Student Privacy Notice
1. About this Privacy Notice
This notice sets out the personal data that we collect, hold and process about you as a prospective and current student, how we use and share this data, and our lawful reasons for doing so. The details of how we process former students’ details is covered in our Alumni Privacy statement.
Please read this notice alongside our overarching privacy notice: Privacy Hub.
It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.
The University of Essex is the controller for the purpose of data protection law.
In the case of student accommodation, the data controller is University of Essex Campus Services Limited.
2. What type of information we collect about you
We collect your personal data directly from you when you apply to study at the University, and throughout your time as a registered student. We also collect data about you from third parties who you have authorised to share your data with us.
After collecting this data, we will process it in relation to your application, your enrolment and study at the University and the use of our facilities.
We will process the following personal information:
- Your identity, including your right to study, your contact details, and those of your next of kin in case of emergency
- Your application details, whether from UCAS, an agent, or received directly from you, including your previous study and qualifications
- Details about which course of study you are on, your level and stage of study, and your chosen modules
- Information about your progress, including submission of work or marks. This also includes information about your attendance and engagement with teaching events and teaching materials, such as library resources and Moodle, and other University resources. Some of this information is made available to students through LEAP, our Learner Engagement Portal. We also collect information about any breaks you take from study (intermission), any repeated study periods and time spent studying abroad or on placement as part of your course
- Extracurricular activities
- Educational background
- Bank details
- Photographs, filming of student performances or other events
- CCTV footage and other information obtained through electronic means such as swipe/identity card records
- Information about your use of our information and communications systems
- Information about any complaints against you, such as academic offences or breaches of our Code of Student Conduct complaints
We will also process some Special category data:
In certain circumstances this processing will include “special category data” where you choose to provide it. Special category data is considered to be more sensitive than other personal data.
For example, when you apply to study with us, you will be asked if you have any disabilities. You may also share this information with us at any point during your time as a student at the University but we encourage you to do this as soon as possible, to help enable the right support package being in place to meet your needs. Your disclosure of this information is voluntary; you are not obliged to share this information with us, but any information you do provide will assist us to assess how we will meet our legal and statutory obligations in relation to your disability.
Where you have provided this, we will process the following special category data:
- Information about your race or ethnicity, and religious beliefs
- Information about your health, including any medical condition, health and sickness records and disability information, including mental health and wellbeing
- Information about your sexual orientation and sex life, and your gender
- Information about spent or unspent criminal convictions
Short courses and summer schools
For short courses and summer schools not leading to the award of credit, and for pathway courses and pre-sessional courses (including UEIC Pre-sessional English (PSE) courses and UK University Ready courses and in country PSE courses) which are delivered by partner institutions, we collect and hold appropriate sub-sets of the data mentioned above.
For UEIC pathway students, we collect and hold appropriate sub-sets of the data mentioned above and will ask you to complete a pre-CAS questionnaire a few months prior to you progressing to the University in order to support the progression process.
3. Why we use your personal data – and our legal basis for doing so
When we collect or otherwise process your personal data, we need both a purpose (i.e., a reason) and a legal basis. There are several legal basis under the UK General Data Protection Regulation. We generally rely on the following legal bases when processing your personal data.
3.1 Performance of a contract
As a student you have a contract with us, and in order for that to function we need to process certain information about you. We have set out our reasons for using your personal information in the table below.
3.2 Legitimate interests
From time to time, we may need to use your personal data to pursue our legitimate interests or those of a third party. We rely on legitimate interests when the processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.
Where we rely on our legitimate interests we mean our:
- pursuit of our activities and objectives, or those of a third party;
- compliance with applicable legal and regulatory obligations and any codes of conduct;
- improvement and development of our business operations and service offering, or those of a third party; or
- protection of our services, students, employees and customers, or those of a third party.
We have set out our reasons for using your personal information in the table below. Where we rely on our legitimate interests, we have set out those interests in the table below.
3.3 Legal obligation
We may need to process your personal data to ensure our compliance with our legal and statutory obligations. For example, should we be required to submit information to the police or to a court, and in cases where the processing is necessary for compliance with other laws. In all cases the personal data shared will only be that which is necessary for the purposes and subject to the University having measures in place to ensure that the data is handled in line with data protection laws.
We have set out our reasons for using your personal information in the table below.
3.4 Consent
We do not routinely rely on consent to process your personal data. If we wish to rely on your consent to process your personal data, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.
Where we are relying on consent to process your personal data, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products, support or services to you. We will advise you if this is the case at the time you withdraw your consent. You have the right to object to our use of your personal data at any time.
Please see the Data Rights section of our Privacy Hub for a summary of your right to object and the details of who to contact if you want to exercise them.
3.5 Vital Interests
We may use your personal information in situations where we need to protect your vital interests (or someone else’s interests). For example, the University would inform the emergency services of known medical conditions of a student where they had lost consciousness.
3.6 Public Task
Some uses of your personal data are required so we can meet our obligations or duties, or to exercise our powers, as a public authority, or to support the functions of other authorities that have a public task defined within law or statute. For example, the University has an obligation to share data with the Higher Education Statistics Authority. We may also collect and retain data to support public health or safety, safeguarding or crime prevention measures, or the need to retain a basic record of students that have studied with us and their attainment for verification of award purposes. We may also be required to share personal information with our external regulators, auditors, assessors, or professional bodies. In all cases the personal data shared will only be that which is necessary for the purposes and subject to the University having measures in place to ensure that the data is handled in line with data protection laws.
3.7 Table 1
Legal basis for processing your data
| Purpose | Legal Basis |
| Correspondence relating to offers and next steps | Necessary to enter into or perform a contract we have with you. |
| Admission, enrolment, and administration of studies | Necessary to enter into or perform a contract we have with you. |
| Administration and consideration of eligibility/applications, relating to bursaries, fees, and funding | Necessary to enter into or perform a contract we have with you. |
| Academic assessment and progression | Necessary to enter into or perform a contract we have with you. |
| Monitoring and management of your attendance | Necessary to enter into or perform a contract we have with you. |
| For provision of services such as the library | Necessary to enter into or perform a contract we have with you. |
| Creation and management of email addresses and accounts | Necessary to enter into or perform a contract we have with you. |
| Information relating to your accommodation whilst studying with us |
Necessary to enter into or perform a contract we have with you. |
| Information relating to any additional needs that you may have may be processed for the purposes of putting reasonable adjustments into place | Necessary to enter into or perform a contract we have with you Necessary to comply with our legal obligations Necessary for performing a task in the public interest [NB you may, nonetheless, assert your statutory right to confidentiality, under the Equality Act 2010. This may, however, limit the support we are able to put into place for you.] |
| Ensuring the health, safety, security and wellbeing of the University, its people and facilities | Necessary to comply with a legal obligation. |
| Processing card access data to ensure the health, safety and wellbeing of persons present on campus, preventing crime and disorder and individual or group compliance with reasonable directions given by Campus Security, your department, University regulations and policies/procedures and the law | Necessary to comply with a legal obligation. |
| Sharing information internally, where appropriate, to identify individuals suspected of or failing to follow our regulations, policies/procedure regarding access to buildings. Issuing warnings and/or instigating (and progressing) disciplinary action and where appropriate sharing information with regulatory authorities such as the Police | Necessary to comply with a legal obligation. |
| Enabling the University to deal with requests (from you or others) under Freedom of Information and other transparency legislation or Data subject rights requests under the General Data Protection Regulation | Necessary to comply with a legal obligation. |
| Collecting and managing information about health and safety such as recording details of accidents and where required reporting that information to the Health and Safety Executive | Necessary to comply with a legal obligation |
| If you are an overseas student then we are obliged to collect and report information about your visa and right to student here | Necessary to comply with a legal obligation |
| DBS check - (for courses subject to a Courses mandatory check). | Necessary to comply with a legal obligation |
| Seeking your views to help us develop University facilities | Legitimate interests. We need to process your personal data for our legitimate interest of allowing us to manage and carry out our operations as an education provider |
| Administration of Alumni relations | Legitimate interests. We need to process your personal data for our legitimate interest of allowing us to manage and carry out our operations as an education provider |
| Monitoring your use of our information and communication systems to ensure compliance with the University’s IT policies | Legitimate interests. We need to process your personal data for our legitimate interest of maintaining security of our systems and services and improving the services we offer |
| To provide our IT services and operate our IT network, we collect your IP address (see also our Visitors to the website Privacy Notice) | Legitimate interests. We need to process your personal data for our legitimate interest of maintaining security of our systems and services and improving the services we offer |
| Provision of your staff profile (PGR students) | Legitimate interests. We need to process your personal data for the legitimate interest of sharing information about our work with the wider world |
| Students name and phone number will be shared with data processors who provide specialist training on issues we think are important for all students to be aware of, e.g. consent training | Legitimate interests. We need to process your personal data for the legitimate interest of sharing information about our work with the wider world |
| Where overseas student recruitment agents are involved, provision of data post-enrolment relating to attendance and fee payment | Legitimate interest. We need to process your personal data for the legitimate interest of supporting you to complete your studies |
| DBS check - (for courses not subject to a Courses mandatory check but where the University Student Membership and Disclosure and Barring Service Check Policy deems one is necessary) |
Necessary for performing a task in the public interest |
| Your personal data will be shared with local councils to assist voter registration | Necessary for performing a task in the public interest |
| Your data may be shared with your emergency contact when the University has serious concerns about your safety, mental health or in the case of an emergency | Necessary for performing a task in the public interest Necessary to protect your (or someone else’s) vital interests. |
| Your personal data may be processed by the University of Essex and transferred to the emergency services and, if necessary, your next of kin or emergency contact, where this is required to protect your vital interests or those of another person | Necessary in order to protect the vital interests of the data subject or of another person |
4. Where the data we hold comes from
We collect data directly from you, or through an agent or UCAS, when you apply to study with us, and at the point of offering you a contract (Registration).
We continue to collect and process data about you, such as attendance or exam marks, while you study with us.
For international students we may collect data about you from your sponsor.
For UEIC pathway students, UEIC share an appropriate sub-set of your data with us when you register at the College (see UEIC Privacy Notice) so that we can provide relevant University services to you. We will also collect additional relevant data from you prior to progression to the University (e.g. pre-CAS questionnaire) in order to facilitate your progression to the University.
5. Whom we share your data with
Internally, access to information about students is restricted to those who need it in order to carry out their roles. This will include your personal tutor and other staff who teach you, as well as the professional services staff in your department who support activity such as exams, attendance monitoring and coursework submission.
There are other central professional services staff who will need access to some information about you, including the timetabling office, the exams office, the library and the central progress team.
Information held by the Student Conduct Team (relating to any breach, or alleged breach of our Code of Student Conduct), and by our Student Wellbeing and Inclusivity Service (relating to your health and wellbeing) will only be shared where necessary, and in line with the lawful bases outlined above and the relevant confidentiality policies.
In line with Universities UK guidance, information relating to the outcome of a complaint and associated actions may be shared with another party to the complaint. The extent of this sharing will be decided upon on a case-by-case basis, and, where any information is shared, with reference to an appropriate and agreed lawful basis.
We share data about your identity and course with the Students’ Union, so that they know you are a student and eligible for membership. We manage a separate Data Sharing Agreement and data sharing log with the Students’ Union.
If you are studying on a course that includes a practical professional placement then, under the terms of our Fitness to Practise procedure we may share your information with the relevant professional body.
Information voluntarily provided by you about any additional needs you have will be shared with the University to enable the University to comply with our legal obligations, fulfil a contractual obligation and/or perform a task in the public interest by putting into place reasonable adjustments to allow you to engage with your studies. Where this sharing takes place only minimal information required for the purpose will be shared.
The University shares current student data with local Councils in order that they can maintain accurate electoral register records. This ensures that you can vote when there are elections.
We may also share your data externally in these ways:
- We send the name, registration number and award title of students who are eligible to graduate each year to the Graduate Gowning Company to ensure that they are able to supply the correct robes for graduation
- If you live in accommodation within a relevant borough then we will share your name, address and the fact that you are studying with us with the relevant local council, to ensure that you receive the Council Tax rebate to which you are entitled
- If you are based on our Colchester Campus then we give your contact details to the Health Centre at the start of each academic year so that they can verify your student status to ensure that their records are accurate and up to date. You do not have to register with the Health Centre.
- For those of you who are registered at our Southend Campus, we share your data with Southend City Council to enable use of our shared library, The Forum. Southend City Council’s privacy statement is viewable online. We specify that your data must be kept safely, used only under our instructions in accordance with data protection law, and not be used for the contracting company’s own purposes.
- We will collect from you the contact details of a person nominated by you for us to contact in case of emergency. We may also pass those contact details to the emergency services. We may also contact that person if we have concerns for your wellbeing, particularly if we have good reason to believe that you are at risk.
- We will share some of your information if we are asked for a reference from a prospective employer
- We may share some information if required to do so by the police or other law enforcement authorities, including the Home Office
- If you have a financial sponsor then, if asked, we may tell them some limited information about you, such as confirming that you are still registered with us. If possible we will ask your permission first. If you have signed an agreement with your sponsor that they can see information about you then we will follow that agreement.
- We may also share your data when an external company provides us with a software system that holds or uses your data. Such sharing will always be carried out under contract, as part of which we will specify that your data must be kept safely, used only under our instructions, and not be used for the contracting company’s own purposes
- We will share your data with statutory regulatory bodies such as the Office for Students (OfS) and those organisations who provide a service on their behalf (for example, HESA, Jisc, etc).
6. Where we keep your data and how long we keep it for
We have retention schedules that set out how long we keep information of all types, including personal data of students.
We do not generally transfer your data outside of the UK. Data are retained primarily within our own student record and student file systems, but may be held elsewhere on our network, including within the email system, and on paper within our faculties and departments.
If we have to transfer any of your personal data outside the EEA we ensure the receiving country or organisation is deemed to have adequate data protection provision. Where a country or organisation does not have adequate protections we will put safeguards in place. Details of these safeguards can be provided to you upon request.
7. Changes to this Privacy Notice
This privacy notice was published on Friday 15 December 2023. We may change this privacy notice from time to time and will communicate these changes directly to you where appropriate.
If you have any questions about this privacy notice or if you would like to access any of your rights, please contact dataprotectionofficer@essex.ac.uk
Last revised December 2023.
