Student privacy notice

This notice explains how the University of the West of England, Bristol (UWE, we, us), “the data controller” uses information about you. We refer to this information as personal data. Personal data can be anything that relates to you, such as your name, contact details, exam results and health information.

UWE Bristol is committed to helping you understand how and why we use your personal data. We are dedicated to keeping your personal data secure and only using it lawfully.

If you have any questions about how we use your personal data please contact our Data Protection Officer at dataprotection@uwe.ac.uk.

You also have rights in your personal data, which we detail below in the section headed - Your Rights.

We have separate privacy notices which explain how we use your personal data in relation to admissions and accommodation:

• For admissions, please see our Admissions Privacy Notice.
• For accommodation, please see our Accommodation Privacy Notice.

We hold the following types of personal data:

• admissions information (eg information received from UCAS or from you or your representative (if you applied via an international agent or a partner institution), your exam results before you joined UWE Bristol)
• your name and contact details (including email address, telephone number and home address), your gender identity and other demographic information and your date of birth
• details about what course you are studying
• information about your academic progress, eg exam and coursework marks
• information about your wellbeing, eg if you are experiencing any personal difficulties
• information about your conduct or behaviour
• medical information and information about any disabilities or special educational needs you may have
• information about any reasonable adjustments agreed with you to support your access to educational and other services
• information about your job and employment, for example where your employer enrols you on one of our courses.

This covers most of the personal data we hold about our students but we may have additional types of information, for example, depending on your circumstances or the course you are enrolled on.

We get information from the following sources:

• you
• UCAS and international agents (where you have used their services) will provide us with information such as your exam results, contact details and personal statement
• your friends (including other UWE Bristol students) and family may provide us with your personal data, eg about your wellbeing, if they are concerned about you
• when using external services provided by UWE Bristol, such as the Health Assured Support line, we may receive information regarding your wellbeing so we can offer you support
• in exceptional circumstances, we may receive information about you from the police or medical professionals, eg if you have been involved in an accident
• if you study abroad, we will receive your personal data (eg your grades) from the university which you attend overseas
• if you carry out a work placement, we will receive your personal data from the relevant employer. This will include records of attendance, reports from mentors and/or supervisors and any other matters relating to your progress whilst on placement. We take our data protection obligations seriously and ensure that we only use and share within UWE Bristol our personal data as is allowed under data protection law. Where information is more sensitive, eg special category data such as medical information, we take extra precautions to keep it safe.

We use your personal data in order to:

• provide the programme you are participating in, such as your degree, research, or course
• manage your engagement with the wider UWE Bristol community. For example, we share your details with The Students' Union at UWE to enable you to get involved (for example, vote in student union elections)
• safeguard the welfare of our students, including you
• assist us with our legal and regulatory obligations
• make UWE Bristol better and protect UWE Bristol and members of our community.

Under data protection law, we are only allowed to use your personal data if we have a lawful basis for doing so.

In many cases, our lawful basis is public interest task. This allows us to use personal data where doing so is necessary in order to perform a task in the public interest. This basis applies when we use personal data for teaching and research purposes and also for student welfare purposes. This means that we rely on public interest task as a lawful basis for a lot of what we do under the first and third purposes listed above in particular.

Sometimes we will be relying on other lawful bases (either instead of or in addition to public interest task). These bases are as follows:

• Contract: you have a contract with us and we will need to use your personal data so that we can both carry out our obligations under the contract. For example, so that we can provide the services under the contract and so that we can collect payment from you. This basis also applies if we need to take steps at your request before we enter into a contract. This means that, where there is a contract between us, then we are relying on contract as a lawful basis for much (but not all) of what we do under the first purpose listed above.
• Legal obligation: this applies where we need to use your personal data in order to comply with one of our legal obligations. We are using legal obligation as a lawful basis for the fourth purpose listed above.
• Vital interests: occasionally, we may need to use personal data to protect your vital interests or somebody else's (vital interests). This usually only applies if we need to use personal data in an emergency, for example, a "life and death" situation.
• Legitimate interests: where necessary for the purposes of our legitimate interests or someone else's legitimate interest where such legitimate interests do not infringe your own rights and freedoms. More detail about these legitimate interests is provided in section 5.
• We may rely on your consent in some circumstances and we will be very clear with you when we are seeking your consent. Where we rely only on your consent to process your personal data, you may withdraw your consent at any time.

The sections below contain more information about why we use your personal data under each of the five purposes above.

1. Your degree, research, or programme of study

This section explains how we use your personal data in relation to the programme you have enrolled on.

• Your personal data gathered during the admissions process (eg information on your UCAS form) will be used to enable you to enrol at UWE Bristol. For example, we will communicate with you about your course, prepare your teaching timetable and create your enrolment records and give you access to UWE Bristol's student systems.
• We will record and monitor your attendance, engagement and academic progress. This is used to check how you are doing, to provide appropriate support, and to award your degree or qualification where appropriate.
• We will communicate with you about your studies (eg to let you know when and where your classes and exams will take place).
• We will use your personal data for administration and management purposes, for example, to determine which classes you will be in, what assessments you need to submit, your timetable and matters relating to the payment of fees and financial support (including bursaries and scholarships).
• We use your personal data to provide you with IT and library services (eg to provide you with a UWE Bristol user account, email address, library card and access to UWE Bristol systems).
• We will use information about any disabilities or special educational needs and any agreed reasonable adjustments in order to support you.
• We will consider extenuating circumstances for an exam or coursework concession or extension.
• We will process financial information about you in relation to the payment of any fees you are responsible for. We may hold information about charges, loans, grants, studentships and hardship funds. We may pass your personal data (eg contact details) to debt recovery agents if you owe UWE Bristol money.
• We publish your course marks and exam results to you (and only you) via secure access to the UWE Bristol portal. We also publish a programme for our graduation ceremonies which contain the names of graduating students.
• We sometimes record (visual and/or audio) lectures. This is so that students can watch them in their own time. We will always let you know when this is happening, eg the lecturer may mention it at the start of the lecture. To find out more, please read our policy: Audio Visual Recording for Educational Activities (PDF).
• We also occasionally record University activities that you participate in. For example, activities carried out in accordance with our governance arrangements. We will always let you know when this is happening before recording has started. To find out more, please read our policy: Audio Visual Recording for Educational Activities (PDF).
• We may use your personal data when monitoring student assessments and examinations, eg video recordings.

We may also use your personal data in other ways in relation to your programme:

• If you have asked us to do so (for example, by putting us down as a reference), we will share information about your UWE Bristol studies with others such as potential employers and other education institutions.
• We will provide you with careers information. This may include helping you to complete careers aptitude tests and carrying out mock job interviews if you request this, as well as sending you information about suggested careers and opportunities.
• If you provide feedback, or it something hasn't gone right (for example, if you complain about a course) then we will investigate in order to improve practices for future.
• Occasionally, we investigate academic or professional conduct issues, eg to investigate an allegation of plagiarism. This is to protect the integrity of the academic process.

Depending on your circumstances or your programme, we will also use your personal data as follows:

• If you have a disability or medical condition, we will use information about this to make reasonable adjustments for you, eg to facilitate access to buildings or to vary exam arrangements. This is also in accordance with our legal obligations.
• If you are undertaking an apprenticeship, we will share your personal data, eg your attendance and progress on your course, with your employer in accordance with your commitment statement. The apprenticeship employer may also provide your personal data to us, eg your national insurance number or other information required for statutory reporting purposes.
• If you take a course which is exempt from the Rehabilitation of Offenders Act (eg social work), we will need to carry out a Disclosure and Barring Service check. We will provide further information if this is relevant to you.
• If you carry out a work placement during your course, we will use your personal data to administer this, eg providing your details to the organisation which you will be working with, including your name, contact details, programme of study and other information required to provide you with a meaningful placement experience.
• Where it is necessary as part of your course requirements to undertake a professional work placement in a care or educational setting, we will share your personal data with NHS organisations and schools, eg your name, contact details, details of you course and any other details to ensure lawful compliance within that workplace.
• If you study abroad, we will use your personal data to facilitate this, eg by sharing your personal data including your name, contact details and programme of study with the university you will be attending abroad. The partner university will ask you to provide more detailed information when you apply or register with them.
• We may also share your qualifications with recognised professional and regulatory bodies, eg the Nursing and Midwifery Council, Solicitors Regulatory Authority and the Royal Society of British Architects. This is for purposes such as facilitating your registration with that body, accrediting your course and to help the regulator to check that you have the right qualifications.
• If you have a sponsor who pays your fees (eg an overseas government or the Student Loans Company) we will share information about your attendance with them.
• If we jointly provide one of your courses with another education provider, we will share information about how you are progressing eg your attendance and marks.

We use your personal data as part of our Learner Analytics system. This system creates engagement scores based on how often you use certain resources, such as, taking a book out of the library or view course content on Blackboard. For more information please see our Learner Analytics Privacy Notice.

2. Your engagement with the wider UWE Bristol community

• We will share some of your personal data with The Students' Union at UWE to enable participation in their activities, such as, voting in their elections.
  1. UWE Bristol student number
  2. First (given) name(s)
  3. Surname (family) name
  4. Gender
  5. Date of birth
  6. Nationality
  7. Mobile number if you have provided one
  8. Personal e-mail address if you have provided one
  9. UWE Bristol e-mail address
  10. Term address, postcode and telephone number if you have provided them. If not, we will use your home address, postcode and telephone number.
  11. Term accommodation type: For example: own home, parent or guardian home, rented accommodation (UWE Bristol or private)
  12. The name of the course(s) you're registered on. You may have more than one course name.
  13. Study mode: How you're studying your course. For example: sandwich, full-time, part-time.
  14. Level of study: Level of your course. For example: undergraduate degree, postgraduate degree.
  15. Registration status: Whether you are registered. For example: provisionally registered, fully registered.
  16. College name: The College in which your course is taught. You may have more than one College.
  17. Campus of study: The UWE Bristol campus where most of your teaching takes place.
• We will use your contact details to let you know about events which are related to the student experience, eg when we are running extracurricular activities like the Grand Challenge, careers events, personal development opportunities or academic skills development.
• We will pass your name and contact details to our Alumni and Development Team shortly before you leave UWE Bristol so that you can maintain links with us. Please see our Alumni Data Privacy Notice for more information about how your personal data will be used by our Alumni and Development Team. This is for our legitimate interest in developing our alumni community. Specifically, we have a legitimate interest in promoting the objects and interests of UWE Bristol. This includes fundraising eg if we want to raise money for research or new buildings.

3. Looking after you and others

• We will use your personal data to help us to safeguard your welfare and the welfare of others. If we have a concern about your welfare or the welfare of someone else such as another student, eg if we are concerned that you are at risk of physical harm or exploitation, we may share personal data with outside agencies. These agencies may include a local authority, the police or other law enforcement agencies. Sometimes, we have a legal obligation to share information with outside agencies in these circumstances, eg where the police provide us with a court order or where you are aged under 18 years old.
• If we have serious concerns about your welfare (eg if you are at risk of harming yourself), we may share information about you with your emergency contact or other family member or supporter to protect your vital interests.
• If we have less serious concerns about your welfare and we consider it appropriate to do so, we will still notify your parents, other family members or designated emergency contacts. We will only do this with your consent and we may provide you with a consent form for this purpose. If you don't consent or you withdraw your consent, we may still share your information as mentioned above where this is to protect your vital interests. If you are unwell or have an accident, we may share your information with medical professionals, such as paramedics and doctors.
• When using the Health Assured support line, you are using a separate service offered to students of UWE Bristol. Health Assured provides a confidential service and the information you discuss with their helpline support workers is not routinely provided to the University unless your health, wellbeing or welfare is judged to be at imminent risk. In these circumstances and where the support worker thinks you need additional support, they will seek your consent to share your name and information about their concerns so they can provide you with further help. In some circumstances, where you are not able to provide consent or where you refuse consent, Health Assured may still decide to share relevant information with the University where it is necessary to protect your or another person’s vital interests. Health Assured may also share anonymised reports with the University so that we can assess the current services available. In some cases, and only with your consent, the University will offer you a direct referral to the Health Assured support line. To make a referral, the University will share your name, contact details and the purpose of the referral. Further information on how Health Assured process your data can be found at Health Assured.
• We may share information with the police or other bodies with law enforcement or regulatory functions, for example, if they are investigating an incident which took place on one of our campuses. We may share information about both alleged victims and any alleged perpetrators.
• We will share information with one of your relatives or nominated representative if you have asked them to act as your advocate in a dispute with UWE Bristol.
• If you have a medical condition which may constitute a public health risk (eg Tuberculosis) or have travelled from a country where a public health risk may exist, we will record your identity and share this with the University medical service.
• We will use your personal data when providing advice and support. This may be if you see one of our advisers or if you speak to a tutor about any difficulties you are experiencing. The University also provides a Wellbeing Service. To find out more about how your data is processed in this context, please see the Student Support and Wellbeing Privacy Notice.
• We will record any periods of absence including those due to ill health.
• Monitoring of your student email account or internet usage would be employed only in exceptional circumstances in order to protect you or others.
• We will share personal data, where applicable, with Student Finance England, Student Finance Wales, Student Awards Agency for Scotland, Student Finance Northern Ireland, the US Federal Loans and other student funding bodies, such as your attendance and enrolment, to enable them to provide you with financial services and support.
• We monitor access to University buildings (swipe card access) where this is necessary for health and safety, security or to protect University property.
• We use CCTV, Body Worn Video, and Automatic Number Plate Recognition (ANPR) for the prevention and detection of crime, to ensure the security, safety and wellbeing of our students, staff and other campus users. We may need to verify your ID (eg for access to buildings, when sitting examinations or when you are on placement).
• We may investigate non-academic disciplinary proceedings or investigations, eg to investigate an incident of violence or theft on campus.
• We will record information about accidents that take place on our premises. We may share information about accidents with other organisations such as the police.

4. Compliance with our legal and regulatory obligations

Sometimes we will have to use your personal data because we have a legal obligation to do so:

• Under health and safety law we are required to share information about certain accidents with the Health and Safety Executive.
• We are obliged to make referrals to the Prevent Programme where we are concerned that someone is, or may become, involved in terrorism. This will involve making an internal record and sharing information with the South West Prevent Regional Co-ordinator for Further Education and Higher Education and the police.
• We are required to share certain personal data with the Higher Education Statistics Agency (HESA). This information includes sex, race/ethnicity, disability, religion or belief and age as well as details of your studies at UWE Bristol and your contact details for HESA to conduct their Graduate Outcomes survey. We may share other information on a voluntary basis, such as, sexual orientation and gender identity.
• Please see HESA's data collection notice for more information on the point above.
• If you have a Tier 4 visa or other visa that allows you to study in the UK, we are required to take and store a copy of your current passport and visa. We may disclose your personal data (eg contact details, attendance and any change of course or circumstance to the UK Visas and Immigration Department. If you are a student with a Tier 4 visa studying at one of our Partner Institutions, the Partner will be your immigration sponsor and is responsible for meeting the requirements of the UK Visas and Immigration Department.
• UWE Bristol is required to check the immigration status of all of our students because we are a Tier 4 sponsor. We may need to share information with the UK Visas and Immigration Department.
• If we receive a Freedom of Information Act request, or a subject access request under data protection law, we may have to disclose your personal data to respond properly.
• Occasionally, we may be required to disclose information under a court order.

5. Making UWE Bristol better and protecting UWE Bristol and members of the University community

We may use photographs and videos of you in our publicity material. This may include on our website, on our social media channels and in printed materials, such as prospectuses. We consider that we have a legitimate interest in publicising UWE Bristol, for example, to attract new students. Where our use of a photograph or video is more intrusive to your privacy we will seek your consent.

We may also use your personal data where we consider that we have a legitimate interest in protecting UWE Bristol and/or others:

• We may share your personal data with our professional advisors (eg lawyers, accountants), for example, when we need their advice on a particular issue.
• We may share your personal data with our insurance company to make sure that we have the insurance cover that we need or in connection with an actual or possible claim.
• We may be required to use a minimal amount of personal information such as name, username, email address, computer name and IP address for the purposes of detecting and preventing malicious activity on our IT systems. This information may also be used to ensure compliance with our Acceptable Use Policy.

We will sometimes share personal data with third parties where we consider we have a legitimate interest in supporting their work:

• We may share personal data (eg dates of attendance) with agencies who are investigating alleged fraud. This will include benefits agencies, government departments, NHS Counter Fraud Department, Local Government Council Tax Departments.
• We may share details regarding confirmation of your student status and your address details with a local council so that it may assess the amount of council tax due.
• We also share personal data with the local Election Returning Officer (at the council) so that they may send out communications encouraging eligible students to register to vote.

Sometimes, we may use information about criminal convictions or offences. This will usually be where such processing is necessary to carry out our obligations, to exercise our rights, to look after our students and staff or to support the police and other relevant agencies. For example, if one of our students is arrested for an offence, we may to need to take steps to protect our other students.

We will only use information about criminal convictions or offences where the law allows us to and our lawful basis will be either public interest task or legal obligation. We also need to identify the relevant condition for the processing, this will usually be substantial public interest.

In certain circumstances we may send your information to countries which do not have the same level of protection for personal information as there is in the UK. For example, if you are studying abroad in China or in the USA or where we store your personal data on cloud computer storage based overseas.

The European Commission has produced a list of countries which have adequate data protection rules.

If the country that we are sending your information to is not on the list, or is not a country within the EEA (which means the European Union, Liechtenstein, Norway and Iceland), then it might not have the same level of protection for personal information as there is in the UK.

We will provide you with details about the safeguards which we have in place outside of this privacy notice. If you have any questions about the safeguards that are in place, please contact our Data Protection Officer at dataprotection@uwe.ac.uk.

We will only retain your personal data for as long as we need it to carry out the purposes in this notice.

Please see our University Records Management Policy and Records Retention Schedules for more detailed information. These are available by contacting our Data Protection Office at dataprotection@uwe.ac.uk.

Data protection law gives you a number of qualified rights regarding your information. Your rights are as follows:

• Rectification: if information that we hold about you is incorrect you can ask us to correct it.
• Access: you can also ask what information we hold about you and be provided with a copy. This is commonly known as making a subject access request. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to.
• Deletion: you can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information.
• Portability: you can request the transfer of your information to you or to a third party in a format that can be read by computer. This applies where (a) the information has been provided by you; (b) the lawful basis that we are relying on is your consent or a contract; and (c) the information is being processed by us on a computer.
• Restriction: our use of information about you may be restricted to simply storing in some cases. For example, if you tell us that the information is inaccurate and can also ask that we only use it for limited purposes while we check its accuracy.
• Object: you may object to us using your information where:
  • we are using it for direct marketing purposes (eg to send you information about our alumni services)
  • the lawful basis on which we are relying is either legitimate interests or performance of a task carried out in the public interest task
  • we use your information for scientific or historical research purposes or statistical purposes
  • we are using it for automated decision making or profiling.

You have a right to lodge a complaint with a data protection supervisory authority. The supervisory authority in the UK is the Information Commissioner's Office.

If you do have any concerns about how we have handled your personal data, we would kindly ask that you contact us in the first instance before you speak to the ICO so that we have an opportunity to put things right.