WAM system privacy notice

Information you need to know

The Liverpool Business School (LBS) is part of Liverpool John Moores University. See further information on the institution.

Liverpool John Moores University is the Data Controller.

Our Data Protection Officer can be contacted at DPO@ljmu.ac.uk.

This privacy notice explains how we use your personal information and your rights regarding that information.

For information about how the wider University uses personal data, please see the Privacy notice section of our website.

Information we are collecting

We collect and process personal data about our staff and the staff of our collaborative partner institutions. This may include your:

  • name
  • gender
  • work email address
  • university profile webpage address

as well as details of intellectual contributions such as:

  • journal articles
  • publications
  • conference presentations and similar outputs

We also process academic workload information, including details of modules and programmes taught, time allocated to research, and other academic or support activities.

In addition, we may collect and process information required for accreditation by external professional or industry bodies, such as the Association to Advance Collegiate Schools of Business (AACSB). This may include information about your academic discipline and specialism, details of your academic qualifications, your AACSB qualification status, and the basis on which that status has been determined.

Source of the personal data

Personal data is obtained from a range of sources. This includes information provided directly by staff and staff of collaborative partner institutions, as well as information supplied by LJMU through internal systems and processes, such as:

  • staff profiles
  • workload allocations
  • accreditation records

Why we are collecting your data and the legal basis for this

We process personal data in accordance with the principles of the GDPR and only where there is a valid lawful basis to do so.

LBS processes personal data within the WAM system for two main purposes.

For LBS academic staff, the data is used to record and manage the allocation of work in support of:

  • workload planning
  • resource management
  • staffing decisions

For both LBS staff and staff at collaborative partner institutions, the data is also used to support submissions to external accreditation and professional standards bodies, such as the Association to Advance Collegiate Schools of Business (AACSB).

The lawful basis for processing personal data for these purposes is Article 6(1)(e) UK GDPR, as the processing is necessary for the performance of a task carried out in the public interest, including the delivery, management and quality assurance of higher education and compliance with recognised academic and professional standards.

Who has access to this data

Your personal data will be accessed only by authorised LJMU staff where this is necessary for them to carry out their role in relation to workload management, academic planning, or accreditation activity.

This includes staff such as:

  • Liverpool Business School line managers
  • faculty administrative and professional services staff
  • those supporting accreditation activity, including AACSB submissions

Personal data may also be shared with external accreditation or professional standards bodies, such as the Association to Advance Collegiate Schools of Business (AACSB), including mentors or auditors, where this is necessary to support accreditation and quality assurance processes.

Access to personal data is limited to individuals who require it for legitimate purposes.

How the university protects your data

We are committed to keeping your personal data safe in line with data protection legislation and the university’s information security and data protection policies.

Personal data associated with the WAM system is held securely in electronic form. The data is stored within the University’s SharePoint environment.

Access to WAM data is strictly restricted to authorised users and is controlled through the university’s secure systems login process, alongside role‑based access permissions specific to the WAM system. This ensures that personal data is accessible only to those staff who require it in order to perform their role.

How long the university keeps your data

In most cases, personal data is kept for two years after the end of your employment with LJMU or, where applicable, your engagement as a member of staff at a collaborative partner institution. This retention period supports workforce planning, academic management, and the completion of accreditation and quality assurance activities.

Once personal data is no longer required, it is securely deleted in line with university records management and data protection requirements.

Your rights

As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request - this could be in a portable electronic format
  • request that the university changes incorrect or incomplete data if you think that it is inaccurate or out of date
  • request that the university delete or stop processing your data, for example where the data is no longer necessary or legally required for the purposes of processing

If you would like to exercise any of these rights, please contact the Data Protection Officer at DPO@ljmu.ac.uk.

If you do not provide data

If relevant personal data is not provided or is incomplete, Liverpool Business School may be unable to accurately record workload allocations, reflect academic activity, or include staff information in external accreditation and quality assurance submissions. This could affect workforce planning, reporting, or accreditation processes.

Transfers of data outside the UK

We normally keep your personal data within the UK. In some cases, however, we may need to transfer it to another country - for example, to deliver a contract with you or to work with a partner organisation such as a university based overseas.

Whenever this happens, we make sure your information stays protected. This could be through a UK “adequacy regulation” (which confirms that the other country’s data protection laws are up to UK standards) or by putting strong safeguards in place.

These safeguards might include:

  • model contractual clauses
  • formal data sharing or processing agreements
  • binding corporate rules

In short, even if your data travels abroad, it will continue to be treated with the same care and respect as it would under UK law.

Automated decision-making

We do not use computers to make decisions about you based solely on your personal data. Any decisions that affect you will always be made by a human, ensuring that you are treated fairly.

As part of workload management and accreditation processes, information held within the WAM system may be used to support categorisation or classification for reporting purposes, for example where academic staff are allocated to qualification or faculty categories required by external accreditation bodies such as the Association to Advance Collegiate Schools of Business (AACSB).

These categorisations are based on relevant information such as academic qualifications, intellectual contributions and workload allocation and are reviewed and applied by authorised staff, rather than being determined solely by automated means.

How to complain to the university

You have a right to complain to the university if you think it has not properly responded to your request for personal information or feel it has not handled your personal data responsibly.

If you are not satisfied with how your request for information or how your personal data has been handled, you should set out your complaint in writing to:

Maria Burquest
University Secretary and General Counsel
Legal and Governance Services
2nd Floor Exchange Station
Tithebarn Street
Liverpool
L2 2QP

or by email via DPO@ljmu.ac.uk.

How to complain to the Information Commissioner’s Office

You have the right to complain to The Information Commissioner if you believe that our processing of your personal data does not meet our data protection obligations. The Information Commissioner can be contacted using the following details:

  • Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF.
  • Telephone: 0303 123 1113.
  • Email: contact can be made by accessing the ICO website.