UCL Prospective Students (Enquirers and Applicants) Privacy Notice

Version 2.2, published November 2021

About this privacy notice

University College London ("UCL", "we", "our", "us") are committed to protecting and respecting your privacy.

This privacy notice sets out how UCL processes the personal data of prospective UCL students, including enquirers and applicants. It covers the period preceding enrolment as a student at UCL, i.e. the enquiry and application stage. It should be read in conjunction with:

the General Student Privacy Notice, which sets out how the personal data of UCL students is processed from enrolment up to and including graduation; and
the Alumni Privacy Notice, which provides details of how the personal data of UCL alumni is processed following graduation.

The above UCL privacy notices (and others) can be found on the UCL Legal Services website.

This notice applies to the personal data we collect from you and personal data which is passed to us by third parties. Please read the following carefully to understand how we process your personal data.

In addition to the information in this privacy notice, you may be given further information about the uses of your personal data when you sign up to use specific services and facilities we offer, and in certain situations, you may be asked whether you give your consent to us processing information about you.

Any changes we make to this privacy notice in the future will be posted on the UCL Legal Services website and, where appropriate, notified to you by e-mail.

What is 'personal data'?

‘Personal data’ means any information which identifies you as an individual. It may include your name but it may also be other information such as your date of birth, nationality and gender which when combined identify you. This information may be collected in a variety of ways, including electronically, in paper form, by telephone or in person.

UCL's data protection obligations

Under current data protection laws we are classed as a controller, which means we are legally responsible for the personal data we collect and hold about you. One of our responsibilities as a controller is to tell you about the different ways in which we use your personal data – what information we collect, our legal basis for doing so, why we collect it, where we collect it from and whether and with whom we will share it. We also need to tell you about your rights in relation to your personal data.

Personal data we collect about you

Types of personal data collected

Personal data we may collect about you in connection with your enquiry or application includes the following:

Name
Date of birth (age)
Proof of Identity (e.g. passport)
Contact Info (Address, Phone, Email etc)
Disability / information relating to your health (note that this is only collected in specific situations, e.g. where it is required for UCL to comply with applicable law)
Ethnicity
Nationality / Place of Birth/ Domicile
UKVI Confirmation for Acceptance to Study/Visa/Biometric Residence Permits and other immigration information (note that this is only collected in certain circumstances in relation to overseas applicants)
Academic Technology Approval Scheme (note that this is only collected in certain circumstances in relation to overseas applicants)
Date of Entry to the UK (note that this is only collected in certain circumstances in relation to overseas applicants)
Overseas police check (note that this is only collected in certain circumstances in relation to overseas applicants)
English proficiency
Literacy/Numeracy proficiency
Student status (e.g. ‘offer’, ‘accepted’ etc)
Qualification Information (provided by the applicant and external bodies e.g. UCAS)
Information about your career aspirations and work experience
Your current situation i.e. whether you are currently working, studying etc
Intended year of entry and level of study
Fee status (e.g. home, EU or overseas) and payment information
Statutory checks
Five year address history
Disqualification by association form (note that this is only collected in relation to students on specific programmes of study)
Photograph
Geodemographic Information

Low participation neighbourhood (note that this information is only collected in relation to specific cohorts of students)
Parental Higher Education
Time in Care (where applicable)

Information relating to any complaints that you make
Information relating to any disciplinary action in which you are involved
Data relating to your criminal convictions and offences, where appropriate
Other personal data that you provide as part of, or that is relevant to, your application/enquiry, eg next of kin / guardian / family etc data, information relating to referees

Special category personal data

Some of the personal data listed above is classed as being within 'special categories of personal data' under current data protection laws, for example information relating to your ethnicity or any disability. Access to, and the sharing of, this information is controlled very carefully. You will be given more details about our use of any special category personal data when we collect it from you.

Personal data relating to criminal convictions and offences

In certain circumstances, we may process data relating to your criminal convictions and offences. Access to, and the sharing of, this information is also controlled very carefully. Where we process criminal records data, we will inform you separately and provide you with further information.

Information that we receive from third parties

We work closely with third parties (including, for example, funding and sponsorship partners, educational institutions, examination boards, overseas agents, UCAS, and clearing houses, business partners and compliance services e.g. UKVI, Disclosure and Barring Service) and may receive information about you from them (including, in certain cases, special category personal data or criminal convictions data). In particular, we may receive any of the following information from third parties: examination or test results, evidence of sponsorship (e.g. scholarship, bursary, loan), updates on your CAS status, DBS certificate number and other information in connection with your application. We may also receive information about you from referees.

Purposes for which we process your personal data and the legal bases for processing

Overall, we will use your personal data in connection with your enquiry or application to UCL as a prospective student. The main purposes for which we process your personal data as a prospective UCL student, enquirer or applicant (as applicable) are set out in the table below.

Data protection laws require us to meet certain conditions before we are allowed to use your personal data in the manner described in this notice, including having a "legal basis" for the processing. Where we process special category personal data or criminal convictions data, we are required to establish an additional legal basis for processing that data.

We take our responsibilities under data protection laws extremely seriously, including meeting these conditions. The main legal bases on which your personal data are processed for a particular purpose are also explained in the table below.

Purpose	Legal Basis
To process and manage your pre- application enquiries and your UCL application We will use your personal information to: Give you advice on how to apply to study at UCL and communicate with you generally; Tell you about the opportunities and support that are available to you, such as funding streams, induction and alternative programmes of study; To provide feedback e.g. if you attend an open day; Assess your application to study at UCL, including your fees status; Create a student application record; Form a decision about your application with a view to accepting or rejecting your application; Assess your eligibility to study on your chosen course; Communicate with you about your application; and Administer our appeals and complaints process. This will include asking all offer holders to disclose relevant criminal convictions (further information on this topic will be provided at the point when this question is asked). In some cases, the information processed will include special category personal data. For example, we may use disability information to help us make reasonable adjustments to meet your health and welfare requirements during the application process. We will also process criminal convictions data where you will be working with children or vulnerable adults, and/or because of fitness to practise requirements in certain regulated professions. For example, certain courses such as Medicine will require a DBS check to be carried out as part of the assessment of eligibility. You will be notified prior to the processing if this is a requirement for enrolment on the course that you have applied for.	For all personal data Performance of a task in the public interest UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information. Performance of contract The processing of your personal data may be necessary in relation to the contract we will enter into with you if you become a student at UCL. For special category personal data Equality of opportunity or treatment We process special category personal data in order to monitor equality of opportunity/treatment. Explicit consent Where we use disability information to help us make reasonable adjustments to meet your health and welfare requirements during the application process, we will rely on your explicit consent. For criminal convictions data Regulatory requirements relating to unlawful acts and dishonesty We may process your criminal convictions data in order to assist a third party to comply with a regulatory requirement that requires the taking of steps to establish whether another person has: (i) committed an unlawful act, or (ii) been involved in dishonesty, malpractice or other seriously improper conduct do so. Safeguarding of children and of individuals at risk We may process your criminal convictions data in order to safeguard children or individuals at risk. Protecting the public against dishonesty We may process your criminal convictions data in order to protect the public against dishonesty, malpractice or other seriously improper conduct; and unfitness or incompetence. Where we are relying on a legal basis other than those set out above in processing your criminal convictions data, we will inform you of the legal basis before we start processing your criminal convictions data based on that legal ground.
Internal and statutory reporting and other legal obligations, including compliance with health and safety law and monitoring equality of opportunity or treatment We will use your personal information to: Comply with our legal obligations; Produce statistics and research for internal and statutory reporting purposes; and Monitor our compliance with our responsibilities under equalities legislation. This may include the processing of special category personal data, e.g. information about disabilities or ethnicity.	For all personal data Compliance with a legal obligation Much of our processing of your personal data in this context will be in order to comply with our legal obligations, e.g. health and safety legislation and UK equal opportunities monitoring. Performance of a task in the public interest UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information. For special category personal data Equality of opportunity or treatment We process special category personal data in order to monitor equality of opportunity/treatment.
Fees and funding We will use your personal information to administer the financial aspects of your relationship with us and any funders/sponsors. We will not generally process special category personal data or criminal convictions data in this context.	Performance of a task in the public interest UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information. Performance of contract The processing of your personal data may be necessary in relation to the contract we will enter into with you if you become a student at UCL.
Marketing/publicity materials If you attend an open day or other event at UCL, we may take photographs or videos at that event which may include images of you. These images will generally be used for UCL's marketing/publicity materials.	Legitimate interests When using your personal data for the purpose of marketing or publicity materials, we will generally rely on our legitimate interests in promoting UCL, including our courses, our activities and our overall aims and objectives.
Research As an established research institution we may use your personal information for research purposes.	Performance of a task in the public interest UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education or research Please see our Statement of Tasks in the Public Interest for further information. For special category personal data and criminal convictions data Research purposes We may process special category data and criminal convictions data for the purposes of research.

Purpose

Legal Basis

To process and manage your pre- application enquiries and your UCL application

We will use your personal information to:

Give you advice on how to apply to study at UCL and communicate with you generally;
Tell you about the opportunities and support that are available to you, such as funding streams, induction and alternative programmes of study;
To provide feedback e.g. if you attend an open day;
Assess your application to study at UCL, including your fees status;
Create a student application record;
Form a decision about your application with a view to accepting or rejecting your application;
Assess your eligibility to study on your chosen course;
Communicate with you about your application; and
Administer our appeals and complaints process.

This will include asking all offer holders to disclose relevant criminal convictions (further information on this topic will be provided at the point when this question is asked).

In some cases, the information processed will include special category personal data. For example, we may use disability information to help us make reasonable adjustments to meet your health and welfare requirements during the application process.

We will also process criminal convictions data where you will be working with children or vulnerable adults, and/or because of fitness to practise requirements in certain regulated professions. For example, certain courses such as Medicine will require a DBS check to be carried out as part of the assessment of eligibility. You will be notified prior to the processing if this is a requirement for enrolment on the course that you have applied for.

For all personal data

Performance of a task in the public interest

UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information.

Performance of contract

The processing of your personal data may be necessary in relation to the contract we will enter into with you if you become a student at UCL.

For special category personal data

Equality of opportunity or treatment

We process special category personal data in order to monitor equality of opportunity/treatment.

Explicit consent

Where we use disability information to help us make reasonable adjustments to meet your health and welfare requirements during the application process, we will rely on your explicit consent.

For criminal convictions data

Regulatory requirements relating to unlawful acts and dishonesty

We may process your criminal convictions data in order to assist a third party to comply with a regulatory requirement that requires the taking of steps to establish whether another person has:
(i) committed an unlawful act, or (ii) been involved in dishonesty, malpractice or other seriously improper conduct do so.

Safeguarding of children and of individuals at risk

We may process your criminal convictions data in order to safeguard children or individuals at risk.

Protecting the public against dishonesty

We may process your criminal convictions data in order to protect the public against dishonesty, malpractice or other seriously improper conduct; and unfitness or incompetence.

Where we are relying on a legal basis other than those set out above in processing your criminal convictions data, we will inform you of the legal basis before we start processing your criminal convictions data based on that legal ground.

Internal and statutory reporting and other legal obligations, including compliance with health and safety law and monitoring equality of opportunity or treatment

We will use your personal information to:

Comply with our legal obligations;
Produce statistics and research for internal and statutory reporting purposes; and
Monitor our compliance with our responsibilities under equalities legislation.

This may include the processing of special category personal data, e.g. information about disabilities or ethnicity.

For all personal data

Compliance with a legal obligation

Much of our processing of your personal data in this context will be in order to comply with our legal obligations, e.g. health and safety legislation and UK equal opportunities monitoring.

Performance of a task in the public interest

For special category personal data

Equality of opportunity or treatment

We process special category personal data in order to monitor equality of opportunity/treatment.

Fees and funding

We will use your personal information to administer the financial aspects of your relationship with us and any funders/sponsors.

We will not generally process special category personal data or criminal convictions data in this context.

Performance of a task in the public interest

Performance of contract

The processing of your personal data may be necessary in relation to the contract we will enter into with you if you become a student at UCL.

Marketing/publicity materials

If you attend an open day or other event at UCL, we may take photographs or videos at that event which may include images of you. These images will generally be used for UCL's marketing/publicity materials.

Legitimate interests

When using your personal data for the purpose of marketing or publicity materials, we will generally rely on our legitimate interests in promoting UCL, including our courses, our activities and our overall aims and objectives.

Research

As an established research institution we may use your personal information for research purposes.

Performance of a task in the public interest

UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education or research Please see our Statement of Tasks in the Public Interest for further information.

For special category personal data and criminal convictions data

Research purposes

We may process special category data and criminal convictions data for the purposes of research.

Please note that where the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, and you do not provide us with the personal data required, UCL may not be able to process your application or provide you with the programme for which you have applied.

We do not generally process your personal data based on your consent (as we can usually rely on another legal basis). Where we do process your personal information based on your consent, you have the right to withdraw your consent at any time. See the "Your Rights" section below.

Third parties with whom we may share your personal data

Your personal data may be disclosed to other organisations as required by law, for crime prevention, investigation or detection purposes or in order to protect your vital interests.

Disclosures may also be made to sponsors, government agencies and present or potential employers. One such body is the Higher Education Statistics Agency (HESA) and further information about the uses for which HESA processes personal data can be found on the HESA website.

We use the services of various external service providers to help us run our university efficiently, particularly in relation to our IT systems. Some of these services (such as email hosting and data backups) involve the service provider holding and using your personal data. In each case where we share your information with one of our service providers, the service provider is required to keep it safe and secure. They are also not permitted to use your information for their own purposes.

For applicants, further information on how we manage disclosures to parents and other third parties, including information about what disclosures we make in the case of emergencies, please see our guidance on 'handling confidential information from students'.

Transfers outside the UK

There are many circumstances in which we may transfer your personal data outside the UK, e.g. where we use a third party cloud services provider based outside the UK to store personal data.

Please note that many countries outside the UK do not have data protection legislation, or have different data protection or privacy regimes, and so may not always protect their personal data to the same standard as within the UK.

Where we transfer your personal information across national boundaries to a third party, such as one of our service providers, we will protect your personal information by ensuring that those transfers are made in compliance with all relevant data protection laws. Generally, this means where we transfer your personal information to a third party that is located in a country which does not have adequate privacy protection, we will put in place a contract with the third party that includes the standard international data transfer contractual terms approved by the Information Commissioner’s Office. For further information on the measures in place, please contact us using the details set out in the 'Who do I contact with questions?' section below.

Principles

When processing your personal data, UCL is required by relevant data protection laws to comply with the following principles.

Principle	Personal Data shall be:
Lawfulness, fairness and transparency	processed lawfully, fairly and in a transparent manner in relation to the data subject.
Purpose limitation	collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
Data minimisation	adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
Accuracy	accurate and, where necessary, kept up to date.
Storage limitation	kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
Integrity and confidentiality	processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

In accordance with the separate 'Accountability' principle under relevant data protection laws, UCL must also be able to demonstrate compliance with each of the above principles.

Change of Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider what we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Retention periods

Your personal data will be retained in accordance with UCL’s Data Retention Schedule. This includes where you are not successful in your application or you reject an offer to study at UCL. In such circumstances, the personal data which you have provided as part of your application will be retained in full according to our Data Retention Schedule to ensure that UCL can meet its statutory reporting requirements and to carry out our own internal business analysis. After the expiry of the relevant retention period, the personal information you have provided will be removed from your record and the non-personal elements of the data which you have provided may be retained for further internal business analysis purposes.

Your rights

Subject to certain conditions, you have the following rights in relation to your personal data:

Right 1: A right to access personal data held by us about you (commonly known as a “data subject access request). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. Please see section entitled "How can I access my personal information" below.

Right 2: A right to require us to rectify any inaccurate personal data held by us about you, though we may be required to verify the accuracy of the new data you provide to us.

Right 3: A right to require us to erase personal data held by us about you where there is no good reason for us continuing to process it This right will only apply where, for example, we no longer need to use the personal data to achieve the purpose we collected it for; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with Right 6 below). Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Right 4: A right to restrict our processing of personal data held by us about you. This right will only apply where, for example, you dispute the accuracy of the personal data held by us; or where you would have the right to require us to erase the personal data but would prefer that our processing is restricted instead; or where we no longer need to use the personal data to achieve the purpose we collected it for, but we require the data for the purposes of dealing with legal claims or due to having overriding legitimate grounds to use it

Right 5: A right to receive personal data which you have provided to us in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal data to another organisation.

Right 6: A right to object to our processing of personal data held by us about you where we are relying on a legitimate interest (or those of a third party), and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Right 7: A right to withdraw your consent where we are relying on it to use your personal data. Note that a withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

Right 8: A right to ask us not to use information about you in a way that allows computers to make decisions about you and ask us to stop.

In certain circumstances, we may need to restrict your rights in order to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege).

If you wish to exercise any of these rights, please contact the Data Protection Officer using the contact details provided in section 'How can I access my personal information?'.

For applicants that come through our communications tools, you have the right to administer the above rights (where they apply) through individual settings function.

Keeping personal data up-to-date

Data protection law requires us to take reasonable steps to ensure that any personal data we process is accurate and up-to-date. Please help us to do this by advising us of any changes to your personal data. If your contact details change, please do notify us by emailing study@ucl.ac.uk.

How can I access my personal information?

As noted above, you have the right to access information held about you. Details are set out in our Data Protection Policy.

Your right of access can be exercised at any time by contacting us at data-protection@ucl.ac.uk or Data Protection Officer, UCL Gower Street, London WC1E 6BT.

Automated processing

UCL does not use automated processing and decision making without manual intervention.

Who regulates the use of my personal information?

UCL maintains a data protection registration with the Information Commissioner's Office, the independent authority which oversees compliance with the UK's data protection laws. Our registration number is Z6364106 and this registration sets out, in very general terms, the full range of purposes for which we use student, staff and all other personal data.

Please see the Information Commissioner's Office website for details.

Who do I contact with questions?

If you have any questions about your personal data and UCL that are not answered by this privacy notice then please consult UCL's data protection web pages, where further guidance and relevant UCL policy documentation can be found.

If you need further assistance, please contact UCL's Data Protection Officer: data-protection@ucl.ac.uk or Data Protection Officer, UCL Gower Street, London WC1E 6BT.

If we are unable to adequately address any concerns you may have about the way in which we use your data, you have the right to lodge a formal complaint with the data protection authority in your country or our main data protection regulator, the Information Commissioner's Office. Full details may be accessed on the complaints section of the Information Commissioner's Office website. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Prospective Students (Enquirers and Applicants) Privacy Notice v2.2