Privacy Information for Students and Applicants

Return to our central privacy information

This privacy notice applies to current and former students and applicants. It explains how we'll process your personal data. This notice does not form part of any student or applicant contract.

What information do we hold?

We hold a range of personal data about you, some of which you provide to us directly and some of which we receive from third parties.

Here are some examples of types of personal data we hold:

• your contact details
• prior educational experience and attainment
• immigration information (such as passport details and language proficiency)
• where relevant, health information (including any disabilities) and other equality monitoring data you provide to us

In addition, if you come to study with us, we'll start keeping data like:

• academic performance
• attendance and progression
• if it's relevant, breaches of our policies (such as academic or other misconduct concerning University activities)
• Location and login data gathered through logging into University Eduroam  WIFI in campus buildings, including teaching and learning spaces and public areas. This is also being used to confirm your attendance on campus due to Covid 19 restrictions.
• Username data gathered through logging into University Eduroam WIFI in campus buildings, including teaching and learning spaces and public areas. This is gathered solely to support the NHS Test and Trace system and is kept for a strictly limited period of time.
• Health information where a student either self-reports symptoms of infections illnesses, e.g. Covid 19 or Mumps, or where the University is informed by Public Health or NHS bodies

• We will process physical attendance and monitor those who are unable to attend due to personal or national restrictions in place due to global health events

We also process contact and educational details after you stop being a student with us.

How do we use it and why?

When you're an applicant, we process your personal data for the purposes of assessing your eligibility to be offered a place on one of our academic programmes and for identifying any support needs you may have.

If you accept a place on a course and/or register as a student at the University, we process your personal data for the purposes of providing our academic programmes and related services, such as welfare support.

In general, this applies to personal data you provides to us to process your application and, if enrolled, to monitor academic performance. Without that information, we wouldn't be able to provide you with your chosen academic programme and related support services.

We pay attention to how you interact with us and may record this information. For example, whether you open or click on our emails, your interactions with University-operated social media accounts, and what you visit on our websites and use this information to personalise future interactions.

Some personal data is also required to fulfil our legal obligation regarding immigration. A failure to provide that information would interfere with your application for a UKVI Tier 4 visa.

We only process data for specified purposes and if it is justified in accordance with data protection law. The table below lists examples of personal data we process and the justification for it.

Purpose of data use and justifications

Purpose	Legal basis	Justification
Receiving data from application partners (including, but not limited to UCAS and Clearing House) from applicants that wish to study at UoN	Contract	Applicants require trusted partners to transfer information to institutions for the purposes of assessing applications.
Assessing eligibility to undertake our academic programmes	Consent & Contract	Consent and/or processing is necessary for the purposes of taking steps prior to entering into a contract with us
Passing applicant details to partner colleges for the purpose of enroling on foundation or pre-masters programmes.	Consent	Consent is required before we transfer your data to partner colleges such as Kaplan etc.
Provision of academic programmes and related services (including IT and library services)	Contract	Necessary for performing a contract - in other words to provide your chosen academic programme. This can be a contract with us or a contract between you and your sending institution. This is called contractual necessity
Monitor your use of our networks to protect the security and integrity of UoN's IT network and information and electronic communications systems.	Contract	Contractual necessity
Assessment of academic progress and performance (including attendance)	Contract	Contractual necessity
To support investigations into the integrity of student contributions and assessment e.g. determining the originality of assessed work, the use of 3rd party services to provide solutions or answers on behalf of students.	Contract	Contractual necessity
Operate security, disciplinary, complaint, and quality assurance processes and arrangements	Contract	Contractual necessity
Monitor compliance by you with UoN’s policies and your other contractual and legal obligations.	Contract	Contractual necessity
Immigration matters	Legal Obligation	Necessary for us to comply with our legal obligation in relation to students or applicants who hold Tier 4 visa. Such processing may also be in the public interest and your consent may be required in some cases
Making reasonable adjustments for disabilities and providing relevant support to students or applicants with ill health	Legal Obligation	Necessary for us to comply with our legal obligation under the Equality Act 2010, and for the establishment, exercise or defence of legal claims relating to the University's duty of care towards students and its obligations to comply with the Equality Act 2010
Regulating the University's community (including dealing with misconduct under our procedures for academic and other misconduct)	Contract & Legitimate Interest	Contractual necessity and our legitimate interest in maintaining academic standards
Obtaining payment of fees	Contract	Contractual necessity and our legitimate interest in obtaining payment for the services we provide
Protecting our property and assets (for example by dealing with misconduct)	Contract & Legitimate Interest	Contractual necessity and necessary for our legitimate interest in safeguarding our property and assets
Crediting students' bank accounts with payments in respect of financial aid.	Contract & Legitimate Interest	Payments may be as part of a contractual relationship between the University and student or where it is in the legitimate interests of the University to ensure that payments are made to the student to facilite their on-going education.
Operation of CCTV including body worn cameras	Legitimate Interests & Legal Obligation	The University has a legitimate interest in ensuring that its property and assets are protected. The University has a legal duty of care to ensure the safety of its staff, students and visitors.
Providing appropriate IT and other infrastructure facilities, for example a virtual learning environment, as well as the development of new IT systems	Contract	Contractual necessity; legitimate interest in providing a proper infrastructure to support the provision of academic programmes and related student services
To manage health and safety incidents including statutory reporting and medical referrals	Legal Obligation	Compliance with the Health and Safety At Work Act.
Communicating with applicants and students	Contract	Contractual necessity
Assisting applicants and students to obtain residential accommodation/housing	Consent	Consent
Administering matters relating to University-managed accommodation including fees, health and safety, catering, cleaning and maintenance and disciplinary procedures.	Contract	Contractual necessity. The accommodation service may use personal email addresses for the purposes of communicating with students.
Sharing data with the University of Lincoln to facility application processing including interviews - applicants to Lincoln Medical School only	Contract	By applying, applicants are taking steps to enter into a contract with the University of Nottingham and the University of Lincoln, which are joint controllers of the Lincoln Medical School.
Assisting applicants and students to obtain residential accommodation/housing - applicants to Lincoln Medical School only	Legitimate Interest	Legitimate Interests. Student information is transferred to the University of Lincoln to enable it to make an offer of accommodation. The University of Lincoln hereafter is the data controller for this purpose.
Invitations to pre-enrolment opportunities to visit the Lincoln Medical School – applicants to Lincoln Medical School only	Legitimate Interests	Legitimate Interests. Student information is transferred to the University of Lincoln to enable it to issue invitations to attend Offer Holder Day, Open Days and other events. The University of Lincoln hereafter is the data controller for this purpose.
Careers and Employability Service	Contract	Contact details, programme details and progression information where relevant to enable the opportunities offered to students by the Careers and Employability Service
Offering you beneficial alumni-focused services (for example, events and webinars with sector-leading experts, networking opportunities, mentoring and careers advice, volunteering opportunities, and the latest updates and news from the University)	Contract/ Consent	Important to deliver and alumni relations service that benefits new graduates (up to 3 years post graduation).
Alumni marketing including paid for events, non-exclusive volunteering opportunities, online courses (NOOCs), CPD-opportunities and fundraising activities.	Consent	The Campaign and Alumni Relations Office (CARO) only processes personal information for these purposes where it has an individual's consent to do to.
Internal Audit Service	Legitimate Interest	Necessary for our legitimate interests in maintaining internal control, and/or prevention, detection and investigation of fraud
Processing catering purchases for students using DailyBites cards and ordering click and collect catering	Contract	Both DailyBites and Click and Collect purchases are made under contract, whether via the University in the case of DailyBites, or on set up of an account for other users.
To provide references on request	Contract & Consent	Necessary for the performance of the employment contract or where consent has been given
Carrying out internal research and analysis for non-academic (research) purposes including monitoring performance and quality at an institutional level and where there is no direct impact on data subjects	Legitimate Interest	Legitimate interest in ensuring that the University is able to benefit its staff and students through understanding how they are impacted by its practices and enacting continuous improvement to its policies, processes and technologies.
Carrying out teaching and learning surveys to enable the University to plan teaching, learning and assessment, and support. There may be some data matching of participants' non-special category data from other UoN systems, but all outputs are non-identifiable. Consent is sought for any inclusion of special category data.	Legitimate Interest/ Consent	Legitimate interest in ensuring that the University is able to benefit its staff and students through understanding how they are impacted by its practices and enacting continuous improvement to its policies, processes and technologies.
Sharing student details with the Office for Students or their contractors for the purposes of conduting the National Student Study (NSS).	Task carried out in the public interest	The University is required to share contact details to the OfS or their contractors for this purpose.
Undertaking electronic student analytics of engagement to identify possible opportunities to support students with their studies, particularly where engagement appears low, and for students with student visas, to monitor and report on engagement as required by law.	Contract, Legitimate Interest, Legal Obligation	The University's contract with students creates a duty of care to students; under-engagement may indicate greater support is required; the analytics systems can flag to students that they are under engaging and may indicate to the University that interventions may be appropriate. Student on student visas are required to engage with studies as a condition of their visa. Failure to do so necessitates a statutory obligation to report to UKVI.
Supplying contact details to the relevant council tax authority in registered place of residence for Council Tax Registration purposes	Consent	Consent is collected at the point of enrolment. Students that do not wish to consent must still register for Council Tax purposes with the relevant local authority
Supplying contact details councils for electoral registration purposes	Statutory Obligation	Statutory obligation on request from Electoral Registration bodies under under regulation 23 of the Representation of the People (England and Wales) Regulations 2001
Purchasing and administering memberships with UoN Sport, and for the arrangement of training and advice, sporting competitions, tournaments, matches and fixtures	Contract	Contract with UoN Sport
Collection and analysis of publicly accessible records of sporting achievement, such as National Sport Governing Bodies and Power of 10	Legitimate Interest	Legitimate interest in enabled the University to recognise sporting achievements of staff
For the purpose of obtaining professional accreditation and charter marks, such as Athena Swann.	Legitimate Interest	Data will be shared in aggregated and anonymised format. The legal basis for this processing is legitimate interest.
For the purpose of obtaining professional accreditation for regulated courses, such as GMC, iChemE etc	Legitimate Interest	Contact details, attendance, assessments and progression information, and employment destination following completion of studies.
For the purposes of conducting competitions and recognition schemes, making awards and giving prizes	Legitimate Interest	Legitimate interests. There is a clear and established benefit to the University being able to run competitions and award excellence.
To maintain the health of our entire campus population, by monitoring student movements around campus to enable effective Test and Trace processes during global health events To identify those affected through Health Screening and Self Reporting.	The University is under a legal obligation to ensure health and safety of employees, student and visitors and those affected by its undertaking It is in the University’s legitimate interests (ensuring wellbeing and minimising risk to the public as well as the delivery and continuance of operations) It is the public interest.	Compliance with relevant national Health & Safety legislation and any national legislation bought in in the event of a Global Health Emergency. Legitimate interest in ensuring that the University is a safe and healthy environment for all students, staff and visitors.
To maintain a register of vaccination status for students working or on placement in the NHS and Health and Social Care in England	Legal Obligation	The law requires that anyone working or on placement in the NHS and Health and Social Care in England must be fully vaccinated unless medically exempt.
To enable students to book a Lateral Flow Test as provided by DHSC.	Consent	In order to facilitate the safe movement of students home, UoN will provide students with the ability to book a Lateral Flow Test at their convenience, using our on premise Careershub booking system. No data will be shared from the system, and all further testing data will be held by DHSC and not shared with UoN.
Using domestic email contact information to communicate with graduates for the purposes of administering graduation ceremonies.	Contract/ Legitimate Interest	Graduation ceremonies are not mandatory but are part of the expected university experience for most students, and is covered by the student contract.
Passing student details to partner organisations to enable the administration of gown hire.	Legitimate Interest	Graduation ceremonies are not mandatory but are part of the expected university experience for most students, and is covered by the student contract.
Recording of calls to University helplines, such as the DTS Service Desk and Estates Service Desk.	Legitimate Interests	The University is entitled to record such information to enable it to identify training needs and monitor service level agreements

There may be other processing in addition to the above, for example, when you access our website which uses cookies, or when we take photos or video of our events and publish them. This is done on the basis of our other policies, and we will inform you about such processing at the time when the data is obtained or as soon as we can afterwards.

Where the basis of processing your personal data is a contractual necessity and you don't provide us with the personal data needed, the University may not be able to process your application or provide you with the programme for which you have applied. A failure to provided immigration-related data may result in failure to obtain a Tier 4 visa for those students who require it.

What information do we get from third parties?

Sometimes we receive your data from third parties. The following table lists what information we may receive from them.

Who we get data from

Data we may receive	Source
Application data, which includes contact details and attainment, work experience, previous institution, contextual data and disability information	UCAS/DfE (Teacher Training Applications)
Your immigration status	Home Office (UKVI), Foreign and Commonwealth Office
Transcripts (details of programmes undertaken or being undertaken at another institution, and your attainment)	Another institution and/or secondary schools
Medical, accessibility related and similar information, occupational health medical clearing (we only obtain this information from third parties if you give us consent to do so)	Another institution, medical practitioners and/or family members
Your financial status	Student Loans Company
Details of any University associated complaint	Officer of the Independent Adjudicator
Details as to how you are performing in your apprenticeship	Your employer if you are an apprentice
Details of performance in foundation courses	Kaplan and other partner institutions and agents
Details of performance in other educational institutions or in relevant jobs	Referees you have identified
Information relating to criminal convictions	Disclosure and Barring Service
Accreditation information	Relevant professional accrediting bodies
Sporting achievement records	Public records held by National and Regional Sport Governing Bodies, and Power of 10

 

Who do we share it with?

Sometimes we may need to share your data. The following table gives examples of this kind of data sharing:

Who we share data with

Recipients	Data which we may share with them
Our academic staff	Contact details, attendance and progression information, education and attainment data, and where necessary for the implementation of reasonable adjustments and/or the provision of other support and subject to your consent health information. Your contact details may also be used by these staff when recruiting to related extra-curricular activities, such as volunteering opportunities
Our administrative and support staff	Contact details, immigration details, attendance and progression information, education and attainment data, and where necessary for the implementation of reasonable adjustments and/or the provision of other support and subject to your consent health information. Your contact details may also be used by these staff when recruiting to related extra-curricular activities, such as volunteering opportunities
Our alumni team	Contact details, attendance, attainment and progression information
The University of Nottingham Students' Union	Contact details and student record details where relevant to enabling the opportunities offered to students by the Union, where required for the purposes of supporting efficient and effective engagement to support the efficient and effective engagement of all eligible Students in the democratic functions of UoNSU, to support the inclusion of representatives of UoNSU (including Student representatives) on University committees that may include discussions about, or the provision of, data or statistics that could potentially include that of identifiable persons (including other Students); to support the efficient and effective communication of UoNSU services to all Students; to support the administration of all elections, and membership activity; to enable effective management and planning of UoNSU services and facilities; to support any investigations, or matters pertaining to, Student safety, wellbeing, safeguarding or the prevention or detection of crime in order to ensure a secure and safe environment for students, staff and visitors; and to comply with any legal obligation to which either Party is subject. Data also includes special category data relating to ethnicity, sexual orientation and disability information, as well as widening participation flags for the purposes of equaties and diversity monitoring. Access to this data is tightly restricted and is used for anonymous reporting purposes only.
Partner institutions such as Kaplan offering foundational courses	If you express an interest in undertaking a foundation or pre-masters programme before progressing to the University of Nottingham, we will pass your contact details, course of interest and academic background to the partner institution in order for them to contact you further.
Partner organisations providing information and training to students	Where the University makes available resources to assist and support students, such as mental health support and safeguarding and wellbeing training, it will share limited information to enable partners to create and operate accounts.
Employment or study placement providers	Your CV as well as any accessibility and assistance requirements and related information
Cocurricular and/or extracurricular excursion providers	Accessibility and assistance requirements and related information
Your employer if you are an apprentice	Details as to how you are performing in the academic part of your apprenticeship
Future employers	Personal information relating to conduct, performance and academic achievement, where we are asked for a reference
University league table compilers, for example The Economist, Financial Times and organisations compiling graduate destination data	Contact details and employment or further study destination data
Official bodies to which the University is obliged to report, for example HESA  and the Office for Students, or their agents	Information supplied as necessary to fulfil the University's reporting obligations to these bodies. This may include relevant special category data. You can find HESA's Privacy Notices here: https://www.hesa.ac.uk/about/regulation/data-protection/notices We supply contact information to the OfS for the purposes of inviting students to participate in the National Student Survey (NSS), and for auditing.
External examiners	Identification details and exam papers and assessment records
UK Home Office	Passport details, programme details and fees, and housing details
Tutors in Halls of Residence	Student details
Housing providers	Student details
Data processors (in other words third parties who process personal data on our behalf, such as software providers)	Application details, attendance records, contact information & account credential where required for single sign-in.
Local Authority	Contact details
Student Loans Company	Contact details
Research partners	Contact details, attendance and progression information
Regulatory and accrediting bodies, where you are on a professionally accredited programme, for example the GMC, iChemE	Contact details, attendance, assessments and progression information
Funding bodies, scholarship and bursary providers	Contact details, attendance and progression information
Government agencies, for example HMRC (only upon request and where there is a legal basis for doing so)	Contact details
Police (only upon request and where there is a legal basis for doing so)	Information supplied as necessary in order to fulfil the University's legal obligations with respect to fire prevention and detection of crime
NHS Test & Trace and PHE (or its replacement)	We may share your contact details and information on your movements around University Campuses in order for them to identify individuals who you may have been in contact with or who may have been in contact with you. This is done in order for them to contact individuals where self-isolation may be required.

When do we transfer data overseas (outside of the European Union)?

As shown in the table above, we will share your data with your placement provider, who may be outside of the EEA, on the grounds that such transfer is necessary for performing our contract with you.

The University of Nottingham also works with suppliers and partners who may make use of Cloud and/or hosted technologies. We undertake data security due diligence on our partners, ensure that suitable contracts are in place and that these partners conform to appropriate accreditations.

Wherever these transfers take place, the University will have an appropriate contract in place and there are strict rules regarding the confidentiality and security of your information in place to safeguard it.

How long do we keep your data?

Usually application-related personal data will be kept for around one year.

Contractual information (for example details of your attendance, performance and contact details) is retained for six years after you have completed or otherwise terminated your programme. Retention periods are usually linked to legal limitation (statute of limitation) periods. The University's records retention schedule is available online.

Personal data held in connection with our alumni office will be retained in support of your lifelong relationship with the University, or until there is no longer a legal basis for holding it (for example if you withdraw your consent).

Where can I get more information?

If you have any questions about this policy, please  contact the data protection team.

We will keep this privacy notice under regular review and we will place any updates on this web page.

Return to our central privacy information