Student privacy notice

This statement explains how and why the University of Plymouth collects, uses and shares your personal data and your rights in relation to that data

The University (“We” or “us”) is the Data Controller of your information and is registered with the Information Commissioner’s Office under registration number Z7546246. Its Data Protection Officer can be contacted at dpo@plymouth.ac.uk.

The student privacy notice covers the following

1. Why do we collect your data?

The University needs to collect and process student personal data in order to provide teaching, learning and research as well as to enable the necessary function of the institution and comply with its statutory obligations.
When you apply and accept an offer, you enter into a contract with the University and as part of this we need to use your personal information for administrative and educational purposes. Without processing your information, it will not be possible for you to continue or complete your programme of study.
It is essential that the personal data we hold about you is accurate and so we ask that you update your Faculty or School office if you change your personal details such as your name. You are also able to access and amend your address and contact details through the student portal.

2. What type of data do we collect?

The University collects a number of different types of personal data.
The following are examples of personal data (not exhaustive) which may be collected, stored and used:
  • name, address and contact details (including personal email address)
  • date of birth
  • NI number
  • dates of enrolment
  • exam and assessment results
  • predicted and final grades
  • next of kin/emergency contact
  • guardians
  • ethnicity
  • communications
  • gender
  • your image
  • marital and family details
  • complaints and disciplinary records including Fitness to Practice
  • visa and immigration information (including visa and passport details)
  • appeals
  • extracurricular activities
  • educational background
  • DBS checks 
  • Criminal convictions and allegations
  • CCTV footage
  • bank and financial information
  • health records 
  • disability information and assessments
  • educational certificates
  • placement details
  • accommodation issues
  • Care Leaver status.
In certain circumstances special category personal data may be collected. These are more sensitive categories of identifying information including:
  • data concerning health
  • race/ethnicity
  • political Opinions
  • trade union membership
  • religion or belief
  • genetic or biometric data 
  • data concerning someone’s sex life or sexual orientation.
Data relating to criminal convictions and allegations of criminal activity also require similar legal controls to special categories of data and are processed on the same grounds as detailed below.

3. When and how do we collect your data?

The University will collect your information in different ways during its relationship with you. These will include:
  • information you provide directly to us such as on enrolment or during your period of study including from your communications, use of University resources, services and systems and other interactions with the University
  • information you provide through UCAS or other admission procedures, and
  • we may also gain your personal data from third parties, for example, from other students, references, information from your sponsor, placement provider, or from previous educational establishments.

4. How do we use your data?

The University will use your personal data to administer and deliver your student contract. This includes:
  • academic administration such as enrolment on programmes and modules, organising professional placements or field trips, organising exams and assessments, attendance monitoring, recording marks and producing certificates or transcripts
  • administration of your financial relationship with the University and any relevant funders or sponsors such as the assessment and collection of fees due to the University
  • management of your use of and access to facilities and enabling participation in events, for example production of the student card, provision of IT services and accommodation and attendance at graduation
  • communicating with you 
  • promotion of the University (for example, providing information about programmes that may be of interest to you, summer schools and events hosted, co-hosted or supported by the University on and off-campus)
  • operation of security, disciplinary, complaint and quality assurance processes and arrangements including campus-wide CCTV images
  • providing you with services and support such as accommodation, access to the library, computer facilities, lecture capture and tutor support as well as employability services, guidance and tutor support
  • support of health, safety and welfare requirements, production of statistics and research for internal and statutory reporting purposes which may include data on your attainment, attendance and interactions with academic resources. This may be used to monitor progress and enables the University to offer personalised support and guidance.
The University also processes more sensitive personal data (special category data) in the following ways:
  • your race, national or ethnic origin, religious, disability, philosophical or religious beliefs, health or gender and your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting (including where required for monitoring purposes conducted by the Higher Education Statistics Agency (HESA)).
  • certain courses of study, placements and work opportunities may require disclosure or information about past criminal convictions and offences. This will be processed where relevant because you are working with children or vulnerable adults, and/or because of fitness to practise requirements in certain regulated professions. In these circumstances a DBS check may be required, and where this is the case you will be informed separately
  • information about allegations of criminal activity or criminal convictions disclosed to us when you apply or reported to us during your period of study 
  • information about physical or mental health or disability status to ensure your health and safety whilst registered at the University and to assess your fitness to study, travel, take part in placements, provide appropriate reasonable adjustments and where you request it, to make decisions relating to applications for extenuating circumstances
  •  where you choose to provide the University with sensitive information about yourself for the purposes of student support we will use this to work with you and provide the support requested
  • production of non-identifiable statistical data for analysis to fulfil its commitment to equality monitoring and to provide a more targeted response to improving the student experience. 

5. What is the lawful basis for processing personal data?

The University must have a lawful basis in order to process personal data. For the processing of students’ data these have been identified as follows:
  • where it is necessary to perform the contract we have entered into with you; 
  • where it is necessary for the performance of a task in the public interest; 
  • where it is necessary to comply with a legal obligation; 
  • where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
The University may also use your data, typically in an emergency, where this is necessary to protect your vital interests, or someone else’s vital interests. In a small number of cases where other lawful bases do not apply, we will process your data on the basis of your consent. Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information. 
In relation to more sensitive personal data (special category data) the additional legal bases for these are: 
  • where we need to carry out our legal obligations,
  • where you have made the data public,
  • where it is necessary in the substantial public interest, in particular: where necessary for the purposes of the prevention or detection of an unlawful act and must be carried out without your consent so as not to prejudice those purposes; or for equal opportunities monitoring;
  • where it is necessary to protect your vital interests or those of another person and where you/they are physically or legally incapable of giving consent. This would be in an emergency situation where a person’s health, wellbeing or welfare was at risk,
  • where processing is necessary for the establishment, exercise or defence of legal claims
  • where we have your consent to do so,
  • where it is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Where consent is required for any additional uses of your personal information, including your image and more sensitive personal information we will collect it at the appropriate time and explain this to you. Where the University is processing your data on the basis of your consent, you can withdraw your consent at any time. We will not use your personal information to carry out any wholly automated decision-making that affects you.
Should you seek support from the teams in the Student Hub (which include Disability Services and Student Wellbeing Services) they will also collect special category data from you for the purposes of providing you with their support services.

6. How long do we keep your data?

Details of the timeframes for the University to keep your personal data are available in the University records retention schedule

7. Who do we share your data with?

Where there is a legitimate need or statutory obligations the University will disclose necessary personal data to third parties. Depending on individual circumstances and the study route i.e. apprenticeship, these may include the following:
  • Higher Education Statistics Agency (the Designated Data Body for England under the Higher Education Research Act 2017), who from October 2022 have merged with JISC (the UK digital, data and technology agency focussed on tertiary education, research and innovation) (see HESA’s statement about the uses made by them and JISC of your personal information published at https://www.hesa.ac.uk/about/regulation/data-protection/notices.)  
  • Higher Education Access Tracker (HEAT).  We use this platform to track and monitor some students so as to enable statistical aggregation and analysis.  Your data may be shared between HEAT and HESA. The Privacy notice for HEAT can be seen here.
  • partner colleges or institutions where your programme is run in conjunction with a partner college or involves an exchange programme. Sub-contractors where a component of your apprenticeship programme may be delivered by a sub-contractor. 
  • funders and/or sponsors (e.g. the Student Loans Company, funders based in other countries including those outside the UK, UK Research and Innovation, Teach First, the funders of any awards or prizes) 
  • providers of any external/collaborative learning, training, work and other placements (e.g. schools involved in the provision of teacher training and hospitals hosting student placements), or fieldwork opportunities e.g. affiliated institutions, exchange partners, including to providers based overseas
  • providers of external/collaborative research projects involving students including sponsors of studentships, research collaborations and enterprise experience opportunities with third parties as part of a programme of study
  • external examiners and assessors, and external individuals involved in relevant University panels, committees or procedures. For apprenticeship programmes Independent Assessors and External Assessors who would be involved in the integrated End Point Assessment. 
  • relevant UK Government Departments (e.g. Department for Education, Home Office (including UK Visas and Immigration), Foreign and Commonwealth Office, Department of Health and Social Care) in accordance with the University’s obligations as a Student sponsor. In addition, the University will share the information required by UKVI to enable graduating students to apply for the Graduate Immigration route, should they wish to do so.  
  • relevant Higher Education bodies (e.g. Office for Students, UK Research and Innovation, Universities and Colleges Admissions Service, Office of the Independent Adjudicator for Higher Education, the organisation(s) running the National Student Survey and other student and surveys)
  •  any other relevant professional or statutory regulatory bodies and/or apprenticeship programmes integrated End Point Assessment Organisations. 
  • to third party student accommodation providers operating under contract on behalf of the University
  • The University of Plymouth Students’ Union (UPSU), in order to facilitate your membership of this and associated clubs and societies
  • Council Tax Offices where limited data is provided to assist with the administration of students’ exemption from Council Tax
  • Electoral Registration Officers where limited personal data is provided in order to assist with the maintenance of a complete and accurate electoral reform register
  • on occasion and where necessary, Plymouth City Council, the police and other law enforcement agencies for the purposes of prevention or detection of crime including anti-social behaviour issues
  • Occupational health providers in order to access services
  • where necessary the emergency services and your designated emergency contact where there is an urgent requirement to share information e.g. illness, serious injury, bereavement or the suspicion/risk of this
  • Disclosure and Barring Service (DBS) where a DBS assessment is required
  • University's professional advisors, solicitors, accountants, insurers and auditors and, where required, other statutory bodies acting in an audit capacity e.g. OFSTED, QAA and ESAF for apprenticeships
  • for apprentice learners information may also be shared with; the employer, the Education and Skills Funding Agency (ESFA) an executive agency of the Department for Education (DfE) and the funding body for apprenticeships. If you are studying on an apprenticeship programme with a non-integrated End Point Assessment (EPA) the University will need to share your data with the designated End Point Assessment Organisation (EPAO). 
  • third party providers providing specific services to, or on behalf of, the University under contract for the purposes of teaching, learning, research and administration
  • to banks (and other payment agencies you may use), family members who are paying your fees, sponsors or other third parties to enable them to pay student debts and this includes the disclosure of relevant information to our supplier of banking services for the purposes of complying with anti-money laundering regulations and to agencies engaged on our behalf for the collection of unpaid debts
  • external organisations contracted by HESA, JISC or other regulatory organisations to carry out surveys on student experience or teaching quality eg. National Student Survey (NSS) and Graduate Outcomes Survey (GO).
  • when you have nominated a member of staff or the University as a referee to a third party we will provide a reference to them when requested to do so.
  • we will make your name and confirmation of your award available at your graduation ceremony and publish in the local paper but you have the opportunity to opt-out of this by emailing gradlistingsoptout@plymouth.ac.uk
  • to third party providers such as Turnitin whose systems are used to check for improper citation and potential plagiarism in students’ work. Students may therefore be required to provide a limited amount of personal data, for instance name, email address and course details and submissions when using the service.
  • information supplied by apprentice learners will be used by the Learner Records Service (LRS). The LRS issues Unique Learner Numbers (ULN) and creates Personal Learning records across England, Wales and Northern Ireland, and is operated by the Education and Skills Funding Agency (ESFA). For more information about how your information is processed, and to access your Personal Learning Record, please refer to: https://www.gov.uk/government/publications/lrs-privacy-notices.
For students enrolled on professionally accredited courses
We will share your data with your relevant professional body eg. General Medical Council, General Dental Council, Nursing and Midwifery Council, Solicitors Regulation Authority, Health and Care Professions Council: 
  • Registration: we will share your name, contact details and personal data including age, disability and ethnicity with the accrediting or regulatory body if requested.
  •  Graduation: we will share a list of students who completed their award with the regulatory or accrediting body in order to register you to practise as a professional or complete your registration. This may include information about Fitness to Practise/Study incidents which the University investigated while you were a student.
The University may also share information to assist the accrediting or regulatory body with its statutory duties or for research purposes to enable them to conduct research into education for the profession. Any data shared for research purposes will not be used for other purposes, will not be used to make decisions about you nor published in ways which could identify you.
Data transfers to third party countries
On occasion, the above types of sharing may involve the transfer of your personal information outside of the UK to the European Economic Area or outside of the European Economic Area such as the United States. This could be to facilitate your participation in an exchange visit or to report to an overseas funding provider. Such transfers usually are necessary in order to meet our contractual obligations with you, and are carried out with appropriate safeguards in place to ensure the confidentiality and security of your personal information. 
Other than as set out above, we will not normally publish or disclose any personal information about you to other external enquirers or organisations, including parents, family members, guardians and friends unless you have requested it or consented to it, or unless it is in accordance with data protection law (e.g. in an emergency situation). 

8. What rights do I have?

As a data subject you have a number of rights in relation to your personal data. You can:
  • access and obtain a copy of your data on request
  • require the University to amend incorrect or incomplete data
  •  require the University to stop processing your data, for example where the data is no longer necessary for the purposes of processing
  •  object to the processing of your data where the University is relying on its legitimate interests as the legal ground for processing 
  •  require us to erase your personal data
  •  require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
  •  receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller.
Please note that the above rights are not absolute, and the University may be entitled to refuse requests where exceptions apply. 
For further information or if you wish to exercise any of these rights or if you have a complaint about the way you believe your data is being processed, in the first instance, please see your information rights or email: dpo@plymouth.ac.uk.
If you have a complaint and you remain dissatisfied with how your complaint has been dealt with you can take your complaint to the Information Commissioner’s Office (ICO) for a review. They can be contacted at casework@ico.org.uk

9. Changes to this notice

This privacy notice is reviewed annually or when required to ensure compliance with data protection legislation. If significant changes are made to this notice and the way we treat your personal information we will make this clear and may seek to communicate this directly to you.
 July 2023.