Student Privacy Notice

1. About this Privacy Notice

This notice sets out how we process the personal data of prospective and current students. The details of how we process former students’ details is covered in our Alumni Privacy statement.

Please read this notice alongside our overarching privacy notice: Privacy Hub.

It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.

The University of Essex is the controller for the purpose of data protection law.

In the case of student accommodation, the data controller is University of Essex Campus Services Limited.

2. What type of information we collect about you

We will collect information related to your application and enrolment at the University and the use of our facilities. In certain circumstances that will include “special category data” where you choose to provide it.

For short courses and summer schools not leading to the award of credit, and for pathway courses and pre-sessional courses (including UEIC Pre-sessional English (PSE) courses and UK University Ready courses and in-country PSE courses) which are delivered by partner institutions, we hold an appropriate sub-set of the data mentioned below.

For UEIC pathway students, we hold an appropriate sub-set of the data mentioned below and will also ask you to complete a pre-CAS questionnaire a few months prior to you progressing to the University in order to support the progression process.

We will collect the following personal information:

• Your identity, including your right to study, your contact details, and those of next of kin in case of emergency
• Your application details, whether from UCAS, an agent, or received directly from you, including your previous study and qualifications
• Details about which course of study you are on, your level and stage of study, and your chosen modules
• Information about your progress, including submission of work, marks etc. This also includes information about your attendance and engagement with teaching events, and teaching materials, such as library resources and Moodle, and other university resources. Some of this information is made available to some students through LEAP, our Learner Engagement Portal. We also collect information about any breaks you take from study (intermission), any repeated study periods, and time spent studying abroad or on placement as part of your course
• Extracurricular activities
• Educational background
• Bank details
• Photographs, filming of student performances or other events
• CCTV footage and other information obtained through electronic means such as swipe/identity card records
• Information about your use of our information and communications systems.
• Information about any complaints against you, such as academic offences or breaches of our code of student conduct complaints

We will also collect some “Special category data”, which includes:

• Information about your race or ethnicity, religious beliefs for equality, diversity and inclusion monitoring and reporting
• Information about your health, including any medical condition, health and sickness records, and disability information, including mental health and wellbeing
• Sexual orientation and sex life, information about gender or transgender type
• Information relating to Covid-19 which may include symptoms, or vaccinations status, for full details please see our separate Covid-19 Privacy Statement

3. Why we use your personal data – and our legal basis for doing so

When we collect or otherwise process your personal data, we need both a purpose (i.e., a reason) and a legal basis. There are several legal basis under the UK General Data Protection Regulation. We generally rely on the following legal bases when processing your personal data.

3.1 Performance of a contract

As a student you have a contract with us, and in order for that to function we need to process certain information about you. We have set out our reasons for using your personal information in the table below. 

3.2 Legal obligation

We have various legal obligations that we need to comply with, and we may need to collect, use, or share your personal information as part of that. We have set out our reasons for using your personal information in the table below. 

3.3 Legitimate interests

From time to time, we may need to use your personal data to pursue our legitimate interests or those of a third party. We rely on legitimate interests when the processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.

Where we rely on our legitimate interests we mean our:

• pursuit of our activities and objectives, or those of a third party;
• compliance with applicable legal and regulatory obligations and any codes of conduct;
• improvement and development of our business operations and service offering, or those of a third party; or
• protection of our services, students, employees and customers, or those of a third party. 

We have set out our reasons for using your personal information in the table below.  Where we rely on our legitimate interests, we have set out those interests in the table below.

3.4 Consent

We do not routinely rely on consent to process your personal data. If we wish to rely on your consent to process your personal data, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

We rely on the legal basis of explicit consent for the purposes of:

• Collecting information relating to COVID-19 (please see our separate Covid-19 Privacy Statement)
• Collecting information about additional needs. We will further share some of this information within the University under a different legal basis (to comply with a legal obligation or our public task), e.g limited information is automatically shared with the Library in order to provide you with collection and/or alternative formats services
• Collecting information about disability, or any health or sexuality issues that may affect your study. This is not mandatory information, but we are unable to support you fully and to comply with our obligations under the Equality Act 2010 if you do not share this information with us
• We use data about individuals’ ethnicity, sexual orientation, disability and gender in order to ensure that we are supporting the specific needs of individual students and providing a fair and equal environment for all

Where we are relying on consent to process your personal data, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. You have the right to object to our use of your personal data at any time.  Please see the Data Rights section of our Privacy Hub for a summary of your right to object and the details of who to contact if you want to exercise them.

3.5 Vital Interests

We may use your personal information in situations where we need to protect your vital interests (or someone else’s interests).  For example, the University would inform the emergency services of known medical conditions of a student where they had lost consciousness.

3.6 Table 1

4. Where the data we hold comes from

We collect data directly from you, or through an agent or UCAS, when you apply to study with us, and at the point of offering you a contract (Registration).

We continue to collect data about you, such as attendance or exam marks, while you study with us.

For international students we may collect data about you from your sponsor.

For UEIC pathway students, UEIC share an appropriate sub-set of your data with us when you register at the College (see UEIC Privacy Notice) so that we can provide relevant University services to you. We will also collect additional relevant data from you prior to progression to the University (e.g. pre-CAS questionnaire) in order to facilitate your progression to the University.

5. Whom we share your data with

Internally, access to information about students is restricted to those who need it in order to carry out their roles. This will include your personal tutor and other staff who teach you, as well as the professional services staff in your department who support activity such as exams, attendance monitoring and coursework submission.

There are other central professional services staff who will need access to some information about you, including the timetabling office, the exams office, the library and the central progress team.

Information held by the Student Conduct Manager (relating to any breach, or alleged breach of our code of student conduct), and by our student support and wellbeing teams (relating to your health and wellbeing) will not normally be shared outside those teams other than in line with any consent you have given or as otherwise set out in the relevant confidentiality policies.

In line with Universities UK guidance, information relating to the outcome of the complaint and associated actions may be shared with another party to the complaint. The extent of this sharing will be decided upon on a case-by-case basis, and, where any information is shared, with reference to an appropriate and agreed lawful basis.

We share data about your identity and course with the Students’ Union, so that they know you are a student and eligible for membership.  We manage a separate Data Sharing Agreement and data sharing log with the Students’ Union.

If you are studying on a course that includes a practical professional placement then, under the terms of our Fitness to Practise procedure we may share your information with the relevant professional body.

We may also share your data externally in these ways:

• We send the name, registration number and award title of students who are eligible to graduate each year to the Graduate Gowning Company to ensure that they are able to supply the correct robes for graduation
• If you live in accommodation within a relevant brough then we will share your name, address and the fact that you are studying with us with the relevant local council, to ensure that you receive the Council Tax rebate to which you are entitled
• If you are based on our Colchester Campus then we give your contact details to the Health Centre at the start of each academic year so that they can check that their records are accurate and up to date. You do not have to register with the Health Centre.
• For those of you who are registered at our Southend Campus, we share your data with Southend Borough Council to enable use of our shared library, The Forum. Southend Borough Council’s privacy statement is viewable online. We specify that your data must be kept safely, used only under our instructions in accordance with data protection law, and not be used for the contracting company’s own purposes.
• We will collect from you the contact details of a person nominated by you for us to contact in case of emergency. We may also pass those contact details to the emergency services. We may also contact that person if we have concerns for your wellbeing, particularly if we have good reason to believe that you are at risk.
• We will share some of your information if we are asked for a reference from a prospective employer
• We share data with HESA. You can read HESA's Collection Notice online.
• We may share some information if required to do so by the police or other law enforcement authorities, including the Home Office
• If you have a financial sponsor then, if asked, we may tell them some limited information about you, such as confirming that you are still registered with us. If possible we will ask your permission first. If you have signed an agreement with your sponsor that they can see information about you then we will follow that agreement.
• We may also share your data when an external company provides us with a software system that holds or uses your data. Such sharing will always be carried out under contract, as part of which we will specify that your data must be kept safely, used only under our instructions, and not be used for the contracting company’s own purposes

6. Where we keep your data and how long we keep it for

We have retention schedules that set out how long we keep information of all types, including personal data of students.

We do not generally transfer your data outside of the UK. Data are retained primarily within our own student record and student file systems, but may be held elsewhere on our network, including within the email system, and on paper within our faculties and departments.

If we have to transfer any of your personal data outside the EEA we ensure the receiving country or organisation is deemed to have adequate data protection provision. Where a country or organisation does not have adequate protections we will put safeguards in place. Details of these safeguards can be provided to you upon request.

7. Changes to this Privacy Notice

This privacy notice was published on Thursday 3 February 2022. We may change this privacy notice from time to time and will communicate these changes directly to you where appropriate.

If you have any questions about this privacy notice or if you would like to access any of your rights, please contact dataprotectionofficer@essex.ac.uk

Last revised Thursday 3 February 2022.