This notice sets out how we process the personal data of prospective and current students. The details of how we process former students’ details is covered in our Alumni Privacy statement.
Please read this notice alongside our overarching privacy notice: Privacy Hub.
It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.
The University of Essex is the controller for the purpose of data protection law.
In the case of student accommodation, the data controller is University of Essex Campus Services Limited.
We will collect information related to your application and enrolment at the University and the use of our facilities. In certain circumstances that will include “special category data” where you choose to provide it.
For short courses and summer schools not leading to the award of credit, and for pathway courses and pre-sessional courses (including UEIC Pre-sessional English (PSE) courses and UK University Ready courses and in-country PSE courses) which are delivered by partner institutions, we hold an appropriate sub-set of the data mentioned below.
For UEIC pathway students, we hold an appropriate sub-set of the data mentioned below and will also ask you to complete a pre-CAS questionnaire a few months prior to you progressing to the University in order to support the progression process.
We will collect the following personal information:
When we collect or otherwise process your personal data, we need both a purpose (i.e., a reason) and a legal basis. There are several legal basis under the UK General Data Protection Regulation. We generally rely on the following legal bases when processing your personal data.
As a student you have a contract with us, and in order for that to function we need to process certain information about you. We have set out our reasons for using your personal information in the table below.
We have various legal obligations that we need to comply with, and we may need to collect, use, or share your personal information as part of that. We have set out our reasons for using your personal information in the table below.
From time to time, we may need to use your personal data to pursue our legitimate interests or those of a third party. We rely on legitimate interests when the processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.
Where we rely on our legitimate interests we mean our:
We have set out our reasons for using your personal information in the table below. Where we rely on our legitimate interests, we have set out those interests in the table below.
We do not routinely rely on consent to process your personal data. If we wish to rely on your consent to process your personal data, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.
We rely on the legal basis of explicit consent for the purposes of:
Where we are relying on consent to process your personal data, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. You have the right to object to our use of your personal data at any time. Please see the Data Rights section of our Privacy Hub for a summary of your right to object and the details of who to contact if you want to exercise them.
We may use your personal information in situations where we need to protect your vital interests (or someone else’s interests). For example, the University would inform the emergency services of known medical conditions of a student where they had lost consciousness.
Purpose | Legal Basis |
Correspondence relating to offers and next steps | Necessary to enter into or perform a contract we have with you. |
Admission, enrolment, and administration of studies | Necessary to enter into or perform a contract we have with you. |
Administration and consideration of eligibility/applications, relating to bursary’s, fees, and funding | Necessary to enter into or perform a contract we have with you. |
Academic assessment and progression | Necessary to enter into or perform a contract we have with you. |
Monitoring and management of your attendance | Necessary to enter into or perform a contract we have with you. |
For provision of services such as the library | Necessary to enter into or perform a contract we have with you. |
Creation and management of email addresses and accounts | Necessary to enter into or perform a contract we have with you. |
Information relating to your accommodation whilst studying with us |
Necessary to enter into or perform a contract we have with you. |
Ensuring the health, safety, security and wellbeing of the University, its people and facilities | Necessary to comply with a legal obligation. |
Processing card access data to ensure the health, safety and wellbeing of persons present on campus, preventing crime and disorder and individual or group compliance with reasonable directions given by Campus Security, your department, University regulations and policies/procedures and the law | Necessary to comply with a legal obligation. |
Sharing information internally, where appropriate, to identify individuals suspected of or failing to follow our regulations, policies/procedure regarding access to buildings. Issuing warnings and/or instigating (and progressing) disciplinary action and where appropriate sharing information with regulatory authorities such as the Police | Necessary to comply with a legal obligation. |
Enabling the University to deal with requests (from you or others) under Freedom of Information and other transparency legislation or Data subject rights requests under the General Data Protection Regulation | Necessary to comply with a legal obligation. |
Collecting and managing information about health and safety such as recording details of accidents and where required reporting that information to the Health and Safety Executive | Necessary to comply with a legal obligation. |
If you are an overseas student then we are obliged to collect and report information about your visa and right to student here | Necessary to comply with a legal obligation. |
DBS check - (for courses subject to a Courses mandatory check) | Necessary to comply with a legal obligation. |
Seeking your views to help us develop University facilities | Legitimate interests. We need to process your personal data for our legitimate interest of allowing us to manage and carry out our operations as an education provider. |
Administration of Alumni relations | Legitimate interests. We need to process your personal data for our legitimate interest of allowing us to manage and carry out our operations as an education provider. |
Monitoring your use of our information and communication systems to ensure compliance with the University’s IT policies | Legitimate interests. We need to process your personal data for our legitimate interest of maintaining security of our systems and services and improving the services we offer. |
To provide our IT services and operate our IT network, we collect your IP address (see also our Visitors to the website Privacy Notice) | Legitimate interests. We need to process your personal data for our legitimate interest of maintaining security of our systems and services and improving the services we offer. |
Provision of your staff profile (PGR students) | Legitimate interests. We need to process your personal data for the legitimate interest of sharing information about our work with the wider world. |
Students name and phone number will be shared with data processors who provide specialist training on issues we think are important for all students to be aware of, e.g. consent training | Legitimate interests. We need to process your personal data for the legitimate interest of sharing information about our work with the wider world. |
DBS check - (for courses not subject to a Courses mandatory check but where the University Student Membership and Disclosure and Barring Service Check Policy deems one is necessary) |
Necessary for performing a task in the public interest. |
Your personal data may be processed by the University of Essex and transferred to the emergency services and, if necessary, your next of kin or emergency contact, where this is required to protect your vital interests or those of another person. | Necessary in order to protect the vital interests of the data subject or of another person |
We collect data directly from you, or through an agent or UCAS, when you apply to study with us, and at the point of offering you a contract (Registration).
We continue to collect data about you, such as attendance or exam marks, while you study with us.
For international students we may collect data about you from your sponsor.
For UEIC pathway students, UEIC share an appropriate sub-set of your data with us when you register at the College (see UEIC Privacy Notice) so that we can provide relevant University services to you. We will also collect additional relevant data from you prior to progression to the University (e.g. pre-CAS questionnaire) in order to facilitate your progression to the University.
Internally, access to information about students is restricted to those who need it in order to carry out their roles. This will include your personal tutor and other staff who teach you, as well as the professional services staff in your department who support activity such as exams, attendance monitoring and coursework submission.
There are other central professional services staff who will need access to some information about you, including the timetabling office, the exams office, the library and the central progress team.
Information held by the Student Conduct Manager (relating to any breach, or alleged breach of our code of student conduct), and by our student support and wellbeing teams (relating to your health and wellbeing) will not normally be shared outside those teams other than in line with any consent you have given or as otherwise set out in the relevant confidentiality policies.
In line with Universities UK guidance, information relating to the outcome of the complaint and associated actions may be shared with another party to the complaint. The extent of this sharing will be decided upon on a case-by-case basis, and, where any information is shared, with reference to an appropriate and agreed lawful basis.
We share data about your identity and course with the Students’ Union, so that they know you are a student and eligible for membership. We manage a separate Data Sharing Agreement and data sharing log with the Students’ Union.
If you are studying on a course that includes a practical professional placement then, under the terms of our Fitness to Practise procedure we may share your information with the relevant professional body.
We may also share your data externally in these ways:
We have retention schedules that set out how long we keep information of all types, including personal data of students.
We do not generally transfer your data outside of the UK. Data are retained primarily within our own student record and student file systems, but may be held elsewhere on our network, including within the email system, and on paper within our faculties and departments.
If we have to transfer any of your personal data outside the EEA we ensure the receiving country or organisation is deemed to have adequate data protection provision. Where a country or organisation does not have adequate protections we will put safeguards in place. Details of these safeguards can be provided to you upon request.
This privacy notice was published on Thursday 3 February 2022. We may change this privacy notice from time to time and will communicate these changes directly to you where appropriate.
If you have any questions about this privacy notice or if you would like to access any of your rights, please contact dataprotectionofficer@essex.ac.uk
Last revised Thursday 3 February 2022.