Student Privacy Notice

Student, Applicant and Enquirer Privacy Notice

September 2019

1. Data Controller

University of Northumbria at Newcastle (“we”, “our”, “us”) is registered as a Data Controller (Registration Number: Z7674926) with the Information Commissioner’s Office for the purpose of processing personal data. We are committed to processing personal data in accordance with our obligations under the (GDPR) and related UK data protection legislation.

2. Overview

This privacy notice describes how and why we process personal data in relation to any individual (“you”, “your”) submitting enquiries and/or applications to the University or when enrolling on any programme of study at any of our locations, including collaborative or foundation programmes, undergraduate or postgraduate (taught or research) programmes offered by us, or our partners, pathway students, degree apprentices, distance learning and CPD (Short Courses).

3. Where do we get your personal data from?

We may obtain personal data direct from you when:

• Submitting enquiries to us or requesting a prospectus via our website, through social media, by telephone, or emails.

• Registering for or attending open days, outreach events, careers fairs and external recruitment events whether in the UK, overseas or online.

• You apply to the University and via transactional activities as part of the application process.

• It is generated through your interactions with us as part of your studies, your use of University resources, services and systems and any other interactions with the University.

From third parties such as:

• UCAS, external recruitment representatives, University regional and country offices overseas, collaborative/partner institutions or organisations.

• Your current or previous places of study, employer(s) or placement providers.

• The Student Loans Company, your sponsor, local authorities, or other relevant parties authorised to provide us with your information.

• Relevant government agencies such as UKVI.

• Partner institutions where we act as the awarding body for your course.

4. Categories of personal data we process

To carry out our activities and to manage our relationship with you we may collect, store, and process the following categories of data:

• Contact and Identification information such as your name, address, other contact details, date of birth, gender, nationality, your dependents and whether you are a care leaver.

• Educational and employment history such as qualifications and work experience.

• References, immigration and visa information.

• Funding and financial arrangements (e.g. bank details, your income, sponsor etc).

• Correspondence and administration in relation to your application and your engagement with/outcome of the selection process and applicant events.

• Records of interactions with University services, academic work, marks and progression.

• Record of attendance (at recruitment events and at timetabled teaching) and absence.

• Photographs and visual images including video recordings.

• Information relating to extenuating circumstances, appeals, complaints and disciplinary.

• Other legitimate personal data relating to academic and pastoral support.

Special Category Data

Special Category Data such as physical or mental health, racial or ethnic origin, sexual orientation, religious belief or information relating to criminal offences may be required for:

• Compliance monitoring under the Equality Act 2010 and by the Higher Education Statistics Agency.

• Implementing reasonable adjustments to support your studies, ensure your health and safety, organising placements or, in relation to applications, for extenuating circumstances.

• Disclosure and Barring Service (DBS) checks on programmes leading to professional qualifications. Once enrolled, you may need to update us of any relevant criminal convictions or provide information about your health. These are required to assess your fitness to practice and suitability to work with patients, children or vulnerable people.

• Assessing any relevant unspent criminal convictions (e.g. physical or sexual assault, firearms, arson or drugs) of all other offer holders so that we may identify risks to other members of the University and/or identify appropriate support measures for you. You will not be asked about criminal convictions at application, only once you receive your offer.

• Information relating to the prevention and detection of crime and the safety and security of staff and students, including, but not limited to, CCTV recording and data relating to breaches of University regulations.

5. The activities we process data for and their lawful basis

We will only process your personal data for legitimate purposes and where we are permitted to do so under an appropriate lawful basis such as:

• Processing is necessary for the performance of your contract (“Contract”) with us as a registered student or in order to enter into that contract at the point of your application. Without this information we would not be able to process your application or enrol you.

• The University is a public authority with an obligation to undertake research and deliver teaching activities. To this end, your data is processed because it is necessary for the performance of a task in the public interest task (“Public Task”) in fulfilment of our duty to provide educational services.

• We may process your data in order to meet our legitimate interests or to meet the legitimate interests of others, including you.

• We may ask for your consent to process your data, for example if you engage with a specific service. Where we rely on consent this will be made clear to you and you are free to decide whether to provide this data with no consequences if you choose not to.

• To protect your vital interests, or those of another person, where you are physically or legally incapable of giving consent.

Special Category Processing

We may process Special Categories of personal data in the following circumstances:

• We may rely on your explicit consent to process Special Category data in relation to specific services. Consent can be withdrawn at any time.

• Processing may be necessary under substantial Public Interest or for archiving, scientific or historical research purposes or statistical purposes: We may process special category data for research as part of our public tasks.

• We process some data in order to comply with the University’s legal obligations to do so, for example national Safeguarding protocols, national ‘PREVENT’ duties etc...

Recording Telephone Calls

We may monitor or record calls to our admissions line in case we need to resolve queries or issues. Conversations may also be monitored for staff training purposes and to help improve our service. Where applicable, we will notify you and take appropriate measures to ensure that sensitive data is not recorded.

Photography

Photographs may be taken at events for use in marketing materials, including on our website and on social media. Where you are not the subject of the image, i.e. if it is a “group” or “crowd” photograph, we may use such images without requiring your consent, however, where you are the subject of the photograph, you will be asked to provide your explicit consent to use the image. Notifications will be put up in and around ‘open’ events to inform you when such photography is taking place and you have the right to object to your image being taken. 

Communications

All communication with you will, where possible, be made via your registered preferred method of communication. E.g. via email, post, telephone, text message (SMS), social media. We will contact you in relation to events that we believe are relevant to you based upon your engagement with us and about other matters we think are relevant to your application. If, at any stage, you are concerned about the content (e.g. unwanted marketing), frequency (too many) or method (change of preference) of communications, you can unsubscribe or update your preferences using links provided at the bottom of the relevant correspondence.

6. How personal data is stored securely by Northumbria University

We have implemented appropriate physical, technical, and organisational security measures designed to secure your personal data against accidental loss and unauthorised access, use, alteration, or disclosure. In addition, we limit access to personal data to those employees, agents, contractors, and other third parties that have a legitimate business need for such access.

We utilise many different storage solutions and IT systems, some of which are outsourced to third party providers. Where processing takes place with an external third party, processing takes place under an appropriate agreement outlining their responsibilities to ensure that processing is compliant with the Data Protection legislation and verified to be secure All employees, contractors and volunteers with access to personal data receive mandatory data protection training and have a contractual responsibility to maintain confidentiality and access to your data is restricted to those members of staff who have a requirement to access it. Where applicable, any credit/debit card details provided will be stored in full compliance with PCI-DSS requirements.

7. Sharing your Personal Data with Third Parties

Where we have a legal obligation to do so, we will share your personal data with the following organisations; 

• Higher Education bodies such as:

• The Higher Education Statistics Agency (HESA) See Privacy Notice
• The Office for Students (OfS), See Privacy Notice
• Health Education England (HEE),
• The Education Skills Funding Agency (ESFA)
• The Higher Education Funding Council for England (HEFCE)
• The UK Research Councils
• Looked after Students returns to LAS.

• UK Visas and Immigration (UKVI) and Home Office for compliance with our Tier 4 sponsor licence and all associated immigration regulations and responsibilities

• Student Loans Company for the administration of your loan See http://www.slc.co.uk/

• Government agencies and authorities, including the Police and DWP for the prevention and detection of crime, apprehension and prosecution of offenders, the collection of tax or duty and safeguarding national security.

Where we have operational requirements to do so to fulfil our Public Task or to fulfil our contract to you, will share your personal data with the following organisations:

• Companies acting as ‘data processors’ under contract, who deliver functions on our behalf. Service providers only process data for the purpose for which we have engaged them and will not process your data in any other manner. This includes the provision of data to externally hosted software solutions which require data to be uploaded for you to monitor your application or to make systems accessible to you when you enrol.

• Representatives working on our behalf for the purpose of marketing and the promotion of the University and conducting surveys on our behalf.

• International agents or appointed representatives if you are an international applicant and you apply via an International Agent or with specialist ‘in country’ applicant support.

• Personal data may be shared with placement providers to ensure that the applications and provisions of your placement can be arranged prior to enrolment and to monitor attendance, and to monitor and assess your progress.

• For London Campus offer holders, and QA Pathway students, relevant data will be processed by staff working for our Joint Venture partners ‘QA HE Limited’.

• For Amsterdam Campus offer holders, we share limited data with ‘Amsterdam University Applied Science’ for facilities management (building access and access to services) and ‘VISTRA’ for the provision of financial services.

• For Distance Learning offer holders, we share data with our data processing partners ‘Pearson’ for the purpose of their providing support to you via our dedicated Northumbria DL Student Success Team

• For applications to other partner educational institutions and organisations involved in the delivery of our programmes e.g. affiliated colleges, exchange institutions, including those outside of the UK and sometimes the EEA.

• Provision of information to external examiners, external reviewers or other relevant external parties required to provide comment or to participate in University convened groups e.g. external professional suitability panel members. 

• Continuing Professional Development (CPD) at Northumbria who have their learning funded by HEE requires some personal data to be shared with your employer and HEE to demonstrate that we are meeting our contractual obligations.

• Sponsors and funding bodies (including employers and overseas bodies) where there is a requirement to confirm periods of attendance, assessment results and similar information. We will seek evidence in individual cases for any prior agreement between you and the sponsor.

• External parties and to external participants on professional suitability panels.

• Turnitin® UK system requires a limited amount of personal data including names and email addresses and course details.

Where we have an appropriate lawful basis to do so, we may also share your data for the following purposes:

• With Northumbria Students Union to enable the provision of information regarding Fresher’s Week activities and to enable you to access their services. 

• To act as referees on your behalf or to seek references from organisations that you have nominated for us to contact – with your consent only. 

• Register you with Newcastle or Gateshead City Councils for the purpose of confirming your exemption from payment of council tax. You will need to present your exemption certificate to the council who will use this data to confirm it is genuine. Without this data being provided, you would need to individually request us to verify you as a student.

• We may be required to provide data to external lawyers, auditors or insurers in respect of accidents occurring within the institution and where we need to seek advice and services in relation to the “establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity”.

• Adult or Children's services as defined by national Safeguarding protocols in the event of safeguarding or 'PREVENT' related concerns or allegations. This may result in sharing with relevant multi-agency Safeguarding and/or Channel Panel.

• University Accommodation Management partner Sodexo Living and to the Accommodation Insurers for the provision of personal property insurance.

• Representatives working on our behalf for the purpose of marketing and promotion of the University; and ‘in country’ student support.

• Relevant Professional Bodies associated with your programme in order to confirm your enrolment on the course and/or your final qualification.

• Debt recovery agencies appointed by us where internal University procedures have failed to recover outstanding debts.

• To the Office of the Independent Adjudicator (OIA)

• To Sport England’s Higher Education Sport Participation and Satisfaction survey in partnership with TNS-BMRB, an independent research company. Students’ University email address is all that is needed for the survey, no other information about an individual student is supplied.

• To Northumbria University Alumni Association upon completion of studies.

• Any other disclosures that may be required but not listed above will be in accordance with your rights and the requirements of the GDPR.

We will not disclose anything to parents and/or guardians without your consent, unless your life or health is threatened, in which case if it is judged to be in your “vital interests”, we may notify your emergency contact.

8. Transfers to countries outside of the European Economic Area (EEA)

Some Partners and IT services providers are based in countries outside of the EEA. We only transfer data to outside the EEA where “appropriate safeguards” are put in place through contract, where the European Commission has agreed that data protection provisions of a country offers adequate levels of protection; or where you have given your explicit consent.

Where providers are based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between the Europe and the US.

9. Automated individual decision making, including profiling

We use limited ‘Profiling’ (where information about you is used to tailor goods or services based on your interests, movement or records of your activities) for Educational Analytics. You will be asked if you wish to participate in the process and will receive tailored advice about how you can enhance you learning. We may collect and use data (but not engage with you) as part of learning analytics under legitimate interests.

10. How long is personal data held by Northumbria University

We will retain your personal data for as long as it is required to fulfil the purpose for which is it held and then to fulfil any legal requirements. Details of the retention periods for each type of processing activity is detailed in our retention schedule which is available on our website here.This can be summarised as:

• Enquiry records will be kept for 3 years to support any subsequent application.

• Unsuccessful applicant’s data will be retained for 1 year following the completion of your application.

• Successful applicant data will be classed as ‘Student data’ where ‘Core Information’ (used to provide your transcripts, certificates, replacement certificates, and validate your studies at any time in the future) is retained for 80 years.

We may keep data for longer if required to do so for legal reasons, limited research or for statistical purposes. If we do, we will make sure that your privacy is protected and only use it for those purposes.

11. Your Rights under GDPR

Under the GDPR, you have a number of rights in relation to the processing of your personal information, each of which may apply to differing degrees’ dependent upon the nature of the processing and the legal basis for it. You have the right to:

• Be informed as to how we use your data (via this privacy notice)

• Request access (a copy) of the personal information that we hold about you.

• Correct inaccurate or incomplete data

• Request that we stop sending you direct marketing communications.

In certain circumstances, you may also have the right to:

• Ask to have certain data erased by us.

• Request that we restrict certain processing of your personal data.

• Request that we provide any data you submitted to us electronically be returned to you or passed to a third party as a data file.

• Object to certain processing of your personal data by us

In order to exercise any of the above rights, please contact the Data Protection Officer. For more information about any of the above please see the GDPR pages of our website.

12. Data Protection Officer

The Data Protection Officer (DPO) for Northumbria University can be contacted via email at dp.officer@northumbria.ac.uk or you can call +44 (0)191 243 7357

13. Lodging a Complaint with the Information Commissioners Office (ICO)

If you are dissatisfied with our processing of your data, or a response to a complaint you have made to us about it, you have the right to complain to the ICO.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9

5AF, and Telephone: 0303 123 1113 (local rate) or 01625 545 745 Email: casework@ico.org.uk

For more information see Information Commissioner’s web site.