Student Privacy Policy

This privacy notice relates to your personal data as necessary for enrolment and studying at University of the Arts London. During your time at UAL you may sign up to other services or programmes for which other privacy notices will apply, e.g. a placement, counselling, a short course, ArtsTemps employment.

Please see the UAL Privacy Information webpage for UAL’s general information as a Data Controller, details of our Data Protection Officer and your rights under the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

Please see our cookies notice for further information about what information may be automatically collected when you visit our websites.

Data collected or created and purpose

UAL processes personal information taken from your application, enrolment form, agents, referees or other third parties supporting your application, information and documentation you provide in support of your application, and information collected or created during your time with us such as tuition notes and course progression, attendance record, your photograph, correspondence, feedback and other comments, details of payments made and received or debts owed, complaints, enquiries, and information you may choose to provide such as special requirements, health or diversity information and marketing preferences.

We use this information to provide your course and support your studies and welfare, to verify your identity, maintain contact with you (by post, email and phone), offer additional related services and information, monitor and enforce the conditions of our agreement with you, to manage payments, for credit scoring and assessment, debt tracing, to manage your use of facilities (e.g. IT, libraries) and participation at events, to support disciplinary, complaint, and quality assurance processes and arrangements, to fulfil our legal obligations, for internal and external auditing purposes and - in anonymised form - to report on our activities and monitor diversity. We will also store the details of the emergency contacts you have provided in case we need to contact them.

CCTV images, card access data and data recording your interaction with UAL IT systems (including wifi and UAL email) are used to maintain the security of the University, its staff and students. In exceptional circumstances we may need to analyse your content to help us detect abuse such as spam, malware, and illegal activity.

Information about your health may be recorded to provide reasonable adjustments and other support for those declaring a disability, or to provide counselling or safeguarding support. Information you choose to provide about disabilities, your ethnicity, religion, sexuality etc or will be used to monitor and report on equality and diversity at the University. See ‘special category (sensitive) data’ in the section below.

Your personal data may be used for other purposes in accordance with an appropriate legal basis, for example with your consent or through other agreements you enter into during your time with us, which will be covered on separate privacy notices at the time.

Your personal data will not be used for automated decision making or profiling without your consent.

If you apply to attend a graduation ceremony your first name, initials, surname and degree title will be printed in the souvenir programme and may also appear on some UAL merchandise. You must inform the graduation team in writing at graduation@arts.ac.uk before the ticket application deadline if you wish to opt out of this.

GDPR legal bases for processing

In most cases, information relating to you and your studies, including any support services provided and information created by your tutors or others during your studies, will be processed under the GDPR legal basis 6(1)b ‘necessary for the performance of a contract’. Your enrolment and the student terms and conditions form the contract between you and UAL.

Where required by a UK law, processing may occur under basis 6(1)c ‘necessary for compliance with a legal obligation’. This includes processing necessary to confirm the immigration status and report on the attendance of overseas students, and processing necessary to provide reasonable adjustments and other support for those declaring a disability.

CCTV images, card access data and data recording your interaction with UAL IT systems - including your use of UAL email - will be processed under the basis 6(1)f ‘legitimate interests’ to maintain security for the University, its assets, staff and students and to monitor the use of our premises and systems. Your photograph may also be used to help tutors and other staff members identify you in classrooms and at events.

Feedback on courses and events will be processed under the basis 6(1)f ‘legitimate interests’ to assess and improve the delivery and quality of courses and events.

Depending on the course, information relating to declared criminal convictions or any unspent criminal convictions may be collected under 6(1)f our ‘legitimate interests’ to fulfil the purposes listed under Data protection Act 2018 Schedule 1:

• Part 1, paragraph 1 – necessary for the purposes of performing obligations under the law relating to social protection.
• Part 2, paragraph 11 – protecting the public against dishonesty.

Marketing contact may sometimes be made under 6(1)f ‘legitimate interests’ if related to your studies, but otherwise will be with your consent. In either case you can withdraw consent or unsubscribe from direct marketing by clicking an ‘unsubscribe’ link or contacting the sender directly.

Special Category (Sensitive) Data

GDPR ‘special category’ personal data includes:

• personal data revealing racial or ethnic origin
• personal data revealing political opinions
• personal data revealing religious or philosophical beliefs
• personal data revealing trade union membership
• genetic data
• biometric data (where used for identification purposes)
• data concerning health
• data concerning a person’s sex life; and
• data concerning a person’s sexual orientation.

This type of data requires an additional legal basis under GDPR Art.9 and has more restrictions covering its use.

Information relating to disabilities, health or dietary requirements provided for the purposes of making reasonable adjustments is processed under GDPR Art.9(2)b where the use of personal information is necessary for carrying out obligations in the field of social protection law.

Information relating to ethnicity, sexuality or religion for the purpose of statistical monitoring of equality and diversity is processed under GDPR Art.9(2)g ‘substantial public interest’, for the purpose under the Data Protection Act 2018 of reviewing the existence or absence of equality of opportunity or treatment between different groups of people, including differences based on ethnicity, religious beliefs, and sexual orientation. This information is not used to influence decision-making.

Information needed to provide counselling or to support safeguarding activity will normally be processed under the legal basis 9(2)a ‘explicit consent’ if you agree to provide it. You can withdraw consent at any time by contacting the department which collected it, in which case this data will be deleted.

In circumstances where it is not practical or appropriate to ask for consent – for example if you are considered to be at particularly high risk – information necessary to support counselling interventions or the safeguarding of children or vulnerable adults will be processed 9(2)g ‘substantial public interest’ as defined under the ‘counselling’ and ‘safeguarding’ sections of the Data Protection Act 2018 Schedule 1.

If provided, some special category data will be shared with the Higher Education Statistics Agency (HESA/Jisc) and the Education and Skills Funding Agency (ESFA) under basis 9(2)j ‘processing is necessary for…statistical purposes’.

Special category data may be processed under 9(2)c Vital Interests if necessary to save your life or that of others.

In other circumstances, special category data will only be processed with your recorded consent for the stated purpose under 9(2)a ‘explicit consent’.

You can find more information about these lawful bases at the ICO website, or by searching online for the text of GDPR or the Data Protection Act 2018.

Data storage, access and processing on UAL’s behalf

Your data will be stored on UAL-managed systems and databases, which can be accessed by relevant staff employed by the University. Your name and UAL email address will be made available to all staff and students through the UAL internal online directory service.

We will sometimes need to share or provide access to your personal data with third parties who are engaged as data processors on our behalf. These may include course tutors or support staff working through their own company or organisations outside of UAL.

Examples of organisations which process data on UAL’s behalf include:

• Microsoft for email, audio visual collaboration and file storage.
• Mailchimp for direct marketing emails.
• JISC, Qualtrics and SurveyMonkey for forms and surveys
• Eventbrite for event booking.
• Unit 4 N.V. (Agresso Business World database), Worldpay, National Westminster Bank Plc, Lloyds Banking Group Plc, To process payments and financial details.
• Blackboard, Panopto and other teaching platforms to facilitate course collaboration, lecture capture and remote learning.
• PTFS Europe to track use of library services needed to support learning.

Data will always be processed within the UK, with a territory deemed adequate by the UK Information Commissioner’s Office (ICO), or otherwise transferred to another territory with appropriate safeguards in place. or under GDPR derogations if they apply,.

Retention

After you complete your studies, core student records will be kept permanently to provide references. Your core student record comprises of your title, official name, name used (if different), date of birth, student ID number, course and dates of study, academic results and award attained.

Your name and contact details will be retained after the end of your studies in order to provide alumni services and contact, including continued library access. Details will be provided by Development and Alumni Services near the point of graduation.

Personal data which relies on your consent as a legal basis will be deleted if you withdraw consent.

Other data will be deleted within 6 years after completion of study.

Sharing with third parties

We share some information with third-parties who act as controllers of data in their own right. You can find their privacy information on their websites.

Under legal basis 6(1)f Legitimate Interests, we will share your name, course and contact details with the Arts Student Union ("Arts SU") to facilitate automatic membership to its services, clubs, societies and events which are available to all students. If you do not want to be a member of Arts SU please opt out in accordance with options provided to you on enrolment or email info@su.arts.ac.uk to cancel your membership.

On completion of your course, your results will be published on a public notice board or on our website, shared with Higher Education Degree Datacheck (HEDD) degree verification and provided to third-parties if references are requested directly.

UAL may also share your data with third parties to fulfil a legal obligation or for other legal purposes.

Personal data may be shared with the appropriate authorities if necessary for the prevention or detection of crime, the apprehension of offenders, or the collection of taxes.

Other sharing of your information or storage outside of UAL will be covered in privacy notices at the point you sign up to the service or provide the information for that specific purpose, e.g. surveys, student support services.

Examples of some organisations we share your personal data with include: