XClose

Legal Services

Home
Menu

UCL Prospective Students (Enquirers and Applicants) Privacy Notice

Version 1.3 Published 16th November 2018

UCL ("we", "our", "us") are committed to protecting and respecting your privacy.
This privacy notice sets out how any personal data we collect about you will be processed by us. Please read the following carefully to understand how we process your personal data.

What is 'personal data'?
‘Personal data’ means any information which relates to and identifies you as an individual. It may include your name but it may also be other information such as your date of birth, nationality and gender which when combined identify you. And it may be collected in a variety of ways: electronic means, paper, telephone or via face to face enquiry.

This statement and UCL's data protection obligations
In accordance with the data protection legislation, we are a controller and this means that we are legally responsible for the personal data we collect and hold about you. One of our responsibilities is to tell you about the different ways in which we use your personal data – what information we collect, our legal basis for doing so, why we collect it, where we collect it from and whether and with whom we will share it. We also need to tell you about your rights in relation to your personal data.

Personal data we may collect about you through your enquiry or application
  • Name, contact details and identifies, date of birth and address history
  • Nationality/place of birth/country of domicile
  • Other personal data that you provide as part of your application, eg Next of kin / guardian / family etc data, information relating to referees
  • Proof of identity e.g. passport
  • Special category personal data, eg disability, ethnicity, health data
  • Your current situation i.e. whether you are currently working, studying etc
  • Intended year of entry and level of study
  • UKVI confirmation for acceptance to study / visa / biometric residence permits
  • Academic Technology Approval Scheme
  • Qualification information (provided by the applicant and external bodies e.g. UCAS)
  • Fee status (e.g. home, EU or overseas) and payment information
  • Statutory checks, disqualification by association form and overseas police check (if required)
  • Literacy/numeracy proficiency information

If you have provided us with this special category personal data or criminal convictions data information, this will only be processed where:

  • you have given explicit consent – eg contact you in relation to any adjustments you may require due to disability
  • for reasons of substantial public interest
  • where there is another lawful basis set out under data protection legislation

Information received from other sources

Such sources may include any of the following: funding and sponsorship partners, educational institutions, examination boards, overseas agents, UCAS, and clearing houses, business partners and compliance services e.g. UKVI, Disclosure and Barring Service.

These sources may provide particular information about you including: examination or test results, evidence of sponsorship (e.g. scholarship, bursary, loan), updates on your CAS status, and other information in connection with your UCL activities.

Purposes for which we process your personal data 

We process your personal data for the following purposes:

  • to give you advice on how to apply to study at UCL and communicate with you generally
  • to tell you about the opportunities and support that are available to you, such as funding streams, induction and alternative programmes of study
  • to assess your application to study at UCL, including your fees status
  • to administer our appeals and complaints process
  • to administer the financial aspects of your relationship with us and any funders or sponsors
  • to facilitate equal opportunities
  • to undertake data analysis and statistics and monitor trends (this is mostly undertaken in an anonymised form)
  • to provide feedback e.g. if you attend an open day
Using your information in accordance with the data protection laws

Data Protection Legislation requires certain conditions are met before we are allowed to use your personal data in the manner described in this notice, including having a "lawful basis" for the processing. The legal bases on which your personal data are collected are explained below.

Consent: You have given us your consent for processing your personal data.

Necessary in order to take steps to enter the student contract: The processing of your personal data may be necessary in relation to the contract we have entered into with you to provide UCL's services to you or because you have asked for something to be done so you can enter into such contract.

Public task: The processing of your personal data may be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. You can find out further details about what activities fall within scope of UCL’s ‘public task’ here.

Legitimate interests: The processing of your personal data may be necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or by fundamental rights and freedoms which require protection of personal data. It may be necessary for either UCL’s legitimate interests or yours to process your personal data. For example, it may be in your legitimate interests for UCL to provide you with details of an alternative course. Equally, it may be in our interests to manage certain operations of the University effectively or provide direct marketing.

Where you have provided us with special category data, it will be processed on the following bases:

  • you have given explicit consent – eg contact you in relation to any adjustments you may require due to disability
  • the processing is necessary for the establishment, exercise or defence of legal claims for reasons of substantial public interest
  • for reasons of substantial public interest
Who is my personal information shared with?

Access to your personal data is limited to staff who have a legitimate need to see it for the purpose of carrying out their job at UCL.

The information we process may be held on corporate systems some of which may be owned and operated by third parties. Where we engage with such third parties, such as externally hosted software or cloud providers, this may involve transfers of personal data outside of the EU. Whenever we do this, to ensure that your personal data is treated by those third parties securely and in a way that is consistent with UK data protection law we require such third parties to agree to put in place safeguards, such as the EU model clauses or equivalent measures.

Where you are on a programme of study that is jointly run or administered with other Higher Education Institutions or organisations that deliver teaching and learning, we will share your personal data with those organisations.

Where you are studying at UCL via a reciprocal exchange / study abroad agreement, we will share your personal data with your home institution for the purposes set out above and in accordance with the terms and conditions of the applicable partnership agreement.

For some selected programmes, we may need to apply for Disclosure and Barring Service (DBS) check. The lawful basis for processing this personal data will be:

  • Preventing or detecting unlawful acts
  • Safeguarding of children and of individuals at risk
Disclosures may also be made to sponsors, government agencies and present or potential employers. One such body is the Higher Education Statistics Agency (HESA) and further information about the uses for which HESA processes personal data can be found on the HESA website.
When you apply for accommodation while studying at UCL, your personal data may be disclosed to organisations in order to administer and provide for your accommodation
For applicants, further information on how we manage disclosures to parents and other third parties, including information about what disclosures we make in the case of emergencies, please see our guidance on Confidentiality.

 

Principles

Principle

Personal Data shall be:

Lawfulness, fairness and transparency

be processed lawfully, fairly and in a transparent manner in relation to the data subject.

Purpose limitation

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

Data minimisation

adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

Accuracy

accurate and, where necessary, kept up to date.

Storage limitation

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

Integrity and confidentiality

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures

Accountability

be able to demonstrate compliance with the above principles

Data Retention

Your data will be retained in accordance with UCL’s Data Retention Schedule.

After this time, the personal information you have provided will be removed from your record, and the non-personal elements of the data which you have provided will be retained for further internal business analysis.

Your Rights

Where they apply, you have the following rights in relation to your personal data:

Right 1: A right to access personal data held by us about you (please see section entitled "How can I access my personal information" below).

Right 2: A right to require us to rectify any inaccurate personal data held by us about you.

Right 3: A right to require us to erase personal data held by us about you.  This right will only apply where, for example, we no longer need to use the personal data to achieve the purpose we collected it for; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with Right 6 below).

Right 4: A right to restrict our processing of personal data held by us about you.  This right will only apply where, for example, you dispute the accuracy of the personal data held by us; or where you would have the right to require us to erase the personal data but would prefer that our processing is restricted instead; or where we no longer need to use the personal data to achieve the purpose we collected it for, but we require the data for the purposes of dealing with legal claims.

Right 5: A right to receive personal data, which you have provided to us, in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal data to another organisation.

Right 6: A right to object to our processing of personal data held by us about you.

Right 7: A right to withdraw your consent, where we are relying on it to use your personal data.

Right 8: A right to ask us not to use information about you in a way that allows computers to make decisions about you and ask us to stop. 

For applicants that come through our communications tools, you have the right to administer the above rights (where they apply) through individual settings function.

Requesting information

As noted above, you have the right to access information held about you. Your right of access can be exercised at any time by contacting us at data-protection@ucl.ac.uk.

Keeping personal data up-to-date

The Data Protection Laws require us to take reasonable steps to ensure that any personal data we process is accurate and up-to-date. If your contact details change please do notify us. If you have not yet made an application you can do this by emailing study@ucl.ac.uk. If you have made an application make your update either via UCAS track or via the applicant portal.

How can I access my personal information?

As noted above, you have the right to access information held about you. Details are set out on the University's Data Protection policy. Your right of access can be exercised at any time by contacting us via email, or writing to Data Protection Officer, UCL Gower Street, London, WC1E 6BT.

Changes to this Privacy Notice

Any changes we make to this privacy notice in the future will be posted [on this page] and, where appropriate, notified to you by e-mail.

Who regulates the use of my personal information?

The University maintains a data protection registration with the Information Commissioner's Office, the independent authority which oversees compliance with the Data Protection Laws. The University's registration number is Z6364106 and sets out, in very general terms, the full range of purposes for which we use student, staff and all other personal information. You have the right to lodge a complaint about how your personal data has been used. Please see the Information Commissioner's Office website for details.

Who do I contact with questions?

The data controller for the purposes of the Data Protection Legislation is University College London. If you have any questions about how your personal data is used, please consult the University's data protection webpages. UCL's Data Protection Policy can also be found on this website. If you need further assistance, please contact the University Data Protection Officer: data-protection@ucl.ac.uk or Data Protection Officer, UCL Gower Street, London WC1E 6BT