Pre-enrolled student privacy notice

Marketing, Recruitment teams and Admissions holds and processes personal data about prospective students and applicants. The University collects, holds and uses personal data about prospective students, parents/guardians of prospective students, recruitment agents and others assisting prospective students.

What we process

In particular we hold and process your:

• First name and last name
• Date of birth
• Email address
• Postal address
• Phone number
• Name and address of the education institution(s) you attend(ed)
• Gender
• Nationality
• Residential status
• IP address of the device you use to access the University of Surrey webpage.
• Disability/accessibility requirements for open day booking
• Any data that indicates that you may fall into one of our Widening Participation categories. You can find more information about this from the In2Surrey scheme.

Sources we receive data from

We receive this data directly from you from a variety of different sources, depending on how and where you have met with us. This will be either from:

• We collect data via our online forms, which are on the Sitefinity or Gecko platforms. The data submitted through these forms is sent directly to Dynamics, where it is securely stored and managed.
• Online requests for prospectus or the downloadable brochure, for the prospectus this will be via We are SMILE Ltd
• We use Gecko Engage or Sitefinity to manage event bookings
• Participate in a University of Surrey competition and prize draw
• Registration details for events via Eventbrite where you have signed up to attend an event
• Registration of interest forms (including from third party sources – currently: Unibuddy, Springpod and Keystone Education Group)
• The data collection app we use at recruitment fairs. The app is currently provided by Gecko Engage
• Scanners we use at certain events (currently UCAS and UK University Search, QS and FAUScan) The event organisers collect the data in these cases, but you will be prompted about this when you register at the event Email or phone enquiries or the Admissions enquiry web form; if you email or phone us with an enquiry or submit an enquiry though our web form we will record the information you give within our database. This may include special category data if you disclose this to us but you will be asked for your consent for us to store this information in our next email to you, or as part of the phone conversation
• Overseas agents or third parties who you enter a contract with to support you through the application process if you are applying from overseas
• When you visit the University of Surrey website, small data files known as cookies are placed on your device. These cookies are used for several purposes: some are strictly essential to make the site’s features work, while others, used only with your consent, collect anonymous usage data to help us improve site performance, understand how people use the site, and support marketing. We do not use cookies to identify you personally. You have control over your cookie preferences and can withdraw consent for non-essential cookies at any time.

Should we receive an application from you, what will we collect?

We will use the details you provide during the application process (made directly to us or via UCAS), together with:

• Any supporting documents requested as part of the admissions process.
• Any additional details provided by any referee.
• Qualification information passed via UCAS or direct from an awarding body.
• Information received via email or phone enquiries; if you email or phone us with an enquiry we may record information you give on our records systems. This may include special category data if you disclose this to us, but you will be asked for your consent for us to store this information in our next email to you, or as part of the phone conversation.

We may also hold information supplied by an agent you commission to work for you, from sponsors, or third parties such as professional bodies, or partners (such as StudyGroup). If you provide information to third parties to pass on to Surrey, you may wish to consult the privacy notices of those organisations or agents.

For students aged 16 or 17 will be requested to provide contact details for a guardian based in the UK. These details will be stored and only accessed by limited staff in the Centre for Wellbeing and Campus Safety should an emergency.

Information to help identify you at the application stage

In particular, we hold and process your:

• Name
• Date of birth
• Email and postal address
• Phone number
• Name and address of the education institution(s) you have attended
• Gender
• Nationality
• Residency status
• University number and username
• Care leaver status
• Participation of Local Areas group (POLAR) (UCAS only)
• Family or next of kin details when you register for any of our events such as our applicant selection/offer holder open days.

Special category data

In addition, we hold ‘special category data’ indicating:

• Disability, health condition, or accessibility requirements
• Ethnicity
• Details relating to criminal convictions as required in the University’s Procedure for Expulsions and Criminal Convictions.

The University collects only the data we need and we keep the data up to date and only for as long as it is needed.

We collect your personal data in order to:

• Provide you with information that you have requested about studying at Surrey
• Contact you via email with additional information about studying at Surrey and about the local area
• Manage event bookings.

Legal bases for processing your data

We take our obligations for data handling very seriously and it is therefore important for you to know that we process your personal data on the following legal bases:

• Data is processed in our legitimate interests where we communicate with you to fulfil a request for information e.g. to send a copy of our prospectus or event booking such as an open day and to follow up with you after the event for feedback.
• These purposes will never override your personal interests, fundamental rights and freedoms which require protection of your personal data.
• We process your data to carry out a task i.e. the provision of educational and research opportunities which is part of our obligation as a public authority where we communicate with you once you have applied to Surrey about your application.
• We process your data in order to comply with a legal obligation (such as equal opportunities monitoring) or regulatory obligation (when we report to governmental bodies but you will not be able to be identified as an individual in our reporting.
• We process your data only with your consent for other emails and similar communications where we tell you things we think you would like to know about Surrey (marketing and targeted communications). We process your data only with your consent for other emails and similar communications where we tell you things we think you would like to know about Surrey (marketing and targeted communications). For example, where you have completed Unibuddy’s data capture form expressing your interest in learning more about Surrey. For more information on how Unibuddy manage your personal data, please see their privacy policy.
• We will also ask for your consent whenever you tell us about any special category data. We obtain this consent at the time you provided us with the data.

We will process the personal information provided on your application in our legitimate interest for the purposes of identifying you, processing your application, verifying the information provided, deciding whether to offer you a place for the course you have applied for, communicating that outcome, and providing you with information relating to your course. These communications may include:

• Updates regarding the status of your application and things you need to do.
• Invitations to events such as offer holder days and a request for feedback post-events.
• Invitations to webinars, offer-holder forums and offer-holder events.
• Information preparing you for university study and life at Surrey.
• Information about benefits available to you, such as scholarships.
• Information about supplementary courses, such as pre-sessional English to help you meet the condition of your offer.
• Information about an alternative course if we are unable to accept you for your original choice
• To enable us to offer you a peer support appointment, if you wish to have one.

We may also use the information provided for the following purposes:

• To meet our legal responsibilities (e.g. under equalities, immigration, and public safety legislation).
• To help us to make reasonable adjustments for any disability.
• To prevent or detect fraud.
• For equal opportunities monitoring in the substantial public interest.
• For safeguarding of vulnerable individuals in the substantial public interest.
• To enable you, members of your family or next of kin to register and attend events such as our applicant open days.

Where we process in our legitimate interest, this will never override your personal interests, fundamental rights and freedoms which require protection of your personal data.

The University processes personal data and special category data in accordance with data protection legislation and Our Data Policy Statement (PDF).

Before you make an application

Data collected before you make an application to Surrey is handled by our Market Insight and Data team, Marketing and Communications Department and the Recruitment and Admissions Department who hold your information in an externally hosted database. This database is currently Microsoft Dynamics 365, view their privacy notice.

We also use the information you provide to compile statistics and conduct research in relation to enquirers, applicants and students for the purpose of planning, reviewing, managing and developing the University’s business, (but not to make any decisions about you).

The University processes personal data and special category data in accordance with data protection legislation and its own Our Data Policy Statement (PDF). Where you provide information relating to criminal convictions, it is handled in the ways described in the University’s Procedure for Expulsions and Criminal Convictions.

After your application

Once you have applied to Surrey we store your data within our student records systems (SITS and Anthology Apply). A subset of this information will be transferred to other systems to support services you would expect from the University, e.g. Kinetics for accommodation and the University’s IT Registration system for your Surrey Self-Service account login.

We collect your information to contact you where you have requested a peer support appointment.

Disability or health conditions

Where you declare a disability or health condition as part of your application, this will be shared with our Disability and Neurodiversity Service who will contact you to make reasonable adjustments. For further information, see their privacy notice. Where you fit certain criteria, your data will be shared with our Widening Participation and Outreach team in the substantial public interest.

Compiling statistics

We also use the information you provide to compile statistics and conduct research in relation to enquirers, applicants and students for the purpose of planning, reviewing, managing and developing the University’s business (but not to make any decisions about you). If you are accepted, we will use your personal information for the purposes described in our student privacy notice.

Attending Open Days and Events

We process your data and that of your family members or next of kin to enable you to register and attend our events and open days and to enable us to host and administer these events.

How will we communicate with you?

Most of our communication will be via email but we will also use SMS, telephone and postal contact from time to time. We will use the most appropriate contact method for the information we need to send you, based on what you supply to us as part of, or after, your application.

We don’t want to overwhelm you with information but want to ensure you have enough to make an informed decision and feel part of our community. You can unsubscribe from non-essential communications altogether but you may miss something helpful and informative if you do so.

If an agent has applied on your behalf, we will share information regarding your application status and documents with them. We will use the contact details supplied on application so please ensure we have your personal contact details if you wish to receive communications.

We keep your personal data in accordance with the University’s retention schedules. This means that your data is kept for a maximum of 6 years after your intended year of entry.

We keep your personal data in accordance with the University’s retention schedules:

Enquiry/ event data (no application)

• 5 years

Incomplete applications

• Self-service account: End of application cycle plus 90 days
• Application record: End of application cycle plus 1 years.

Unsuccessful applications

• Self-service account: End of application cycle plus 90 days
• Application record: End of application cycle plus 1 years. See our student privacy notice.

Your personal data will only be shared with those third parties with whom the University works with in order to provide you with relevant, personalised communications.

Third-party service providers

These are organisations who provide the following services:

• Service providers who send out emails, SMS e.g. Meercat and Telesign or other communications on behalf of the University.
• Survey providers who support the way we obtain feedback from open days (currently SurveyMonkey and Alchemer).
• We use live chat software on our website. This is provided by Click4Assistance who are a UK-based software company, view their privacy policy
• Service providers who assist in the process of distributing printed materials (currently Impress Print)
• Virtual and physical scanner recruitment fair data from third party event hosts. We currently use UCAS, QS, FindAUniversity's FAUScan and the Council of International Schools.

No information will be passed to third party organisations for them to contact you directly themselves.

Once you make an application to study at Surrey we share your data with the following third parties:

• Your referees.
• If you are using an agent, we may need further information from them and may need to refer to your application
• We may share personal data with our partner StudyGroup in order to provide you with pathway programme options for meeting entry requirements
• Your funders and/or potential funders
• Where relevant, UK Visas and Immigration to act as your sponsor for visa purposes
• If a course has certain requirements, it may be necessary to consult with external partners. This includes Disclosure and Barring Service checks and Occupational Health checks. In these instances, specific information will be required and you will be contacted to provide this. Specific agreements will be in place to protect the use of your personal information
• We may also need to deal with external providers during the application process. These could include UKCISA, UCAS, Ecctis, IELTS, TOEFL, ESFA, Pearson and other qualification verification systems
• Third parties who are contracted to provide services for the University, for example, Meercat/Impress
• Data analysis companies, such as DataHE, who provide aggregated analysis and reporting on applicant data, including age, location and qualifications, to assist Surrey’s student marketing and recruitment efforts
• We use live chat software on our website. This is provided by Click4Assistance who are a UK based software company, view their privacy policy. We also use LiveAssist which is part of our Microsoft Dynamics CRM.

Data will be transferred from overseas only where international applicants have given consent for an overseas agent or overseas University staff to enquire about study at Surrey or to assist you with making an application. The University works with overseas agents as data processors to assist you with managing the application process if you are an overseas applicant.

Data will only be transferred overseas to university staff to follow up on enquiries or applications from international students or applicants in that region. Information provided to overseas university staff and overseas agents acting on our behalf is subject to the same protection, processes and rights as data held in the UK. All transfers to overseas agents is bound by a data processor contract which sets out how they will handle your data in accordance with UK data protection legislation.

As an individual whose data we process (a data subject), you have certain rights in relation to the processing. Find detailed information about your rights as a data subject.

You have the right to:

• Withdraw your consent for us to process your personal data where we have relied on you giving us your consent to processing
• Ask us to confirm that your personal data is being processed and to access (i.e. have a copy) of that data as well as to be provided with supplemental information about the processing.
• Request that we rectify any inaccuracies where the data we hold on you is inaccurate or incomplete
• Have your data erased by us, although in certain circumstances we may not be able to do this. The circumstances where this applies can be found in the guide to data subject rights information.
• Restrict the processing of your personal data in certain ways
• Obtain your personal data for reuse
• Object to certain processing of your personal data. If you would like to exercise any of your rights please visit our make a privacy request section.

Make a complaint

If you have any concerns about the way that we have handled your personal data please email the Data Protection team as we would like to have the opportunity to resolve your concerns.

If you’re still unhappy, you have the right to complain to the Information Commissioner’s Office (an independent body set up to advise on information rights for the UK) about the way in which we process your personal data.