Student Privacy Policy

This privacy notice relates to your personal data as necessary for enrolment and studying at University of the Arts London. During your time at UAL you may sign up to other services or programmes for which other privacy notices will apply, e.g. a placement, counselling, a short course, ArtsTemps employment.

Please see the UAL Privacy Information webpage for UAL’s general information as a Data Controller, details of our Data Protection Officer and your rights under the EU General Data Protection Regulation and the UK Data Protection Act 2018.

Data collected or created and purpose

UAL processes personal information taken from your application, enrolment form, agents, referees or other third parties supporting your application, information and documentation you provide in support of your application, and information collected or created during your time with us such as tuition notes and course progression, attendance record, your photograph, correspondence, feedback and other comments, details of payments made and received or debts owed, complaints, enquiries, and information you may choose to provide such as special requirements, health or diversity information and marketing preferences.

We use this information to provide your course and support your studies and welfare, to verify your identity, maintain contact with you (by post, email and phone), offer additional related services and information, monitor and enforce the conditions of our agreement with you, to manage payments, for credit scoring and assessment, debt tracing, to manage your use of facilities (e.g. IT, libraries) and participation at events, to support disciplinary, complaint, and quality assurance processes and arrangements, to fulfil our legal obligations, for internal and external auditing purposes and - in anonymised form - to report on our activities and monitor diversity. We will also store the details of the emergency contacts you have provided in case we need to contact them.

CCTV images, card access data and data recording your interaction with UAL IT systems (including wifi and UAL email) are used to maintain the security of the University, its staff and students. In exceptional circumstances we may need to analyse your content to help us detect abuse such as spam, malware, and illegal activity.

Your personal data may be used for other purposes in accordance with an appropriate legal basis, for example with your consent or through other agreements you enter into during your time with us, which will be covered on separate privacy notices at the time.

Please see our cookies notice for further information about what information may be automatically collected when you visit our websites.

GDPR legal bases for processing

In most cases, information relating to you and your studies, including any support services provided and information created by your tutors or others during your studies, will be processed under the GDPR legal basis 6(1)b ‘necessary for the performance of a contract’. Your enrolment and the student terms and conditions form the contract between you and UAL.

Where required by a UK law, processing may occur under basis 6(1)c ‘necessary for compliance with a legal obligation’.

CCTV images, card access data and data recording your interaction with UAL IT systems - including your use of UAL email - will be processed under the basis 6(1)f ‘legitimate interests’ to maintain security for the University, its assets, staff and students and to monitor the use of our premises and systems. Your photograph may also be used to help tutors and other staff members identify you in classrooms and at events.

Marketing contact may sometimes be made under 6(1)f ‘legitimate interests’ if related to your studies, but otherwise will be with your consent. In either case you can withdraw consent or unsubscribe from direct marketing by clicking an ‘unsubscribe’ link or contacting the sender directly.

Special Category (Sensitive) Data

GDPR ‘special category’ personal data includes:

• Information relating to disabilities, health or dietary requirements provided for the purposes of making reasonable adjustments
• Information relating to ethnicity, sexuality or religion for the purpose of statistical monitoring

This type of data will normally be processed under the legal basis 9(2)a ‘explicit consent’ if you agree to provide it. You can withdraw consent at any time by contacting the department which collected it, in which case this data will be deleted.

If provided, some special category data will be shared with the Higher Education Statistics Agency (HESA/Jisc) and the Education and Skills Funding Agency (ESFA) under basis 9(2)j ‘processing is necessary for…statistical purposes’. Special category data may also be processed under 9(2)c Vital Interests if necessary to save your life or that of others, or under 9(2)g Substantial Public Interest if necessary for safeguarding children or vulnerable adults or provide counselling, where it is not practical or appropriate to obtain your consent.

Information relating to declared criminal convictions or any unspent criminal convictions will be collected under 9(2)g Substantial Public Interest in order to identify potential threats to children and vulnerable adults.

Data storage, access and sharing with third parties

Your data will be stored on UAL hosted systems and databases, which can be accessed by relevant staff employed by the University. Your name and UAL email address will be made available to all staff and students through the UAL internal online directory service.

We will sometimes need to share or provide access to your personal data with third parties who are engaged as data processors on our behalf. These may include course tutors or support staff working through their own company or organisations outside of UAL. Data will always be shared within the EEA, with a territory deemed adequate by the EU, or with appropriate safeguards in place in line with GDPR, unless you consent otherwise or enter into a separate agreement that covers the processing.

Under legal basis 6(1)f Legitimate Interests, we will share your name, course and contact details with the Arts Student Union ("Arts SU") to facilitate automatic membership to its services, clubs, societies and events which are available to all students. If you do not want to be a member of Arts SU please opt out in accordance with options provided to you on enrolment or email info@su.arts.ac.uk to cancel your membership.

On completion of your course, your results will be published on a public notice board or on our website, shared with Higher Education Degree Datacheck (HEDD) degree verification and provided to third-parties if references are requested directly.

If you apply to attend a graduation ceremony your first name, initials, surname and degree title will be printed in the souvenir programme and may also appear on some UAL merchandise. You must inform the graduation team in writing at graduation@arts.ac.uk before the ticket application deadline if you wish to opt out of this.

UAL may also share your data with third parties to fulfil a legal obligation or for other legal purposes.

Personal data may be shared with the appropriate authorities if necessary for the prevention or detection of crime, the apprehension of offenders, or the collection of taxes.

Other sharing of your information or storage outside of UAL will be covered in privacy notices at the point you sign up to the service or provide the information for that specific purpose, e.g. surveys, student support services.

Retention

After you graduate core student records will be kept permanently to provide references. Your core student record comprises of your title, official name, name used (if different), date of birth, student ID number, course and dates of study, transcript of results and award attained.

Your name and contact details will be retained after the end of your studies in order to provide alumni services and contact, including continued library access. Details will be provided by Development and Alumni Services near the point of graduation.

Personal data which relies on your consent as a legal basis will be deleted if you withdraw consent.

Other data will be deleted within 6 years after completion of study.

Automated decision making and profiling

Your personal data will not be used for automated decision making or profiling without your consent.

Examples of some organisations we share your personal data with include: