Prospective student privacy notice

Data relating to prospective students is handled by the University of Surrey, usually within the Marketing, Recruitment and Admissions teams or the International Student Recruitment team if you apply from overseas.

We are registered as a data controller with the Information Commissioner’s Office (our notification number is Z6346945) and we are committed to ensuring that the personal data we process is handled in accordance with data protection legislation. 

We have a named Data Protection Officer, Suzie Mereweather, who can be contacted via

What information do we collect from you?

The University collects, holds and uses personal data about prospective students, parents/guardians of prospective students, recruitment agents and others assisting prospective students.  In particular we hold and process your:

  • First name, last name
  • Date of birth
  • Email address
  • Postal address
  • Phone number
  • Name and address of the education institution(s) you attend(ed)
  • Gender
  • Nationality
  • IP address of the device you use to access the University of Surrey webpage

In addition, once you apply to the University we hold and use your:

  • University URN and username

We may process data called “special category data” as we mark your record to indicate whether you have disclosed to us any of the following:

  • Disability/accessibility requirements for open day booking
  • Any data that indicates that you may fall into one of our widening participation categories. You can find more information about this from the In2Surrey scheme.

We receive this data directly from you from a variety of different sources, depending on how and where you have met with us. This will be either:

  • From online requests for prospectus or the downloadable brochure
  • From event bookings; Vet School Open Day bookings may use Eventbrite to manage the event but you will be prompted about this at the time of booking
  • From registration of interest forms
  • Via the data collection app we use at recruitment fairs. The app is currently provided by Akkroo but will change during 2018 to PowerApps.
  • Via scanners we use at certain events (currently UCAS and UK University Search); the event organisers collect the data in these cases, but you will be prompted about this when you register at the event
  • Via email or phone enquiries; if you email or phone us with an enquiry we will record the information you give within our database. This may include special category data if you disclose this to us but you will be asked for your consent for us to store this information in our next email to you, or as part of the phone conversation
  • Via overseas agents or third parties who you enter a contract with to support you through the application process if you are applying from overseas
  • Your IP address is captured when you visit the University website. A tracking code is used to create records based on your IP. The tracking code is created the moment you view the webpage. We capture consent from you to do this when you visit the University webpage.

Why do we collect this information?

The University collects only the data we need and we keep the data up to date and only for as long as it is needed. 

We collect your personal data in order to:

  • Provide you with information that you have requested about studying at Surrey.
  • Contact you via email with additional information about studying at Surrey and about the local area.
  • Manage event bookings.

We take our obligations for data handling very seriously and it is therefore important for you to know that we process your personal data on the following legal bases:

  • Data is processed in our legitimate interests where we communicate with you to fulfil a request for information or event booking and to follow up with you after the event for feedback.
  • These purposes will never override your personal interests, fundamental rights and freedoms which require protection of your personal data
  • We process your data to carry out a task which is part of our obligation as a public authority where we communicate with you once you have applied to Surrey about your application
  • We process your data in order to determine whether to make an offer to study at Surrey, and if so decide on the terms of that offer to help you decide whether to enter into a contract with us
  • We process your data in order to comply with a legal obligation (such as equal opportunities monitoring) or regulatory obligation (when we report to governmental bodies)
  • We process your data only with your consent for other emails and similar communications where we tell you things we think you would like to know about Surrey (marketing and targeted communications).  We will also ask for your consent whenever you tell us about any special category data.
  • We obtain this consent at the time you provided us with the data.

What do we do with your information?

The University processes personal data and special category data in accordance with data protection legislation and its own Data Protection Policy. 

Data collected before you make an application to Surrey is handled by our Marketing, Recruitment and Admissions department who hold your information in an externally hosted database.  This database is currently managed by Hobsons. From 2019, data will be held in an externally hosted database managed by Crimson using Microsoft Dynamic. Both databases have been assessed to ensure they meet University requirements for data protection and security. View Hobson’s privacy notice.

We also use the information you provide to compile statistics and conduct research in relation to enquirers, applicants and students for the purpose of planning, reviewing, managing and developing the University’s business, (but not to make any decisions about you).

How long do we keep your information?

We keep your personal data in accordance with the University’s retention schedules. This means that your data is kept for a maximum of five years after your intended year of entry.

Who do we share your information with?

Your personal data will only be shared with those third parties with whom the University works in order to provide you with relevant, personalised communications. These are organisations who provide the following services:

  • Service providers who send out emails, SMS, direct mail or other communications on behalf of the University (currently Meercat)
  • Service providers who assist in the process of distributing open day programmes (currently Something Big and Impress Print)
  • Survey providers who support the way we obtain feedback from open days (currently SurveyMonkey and SurveyGizmo
  • We use live chat software on our website. This is provided by Click4Assistance who are a UK based software company. Find information on how they will process and store your data.

No information will be passed to third party organisations for them to contact you directly themselves.

Do we transfer information overseas?

Data will be transferred from overseas only where you have given consent for an overseas agent or overseas university staff to enquire about study at Surrey. The University works with overseas agents as data processors to assist you with managing the application process if you are an overseas applicant.

Data will only be transferred overseas to university staff to follow up on enquiries or applications from international students or applicants in that region. Information provided to overseas university staff and overseas agents acting on our behalf is subject to the same protection, processes and rights as data held in the UK. All transfers to overseas agents is bound by a data processor contract which sets out how they will handle your data in accordance with UK data protection legislation.

What rights do you have in relation to the way we process your data?

As an individual whose data we process (a data subject), you have certain rights in relation to the processing. Find detailed information about your rights as a data subject.

You have the right to:

  • Withdraw your consent for us to process your personal data
  • Ask us to confirm that your personal data is being processed and to access (i.e. have a copy) of that data as well as to be provided with supplemental information about the processing.
  • Request that we rectify any inaccuracies where the data we hold on you is inaccurate or incomplete
  • Have your data erased by us, although in certain circumstances we may not be able to do this. The circumstances where this applies can be found in the guide to data subject rights information.
  • Restrict the processing of your personal data in certain ways
  • Obtain your personal data for reuse
  • Object to certain processing of your personal data.

You have the right to object to the way we process your data. To exercise this right, please email the Information Compliance Unit

You also have the right to complain to the Information Commissioner’s Office (an independent body set up to advise on information rights for the UK) about the way in which we process your personal data.