Prospective student and applicants privacy notice
Data relating to prospective students and applicants is handled by the University of Surrey, usually within the Marketing, Recruitment and Admissions teams or the International Student Recruitment team if you apply from overseas.
We are registered as a data controller with the Information Commissioner’s Office (our notification number is Z6346945) and we are committed to ensuring that the personal data we process is handled in accordance with data protection legislation.
We have a named Data Protection Officer, James Newby, who can be contacted via firstname.lastname@example.org.
The University collects, holds and uses personal data about prospective students and applicants, parents/guardians of prospective students, recruitment agents and others assisting prospective students. In particular we hold and process your:
- First name, last name
- Date of birth
- Email address
- Postal address
- Phone number
- Name and address of the education institution(s) you attend(ed)
- IP address of the device you use to access the University of Surrey web page.
In addition, once you apply to the University we hold and use your:
- University URN and username.
We may process data called “special category data” as we mark your record to indicate whether you have disclosed to us any of the following:
- Disability/accessibility requirements for open day booking
- Any data that indicates that you may fall into one of our Widening Participation categories. You can find more information about this on our Widening Participation and Outreach web page https://surreynet.surrey.ac.uk/staff-services/widening-participation-and-outreach.
In addition, once you apply to the University we will hold data indicating:
- Whether you are a care leaver.
We receive this data directly from you from a variety of different sources, depending on how and where you have met with us. This will be either:
- From online requests for prospectus or the downloadable brochure
- From event bookings; Vet School open day bookings may use Eventbrite to manage the event but you will be prompted about this at the time of booking
- From registration of interest forms
- Via the data collection app we use at recruitment fairs. The app is currently provided by Akkroo but will change during 2018 to PowerApps
- Via the UCAS scanners we use at UCAS events; UCAS collect the data in these cases, but you will be prompted about this when you register at the event
- Via email or phone enquiries; If you email or phone us with an enquiry we will record the information you give within our database. This may include special category data if you disclose this to us but you will be asked for your consent for us to store this information in our next email to you, or as part of the phone conversation
- Via overseas agents or third parties who you enter a contract with to support you through the application process if you are applying from overseas
- Your IP address is captured when you visit the University website. A tracking code is used to create records based on your IP. The tracking code is created the moment you view the web page. We capture consent from you to do this when you visit the University web page.
The University collects only the data we need and we keep the data up to date and only for as long as it is needed.
We collect your personal data in order:
- To provide you with information that you have requested about studying at Surrey
- To contact you via email with additional information about studying at Surrey and about the local area
- To manage event bookings.
Once you apply to the University, we use your personal data for these purposes:
- To inform the decision about your suitability for your chosen programme of study
- To prevent or detect fraud
- For equal opportunities monitoring
- To meet our legal responsibilities, for example under equalities, immigration and public safety legislation
- To help us to make reasonable adjustments for any disability, as requested by you
- To allow us to consider any future accommodation requirements
- To provide statutory returns required by applicable legislation
- For research and statistical purposes to provide insight and support improvements to the application process. Data is matched from communications with you before you applied but is anonymised for all further analysis.
We take our obligations for data handling very seriously and it is therefore important for you to know that we process your personal data on the following legal bases:
Data is processed in our legitimate interests where we:
- Communicate with you to fulfil a request for information or event booking and to follow up with you after the event for feedback
- Match data from your application to data we hold about you from before you applied to Surrey to for anonymous analysis and insight purposes.
These purposes will never override your personal interests, fundamental rights and freedoms which require protection of your personal data
We process your data to carry out a task which is part of our obligation as a public authority where we:
- Communicate with you once you have applied to Surrey about your application
- Match data from your application to data we hold about you from before you applied to Surrey to help give you information you need during your application.
We process your data in order to determine whether to make an offer to study at Surrey, and if so decide on the terms of that offer to help you decide whether to enter into a contract with us
We process your data in order to comply with a legal obligation (such as equal opportunities monitoring) or regulatory obligation (when we report to governmental bodies)
We process your data only with your consent for other emails and similar communications where we tell you things we think you would like to know about Surrey (marketing and targeted communications). We will also ask for your consent whenever you tell us about any special category data.
We obtain this consent at the time you provided us with the data.
The University processes personal data and special category data in accordance with data protection legislation and its own Data Protection Policy.
Data collected before you make an application to Surrey is handled by our Marketing, Recruitment and Admissions department who hold your information in an externally hosted database. This database is currently managed by Hobsons. From 2019, data will be held in an externally hosted database managed by Crimson using Microsoft Dynamic. Both databases have been assessed to ensure they meet University requirements for data protection and security. You can find Hobson’s privacy notice here: https://www.hobsons.com/privacy-policy
Once you have applied to Surrey we store your data within our student records database. This data is matched with data we gathered before you applied to help support you through your application. Data is also used in anonymous form for analysis and insight about the application process.
We also use the information you provide to compile statistics and conduct research in relation to enquirers, applicants and students for the purpose of planning, reviewing, managing and developing the University’s business, (but not to make any decisions about you).
We keep your personal data in accordance with the University’s retention schedules. This means that your data is kept for a maximum of two years after your intended year of entry.
When you apply to Surrey the information provided in your application will form the basis of your student record and be kept alongside that data.
Your personal data will only be shared with those third parties with whom the University works in order to provide you with relevant, personalised communications. These are organisations who provide the following services:
- Service providers who send out emails, SMS, direct mail or other communications on behalf of the University (currently Meercat)
- Survey providers who support the way we obtain feedback from open days (currently SurveyMonkey and SurveyGizmo.
No information will be passed to third party organisations for them to contact you directly themselves.
Once you make an application to study at Surrey we share your data with the following third parties:
- Your referees
- Your examination boards or awarding bodies
- Your student support assessment body
- Your funders and/or potential funders (for example, the Student Loans Company)
- In the case of international applicants, the British Council or appropriate agencies
- Where relevant, UK Visas and Immigration in order to act as your sponsor for visa purposes
- Where relevant, governmental bodies including local authorities, the Home Office, and the Department for Work and Pensions and its agencies.
If you have disclosed on your application that you have a disability, our Student Support team will contact you to let you know how you can access the Additional Learning Support service. You will be provided with further details about how your data will be used for this purpose at the relevant time.
Data will be transferred from overseas only where International students or applicants have given consent for an overseas agent or overseas University staff to enquire about study at Surrey or to assist you with making an application. The University works with overseas agents as data processors to assist you with managing the application process if you are an overseas applicant.
Data will only be transferred overseas to University staff to follow up on enquiries or applications from international students or applicants in that region. Information provided to overseas University staff and overseas agents acting on our behalf is subject to the same protection, processes and rights as data held in the UK. All transfers to overseas agents is bound by a data processor contract which sets out how they will handle your data in accordance with UK data protection legislation.
As an individual whose data we process (a data subject), you have certain rights in relation to the processing. You can find detailed information about your rights as a data subject on the University’s web page.
You have the right to:
- Withdraw your consent for us to process your personal data
- To ask us to confirm that your personal data is being processed and to access (i.e. have a copy) of that data as well as to be provided with supplemental information about the processing
- Request that we rectify any inaccuracies where the data we hold on you is inaccurate or incomplete
- To have your data erased by us, although in certain circumstances we may not be able to do this. The circumstances where this applies can be found in the data subject rights information on the University’s web page
- To restrict the processing of your personal data in certain ways
- To obtain your personal data for reuse
- To object to certain processing of your personal data.
You have the right to object to the way we process your data. To exercise this right, please contact email@example.com.
You also have the right to complain to the Information Commissioner’s Office about the way in which we process your personal data.