Student applicant privacy notice
Data relating to applicants is handled by the University of Surrey, usually within the Student Marketing, Student Recruitment, International Student Recruitment and Admissions teams.
The University is registered as a data controller with the Information Commissioner’s Office (our notification number is Z6346945) and we are committed to ensuring that the personal data we process is handled in accordance with data protection legislation.
We have a named Data Protection Officer, Suzie Mereweather, who can be contacted via firstname.lastname@example.org.
What information do we collect?
We will use the details you provide during the application process (made via UCAS or directly to us), together with;
- Any supporting documents requested as part of the admissions process
- Any additional details provided by any referee
- Qualification information passed via UCAS or direct from an awarding body
- Information received via email or phone enquiries; if you email or phone us with an enquiry we may record information you give on our records systems. This may include special category data if you disclose this to us, but you will be asked for your consent for us to store this information in our next email to you, or as part of the phone conversation.
We may also hold information supplied by an agent you commission to work for you, from sponsors, or third parties such as professional bodies, or partners (such as StudyGroup). If you provide information to third parties to pass on to Surrey, you may wish to consult the privacy notices of those organisations or agents.
In particular, we hold and process your:
- Date of birth
- Email and postal address
- Phone number
- Name and address of the education institution(s) you have attended
- University number and username
- Care leaver status (UCAS only)
- Participation of Local Areas group (POLAR) (UCAS only).
In addition, we hold ‘special category data’ indicating:
- Disability, health condition, or accessibility requirements
- Details relating to criminal convictions as required in the University’s Criminal Convictions Policy.
Why do we collect this information?
We will process the personal information provided on your application in our legitimate interest for the purposes of identifying you, processing your application, verifying the information provided, deciding whether to offer you a place for the course you have applied for, communicating that outcome, and providing you with information relating to your course. These communications may include:
- Updates regarding the status of your application and things you need to do.
- Invitations to events such as Applicant Days and a request for feedback post-event.
- Invitations to webinars, offer-holder forums and offer-holder events.
- Information preparing you for university study and life at Surrey.
- Information about benefits available to you, such as scholarships.
- Information about supplementary courses, such as Pre-sessional English to help you meet the condition of your offer.
- Information about an alternative course if we are unable to accept you for your original choice.
We may also use the information provided for the following purposes:
- To meet our legal responsibilities (e.g. under equalities, immigration, and public safety legislation).
- To help us to make reasonable adjustments for any disability.
- To prevent or detect fraud.
- For equal opportunities monitoring in the substantial public interest.
- for safeguarding of vulnerable individuals in the substantial public interest.
Where we process in our legitimate interest, this will never override your personal interests, fundamental rights and freedoms which require protection of your personal data.
How will we communicate with you?
Most of our communication will be via email but we will also use SMS, telephone and postal contact from time to time. We will use the most appropriate contact method for the information we need to send you, based on what you supply to us as part of, or after, your application.
We don’t want to overwhelm you with information but want to ensure you have enough to make an informed decision and feel part of our community. You can unsubscribe from non-essential communications altogether but you may miss something helpful and informative if you do so.
If an agent has applied on your behalf, we will share information regarding your application status and documents with them. We will use the contact details supplied on application so please ensure we have your personal contact details if you wish to receive communications.
What we do with your information
The University processes personal data and special category data in accordance with data protection legislation and its own Data Protection Policy. Where you provide information relating to criminal convictions, it is handled in the ways described in the University’s Criminal Convictions Policy.
Once you have applied to Surrey we store your data within our student records system (SITS). A subset of this information will be transferred to other systems to support services you would expect from the University, e.g. Kinetics for accommodation and the University’s IT Registration system for your Surrey Self-Service account login.
Where you declare a disability or health condition as part of your application, this will be shared with our Disability and Neurodiversity Service who will contact you to make reasonable adjustments. For further information, see the Disability and Neurodiversity Service privacy notice.
Where you fit certain criteria, your data will be shared with our Widening Participation and Outreach (WP&O) team in the substantial public interest.
We also use the information you provide to compile statistics and conduct research in relation to enquirers, applicants and students for the purpose of planning, reviewing, managing and developing the University’s business (but not to make any decisions about you).
If you are accepted, we will use your personal information for the purposes described in our student privacy notice.
Who do we share your information with?
Once you make an application to study at Surrey we share your data with the following third parties:
- Your referees
- If you are using an agent, we may need further information from them and may need to refer to your application
- We may share personal data with our partner StudyGroup in order to provide you with pathway programme options for meeting entry requirements
- Your funders and/or potential funders
- Where relevant, UK Visas and Immigration to act as your sponsor for visa purposes
- If a course has certain requirements, it may be necessary to consult with external partners. This includes Disclosure and Barring Service checks and Occupational Health checks. In these instances, specific information will be required and you will be contacted to provide this. Specific agreements will be in place to protect the use of your personal information.
- We may also need to deal with external providers during the application process. These could include UKCISA, UCAS, UK NARIC, IELTS, TOEFL, and Pearson
- Third parties who are contracted to provide services for the University, for example, Meercat/Impress.
How long do we keep your information?
We keep your personal data in accordance with the University’s retention schedules:
- Incomplete applications:
- Self-service account: end of application cycle + 90 days
- Application record: end of application cycle + 2 years.
- Unsuccessful applications:
- Self-service account: end of application cycle + 90 days
- Application record: end of application cycle + 4 years.
- Successful applications: see our student privacy notice.
Do we transfer information overseas?
Data will be transferred from overseas only where international applicants have given consent for an overseas agent or overseas University staff to enquire about study at Surrey or to assist you with making an application. The University works with overseas agents as data processors to assist you with managing the application process if you are an overseas applicant.
Data will only be transferred overseas to university staff to follow up on enquiries or applications from international students or applicants in that region. Information provided to overseas university staff and overseas agents acting on our behalf is subject to the same protection, processes and rights as data held in the UK. All transfers to overseas agents is bound by a data processor contract which sets out how they will handle your data in accordance with UK data protection legislation.
What rights do you have in relation to the way we process your data?
As an individual whose data we process (a data subject), you have certain rights in relation to the processing. Find detailed information about your rights as a data subject.
You have the right to:
- Withdraw your consent for us to process your personal data
- Ask us to confirm that your personal data is being processed and to access (i.e. have a copy) of that data as well as to be provided with supplemental information about the processing
- Request that we rectify any inaccuracies where the data we hold on you is inaccurate or incomplete
- Have your data erased by us, although in certain circumstances we may not be able to do this. The circumstances where this applies can be found in the data subject rights information on the University’s web page
- Restrict the processing of your personal data in certain ways
- Obtain your personal data for reuse
- Object to certain processing of your personal data.
You have the right to object to the way we process your data. To exercise this right, please email the Information Compliance Unit.
You also have the right to complain to the Information Commissioner’s Office (an independent body set up to advise on information rights for the UK) about the way in which we process your personal data.