General Privacy Notice
UAL and Short Courses Ltd collect or create personal data relating to students, staff, prospective students or staff, enquirers, contractors, alumni, donors and contacts in other organisations or companies.
Information about UAL and UAL Short Courses Limited’s registration, contact details, DPO details and subject rights.
Wherever possible, specific privacy notices are presented to data subjects within applications processes and on forms before processing begins.
The privacy notice for UAL and Short Courses staff.
The privacy notice for UAL students.
The privacy notice for student complaints.
The privacy notice for Short Courses students.
The privacy notice for UAL Accommodation student tenants.
The privacy notice for UAL alumni.
The personal data we collect or create
Data we collect or create may include:
- Identity and contact details.
- Data relating to academic or employment performance (including records of attendance, disciplinary records etc.)
- Next of kin details.
- Complaints or enquiries made by or about you.
- Records of counselling or other support requested or given.
- Survey data.
- Records of goods or services provided.
- CCTV footage.
- Photographs.
- Scans of identity documents.
- ID card access data.
- Use of UAL IT systems.
- Accident forms.
- Financial details.
- Employment references.
- Records of employment.
- Vetting checks.
In limited circumstances, we also process sensitive classes of information that may include:
- Racial or ethnic origin.
- Trade union membership.
- Religious, political or other similar beliefs.
- Physical or mental health details.
- Sexual life.
- Offences and alleged offences, criminal proceedings.
What we do with your personal data
Among other things we process personal information to enable us to:
- Provide education and support services to our students and staff.
- Advertise and promote the university and the services we offer
- Conduct surveys.
- Manage alumni relations and fundraising.
- Undertake academic research.
- Undertake market research.
- Manage our accounts.
- Provide commercial activities to our clients.
- Maintain security.
Legal bases for processing
Under GDPR and the Data Protection Act 2018, we will process personal data under the following bases and for the following purposes.
Core student and staff data; the personal data of anyone entering into or acting under a contractual relationship with UAL or Short Courses Limited, such as suppliers, commercial partners etc:
Legal basis under GDPR: 6(1)(b) necessary for the performance of a contract.
Purposes:
- To support applications and provide education and support to students.
- To support applications, employ, manage and support the work of staff.
- To provide accommodation and other commercial services governed by contract.
- To provide and obtain other commercial services and manger the related contracts.
- To make and receive payments under these contracts.
- In the event of a complaint, enquiry or legal action relating to its performance, to determine and demonstrate for up to 6 years after the year the contract ends that the contract was either fulfilled or breached.
Identity details and personal data detailing an individual’s complaint, concern or account of events:
Legal basis under GDPR: 6(1)(f): legitimate interests.
Purpose: In response to reports, complaints or legal action relating to breach of contract and/or malpractice, to investigate, gather evidence, take witness statements and report on outcomes.
Personal data of governors and senior management:
Legal basis under GDPR: 6(1)(e) in the exercise of official authority.
Purpose: To provide oversight of University activity and transparency to the public.
Personal data processed to develop commercial, community or research activity, including enquiry, alumni and third-party contact or supplier details:
Legal basis under GDPR: 6(1)(f) legitimate interests.
Purposes:
- To develop and maintain enquirer, alumni, commercial and donor relationships.
- To conduct market research.
Personal data captured by CCTV systems, card access data and logs of activity on our IT systems or otherwise for security purposes; Personal data relating to declared criminal convictions or any unspent criminal convictions:
Legal basis under GDPR: 6(1)(f) legitimate interests.
Purposes:
- To protect University assets, maintain security and for the prevention and detection of crime.
- To fulfil the purposes listed under Data protection Act 2018 Schedule 1:
- Part 1, paragraph 1 – necessary for the purposes of performing obligations under the law relating to social protection.
- Part 2, paragraph 11 – protecting the public against dishonesty.
Contact details and other personal data related to direct marketing:
Legal basis under GDPR:
6(1)(a) consent for campaigning, fundraising or marketing contact with people who are not existing or former students, staff or customers or on behalf of third parties.
or
6(1)(f) legitimate interests - PECR ‘soft opt-in’ for the promotion of related commercial services provided by UAL to existing or former students, staff or customers where they have been given the option to withdraw consent on each contact.
Purpose:
To promote the activities of UAL and partner organisations, to raise awareness of opportunities and events of potential interest to applicants, students, staff, alumni and others.
‘Special Category’ or ‘Sensitive’ personal data such as health, ethnicity, religion, sexuality etc:
Legal basis under GDPR: 9(2)(a) explicit consent, (but if provided, shared with HESA for statistical purposes under basis 9(2)(j)).
Purpose:
To adhere to statutory requirements to monitor and report on diversity, to provide reasonable adjustments, provide counselling and welfare support services.
Legal basis under GDPR: 9(2)(b) necessary for carrying our obligations and exercising rights under employment and social security and social protection law, as further defined by the Data Protection Act 2018
Purposes:
- Record sickness absence and accidents, make occupational health referrals, respond to occupational health reports in order to assess working capacity of the employee;
- Supporting positive action under the Equality Act 2010, including provision of reasonable adjustments
Legal basis under GDPR: 9(2)(g) substantial public interest, as further defined by the Data Protection Act 2018
Purposes:
- Safeguarding and counselling where consent is not practical or appropriate;
- Monitoring of equality in senior roles;
- Processing as necessary to prevent and detect crime and apprehend offenders.
Who the information may be shared with
We will share personal data with third parties who are engaged as data processors on our behalf, including course tutors or support staff working through their own company, IT service providers (e.g. JISC, Microsoft, AWS, Midland HR), facilities contractors, property management companies etc.
Student contact details may be shared with the Students Union in order to facilitate membership, and also with Higher Education bodies such as HEFCE or the Office of Students, or their data processors, in order to conduct the National Student Survey. Student data will be shared with HESA for monitoring purposes, and UAL will also produce anonymised statistical data for reporting purposes in general which may be shared widely or published.
Staff student and supplier personal data may be shared with payment providers such as
- Lloyds Bank plc – payments to suppliers, staff, students and other individuals, both overseas and UK.
- Convera UK Ltd – payments to suppliers overseas.
- National Westminster Bank plc – to receive payments.
Any personal data may be shared with UK law enforcement or tax collection officials on request if they provide a court order or otherwise can demonstrate the specified information is necessary for the prevention or detection of crime of the collection of taxes. We will also share personal data with health professionals if necessary to protect the ‘vital interests’ of the data subject, and with others if necessary to safeguard children and adults at risk, or any other similar situation that meets the definition of ‘substantial public interest’ under the Data Protection Act 2018.
Unless otherwise specified in a relevant Privacy Notice or to comply with a specific legal obligation, exemption or derogation under Data Protection law, we will only share personal data with others with the explicit consent of the individual.
International Transfer
Personal data will not normally be transferred outside the UK, EEA or territories and organisations deemed ‘adequate’ by the ICO. Where this is necessary, personal data will be transferred with appropriate safeguards as prescribed by the UK Information Commissioner’s Office, such as the UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses (SCCs) plus UK IDTA addendum, ICO-approved Binding Corporate Rules (BCRs), or under the US-UK Data Privacy Framework, except in rare circumstances where a UK GDPR derogation applies.
Retention
Personal data necessary for the performance of a contract, relating to a governor, relating to a complaint about a staff member or to make a payment, or will be retained for 6 years after the end of the contractual relationship or financial year of the payment.
Personal data relating to a complaint about course quality or the student experience, or a complaint about the conduct of a student, will be retained for 6 years after the conclusion of the investigation.
More specific information is provided in detailed Privacy Notices at the point of data collection or sharing.