Data Controller
- Ulster University
Data Protection Officer
- Eoin Coyle, Data Protection & Information Compliance Manager, M1207, Derry~Londonderry BT48 7JL, email: E.Coyle2@ulster.ac.uk
This Privacy Notice explains how Ulster University collects, uses and processes student personal data as a data controller and explains students’ rights in relation to the personal data that the University processes about prospective, current and past students.
The University actively seeks to preserve the privacy rights of those individuals that share information with the University. The personal data which you provide to the University will be processed in accordance with UK data protection legislation, specifically UK GDPR and the Data Protection Act 2018.
What is the purpose and legal basis of the processing?
The University processes personal data about you for admission, various teaching, research and administrative purposes.
Examples of how your data is used are as follows:
- admission purposes, supporting registration and enrolment and thereafter maintenance of your records;
- for teaching purposes, be that face-to-face teaching, online synchronous teaching, recorded lectures tutorials seminars and workshops and other such remote learning as supported by software solutions;
- the administration of your education, including academic assessment, recording assessment results, , granting of awards and organising graduations;
- providing student support services, for example in relation to disability, health, counselling, [welfare and pastoral support services, career services and sport facility services];
- welfare and pastoral support including ensuring the health and safety of students, staff and employees;
- administration and provision of facilities such as IT and Library services;
- administration of financial aspects of your education including payment of tuition fees, bursaries, scholarships and where applicable debt recovery;
- provision of accommodation services and administering accommodation licences of University controlled properties;
- monitoring equal opportunities and providing management statistics;
- holding student photographs to assist staff in identifying and recognising students and to produce ID cards;
- maintaining contact with alumni for alumni engagement and fundraising;
- fundraising and marketing;
- processing student academic appeals and student discipline cases;
- processing your images for use with CCTV for your security;
- monitor compliance with UKVI for international students and workers;
- to contact you and/or your emergency contact in the event of an emergency;
- to carry out our legal duties and statutory responsibilities.
The following lawful basis that applies to this processing:
- UK GDPR Article 6.1(a) – the data subject has given consent to the processing of their personal data for specific purposes.
- UK GDPR Article 6.1(b) – the processing is necessary in order to meet our obligations or exercise our rights under our contract with you. The University also need to process personal data for contractual purposes where the University is working with a third party to provide certain services such as the Student Union.
- UK GDPR Article 6.1(c) – the processing is necessary for compliance with a legal obligation to which the controller is subject.
- UK GDPR Article 6.1(d) – The processing is necessary in order to protect your vital interests or the vital interests of another individual. This is typically limited to processing needed for medical emergencies or where there is a threat to life.
- UK GDPR Article 6.1(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- UK GDPR Article 6.1(f) – the processing is necessary for the purposes of the legitimate interests pursued by the University as controller relating to student administration, alumni relations, business continuity or similar activities except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
For processing special category data, our legal basis for processing is:
- UK GDPR Article 9(b) – Explicit Consent (where appropriate).
- UK GDPR Article 9(b) – Employment, social security and social protection.
- UK GDPR Article 9(c) – processing is necessary to protect the vital interests of the data subject.
- UK GDPR Article 9(g) – reasons of substantial public interest (with a basis in law).
- UK GDPR Article 9(h) – Health or Social care (with a basis in law)
- UK GDPR Article 9(i) – reasons of Public Health (with a basis in law)
- UK GDPR Article 9(j) – reasons of Archiving, research and statistics (with a basis in law)
- Data Protection Act 2018, Schedule 1, Part 1 (2) – Health or social care purposes
- Data Protection Act 2018, Schedule 1, Part 1 (3) – Public Health
- Data Protection Act 2018, Schedule 1, Part 1 (4) – Research etc
- Data Protection Act 2018, Schedule 1, Part 2 (6) – Statutory etc and government purposes
- Data Protection Act 2018, Schedule 1, Part 2 (8) – Equality of opportunity or treatment
- Data Protection Act 2018, Schedule 1, Part 2 (11) – Protecting the public against dishonesty etc
- Data Protection Act 2018, Schedule 1, Part 2 (16) – Support for individuals with a particular disability or medical condition
How the University collects your personal data
The University shall collect the vast majority of personal data from you directly, through the admissions and enrolment process and then as updated by you from time to time. In addition, our staff shall further collect personal data during the academic year. You have access through the Portal to Student Self-Service where you can view some of your personal data held by the University.
It is important that the personal data the University holds about you is accurate and current. You have a responsibility to check the accuracy of the personal data and to information the University immediately of any errors or changes during your relationship with us.
The University may also collect personal data from other sources such as former schools, colleges, higher education institutions, UCAS, the PSNI, placement providers or from our website which may occur automatically through your use.
Change of Purpose
The University will only use your personal data for the purposes for which it collected in, unless the University reasonable considers that it needs to use the personal data for another reason and that reason is compatible with the original purpose. If the University needs to use your personal data for an unrelated purpose it shall notify you and explain the legal basis for which allows the University to do so.
How long does the University hold your personal data?
The University’s Retention and Disposal Schedule includes guidance on retention and disposal periods.
Categories of personal data processed by the University
Personal Data
The University may collect, use, store and transfer the following types of personal data as part of this processing:
- Name
- Gender
- Date of Birth
- Address
- Financial data including bank account and payment card details
- Contact Details
- Next of Kin
- Educational Background
- Marital Status
- Dependents
Special Category Data
“Special Categories” or particularly sensitive personal information, such as information about your health, racial or ethnic origin, sexual orientation require higher levels of protection. The following categories of special category data will be processed:
- Health (incl. Disabilities, learning difficulties and long-term medical conditions)
- Racial or ethnic origin
- Sexual Orientation
- Religious Belief
- Political Opinion
The University does not need your consent to process special category data if it processes same in accordance with this notice and the Appropriate Policy Document to carry out its contractual and legal obligations. In limited circumstances, the University may approach you for your written consent to allow it to process certain special category data. In such circumstances the University will provide full details of the information requested and the reason why it is required so you can carefully consider whether you wish to consent.
The University do not need your consent where the purpose of the processing is to protect you or another person form harm or to protect your well-being and it reasonably believes that you need care and support, are at risk of harm and are unable to protect yourself.
Criminal Convictions and Criminal Records Checks
The University may only use information relating to criminal convictions and criminal records where the law permits it to do so. This will typically be where such processing is necessary to carry out its obligations and provided such processing is in line with this notice.
The University may ask you to disclose information about serious past criminal convictions that are not spent prior to offering a place on its programmes. The University also undertakes mandatory criminal records checks if you are accepted to a course which involves regulated activity with children or vulnerable adults. If subsequent to your enrolment you obtain a criminal conviction, you are required to disclose this to the University.
The University are permitted to use such criminal offence data to carry out its obligations in respect of its public task and to comply with its legal obligations under the following lawful basis:
- Data Protection Act 2018, Schedule 1, Part 2, Paragraph 10 - Preventing or detecting unlawful acts
- Data Protection Act 2018, Schedule 1, Part 2, Paragraph 18 - Safeguarding of children and of individuals at risk
The University has in place an appropriate policy and safeguards which are required by law to maintain when processing such criminal offence data.
Who does the University share your data with?
The University shares personal data with third parties where necessary for the purposes of the processing and where there is a legal basis to do so. Where information is shared with such third parties, the University will seek to share the minimum amount necessary.
As part of this processing the University may share your personal data with the following third parties:
- Ulster University Student’s Union to enable the Students’ Union to provide services to students.
- Government Bodies pursuant to statutory obligations, the University is required to disclose your personal data to government departments, to the Higher Education Statistics Agency (HESA), the Student Loans Company and Education and Library Boards/Local Authorities.
- The information provided to HESA is used for statistical purposes and no information will be published that would enable you to be identified personally. The University will send information from the Destination of Leavers in Higher Education (DLHE) form to HESA. HESA may pass student personal data to other government departments or statutory bodies that need the personal data to carry out their functions connected with higher education. If you have any concerns about the use of your information, you can contact HESA directly.
- The University may share your personal data with our partner institutions, for example: FE Colleges, for the purposes of facilitating your academic progress and awarding qualifications.
- The National Student Survey – the University shall pass your contact details to the organisation contracted to carry out the National Student Survey.
- Stryder Corp (“Handshake”) which hosts a database that enables you to access the range of services provided by the University’s Career Development Centre.
- Google Analytics which processes information about how you use the website ulster.ac.uk. The University do this to help make sure the site is meeting the needs of its users and to help us make improvements. For further information please view our Privacy notice.
- Professional statutory regulatory bodies such as the General Teaching Council for Northern Ireland and the Nursing and Midwifery Council to enable you to be registered with such bodies in order to take up employment and practice within such professions.
- Postgraduate Research Experience Survey (PRES)– The PRES is a national, biannual survey that asks research postgraduate students to feedback on their experiences of their studies. The survey includes the processing of personal data to allow for analysis by personal characteristics. The national PRES is co-ordinated by AdvanceHE. The local survey is administered by the University using the JISC Online Survey platform to collect responses. The survey is optional for students to complete. Survey data which has your name and email address removed, so not to identify you, is disclosed to Advance-HE for research purposes, including the production of national reports about the characteristics and views of postgraduate researchers, and the state of postgraduate research. The survey data is stored in the JISC online survey platform, JISC act as a data processor of the survey data.
Further, the University may share your personal data with the following categories of third parties:
- Firms that provide professional services to the University such as legal firms, consultants and auditors
- Research and academic partners
- Firms that provide IT or cloud services not previously identified which provide essential services to the University
- Third parties who provide student support services for example in relation to welfare issues, disability, health or counselling.
- The PSNI or other law enforcement agencies when required by law to do so
- Debt collection agency if the University has been unable to recover the debt using its internal processes.
- Organisations that provide placements for students, such as businesses, schools and the National Health Service Trusts
All third party service providers that process data on our behalf are required to take appropriate security measures to protect your data in line with our policies. We do not allow them to use your data for their own purposes. We permit them to process your data only for specified purposes and in accordance with our instructions.
International Transfers
The University will transfer your personal data to the following countries outside of the United Kingdom:
- European Economic Area
In these circumstances your personal data is being transferred on the basis that the Secretary of State has made an adequacy regulation in respect of said countries. This means that countries are deemed to provide equivalent protection to personal data as provided by the UK data protection regime.
In addition to the European Economic Area, the University may also transfer your personal data to countries outside the United Kingdom in very limited occasions that are deemed not to provide an adequate level of protection for your personal data. However, to ensure that your personal data does receive an adequate level of protection, the University will put in place appropriate safeguards.
Your rights as a Data Subject
As a University data subject you have the right to:
- Access and obtain a copy of your personal data on request;
- Require the University to change incorrect or incomplete personal data;
- Require the University to delete or remove your personal data, for example where the data is no longer necessary for the purposes of processing. Note, however that the University may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request;
- Object to the processing of your personal data where the University is relying on its legitimate interests as a legal ground for processing;
- Where the University is relying upon consent to process your personal data, you may withdraw your consent at any time; and ask the University to stop processing personal data for a period if the personal data is inaccurate or there is a dispute about whether or not your interests override the University’s legitimate grounds for processing the personal data.
The University may update this Privacy Notice from time to time and where required to do so by law the University shall notify you of the changes.
Further information and your right to complain
Further information about the University’s practice in respect of data protection is available via our Data Protection Policy.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request the University transfer a copy of your personal information to another party, please contact the University’s Data Protection Officer.
Eoin Coyle,
Data Protection & Information Compliance Manager,
c/o Ulster University,
Room J309, Coleraine,
BT52 1SA
Tel: 02871 675525
Email: gdpr@ulster.ac.uk
If you are not satisfied with how the University is processing your personal data, you can make a complaint to the ICO. Further information about your data privacy rights are available on the ICO’s website.