UCL Student Privacy

Version 3.4, published November 2021

About this privacy notice

University College London ("UCL", "we", "our", "us") are committed to protecting and respecting your privacy.

This privacy notice sets out how UCL processes your personal data whilst you are a student at UCL. It should be read in conjunction with:

the Prospective Student (Enquirers and Applicants) Privacy Notice, which sets out in further detail how your personal data is processed during the enquiry and application stage to become a student at UCL; and
the Alumni Privacy Notice, which provides details of how your personal data is processed once you have graduated.

The above UCL privacy notices (and others) can be found on the UCL Legal Services website.

This notice applies to the personal data we collect from you and personal data which is passed to us by third parties. Please read the following carefully to understand how we process your personal data.

In addition to the information in this privacy notice, you may be given further information about the uses of your personal data when you sign up to use specific services and facilities we offer and, in certain situations, you may be asked whether you give your consent to us processing information about you.

Any changes we make to this privacy notice in the future will be posted on the UCL Legal Services website and, where appropriate, notified to you by e-mail.

What is 'personal data'?

‘Personal data’ means any information which identifies you as an individual. It may include your name but it may also be other information such as your date of birth, nationality and gender which when combined identify you. This information may be collected in a variety of ways, including electronically, in paper form, by telephone or in person.

UCL's data protection obligations

Under current data protection laws we are classed as a controller, which means we are legally responsible for the personal data we collect and hold about you. One of our responsibilities as a controller is to tell you about the different ways in which we use your personal data – what information we collect, our legal basis for doing so, why we collect it, where we collect it from and whether and with whom we will share it. We also need to tell you about your rights in relation to your personal data.

Personal data we collect about you

Types of personal data collected

We may collect and process the following information about you upon your enrolment at UCL and subsequently in order to manage your relationship with us as a registered student. Please note that some of the information listed below will only be collected in specific situations and will not therefore be collected in respect of all students.

Fee Status (e.g. home, EU or overseas)
Name
Date of birth (age)
Proof of Identity (e.g. passport)
Contact Info (Address, Phone, Email etc)
Disability/information relating to your health (including data collected as part of our management of the Covid-19 outbreak) – note this is only collected in specific situations e.g. where it is required for UCL to comply with applicable law
Ethnicity
Nationality / Place of Birth/ Domicile
UKVI Confirmation for Acceptance to Study/Visa/Biometric Residence Permits and other immigration information (note that this is only collected in certain circumstances in relation to overseas applicants)
Academic Technology Approval Scheme (note that this is only collected in certain circumstances in relation to overseas applicants)
Date of Entry to the UK (note that this is only collected in certain circumstances in relation to overseas applicants)
Overseas police check (note that this is only collected in certain circumstances in relation to overseas applicants)
English proficiency
Literacy/Numeracy proficiency
Student status (e.g. ‘offer’, ‘accepted’ etc)
Qualification Information (provided by the applicant and external bodies e.g. UCAS)
Information about your career aspirations and work experience
Marks
Awards
Course
Programme
Fees/ Payment Info
Student Funding and Finance information (including sponsor details)
Occupational Health (note that this is only collected in relation to students on specific programmes of study)
Next of kin / guardian / family etc data
Reference / Referee data
Statutory checks
Five year address history
Disqualification by association form (note that this is only collected in relation to students on specific programmes of study)
Photograph
Geodemographic Information

Low participation neighbourhood (note that this information is only collected in relation to specific cohorts of students)
Parental Higher Education
Time in Care (where applicable)

Information relating to any complaints that you make
Information relating to any disciplinary action in which you are involved
Data relating to your criminal convictions and offences, where appropriate
Other information relating specifically to your status as a student at UCL

Whilst you are a UCL student, both your image and voice may be recorded during our use of Lecturecast (our system for recording lectures and making them available online) as specified at the UCL Digital Education website and at teaching locations across the UCL campus.

In accordance with our CCTV Policy we may also capture your image on CCTV whilst you are on UCL premises.

Special category personal data

Some of the personal data listed above is classed as being within 'special categories of personal data' under current data protection laws, for example information relating to your ethnicity or any disability. Access to, and the sharing of, this information is controlled very carefully. You will be given more details about our use of any special category personal data when we collect it from you.

Personal data relating to criminal convictions and offences

In certain circumstances, we may process data relating to your criminal convictions and offences. Access to, and the sharing of, this information is also controlled very carefully. Where we process criminal records data, we will inform you separately and provide you with further information.

Information that we receive from third parties

We work closely with third parties (including, for example, funding and sponsorship partners, educational institutions, examination boards, overseas agents, UCAS, and clearing houses, business partners and compliance services e.g. UKVI, Disclosure and Barring Service) and may receive information about you from them (including, in certain cases, special category personal data or criminal convictions data). In particular, we may receive any of the following information from third parties: examination or test results, evidence of sponsorship (e.g. scholarship, bursary, loan), updates on your CAS status, DBS certificate number and other information in connection with your activities as a UCL student.

We have partnered with Key Travel to give UCL students access to an online portal to book flights at discounted academic rates. Kay Travel will share some details of any travel booked with UCL to allow us to analyse engagement with the Key Travel service.

Purposes for which we process your personal data and the legal bases for processing

Overall, we will use your personal data to manage your relationship with us as a student at UCL. The main purposes for which we process your personal data as a student at UCL are set out in the table below.

Data protection laws require us to meet certain conditions before we are allowed to use your personal data in the manner described in this notice, including having a "legal basis" for the processing. Where we process special category personal data or criminal convictions data, we are required to establish an additional legal basis for processing that data.

We take our responsibilities under data protection laws extremely seriously, including meeting these conditions. The main legal bases on which your personal data are processed for a particular purpose are also explained in the table below:

Purpose	Legal Basis
To process and manage your UCL enrolment We will use your personal information to: Enrol you as a student, where your application is successful and you accept our offer; and Communicate with you about the enrolment process. This will include asking all offer holders to disclose relevant criminal convictions (further information on this topic will be provided at the point when this question is asked). In some cases, the information processed will include special category personal data. We will also process criminal convictions data where you are working with children or vulnerable adults, and/or because of fitness to practise requirements in certain regulated professions. For example, certain courses such as Medicine will require a DBS check to be carried out as part of the assessment of eligibility. You will be notified prior to the processing if this is a requirement for enrolment on your course.	For all personal data Performance of a task in the public interest UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information. Performance of contract The processing of your personal data may be necessary in relation to the contract we have entered into with you as a student at UCL. For special category personal data Equality of opportunity or treatment We process special category personal data in order to monitor equality of opportunity/treatment. For criminal convictions data Regulatory requirements relating to unlawful acts and dishonesty We may process your criminal convictions data in order to assist a third party to comply with a regulatory requirement that requires the taking of steps to establish whether another person has: (i) committed an unlawful act, or (ii) been involved in dishonesty, malpractice or other seriously improper conduct do so. Safeguarding of children and of individuals at risk We may process your criminal convictions data in order to safeguard children or individuals at risk. Protecting the public against dishonesty We may process your criminal convictions data in order to protect the public against dishonesty, malpractice or other seriously improper conduct; and unfitness or incompetence. Where we are relying on a legal basis other than those set out above in processing your criminal convictions data, we will inform you of the legal basis before we start processing your criminal convictions data based on that legal ground.
To deliver and administer your education We will use your personal information to: Facilitate your education; Record the details of your previous academic studies (including any placements with external organisations); Determine your examination achievements; and Communicate with you about your education. Special category personal data and criminal convictions data may be processed in certain circumstances, for example if you are on a course such as Medicine or a speech and language therapy programme, where NHS healthcare placements are undertaken. This processing will generally be to ensure that you are fit to practise and to work with persons in healthcare situations. You will be notified prior to the processing if this is a requirement for your course.	For all personal data Performance of a task in the public interest UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information. Performance of contract The processing of your personal data may be necessary in relation to the contract we have entered into with you as a student at UCL. For special category personal data Management of health care systems / services We may process your special category personal data where this is necessary for health and social care purposes with respect to the management of health care systems and services. Establishment, exercise or defence of legal claims It may be necessary to process your special category personal data in relation the establishing, exercising or defending legal claims. Employment and social security and social protection law Where obligations or rights exist in the field of employment or social protection law we may rely on this condition. Equality of opportunity or treatment and/or consent There may be occasions when we need to process your personal data relating to health to facilitate your education, eg administering our extenuating circumstances procedures, or ensure the equality of opportunity/treatment. For criminal convictions data Management of health care systems / services We may process your criminal convictions data where this is necessary for health and social care purposes with respect to the management of health care systems and services.
To manage the student experience at UCL We will use your personal information to: Manage your use of facilities and participation at events (e.g. computing, libraries, accommodation, functions, graduation, careers); Support your training, health, safety and welfare requirements; Operate security, disciplinary, complaint, and quality assurance processes and arrangements; Monitor compliance by you with UCL's policies and your other contractual and legal obligations. Please see UCL's Policy on Monitoring Computer and Network Use for further guidance on the monitoring that we may carry out; Monitor your use of our networks to protect the security and integrity of UCL's IT network and information and electronic communications systems. Please see UCL's Policy on Monitoring Computer and Network Use for further guidance on the monitoring that we may carry out; and Allow your achievements via the UCLU to be accredited, for example by inclusion in the Higher Education Achievement Report. We may process special category personal data, such as data relating to your health and your religious beliefs for this purpose. For example, we may use disability information to help us make reasonable adjustments to meet your health and welfare requirements.	For all personal data Performance of a task in the public interest UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information. Performance of contract The processing of your personal data may be necessary in relation to the contract we have entered into with you as a student at UCL. Vital interests Your personal data may be processed by UCL and transferred to the emergency services where this is required to protect your vital interests. Consent In relation to managing participation at events, where we cannot rely upon public interest or performance of a contract legal bases we will generally seek to obtain your consent to the processing of your personal data. For special category personal data Vital interests Your special category personal data may be processed by UCL and transferred to the emergency services where this is required to protect your vital interests. Consent Where we cannot rely upon protecting your vital interests, we will generally seek to obtain your consent to the processing of your special category personal data, e.g. data relating to your health, in this context. Where we are relying on a legal basis that is not consent or your vital interests in processing your special category personal data, we will inform you of the legal basis before we start processing your special category personal data based on that legal ground.
Internal and statutory reporting and other legal obligations, including compliance with health and safety law and monitoring equality of opportunity or treatment We will use your personal information to: Comply with our legal obligations. For example, we may process your personal data in the context of arranging and/or providing student accommodation, for the purpose of complying with health and safety and other applicable tenancy and housing legislation; Produce statistics and research for internal and statutory reporting purposes; and Monitor our compliance with our responsibilities under equalities legislation. This may include the processing of special category personal data, e.g. information about disabilities or ethnicity.	For all personal data Compliance with a legal obligation Much of our processing of your personal data in this context will be in order to comply with our legal obligations, e.g. health and safety legislation and UK equal opportunities monitoring. Performance of a task in the public interest UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information. For special category personal data Equality of opportunity or treatment We process special category personal data in order to monitor equality of opportunity/treatment. Employment law obligations We may also process certain special category personal data where this is necessary so that we can meet our obligations in the field of employment law.
Fees and funding We will use your personal information to administer the financial aspects of your relationship with us and any funders/sponsors. We will not generally process special category personal data or criminal convictions data in this context.	Performance of a task in the public interest UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information. Performance of contract The processing of your personal data may be necessary in relation to the contract we have entered into with you as a student at UCL.
Alumni Before you graduate, the Office of the Vice Provost (Development) (OVPD) creates an outline record for you from the UCL Student database with name, department, preferred gender, date of birth, "UCL Person ID", Student Number and your UCL email address. This is to enable OVPD to run careers mentoring registration and record touchpoints. Following your graduation, your personal data will be used by the OVPD to keep you in touch with UCL and the Alumni Network. UCL's role in your education does not stop on graduation and UCL views its Alumni programme as an essential tool in providing you with ongoing educational support. Further details about how OVPD may use your information can be viewed in the separate OVPD data protection statement. We will not generally process special category personal data or criminal convictions data in this context.	Performance of a task in the public interest For some of our alumni activities, UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information. Legitimate interests For some of our alumni activities, we rely upon our legitimate interests in communicating with our alumni as part of the extended UCL community. Consent In certain limited circumstances, where we cannot rely upon our legitimate interests or performance of a task in the public interest, we will seek to obtain your consent to the processing of your personal data for our alumni programme. Please see the separate OVPD data protection statement for further information.
Marketing/publicity materials While you are at UCL, we may take photographs or videos at an event or while you are participating in student life which may include images of you. These images will generally be used for UCL's marketing/publicity materials.	Legitimate interests When using your personal data for the purpose of marketing or publicity materials, we will generally rely on our legitimate interests in promoting UCL, including our courses, our activities and our overall aims and objectives.
Research As an established research institution, we may use your personal information for research purposes.	Performance of a task in the public interest UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education or research Please see our Statement of Tasks in the Public Interest for further information. For special category personal data and criminal convictions data Research We may process special category data and criminal convictions data for the purposes of research.

Purpose

Legal Basis

To process and manage your UCL enrolment

We will use your personal information to:

Enrol you as a student, where your application is successful and you accept our offer; and
Communicate with you about the enrolment process.

This will include asking all offer holders to disclose relevant criminal convictions (further information on this topic will be provided at the point when this question is asked).

In some cases, the information processed will include special category personal data.

We will also process criminal convictions data where you are working with children or vulnerable adults, and/or because of fitness to practise requirements in certain regulated professions. For example, certain courses such as Medicine will require a DBS check to be carried out as part of the assessment of eligibility. You will be notified prior to the processing if this is a requirement for enrolment on your course.

For all personal data

Performance of a task in the public interest

UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information.

Performance of contract

The processing of your personal data may be necessary in relation to the contract we have entered into with you as a student at UCL.

For special category personal data

Equality of opportunity or treatment

We process special category personal data in order to monitor equality of opportunity/treatment.

For criminal convictions data

Regulatory requirements relating to unlawful acts and dishonesty

We may process your criminal convictions data in order to assist a third party to comply with a regulatory requirement that requires the taking of steps to establish whether another person has: (i) committed an unlawful act, or (ii) been involved in dishonesty, malpractice or other seriously improper conduct do so.

Safeguarding of children and of individuals at risk

We may process your criminal convictions data in order to safeguard children or individuals at risk.

Protecting the public against dishonesty

We may process your criminal convictions data in order to protect the public against dishonesty, malpractice or other seriously improper conduct; and unfitness or incompetence.

Where we are relying on a legal basis other than those set out above in processing your criminal convictions data, we will inform you of the legal basis before we start processing your criminal convictions data based on that legal ground.

To deliver and administer your education

We will use your personal information to:

Facilitate your education;
Record the details of your previous academic studies (including any placements with external organisations);
Determine your examination achievements; and
Communicate with you about your education.

Special category personal data and criminal convictions data may be processed in certain circumstances, for example if you are on a course such as Medicine or a speech and language therapy programme, where NHS healthcare placements are undertaken. This processing will generally be to ensure that you are fit to practise and to work with persons in healthcare situations. You will be notified prior to the processing if this is a requirement for your course.

For all personal data

Performance of a task in the public interest

Performance of contract

The processing of your personal data may be necessary in relation to the contract we have entered into with you as a student at UCL.

For special category personal data

Management of health care systems / services

We may process your special category personal data where this is necessary for health and social care purposes with respect to the management of health care systems and services.

Establishment, exercise or defence of legal claims

It may be necessary to process your special category personal data in relation the establishing, exercising or defending legal claims.

Employment and social security and social protection law

Where obligations or rights exist in the field of employment or social protection law we may rely on this condition.

Equality of opportunity or treatment and/or consent

There may be occasions when we need to process your personal data relating to health to facilitate your education, eg administering our extenuating circumstances procedures, or ensure the equality of opportunity/treatment.

For criminal convictions data

Management of health care systems / services

We may process your criminal convictions data where this is necessary for health and social care purposes with respect to the management of health care systems and services.

To manage the student experience at UCL

We will use your personal information to:

Manage your use of facilities and participation at events (e.g. computing, libraries, accommodation, functions, graduation, careers);
Support your training, health, safety and welfare requirements;
Operate security, disciplinary, complaint, and quality assurance processes and arrangements;
Monitor compliance by you with UCL's policies and your other contractual and legal obligations. Please see UCL's Policy on Monitoring Computer and Network Use for further guidance on the monitoring that we may carry out;
Monitor your use of our networks to protect the security and integrity of UCL's IT network and information and electronic communications systems. Please see UCL's Policy on Monitoring Computer and Network Use for further guidance on the monitoring that we may carry out; and
Allow your achievements via the UCLU to be accredited, for example by inclusion in the Higher Education Achievement Report.

We may process special category personal data, such as data relating to your health and your religious beliefs for this purpose. For example, we may use disability information to help us make reasonable adjustments to meet your health and welfare requirements.

For all personal data

Performance of a task in the public interest

Performance of contract

The processing of your personal data may be necessary in relation to the contract we have entered into with you as a student at UCL.

Vital interests

Your personal data may be processed by UCL and transferred to the emergency services where this is required to protect your vital interests.

Consent

In relation to managing participation at events, where we cannot rely upon public interest or performance of a contract legal bases we will generally seek to obtain your consent to the processing of your personal data.

For special category personal data

Vital interests

Your special category personal data may be processed by UCL and transferred to the emergency services where this is required to protect your vital interests.

Consent

Where we cannot rely upon protecting your vital interests, we will generally seek to obtain your consent to the processing of your special category personal data, e.g. data relating to your health, in this context.

Where we are relying on a legal basis that is not consent or your vital interests in processing your special category personal data, we will inform you of the legal basis before we start processing your special category personal data based on that legal ground.

Internal and statutory reporting and other legal obligations, including compliance with health and safety law and monitoring equality of opportunity or treatment

We will use your personal information to:

Comply with our legal obligations. For example, we may process your personal data in the context of arranging and/or providing student accommodation, for the purpose of complying with health and safety and other applicable tenancy and housing legislation;
Produce statistics and research for internal and statutory reporting purposes; and
Monitor our compliance with our responsibilities under equalities legislation.

This may include the processing of special category personal data, e.g. information about disabilities or ethnicity.

For all personal data

Compliance with a legal obligation

Much of our processing of your personal data in this context will be in order to comply with our legal obligations, e.g. health and safety legislation and UK equal opportunities monitoring.

Performance of a task in the public interest

For special category personal data

Equality of opportunity or treatment

We process special category personal data in order to monitor equality of opportunity/treatment.

Employment law obligations

We may also process certain special category personal data where this is necessary so that we can meet our obligations in the field of employment law.

Fees and funding

We will use your personal information to administer the financial aspects of your relationship with us and any funders/sponsors.

We will not generally process special category personal data or criminal convictions data in this context.

Performance of a task in the public interest

Performance of contract

The processing of your personal data may be necessary in relation to the contract we have entered into with you as a student at UCL.

Alumni

Before you graduate, the Office of the Vice Provost (Development) (OVPD) creates an outline record for you from the UCL Student database with name, department, preferred gender, date of birth, "UCL Person ID", Student Number and your UCL email address. This is to enable OVPD to run careers mentoring registration and record touchpoints.

Following your graduation, your personal data will be used by the OVPD to keep you in touch with UCL and the Alumni Network. UCL's role in your education does not stop on graduation and UCL views its Alumni programme as an essential tool in providing you with ongoing educational support. Further details about how OVPD may use your information can be viewed in the separate OVPD data protection statement.

We will not generally process special category personal data or criminal convictions data in this context.

Performance of a task in the public interest

For some of our alumni activities, UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information.

Legitimate interests

For some of our alumni activities, we rely upon our legitimate interests in communicating with our alumni as part of the extended UCL community.

Consent

In certain limited circumstances, where we cannot rely upon our legitimate interests or performance of a task in the public interest, we will seek to obtain your consent to the processing of your personal data for our alumni programme.

Please see the separate OVPD data protection statement for further information.

Marketing/publicity materials

While you are at UCL, we may take photographs or videos at an event or while you are participating in student life which may include images of you. These images will generally be used for UCL's marketing/publicity materials.

Legitimate interests

When using your personal data for the purpose of marketing or publicity materials, we will generally rely on our legitimate interests in promoting UCL, including our courses, our activities and our overall aims and objectives.

Research

As an established research institution, we may use your personal information for research purposes.

Performance of a task in the public interest

UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education or research Please see our Statement of Tasks in the Public Interest for further information.

For special category personal data and criminal convictions data

Research

We may process special category data and criminal convictions data for the purposes of research.

Please note that where the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, and you do not provide us with the personal data required, UCL may not be able to process your application or provide you with the programme for which you have applied.

We do not generally process your personal data based on your consent (as we can usually rely on another legal basis). Where we do process your personal information based on your consent, you have the right to withdraw your consent at any time. See the "Your Rights" section below.

Third parties with whom we may share your personal data

Your personal data may be disclosed to other organisations as required by law, for crime prevention, investigation or detection purposes or in order to protect your vital interests. Disclosures may also be made by UCL as outlined below:

To Students’ Union UCL (UCLU) to enable it to manage your student union membership. UCLU will only use this information for running the Union, for example communications regarding your membership rights, including for example, notice of general meetings, referenda and election of trustees, as well as information about the Union's activities;
To sponsors, government agencies and present or potential employers. One such body is the Higher Education Statistics Agency (HESA); further information about the uses for which HESA processes personal data can be found on the HESA website;
Your contact details may also be passed to the Office for Students (OfS) and its agents, including for the purpose of administering the national student survey;
To our agents for the purpose of administering our own surveys;
Where a programme of study leads to a qualification recognised by a professional body we will disclose relevant information to that body (e.g. General Medical Council);
Statements of student status will be provided on request to Council Tax Registration Officers;
To the Student Loans Company;
To debt collection agencies acting on our behalf in the event that you owe money to us;
Release of results to former schools/colleges;
If you decide to make on-line payments to us, limited information (date of birth and student numbers) will be disclosed to our service provider for validation purposes;
To the Office of the Independent Adjudicator (OIA);
To providers of anti-plagiarism software;
As a College of the University of London, we provide student personal data to the University of London for administration of examinations and for the award of degrees;
To NHS services, where necessary in order to protect your health and welfare;
If you undertake a placement or complete a period of study with a third party organisation or institution in the UK or in another country, personal data relating to you may be shared with the partner organisation/institution for the purposes of administering the placement. Special category personal data relating to your health or a disability will not be shared without your express consent unless required by law or in your vital interests in an emergency situation.
If you apply to attend a graduation ceremony your first name, initials, surname and degree title will be printed in the souvenir programme. It may also appear on some UCL merchandise. You must inform the Student Support and Events Team in writing before the ticket application deadline if you wish to opt out of this (grad_ceremonies@ucl.ac.uk); and
Your basic contact details may be made available through the UCL online staff and student directory, which is publicly accessible via the Internet, unless you opt out of this. The process for becoming ex-directory is available on the UCL Information Services Division website.
We use the services of various external service providers to help us run our university efficiently, particularly in relation to our IT systems. Some of these services (such as email hosting and data backups) involve the service provider holding and using your personal data. In each case where we share your information with one of our service providers, the service provider is required to keep it safe and secure. They are also not permitted to use your information for their own purposes.

And if you are an Undergraduate Degree Student:

To GradIntel, the service through which the Higher Education Achievement Record will be delivered;
If you do not complete your programme, to the organisers of the "Back on Course" scheme - the Open University and UCAS; and
From the 2016/17 academic year, we, along with a consortium of other universities, are participating in a 'Learning Gain' project sponsored by HEFCE. Your level of work experience and self-evaluation about how prepared you are for your future career will be passed to HEFCE to allow them to conduct further research into learning gain, including combining with data from similar work at other Universities and Colleges. These data may be linked to other data that they hold about you including prior, current or future educational records and records on earnings and employment. These data will not be used in any way that will affect you personally and any analysis published will take steps to ensure that you cannot be identified from it. If you have any questions about the use of your data for this purpose please email foi@hefce.ac.uk or learninggain@hefce.ac.uk.
In order to support the UK’s effort to tackle Covid-19, contact information may also be shared with NHS Test and Trace where requested.

For further information on how we manage disclosures to parents and other third parties, including information about what disclosures we make in the case of emergencies, please see our guidance on 'handling confidential information from students ' and the Trusted Contact policy.

Transfers outside the UK

We display students' UCL email addresses in the UCL online staff and student directory (subject to any opt outs). This directory is publically accessible to Internet users, including those in countries outside the UK. Please note that many countries outside the UK do not have data protection legislation, or have different data protection or privacy regimes, and so may not always protect personal data to the same standard as in the UK. If you are uncomfortable with this then you should use the opt out from the directory.

There are also many other circumstances in which we may transfer your personal data outside the UK, e.g. where we use a third party cloud services provider based outside the UK to store personal data.

Where we transfer your personal information across national boundaries to a third party, such as one of our service providers, we will protect your personal information by ensuring that those transfers are made in compliance with all relevant data protection laws. Generally, this means where we transfer your personal information to a third party that is located in a country which does not have adequate privacy protection, we will put in place a contract with the third party that includes the standard international data transfer contractual terms approved by the ICO. For further information on the measures in place, please contact us using the details set out in the 'Who do I contact with questions?' section below.

Principles

When processing your personal data, UCL is required by relevant data protection laws to comply with the following principles.

Principle	Personal Data shall be:
Lawfulness, fairness and transparency	processed lawfully, fairly and in a transparent manner in relation to the data subject.
Purpose limitation	collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
Data minimisation	adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
Accuracy	accurate and, where necessary, kept up to date.
Storage limitation	kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
Integrity and confidentiality	processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

In accordance with the separate 'Accountability' principle under relevant data protection laws, UCL must also be able to demonstrate compliance with each of the above principles.

Change of Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider what we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Retention periods

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for. Your personal data will be retained in accordance with UCL’s central Data Retention Schedule. After you leave UCL certain parts of your data may be retained as a permanent archival record for research purposes and to confirm your award and period of study.

Your rights

Subject to certain conditions, you have the following rights in relation to your personal data:

Right 1: A right to access personal data held by us about you (commonly known as a “data subject access request). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. Please see section entitled "How can I access my personal information" below.

Right 2: A right to require us to rectify any inaccurate personal data held by us about you, though we may need to verify the accuracy of the new data you provide to us.

Right 3: A right to require us to erase personal data held by us about you where there is no good reason for us continuing to process it. This right will only apply where, for example, we no longer need to use the personal data to achieve the purpose we collected it for; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with Right 6 below). Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Right 4: A right to restrict our processing of personal data held by us about you. This right will only apply where, for example, you dispute the accuracy of the personal data held by us; or where you would have the right to require us to erase the personal data but would prefer that our processing is restricted instead; or where we no longer need to use the personal data to achieve the purpose we collected it for, but we require the data for the purposes of dealing with legal claims or due to having overriding legitimate grounds to use it.

Right 5: A right to receive personal data which you have provided to us in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal data to another organisation.

Right 6: A right to object to our processing of personal data held by us about you where we are relying on a legitimate interest (or those of a third party), and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Right 7: A right to withdraw your consent where we are relying on it to use your personal data. Note that a withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

Right 8: A right to ask us not to use information about you in a way that allows computers to make decisions about you and ask us to stop.

In certain circumstances, we may need to restrict your rights in order to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege).

If you wish to exercise any of these rights, please contact the Data Protection Officer using the contact details provided in section ‘How can I access my personal information?’.

Keeping personal data up-to-date

Data protection law requires us to take reasonable steps to ensure that any personal data we process is accurate and up-to-date. Please help us to do this by advising us of any changes to your personal data.

How can I access my personal information?

As noted above, you have the right to access information held about you. Details are set out in our Data Protection Policy. Your right of access can be exercised at any time by contacting us at data-protection@ucl.ac.uk or Data Protection Officer, UCL Gower Street, London WC1E 6BT.

Automated processing

UCL does not use automated processing and decision making without manual intervention.

Who regulates the use of my personal information?

UCL maintains a data protection registration with the Information Commissioner's Office, the independent authority which oversees compliance with the UK's data protection laws. Our registration number is Z6364106 and this registration sets out, in very general terms, the full range of purposes for which we use student, staff and all other personal data. Please see the Information Commissioner's Office website for details.

Who do I contact with questions?

If you have any questions about your personal data and UCL that are not answered by this privacy notice then please consult UCL's data protection web pages, where further guidance and relevant UCL policy documentation can be found.

If you need further assistance, please contact UCL's Data Protection Officer: data-protection@ucl.ac.uk or Data Protection Officer, UCL Gower Street, London WC1E 6BT.

If we are unable to adequately address any concerns you may have about the way in which we use your data, you have the right to lodge a formal complaint with the data protection authority in your country or our main data protection regulator, the Information Commissioner's Office. Full details may be accessed on the complaints section of the Information Commissioner's Office website.

General Student Privacy Notice v3.4

UCL Student Privacy

Related links: