How we use information about you | University of Essex

1. About this Privacy Notice

This notice sets out the personal data that we collect, hold and process about you as a prospective and current student, how we use and share this data, and our lawful reasons for doing so. The details of how we process former students’ details is covered in our Alumni Privacy statement.

Please read this notice alongside our overarching privacy notice: Privacy Hub.

It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.

The University of Essex is the controller for the purpose of data protection law.

In the case of student accommodation, the data controller is University of Essex Campus Services Limited.

2. What type of information we collect about you

We collect your personal data directly from you when you apply to study at the University, and throughout your time as a registered student. We also collect data about you from third parties who you have authorised to share your data with us.

After collecting this data, we will process it in relation to your application, your enrolment and study at the University and the use of our facilities.

We will process the following personal information:

Your identity, including your right to study, your contact details, and those of your next of kin in case of emergency
Your application details, whether from UCAS, an agent, or received directly from you, including your previous study and qualifications
Details about which course of study you are on, your level and stage of study, and your chosen modules
Information about your progress, including submission of work or marks. This also includes information about your attendance and engagement with teaching events and teaching materials, such as library resources and Moodle, and other University resources. Some of this information is made available to students through LEAP, our Learner Engagement Portal. We also collect information about any breaks you take from study (intermission), any repeated study periods and time spent studying abroad or on placement as part of your course
Extracurricular activities
Educational background
Bank details
Photographs, filming of student performances or other events
CCTV footage and other information obtained through electronic means such as swipe/identity card records
Information about your use of our information and communications systems
Information about any complaints against you, such as academic offences or breaches of our Code of Student Conduct complaints
Video or audio recordings for the purpose of recording lectures, student assessment and examinations

We will also process some Special category data:

In certain circumstances this processing will include “special category data” where you choose to provide it. Special category data is considered to be more sensitive than other personal data.

For example, when you apply to study with us, you will be asked if you have any disabilities. You may also share this information with us at any point during your time as a student at the University but we encourage you to do this as soon as possible, to help enable the right support package being in place to meet your needs. Your disclosure of this information is voluntary; you are not obliged to share this information with us, but any information you do provide will assist us to assess how we will meet our legal and statutory obligations in relation to your disability.

Where you have provided this, we will process the following special category data:

Information about your race or ethnicity, and religious beliefs
Information about your health, including any medical condition, health and sickness records and disability information, including mental health and wellbeing
Information about your sexual orientation and sex life, and your gender
Information about spent or unspent criminal convictions

Short courses and summer schools

For short courses and summer schools not leading to the award of credit, and for pathway courses and pre-sessional courses (including UEIC Pre-sessional English (PSE) courses and UK University Ready courses and in country PSE courses) which are delivered by partner institutions, we collect and hold appropriate sub-sets of the data mentioned above.

For UEIC pathway students, we collect and hold appropriate sub-sets of the data mentioned above and will ask you to complete a pre-CAS questionnaire a few months prior to you progressing to the University in order to support the progression process.

3. Why we use your personal data – and our legal basis for doing so

When we collect or otherwise process your personal data, we need both a purpose (i.e., a reason) and a legal basis. There are several legal basis under the UK General Data Protection Regulation. We generally rely on the following legal bases when processing your personal data.

3.1 Performance of a contract

As a student you have a contract with us, and in order for that to function we need to process certain information about you. We have set out our reasons for using your personal information in the table below.

3.2 Legitimate interests

From time to time, we may need to use your personal data to pursue our legitimate interests or those of a third party. We rely on legitimate interests when the processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.

Where we rely on our legitimate interests we mean our:

pursuit of our activities and objectives, or those of a third party;
compliance with applicable legal and regulatory obligations and any codes of conduct;
improvement and development of our business operations and service offering, or those of a third party; or
protection of our services, students, employees and customers, or those of a third party.

We have set out our reasons for using your personal information in the table below. Where we rely on our legitimate interests, we have set out those interests in the table below.

3.3 Legal obligation

We may need to process your personal data to ensure our compliance with our legal and statutory obligations. For example, should we be required to submit information to the police or to a court, and in cases where the processing is necessary for compliance with other laws. In all cases the personal data shared will only be that which is necessary for the purposes and subject to the University having measures in place to ensure that the data is handled in line with data protection laws.

We have set out our reasons for using your personal information in the table below.

3.4 Consent

We do not routinely rely on consent to process your personal data. If we wish to rely on your consent to process your personal data, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

Where we are relying on consent to process your personal data, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products, support or services to you. We will advise you if this is the case at the time you withdraw your consent. You have the right to object to our use of your personal data at any time.

Please see the Data Rights section of our Privacy Hub for a summary of your right to object and the details of who to contact if you want to exercise them.

3.5 Vital Interests

We may use your personal information in situations where we need to protect your vital interests (or someone else’s interests). For example, the University would inform the emergency services of known medical conditions of a student where they had lost consciousness.

3.6 Public Task

Some uses of your personal data are required so we can meet our obligations or duties, or to exercise our powers, as a public authority, or to support the functions of other authorities that have a public task defined within law or statute. For example, the University has an obligation to share data with the Higher Education Statistics Authority. We may also collect and retain data to support public health or safety, safeguarding or crime prevention measures, or the need to retain a basic record of students that have studied with us and their attainment for verification of award purposes. We may also be required to share personal information with our external regulators, auditors, assessors, or professional bodies. In all cases the personal data shared will only be that which is necessary for the purposes and subject to the University having measures in place to ensure that the data is handled in line with data protection laws.

3.7 Table 1

Purpose	Legal Basis
Correspondence relating to offers and next steps	Necessary to enter into or perform a contract we have with you.
Admission, enrolment, and administration of studies	Necessary to enter into or perform a contract we have with you.
Administration and consideration of eligibility/applications, relating to bursaries, fees, and funding	Necessary to enter into or perform a contract we have with you.
Academic assessment and progression	Necessary to enter into or perform a contract we have with you.
Monitoring and management of your attendance	Necessary to enter into or perform a contract we have with you.
For provision of services such as the library	Necessary to enter into or perform a contract we have with you.
Creation and management of email addresses and accounts	Necessary to enter into or perform a contract we have with you.
Information relating to your accommodation whilst studying with us	Necessary to enter into or perform a contract we have with you.
Sharing information with commercial partners to support work placements/apprenticeships where these are part of your course in order to deliver our learning services	Necessary to enter into or perform a contract we have with you
Sharing information with affiliated institutions, research partners and study event organisers to support study placements and events where these are part of your course	Necessary to enter into or perform a contract we have with you
Information relating to any additional needs that you may have may be processed for the purposes of putting reasonable adjustments into place	Necessary to enter into or perform a contract we have with you Necessary to comply with our legal obligations Necessary for performing a task in the public interest [NB you may, nonetheless, assert your statutory right to confidentiality, under the Equality Act 2010. This may, however, limit the support we are able to put into place for you.]
Providing student parking permits	Necessary to enter into or perform a contract we have with you.
Registering you with the National Council for the Training of Journalists (NCTJ)	Necessary to enter into or perform a contract we have with you. Necessary for performing a task in the public interest
Ensuring the health, safety, security and wellbeing of the University, its people and facilities	Necessary to comply with a legal obligation.
Processing card access data to ensure the health, safety and wellbeing of persons present on campus, preventing crime and disorder and individual or group compliance with reasonable directions given by Campus Security, your department, University regulations and policies/procedures and the law	Necessary to comply with a legal obligation.
Sharing information internally, where appropriate, to identify individuals suspected of or failing to follow our regulations, policies/procedure regarding access to buildings. Issuing warnings and/or instigating (and progressing) disciplinary action and where appropriate sharing information with regulatory authorities such as the Police	Necessary to comply with a legal obligation.
Enabling the University to deal with requests (from you or others) under Freedom of Information and other transparency legislation or Data subject rights requests under the General Data Protection Regulation	Necessary to comply with a legal obligation.
Collecting and managing information about health and safety such as recording details of accidents and where required reporting that information to the Health and Safety Executive	Necessary to comply with a legal obligation
If you are an overseas student then we are obliged to collect and report information about your visa and right to student here	Necessary to comply with a legal obligation
DBS check - (for courses subject to a Courses mandatory check).	Necessary to comply with a legal obligation
Seeking your views to help us develop University facilities	Legitimate interests. We need to process your personal data for our legitimate interest of allowing us to manage and carry out our operations as an education provider
Administration of Alumni relations	Legitimate interests. We need to process your personal data for our legitimate interest of allowing us to manage and carry out our operations as an education provider
Monitoring your use of our information and communication systems to ensure compliance with the University’s IT policies	Legitimate interests. We need to process your personal data for our legitimate interest of maintaining security of our systems and services and improving the services we offer
To provide our IT services and operate our IT network, we collect your IP address (see also our Visitors to the website Privacy Notice)	Legitimate interests. We need to process your personal data for our legitimate interest of maintaining security of our systems and services and improving the services we offer
Provision of your staff profile (PGR students)	Legitimate interests. We need to process your personal data for the legitimate interest of sharing information about our work with the wider world
Collecting information about your ethnicity, sexual orientation, disability and gender in order to ensure that we are providing a fair and equal environment, and for reporting externally, using de-identified data (that does not identify you as an individual) for initiatives such as the Disability Confident scheme and Athena Swan. We also report to HESA. You do not need to declare any disability to us or any health issues that may affect your work, but we are unable to support you fully and to comply fully with our obligations under the Equality Act 2010 if you do not share this information with us.	Necessary to comply with a legal obligation.
Students name and phone number will be shared with data processors who provide specialist training on issues we think are important for all students to be aware of, e.g. consent training	Legitimate interests. We need to process your personal data for the legitimate interest of sharing information about our work with the wider world
Where overseas student recruitment agents are involved, provision of data post-enrolment relating to attendance and fee payment	Legitimate interest. We need to process your personal data for the legitimate interest of supporting you to complete your studies
Your name, personal opinions, contributions to discussions and images (where video capture is also being used) may be recorded so that course material and class sessions can be made available to individuals.	Legitimate interest. We need to process your personal data for the legitimate interest of supporting you to complete your studies.
DBS check - (for courses not subject to a Courses mandatory check but where the University Student Membership and Disclosure and Barring Service Check Policy deems one is necessary)	Necessary for performing a task in the public interest
Your personal data will be shared with local councils to assist voter registration	Necessary for performing a task in the public interest
Your data may be shared with your emergency contact when the University has serious concerns about your safety, mental health or in the case of an emergency	Necessary for performing a task in the public interest Necessary to protect your (or someone else’s) vital interests.
Your personal data may be processed by the University of Essex and transferred to the emergency services and, if necessary, your next of kin or emergency contact, where this is required to protect your vital interests or those of another person	Necessary in order to protect the vital interests of the data subject or of another person

4. Where the data we hold comes from

We collect data directly from you, or through an agent or UCAS, when you apply to study with us, and at the point of offering you a contract (Registration).

We continue to collect and process data about you, such as attendance or exam marks, while you study with us.

For international students we may collect data about you from your sponsor.

For UEIC pathway students, UEIC share an appropriate sub-set of your data with us when you register at the College (see UEIC Privacy Notice) so that we can provide relevant University services to you. We will also collect additional relevant data from you prior to progression to the University (e.g. pre-CAS questionnaire) in order to facilitate your progression to the University.

5. Whom we share your data with

Internally, access to information about students is restricted to those who need it in order to carry out their roles. This will include your personal tutor and other staff who teach you, as well as the professional services staff in your department who support activity such as exams, attendance monitoring and coursework submission.

There are other central professional services staff who will need access to some information about you, including the timetabling office, the exams office, the library and the central progress team.

Information held by the Student Conduct Team (relating to any breach, or alleged breach of our Code of Student Conduct), and by our Student Wellbeing and Inclusivity Service (relating to your health and wellbeing) will only be shared where necessary, and in line with the lawful bases outlined above and the relevant confidentiality policies.

In line with Universities UK guidance, information relating to the outcome of a complaint and associated actions may be shared with another party to the complaint. The extent of this sharing will be decided upon on a case-by-case basis, and, where any information is shared, with reference to an appropriate and agreed lawful basis.

We share data about your identity and course with the Students’ Union, so that they know you are a student and eligible for membership. We manage a separate Data Sharing Agreement and data sharing log with the Students’ Union.

If you are studying on a course that includes a practical professional placement then, under the terms of our Fitness to Practise procedure we may share your information with the relevant professional body.

Information voluntarily provided by you about any additional needs you have will be shared with the University to enable the University to comply with our legal obligations, fulfil a contractual obligation and/or perform a task in the public interest by putting into place reasonable adjustments to allow you to engage with your studies. Where this sharing takes place only minimal information required for the purpose will be shared.

The University shares current student data with local Councils in order that they can maintain accurate electoral register records. This ensures that you can vote when there are elections.

We may also share your data externally in these ways:

We send the name, registration number and award title of students who are eligible to graduate each year to the Graduate Gowning Company to ensure that they are able to supply the correct robes for graduation
If you live in accommodation within a relevant borough then we will share your name, address and the fact that you are studying with us with the relevant local council, to ensure that you receive the Council Tax rebate to which you are entitled
If you are based on our Colchester Campus then we give your contact details to the Health Centre at the start of each academic year so that they can verify your student status to ensure that their records are accurate and up to date. You do not have to register with the Health Centre
For those of you who are registered at our Southend Campus, we share your data with Southend City Council to enable use of our shared library, The Forum. Southend City Council’s privacy statement is viewable online. We specify that your data must be kept safely, used only under our instructions in accordance with data protection law, and not be used for the contracting company’s own purposes
We will collect from you the contact details of a person nominated by you for us to contact in case of emergency. We may also pass those contact details to the emergency services. We may also contact that person if we have concerns for your wellbeing, particularly if we have good reason to believe that you are at risk
We will share some of your information if we are asked for a reference from a prospective employer
We may share some information if required to do so by the police or other law enforcement authorities, including the Home Office
If you have a financial sponsor then, if asked, we may tell them some limited information about you, such as confirming that you are still registered with us. If possible we will ask your permission first. If you have signed an agreement with your sponsor that they can see information about you then we will follow that agreement.
We may also share your data when an external company provides us with a software system that holds or uses your data. Such sharing will always be carried out under contract, as part of which we will specify that your data must be kept safely, used only under our instructions, and not be used for the contracting company’s own purposes
We will share your data with statutory regulatory bodies such as the Office for Students (OfS) and those organisations who provide a service on their behalf (for example, HESA, Jisc, etc)
If you have enrolled on the BA in Multimedia Journalism in order to register you with the National Council for the Training of Journalists (NCTJ) we share your name, date of birth, personal email address and gender with the NCTJ
In the event that you intermit or withdraw from an apprenticeship at the University, in accordance with statutory requirements we will share your data with the Education and Skills Funding Agency (ESFA) and your employer

6. Where we keep your data and how long we keep it for

We have retention schedules that set out how long we keep information of all types, including personal data of students.

We do not generally transfer your data outside of the UK. Data are retained primarily within our own student record and student file systems, but may be held elsewhere on our network, including within the email system, and on paper within our faculties and departments.

If we have to transfer any of your personal data outside the EEA we ensure the receiving country or organisation is deemed to have adequate data protection provision. Where a country or organisation does not have adequate protections we will put safeguards in place. Details of these safeguards can be provided to you upon request.

7. Changes to this Privacy Notice

This privacy notice was published on Friday 15 December 2023. We may change this privacy notice from time to time and will communicate these changes directly to you where appropriate.

If you have any questions about this privacy notice or if you would like to access any of your rights, please contact dataprotectionofficer@essex.ac.uk

Last revised June 2024.

Information Assurance Manager

Telephone: 01206 872285

Email: dataprotectionofficer@essex.ac.uk

Student Privacy Notice