MICIS Staff Privacy Notice
Arden University Limited is the controller for personal information used to provide MICIS. MICIS supports governed module review, evidence-led analysis, accountable review outcomes and organisational learning.
MICIS is not a staff-monitoring, performance-management or automated employment decision-making system. Do not enter student personal data, special-category information, passwords, confidential case material or unnecessary personal information.
Information used
- Your name and Arden University email address.
- Your MICIS role, account status, Quality access where granted and module assignments.
- Sign-in, sign-out, access, refusal, material, review and administration timestamps where needed for security, governance and audit.
- One-way identity, session and security hashes used for audit and protection.
- Role-specific session state and expiry information.
- A shortened one-way fingerprint derived from the connection address for sign-in rate limiting.
Purpose and lawful basis
The information is used to provide secure role-based access, protect module evidence, investigate unauthorised access or system faults, preserve accountable review history and operate MICIS. The documented lawful-basis assessment is Arden University's legitimate interests under Article 6(1)(f) UK GDPR, supported by MICIS-LIA-001.
Services involved
Authorised MICIS administrators and the services needed to operate MICIS may process the information. These currently include Netlify, Supabase, Postmark and approved University-connected services used by the MICIS workflow.
Retention
- Approved account and assignment details: retained while the account remains approved and until an authorised Administrator changes or removes it.
- Used or expired magic-link records: deleted within 24 hours.
- Expired or revoked sessions: deleted within 30 days.
- Hashed security and administration audits: deleted after 12 months unless a longer period is required for an active investigation or governance requirement.
- Governed module-review history is retained according to the applicable MICIS and University records requirements.
Approved accounts do not expire automatically. Deactivation revokes active sessions immediately while preserving the administration record needed for controlled reactivation, removal and audit.
Your rights and questions
You may ask for access, correction, restriction or deletion where applicable, or object to processing based on legitimate interests. Contact Arden University's Data Protection Officer at dpo@arden.ac.uk.
Further information is available in Arden University's Privacy Policy. You may also complain to the Information Commissioner's Office.