EEA).
   6. Except as set out above, or when we are obliged to do so by law, we do not pass ANY data on to third party companies for marketing or any other purposes. You will therefore never receive third party marketing emails or spam as a result of any dealings with HESA.
   7. We use cookies that are necessary to the provision of the HESA Identity System and the services we provide to you. We also use cookies to collect anonymous information about pages visited on ourwebsite. We may also use cookies to remember choices you make to improve your experience of our services. We do not use cookies to share information about your use of our services with any third parties. You consent to our use of cookies as described above.

6. Cancellation
   1. If you do not comply with the terms of this agreement we may take action against you including suspending your HESA Identity, suspending or removing roles, asking you to refrain from certain activities and referring your activity to your organisation or other appropriate authority. At our sole discretion we may permanently suspend your HESA Identity and prevent you from further registration. You accept that any delay or inability to carry out your activities caused by any such action is your responsibility.
   2. If your HESA Identity is not used for 720 days it will be reset. You may reset your HESA Identity yourself at any time.