This policy explains what information is gathered from visitors to the SDEO website, and how that information is used. Our website is designed in accordance with the Information Commissioner's Office guidance on the use of cookies and similar technologies.

Information Collected

Information is gathered from visitors via several methods that are outlined below:

1. Logfiles

SDEO's web server tracks requests made of it to centrally held log files. Log files can contain any or all of the following types of data:

• The date and time of connection
• Identification of the files requested
• Whether the request was successful
• The size (in bytes) sent in response
• The referring page (where the visitor came from), as supplied by the visitor's browser
• The software used to access the server, as supplied by the visitor's browser

SDEO also uses the following log reporting services on its website to measure and analyse visitor information:

• Matomo (formerly Piwik)

Examples of data collected automatically from all users include:

• the Internet Protocol (IP) address;
• computer and connection information such as browser type and version, operating system, and platform;
• Uniform Resource Locator (URL) click-stream data, including date and time, and content viewed or searched for on the website.

Information gathered is used for server system administration, identifying broken links, producing usage statistics and for educational research.

Logged information may be kept indefinitely. Log files do not contain any personal information.

2. Single Sign-On Services (SSO)

SDEO makes use of single sign-on services such as Shibboleth and Oauth2. These services allow a user to access the SDEO website with a username and password obtained from an authorised third party they have previously signed up to. Names and email addresses are sometimes passed to SDEO from these third parties.

3. Cookies

Cookies are small files that are sent from the web server to the visitor's computer via the visitor's browser. They are then stored in the visitor's computer as text files and passed back to the server. Cookies are generally used to identify users and, on occasion, prepare customized web pages for them. Cookies may remain on the visitor's computer merely for the duration of the visit or they may remain indefinitely. Most standard web browsers may be configured to refuse cookies.

SDEO uses cookies for the essential running of its websites and web applications. Such cookies are transient, do not contain any personal information, cannot be used to identify you and are exempt from the EU Directive.

4. Web forms

Forms on the SDEO website may request visitors to supply personal details. Where appropriate, such forms operate over secure connections so that data is safeguarded.

By supplying such information the visitor consents to SDEO storing the information for a period of time appropriate to the supply of the goods or services requested. Personal information provided will be used for the purpose stated and will not be sold, licensed or traded to third parties. Information entered into a form may be used by SDEO to contact you.

Personal information collected and/or processed by SDEO is held in accordance with the provisions of the General Data Protection Regulation.

Sharing

Website analytics and educational usage data are shared with SDEO's partner institutions for the purpose of improving SDEO services. Anonymised data that forms part of educational research results may be published internationally. We make no attempt to identify individual users. SDEO partner institutions include: University of Aberdeen, University of Dundee, The University of Edinburgh, University of Glasgow, Glasgow Caledonian University, University of the Highlands and Islands and NHS Education for Scotland.

Your Rights Regarding Your Personal Data

You have the right to:

• know what information SDEO holds about you and how it is processed
• ask for inaccurate data to be corrected
• receive a copy of information SDEO holds about you
• raise concerns with the supervisory authority (the Information Commissioner)

If you would like to see information we hold about you, please contact SDEO.

We will ask for proof of identity (such as a passport or photo ID driving licence). Once we have received your request, identification, we must respond to you within 30 days.

Data Deletion

You can instruct SDEO to delete the data we hold on you via the following methods:

• Log in to the SDEO site, click on the account icon and follow the 'I wish to be forgotten' link at the bottom of the page.
• Email admin@sdeo.ac.uk instructing us to delete your data and we will contact you to complete the process.

Data Protection

Queries regarding data protection should be addressed in the first instance to the NHS Education for Scotland Data Protection Officer. foidp@nes.scot.nhs.uk

SDEO's lead data protection supervisory authority is the Information Commissioner's Office (ICO).

Disclaimer

SDEO takes reasonable efforts to ensure that the contents of its websites are accurate; however, it cannot give any warranty that this is the case. SDEO may change web content at any time without notice.

Users posting to web-based facilities on SDEO must abide by the SDEO Code of Practice (below). Postings deemed to be offensive will be removed.

SDEO includes links to third-party websites. These links are used to provide further information and are not intended as an endorsement of such websites and/or their content.

SDEO Code of Practice

1 - Scope

Anyone using the services provided by SDEO.

2 - Governance

When using SDEO you remain subject to the same laws and regulations as in the physical world.

It is expected that your conduct is lawful. Furthermore, ignorance of the law is not considered to be an adequate defence for unlawful conduct.

When accessing services for another jurisdiction, you must abide by all relevant local laws, as well as those applicable to the location of the service.

Breach of any applicable law or third party regulation will be regarded as a breach of these regulations.

3 - Intended Use

SDEO is provided for use in furtherance of study, teaching and education.

Use of SDEO for private commercial purposes is forbidden.

4 - Identity

You must take all reasonable precautions to safeguard any credentials issued to you. You must not allow anyone else to use your credentials. Nobody has the authority to ask you for your password and you must not disclose it to anyone.

You must not attempt to obtain or use anyone else's credentials.

You must not impersonate someone else when using SDEO.

You must not disguise your identity when using SDEO, except where the login method explicitly provides / enforces this feature.

5 - Infrastructure

You must not do anything to jeopardise the integrity of SDEO, for example, by doing any of the following:

• Deliberately of recklessly introduce malware
• Attempt to disrupt or circumvent security measures

6 - Information

You must not infringe copyright or break the terms of licences for SDEO or other material.

You must not attempt to access, delete, modify or disclose information belonging to other people without their permission or explicit approval.

You must not create, download, store or transmit unlawful material, or material that is indecent, offensive, threatening or discriminatory.

7 - Behaviour

Real world standards of behaviour apply online.

You must not send spam.

You must not use SDEO in a way that interferes with others' use.

8 - Infringement

Infringing these regulations may result in sanctions under your institution's disciplinary procedures. Penalties may include withdrawal of service. Offending material may be taken down.

Information about infringement may be passed to appropriate law enforcement agencies and any other organisations whose regulations you have breached.

SDEO reserves the right to recover from you any costs incurred as a result of your infringement.

You must inform SDEO if you become aware of any infringement of these regulations.