Prospective student privacy notice

Communications, Marketing and Student Recruitment

The purpose of this Privacy Notice is to tell you how the university will collect and use your personal data. In addition to this notice, you may be given further information about the uses of your personal data when you use specific services and facilities offered by the University of Gloucestershire.

This Privacy Notice may be updated from time to time to ensure continued compliance with Data Protection legislation and to reflect best practice.

The latest version of the Notice can be found on our data protection webpage.

1. Identity and contact details of the Data Controller

The University of Gloucestershire is registered with the Information Commissioner’s Office as a Data Controller and is committed to protecting the rights of individuals in line with Data Protection legislation.

A copy of this registration can be found on the ICO website.

2. Contact details of the Data Protection Officer

The Data Protection Officer is responsible for advising the university on compliance with Data Protection legislation and monitoring its performance against it. If you have any concerns regarding the way in which the university is processing your personal data, please contact the Data Protection Officer at:

Data Protection Officer University of Gloucestershire Registrar’s Directorate Fullwood House
The Park
Cheltenham, GL50 2RH

Email: dpo@glos.ac.uk

3. What information do we collect about you?

The following are examples of personal data that may be collected, kept and used: name, year group, email address, phone number, name of school or college, address of school or college, gender, ethnicity, post code, access needs (for yourself or any guests attending events with you) and any other personal data submitted in your feedback to us about the running of an event or activity.

We collect information in order to fulfil your request and, if consent is given, to send you further relevant information about the university, courses you’re interested in, accommodation or events relevant to your course of interest.

4. How do we collect this information?

We may collect your personal data in a number of ways, for example:

• from the information you provide to us when you interact with us before applying, for example
• when you request a prospectus
• from the information you provide on your application form if you apply to us
• from the information supplied as part of any surveys and feedback requests we issue
• when you communicate with us by telephone, email or via our website, for example in order to make enquiries about events or activities
• from third parties, for example, from your previous or current school or sixth form college
• from third party organisations providing facilities and services aimed at encouraging engagement in higher education and/or applications to universities including the university from sponsors and bodies and agencies who intend to fund your higher education
• if you complete an evaluation form after participating in an outreach activity.

If you are registering for events (for example open days and applicant days) or requesting information via our website, your personal data will also be processed in line with our website policy.

5. How will your information be used?

The information you provide will be used to send you communications (printed and/or digitally) about the University of Gloucestershire, the courses we offer and events we run, and our services, such as student support, accommodation, scholarships and bursaries. We may also contact you to conduct market research and quality assurance checks, for example we may ask you about your satisfaction with the information we provide and your experience of the admission process.

We will also use the information you provide to evaluate the impact of our activities and track your progression through education if you have given us your consent. Your data will be used to help evaluate the effectiveness of our activity as part of the government policy to widen participation in higher education and to develop future policy. The University of Gloucestershire will not use its records in any way which will affect any learner individually.

We will not disclose any data to anyone who is unauthorised to receive it. We consider the processing of your information for the above purposes to be necessary for the performance of tasks we carry out in the public interest. This includes running events to promote access to higher education, informing students of their educational options, increasing educational attainment, and carrying out related evaluation, tracking and research.

We will not sell your data to third parties.

6. What is our lawful basis for processing your personal data?

Prior to application

We will use your data to process your enquiry and provide you with marketing materials where you have given us your consent to do so. This includes, but is not limited to, communications about courses, accommodation and events. If you have booked onto an event, you will receive communications regarding the event, irrespective of the communication preferences you have chosen, so we can ensure you have everything you need to know.

• We may process your personal data because it is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract.
• We may also process your personal data because it is necessary for the performance of our tasks carried out for a legitimate interest.
• We also have a legal requirement to report back to the government based on a task carried out in public interest to widen participation for underrepresented groups in higher education.

On application

Once you have applied to study, you enter a contract with the university to provide you with the information you need to make an informed decision about whether to attend the university. This includes invitations to interviews, applicant days, reminders of key dates (including deadlines) and induction.

To opt out of receiving this information you will need to email the university at enquiries@glos.ac.uk.

We may also process your information for a legitimate interest if you have given us the consent to do so. This includes sending you communications about your course, the facilities of the university and general
accommodation information.

Special category data

In some of our activities, for example those related to widening participation to university from underrepresented groups, we need to collect data that is classified as special category (sensitive) personal data under data protection legislation, including details on ethnicity and race.

This is processed on the basis of a legitimate interest under Article 6 of the General Data Protection Regulation (GDPR) and condition J of Article 9(2) of the GDPR which states: processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes to safeguard the fundamental rights and the interests of the data subject.

This data may also be shared with government bodies, or organisations working on behalf of the government for research and analysis purposes.

7. Who is your personal information shared with?

Your information will be processed by the university and organisations working on our behalf who are compliant with current data protection legislation in order to send you relevant communications, for example:

• providers who send communications on behalf of the university, e.g. letters, emails, SMS or other communications
• providers who will use your profile information to identify others who may be interested in the university.

No information will be passed to third party organisations for them to contact you directly themselves.

Information about you may be disclosed to other organisations outside of the university where it is in our legitimate interests and/or as required by law, including but not limited to:

• the police and other crime and fraud prevention, and detection agencies for crime prevention or detection purposes
• the Home Office, including UK Visas and Immigration, UK embassies, local authorities and other governmental bodies
• Government bodies and agencies where the university is legally obliged to do so such as the Office for Students, the Higher Education Funding Council for England and the Quality Assurance Agency for Higher Education, the Higher Education Statistics Agency, UCAS, the Department for Education, and the Higher Education Access Tracker and its subscribers
• the Disclosure and Barring Service
• sponsors, agencies or bodies funding or intending to fund your programme of study
• your country’s government, high commission, embassy or consulate
• third parties who initially provided us with personal information relating to you such as third party recruitment agents.

8. Transfers to other countries and safeguards in place

Data collected may be transferred outside the EU, for example some data processed by the university’s contracted software supplier is stored on servers located in Canada. Canada has “adequacy” status from the European Commission. Whenever data is transferred from one location to another it will always be in a secure, encrypted or password protected format.

We ensure that any data processor complies with confidentiality, current data protection legislation, data sharing protocols and safeguards, governing law, intellectual property, liability and pursuant to its commitment to compliant practice.

9. How long will your information be held?

When we captured your data along with your intended year of entry (when you planned to start studying at university), the general information you provide to us will be held for one year after this date. If no ‘year of entry’ was known, we keep your information for a maximum of 3 years from the time it was collected. If, however, you become an applicant you will be subject to other notices that we will provide to you and your data will be held in line with the University’s Records Retention Schedule.

If you attend one of our events and activities, we will only retain certain detailed information that we need for the purpose of administration for as long as necessary to serve that purpose. In order to conduct long-term evaluation, tracking and research about access to higher education, we will retain some of your key personal information until you reach the age of thirty or up to fifteen years from graduation. After this time, any personal information will be removed from our systems, but we may continue to retain and process your information in an anonymised form. This will enable us to track your university and career destinations.

If you have given your consent and you wish to withdraw it, you can opt out at any point by contacting us directly at enquiries@glos.ac.uk, at the address below, or by unsubscribing via any email communications you receive from us.

You can also amend your communication preferences here.

10. What are your rights?

Under Data Protection Legislation you have the following rights:

• to request access to, and copies of, the personal data that we hold about you
• to request that we cease processing your personal data
• to request that we do not send you any marketing communications
• to request us to correct the personal data we hold about you if it is incorrect
• to request that we erase your personal data
• to request that we restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
• to receive from us the personal data you have provided to us, in a reasonable format specified by you, to another data controller
• to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights and freedoms.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

Security of your information

Your data will be held securely and all staff are required to comply with the university’s processes and procedures regarding data security. Whenever data is transferred from one location to another it will always be in a secure, encrypted or password protected format.

Any requests or objections should be made in writing to the university’s Data Protection Officer, contact details are in Section 2 of this Privacy Notice.

11. How to make a complaint

If you have queries, concerns or wish to raise a complaint regarding the way in which your personal data has been processed you should contact the Data Protection Officer in the first instance, using the contact details under Section 2 above.

If you still remain dissatisfied, then you have the right to apply directly to the Information Commissioner’s Office (ICO) for a decision. The ICO can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow Cheshire SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk