Privacy notice for students

1. Introduction

1.1 This notice is for all students of the University of West London (UWL) to explain the purposes for which we hold information about you (your personal data).  It sets out how and on what basis the information is collected, stored and used and what your rights are in relation to this data.

1.2 Your data is held in accordance with the General Data Protection Regulation (GDPR).

1.3 UWL is registered as a Data Controller with the Information Commissioner (University registration number: Z4666761). The University Secretary and Chief Compliance Officer is the Data Protection Officer.

1.4 All data is held and processed in line with the University’s data protection policy. All data which we receive from you or which is created while you are a student is kept securely and only used for legitimate purposes in connection with your education.

2. How does the University collect your data?

2.1 Through the admissions process and at enrolment, you will be asked to confirm various personal and academic details. Further information is collected as you undertake your studies in terms of attendance and engagement data, accessing learning materials and your assessment performance.

2.2 We may also obtain data from third party sources such as UCAS and the Student Loans Company. When we obtain data in this way, we will ensure that the third party has the legal authority to provide this.

3. Types and categories of data

3.1 Your data will relate to your personal details, your study record and payment and where appropriate accommodation records.

3.2 Your personal data may include ‘special categories of data’ as described under the GDPR. Such special categories include racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

3.3 The University may process data relating to criminal convictions if your course requires a Disclosure and Barring Service check or you have an unspent conviction.

3.4 Particular safeguards will be put in place for the collection and processing special categories of data and criminal convictions.

4. Purpose of collection and processing of your data

4.1 The University needs to process your personal data to manage your course, support your performance and provide you with services.

4.2 The University processes your personal data for the following purposes:

• Administration and delivery of your studies, including your assessments;
• Access to, and security of, University facilities;
• Provision of student facilities and support services (such as library, careers, counselling, IT,  advice services, scholarship and bursaries, etc);
• Using and analysing your data in order to support you to achieve your study goals;  
• Monitoring the effectiveness of our provision and outreach activities;
• Carrying out statutory duties to provide information to external agencies (see 'Disclosures' for further details);
• Providing accommodation;
• Other activities that are for the purpose of University's legitimate business including the development and maintenance of an alumni programme.

4.3 The special category data, such as ethnicity, religion or belief, are used for monitoring, statistical and research purposes in order to improve student satisfaction and attainment and ensure equality of opportunity and inclusion.

4.4 The University will collect and analyse student data to help students succeed and achieve their study goals. Student data includes student characteristic data, such as previous qualifications and demographic information, as well as study behaviour data, such as attendance and the use of Blackboard. The analysis of this data might be used in a number of ways, for example to inform how modules are taught, to help ensure appropriate support is given to all students or to provide you with additional support and keep you engaged in your studies.

4.5 You may also provide the University with details of your physical and/or mental health in order to access Student Services or for the purposes of applying for mitigation.  

4.6 The University also provides data to the Students’ Union to enable it to process your membership and provide services and support. It also provides data on student characteristics for monitoring purposes only to enable the Students’ Union to review the effectiveness of its provision and that it is accessible to all.

5. Additional notices and guidance/policies

5.1 We also have some additional notices, guidelines and policies with further useful information about the way in which we process your personal data:

The University’s data protection policy: This contains a lot of useful general information on data protection and University practices.

Attendance and engagement monitoring policy: We conduct attendance monitoring for a number of reasons including to assist with student visas for international students and ensure the proper engagement of our students. We require you to participate in electronic recording of attendance using SAM.

UWL Replay: We regularly make audio recordings of lectures in which you may be involved. These recordings will be made in accordance with our policy on lecture capture. Please note that under this policy we assume that you generally consent to being recorded, however, there is a right to opt out and request an edit of recordings. Save in agreed exceptional circumstances, we do not permit students to record education activities.

Our alumni: As an integral part of the University’s services to its students it provides alumni activities.

Our website: We use cookies (that will collect your personal data) on our web pages.

HESA returns: We are required to return important information (that will include your personal data) to HESA. Please see HESA’s collection notices together with other supporting information.

Outreach monitoring: The University undertakes monitoring activities to evaluate the effectiveness of its outreach programmes. The University will do this by sharing data with HEAT.

6. Lawful basis for processing

6.1 Most of the data we collect from you is required to enable us to administer and deliver your studies. The provision of this data is part of the contract you form with the University when you accept an offer and enrol.

6.2 Some of the activities, such as the work to ensure you are engaged in your studies and succeed in your studies are undertaken as part of the University’s public task to deliver education and also value for money for the tax payer.

6.3 In some cases, such as provision of special categories of data, we need your consent to process this and you will be informed of the reasons for collecting the data and also request your consent where required at the time we collect it.

6.4 An explanation of the basis for processing is attached at Appendix 1. The basis for the collection and processing of your data is outlined in Table 1 below.

Types of data:

6.3 Your personal data includes your photograph which will be used, where necessary, for the purposes of identifying you in the course of the University's legitimate business and will appear on your University ID card and the University's IT systems including the Student Record systems.

7. Storing data

7.1 The University has implemented appropriate physical, technical and organisational security measures designed to secure your personal data against accidental loss and unauthorised access, use, alteration or disclosure. In addition, we limit access to personal data to those employees, agents, contractors and other third parties that have a legitimate business need for such access.

7.2 All of University staff and contractors with access to personal data receive mandatory data protection training and have a contractual responsibility to maintain confidentiality and access to your data is restricted to those members of staff who have a requirement to access it.

7.3 The University utilises many different storage solutions and IT systems, some of which are outsourced to third party providers. These are set out below. In all cases, there are security measures in place to protect your data.

8. Disclosures to third parties

8.1 The University will disclose your data for third parties where this supports the educational process or where we are legally obliged to do so and details are contained in the table below.

Disclosure to:

8.2 The University may from time to time make other disclosures without your consent. However, these will always be in accordance with the provisions of the General Data Protection Regulations or the Data Protection Act (2018).

9. Transfers to countries outside the EU  

9.1 Sometimes, to achieve the purposes for which we are processing your personal data, we may need to share your personal data with other organisations based within the European Union or if outside the European.

9.2 When it is necessary to share your data with organisations outside of the European Union, we will ensure that there are appropriate safeguards in place.

10. Retention of your data

10.1 Your data will be retained as set out in the University’s records retention schedule.

11. Your rights

11.1 You have a right to request a copy of your personal data held by the University. The University is required to fulfil this request within one month. You may make the request via the form for this purpose which is available here.

11.2 You also have the right to:

• withdraw consent where that is the legal basis of our processing;
• rectify inaccuracies in personal data that we hold about you;
• request to remove some personal data we hold about you (this will not apply to your basic student record or data held as part of the University’s legal obligations);
• restrict the processing in certain ways;  
• object to certain processing of your personal data by us.

11.3 Please see ICO website for further information on the above rights. You may also contact the Data Protection Officer for further information (university.secretary@uwl.ac.uk).

11.4 You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data.

12. Unwanted communication

12.1 We will from time to time communicate with you by email, post and telephone. If, at any stage, you are concerned about the content of these communications, e.g. unwanted marketing information, or wish to change the method of communication that we use please unsubscribe to general email communications.

12.2 If you are unsuccessful in unsubscribing from our communications and/or remain concerned, please contact our Data Protection Officer.

13. Your responsibilities

13.1 You have a responsibility to keep your personal details accurate and up to date and should notify the University of any changes through MyRegistry.

13.2 Students at the University may, during the course of their studies, have access to personal information about other individuals. Students are expected to treat this in a responsible and professional manner.

You have responsibilities under the GDPR for any personal data relating to other people which you may access whilst at the University. This responsibility is in addition to any obligations arising from professional ethics or codes of conduct. Information obtained in the expectation of a duty of confidence should be treated as confidential and generally not disclosed without the subject's consent.

The University will take a serious view of any breach of the GDPR by any of its members, including the consideration of disciplinary action.