Prospective student privacy notice

Communications, Marketing and Student Recruitment

The purpose of this Privacy Notice is to tell you how the university will collect and use your personal data. In addition to this notice, you may be given further information about the uses of your personal data when you use specific services and facilities offered by the University of Gloucestershire.

This Privacy Notice may be updated from time to time to ensure continued compliance with Data Protection legislation and to reflect best practice.

The latest version of the Notice can be found on our data protection webpage.

---

If you’re under 18, we take extra care to protect your personal data:

• We collect information like your name, contact details, and what you’re interested in studying.
• We use this to send you information about courses, events, and applying to university.
• We will not sell your data.
• You can ask us to stop contacting you at any time.
• We keep your data only as long as necessary (see below for details).

If anything is unclear, you can contact us – we’re happy to help.

---

1. Identity and contact details of the Data Controller

The University of Gloucestershire is registered with the Information Commissioner’s Office as a Data Controller and is committed to protecting the rights of individuals in line with Data Protection legislation.

A copy of this registration can be found on the ICO website.

2. Contact details of the Data Protection Officer

The Data Protection Officer is responsible for advising the university on compliance with Data Protection legislation and monitoring its performance against it. If you have any concerns regarding the way in which the university is processing your personal data, please contact the Data Protection Officer at:

Data Protection Officer University of Gloucestershire Registrar’s Directorate Fullwood House
The Park
Cheltenham, GL50 2RH

Email: [email protected]

---

If you’re under 18:

• We take extra care to make sure our use of your data is fair and appropriate
• We only collect information that we really need
• We avoid using your data in ways that could be unexpected or harmful
• We make our information as clear as possible so you can understand how your data is used

3. What information do we collect about you?

We may collect:

• Your name and contact details (email, phone number)
• Your school or college
• Your course interests
• Information about your needs (for example, accessibility requirements)
• Feedback you give us about events or activities

Sometimes we collect additional information (for example, ethnicity) to help improve access to higher education. We will explain this clearly when we ask for it.

We may also collect information you provide when registering for and participating in university-facilitated community platforms, such as our prospective student online community forum (MyGlos Lounge), where you register directly on a third-party platform following an invitation from the university.

We collect information in order to fulfil your request and, if consent is given, to send you further relevant information about the university, courses you’re interested in, accommodation or events relevant to your course of interest.

4. How do we collect this information?

We may collect your personal data in a number of ways, for example:

• from the information you provide to us when you interact with us before applying, for example
• when you request a prospectus
• from the information you provide on your application form if you apply to us
• from the information supplied as part of any surveys and feedback requests we issue
• when you communicate with us by telephone, email or via our website, for example in order to make enquiries about events or activities
• from third parties, for example, from your previous or current school or sixth form college
• from third party organisations providing facilities and services aimed at encouraging engagement in higher education and/or applications to universities including the university from sponsors and bodies and agencies who intend to fund your higher education
• if you complete an evaluation form after participating in an outreach activity.
• when you register for and use third-party community platforms to which the university has invited you — for example, when you create an account on MyGlos Lounge, our prospective student community forum, you will provide personal data (such as your name and email address) directly to the platform provider

If you are registering for events (for example open days and applicant days) or requesting information via our website, your personal data will also be processed in line with our website policy.

5. How will your information be used?

The information you provide will be used to send you communications (printed and/or digitally) about the University of Gloucestershire, the courses we offer and events we run, and our services, such as student support, accommodation, scholarships and bursaries. We may also contact you to conduct market research and quality assurance checks, for example we may ask you about your satisfaction with the information we provide and your experience of the admission process.

We will also use the information you provide to evaluate the impact of our activities and track your progression through education if you have given us your consent. Your data will be used to help evaluate the effectiveness of our activity as part of the government policy to widen participation in higher education and to develop future policy. The University of Gloucestershire will not use its records in any way which will affect any learner individually.

Where you have accepted an invitation to join a university-facilitated community platform such as MyGlos Lounge, the information you provide on registration and your activity on the platform may be used to support your transition to university life, to facilitate peer and staff engagement prior to your arrival, and to monitor and moderate the community for the safety and wellbeing of all participants. The university may also use aggregated, anonymised activity data from the platform to evaluate the effectiveness of pre-arrival engagement activity.

We will not disclose any data to anyone who is unauthorised to receive it. We consider the processing of your information for the above purposes to be necessary for the performance of tasks we carry out in the public interest. This includes running events to promote access to higher education, informing students of their educational options, increasing educational attainment, and carrying out related evaluation, tracking and research.

We will not sell your data to third parties.

6. Why are we allowed to use your data? (lawful basis)

We use your data for different reasons:

• To respond to your enquiry or process your event booking — because it’s necessary to take steps before entering into a contract with you, or to perform a contract once you’ve applied.
• To send you marketing (emails, updates about courses, accommodation, events) — only where you’ve given us your consent, or, post-application, where we have a legitimate interest and you’ve consented to it.
• To run outreach activities and widen access to university — because this supports a task carried out in the public interest, and in some cases because we have a legal requirement to report this to government.
• To support your transition to university — for example, inviting you to register for a university-facilitated community platform such as MyGlos Lounge. This is based on legitimate interest. Registration is entirely voluntary; once you register, the platform provider processes your account data under their own privacy notice and may act as an independent data controller for that data. We encourage you to review their privacy notice before registering.

A few important points:

• If you’ve booked onto an event, we’ll send you the practical information you need about that event regardless of your general marketing preferences, so you have everything required to attend.
• Once you’ve applied to study, we’ll send you essential information to help you decide whether to attend — including interview invitations, applicant day details, key dates and deadlines, and induction information. This is necessary for the contract between us. To opt out, email [email protected].
• Some of our outreach work, particularly widening participation activity with underrepresented groups, requires us to collect special category data such as ethnicity and race. We process this under our legitimate interest and under Article 9(2)(j) UK GDPR, which permits processing necessary for archiving, research, or statistical purposes in the public interest, with appropriate safeguards for your rights. This data may also be shared with government bodies, or organisations working on their behalf, for research and analysis.

When we send you marketing:

• You can unsubscribe at any time.
• We will not send you messages if you’ve told us not to.
• We may tailor messages based on your interests, but we will not do this in a way that would harm you or take advantage of you.

7. Who is your personal information shared with?

Your information will be processed by the university and organisations working on our behalf who are compliant with current data protection legislation in order to send you relevant communications, for example:

• providers who send communications on behalf of the university, e.g. letters, emails, SMS or other communications
• providers who will use your profile information to identify others who may be interested in the university.
• providers of community engagement platforms used to support prospective and incoming students, such as our MyGlos Lounge forum — please note that where you self-register on such platforms following a university invitation, the platform provider may act as an independent data controller for your account data, and their own privacy notice will apply

No information will be passed to third party organisations for them to contact you directly themselves.

Information about you may be disclosed to other organisations outside of the university where it is in our legitimate interests and/or as required by law, including but not limited to:

• the police and other crime and fraud prevention, and detection agencies for crime prevention or detection purposes
• the Home Office, including UK Visas and Immigration, UK embassies, local authorities and other governmental bodies
• Government bodies and agencies where the university is legally obliged to do so such as the Office for Students, the Higher Education Funding Council for England and the Quality Assurance Agency for Higher Education, the Higher Education Statistics Agency, UCAS, the Department for Education, and the Higher Education Access Tracker and its subscribers
• the Disclosure and Barring Service
• sponsors, agencies or bodies funding or intending to fund your programme of study
• your country’s government, high commission, embassy or consulate
• third parties who initially provided us with personal information relating to you such as third party recruitment agents.

8. Transfers to other countries and safeguards in place

As the University of Gloucestershire is a UK organisation, your data is processed in accordance with UK GDPR. Some data processed by the university’s contracted software suppliers may be stored on servers outside the UK. Where data is transferred internationally, this will only be to countries or organisations that provide an adequate level of protection as recognised under UK data protection law, or where appropriate safeguards are in place. For example, data associated with MyGlos Lounge is hosted on servers located within the European Economic Area (EEA), which is recognised as adequate under UK data protection law. Any other international transfers will be made in accordance with UK GDPR requirements.

We ensure that any data processor complies with confidentiality, current data protection legislation, data sharing protocols and safeguards, governing law, intellectual property, liability and pursuant to its commitment to compliant practice.

9. How long will your information be held?

We only keep your information for as long as it’s needed.

For most prospective students:

• We keep your data for up to 1 year after your intended start date, or
• Up to 3 years if no start date was known

If you become an applicant, your data is then held in line with the University’s Records Retention Schedule, and you’ll be provided with further notices covering that stage.

If you attend an event or activity:

We retain only the details needed for administration, for as long as necessary to serve that purpose.

For outreach and research activities:

To support long-term evaluation of access to higher education, we retain some key personal information until you turn 30, or for up to 15 years after graduation — whichever applies. After this point we delete personal information from our systems, though we may continue to use it in anonymised form to track university and career outcomes. Wherever we hold data for these longer periods, we minimise what we keep and protect it carefully.

If you’ve registered for a university-facilitated community platform such as MyGlos Lounge, your account is kept for as long as needed to fulfil the purpose it was created for. Accounts are closed when no longer needed — for example, when you enrol, if you choose not to take up your place, or if the platform is discontinued. You can close your account yourself via the platform, or by contacting us using the details in Section 2.

Withdrawing consent or changing your preferences:

If you’ve given consent and want to withdraw it, you can opt out at any time by emailing [email protected], by post to the address in Section 2, or by unsubscribing from any email you receive from us. You can also amend your communication preferences here.

10. What are your rights?

Under Data Protection Legislation you have the following rights:

• to request access to, and copies of, the personal data that we hold about you
• to request that we cease processing your personal data
• to request that we do not send you any marketing communications
• to request us to correct the personal data we hold about you if it is incorrect
• to request that we erase your personal data
• to request that we restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
• to receive from us the personal data you have provided to us, in a reasonable format specified by you, to another data controller
• to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights and freedoms.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

Security of your information

Your data will be held securely and all staff are required to comply with the university’s processes and procedures regarding data security. Whenever data is transferred from one location to another it will always be in a secure, encrypted or password protected format.

Any requests or objections should be made in writing to the university’s Data Protection Officer, contact details are in Section 2 of this Privacy Notice.

11. How to make a complaint

If you have queries, concerns or wish to raise a complaint regarding the way in which your personal data has been processed you should contact the Data Protection Officer in the first instance, using the contact details under Section 2 above.

If you still remain dissatisfied, then you have the right to apply directly to the Information Commissioner’s Office (ICO) for a decision. The ICO can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow Cheshire SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk