Graduation Ceremonies


UCL Picture Mosaic Privacy Notice

1. Introduction


The UCL Graduations Team (“we” “us”, or “our”) respects your privacy and is committed to protecting your personal data.

Please read this Privacy Notice carefully – it describes why and how we collect and use personal data and provides information about your rights. It applies to personal data provided to us, both by individuals themselves or by third parties and supplements the following wider UCL privacy notice(s):

2. About us

The UCL Graduations Team is part of Communications and Marketing (CAM) at University College London (UCL).

UCL, a company incorporated by Royal Charter (number RC 000631), is the entity that determines how and why your personal data is processed. This means that UCL is the ‘controller’ of your personal data for the purposes of data protection law.

3. Personal data that we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you. This may include:

  • Identity data: includes first name, last name, student number, email address and photographs and/or video, username or similar identifier, social media tokens provided to UCL and Noonah Marketing Limited by a social media site.

  • User generated data: includes text or comments inputted into our website or services by a data subject.

  • Contact data: includes email address.

  • Profile data: includes usernames and use of social media sites.

  • Technical Data: includes internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices used to access UCL’s and Noonah’s website or services.

  • Usage Data: includes information about how our website or services are used.

  • Aggregated Data: Noonah Marketing Limited collects, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from personal data, but is not considered personal data in law as this data does not directly or indirectly reveal identity. For example, Noonah Marketing Limited may aggregate Usage Data to calculate the percentage of users accessing a specific website feature. However, if Noonah Marketing Limited combine or connect Aggregated Data with personal data so that it can directly or indirectly identify a Data Subject, we treat the combined data as personal data and it remains subject to the restrictions contained within our agreement(s) with UCL and is only used to provide our services.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Data is stored on Noonah Marketing Limited servers or with our hosting providers, publishing it to UCL’s website and providing you with copies for your own purposes. We may also process personal data when we are providing support services to you in respect of our services.

• The overarching purpose for collecting the personal data is to take part in UCL’s picture mosaic. Your data is only used for this purpose, however, the UCL’s picture mosaic may be used for ongoing marketing purposes. If you would like to withdraw your image, you are required to give written consent by emailing ceremonies@ucl.ac.uk.

Where the processing is based on your consent, you have the right to withdraw your consent at any time by contacting us using the details set out below. Please note that this will not affect the lawfulness of processing based on consent before its withdrawal.

We may also use anonymised data, meaning data from which you cannot be identified, for the purposes of:

  • Service evaluation;

  • Education and research; or

  • Fundraising and promotional purposes.

Anonymised data may also be used in published reports or journals and at conferences.

5. Who we share your personal data with

Your personal data will be collected and processed primarily by our staff and UCL (Access to your personal information is limited to staff who have a legitimate need to see it for the purpose of carrying out their job at UCL.). We may have to share your personal data with the parties set out below for the purposes outlined in section 4:

Noonah Marketing Limited may share personal data with their IT and technical support providers for the sole purpose of providing services to UCL. This will include our secure hosting providers, and third party technology providers. Wherever possible Noonah Marketing Limited separate the data onto secure servers that can only be accessed by Noonah Marketing Limited, and so their technology partners do not have access.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes – we only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. Lawful basis for processing

Data Protection Legislation requires that we meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a "lawful basis" for the processing. The basis for processing will be as follows:

  • Consent. You have given us your consent for processing your personal data.

  • Contract. The processing is necessary for the performance of a contract or in order to

    take steps prior to entering into a contract

  • Legitimate interests. The processing of your personal data may be necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or by fundamental rights and freedoms which require protection of personal data.

7. International transfers

Most of Noonah Marketing Limited services do not involve transfers outside of the EEA and where Noonah Marketing Limited have technology partners based in other countries, Noonah Marketing Limited try to separate the event data onto secure servers within the EEA that can only be accessed by Noonah Marketing Limited.

Where there is the potential for personal data to be accessed from outside of the EEA Noonah Marketing Limited ensure that a similar degree of protection is provided to the data subject, either because the country concerned has been granted ‘adequacy status’, or because we have contracted with the service provider using approved standard contractual clauses.

8. Information security

UCL and Noonah Marketing Limited have put in place technical and organisational measures to ensure that your data is kept secure. These include limiting access to it, ensuring that it is encrypted both at rest and during transit, and training our staff on data protection issues.

9. Data retention

Your personal data will be retained in accordance with UCL’s central Data Retention Schedule. After you leave UCL certain parts of your data may be retained as a permanent archival record for research purposes and to confirm your award and period of study. Noonah Marketing Limited standard policy is to retain data ourselves for at least 30 days but no more than 12 months following UCL’s virtual graduation ceremonies.

We will keep your personal data according to the Records Retention Schedule

10. Your rights

Under certain circumstances, you may have the following rights under data protection legislation in relation to your personal data:

  • Right to request access to your personal data;

  • Right to request correction of your personal data;

  • Right to request erasure of your personal data;

  • Right to object to processing of your personal data;

  • Right to request restriction of the processing your personal data;

  • Right to request the transfer of your personal data; and

  • Right to withdraw consent.

    If you wish to exercise any of these rights, please contact the Data Protection Officer.

    Contacting us

    You can contact UCL by telephoning +44 (0)20 7679 2000 or by writing to: University College London, Gower Street, London WC1E 6BT.

    Please note that UCL has appointed a Data Protection Officer. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact our Data Protection Officer using the details set out below:

    Data Protection & Freedom of Information Officer


11. Complaints

If you wish to complain about our use of personal data, please send an email with the details of your complaint to the Data Protection Officer so that we can look into the issue and respond to you.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) (the UK data protection regulator). For further information on your rights and how to complain to the ICO, please refer to the ICO website.