Enquirer privacy policy

This privacy notice explains how we use your data in relation to your enquiry

The University of Plymouth is registered with the Information Commissioner’s Office Z7546246 and is responsible for the use of the personal data provided to it. You may provide us with information directly but we may also receive it from third parties including but not exclusive to:
  • Cappex
  • Common App
  • GBGroup
  • Hotcourses
  • International agents
  • Postgrad.com
  • Prospects
  • ThinkPostgrad
  • UCAS
  • Your attendance at Higher Education fairs
  • Your attendance at school/college careers fairs and other outreach events
This privacy notice explains how we use your data in relation to your enquiry. If you apply to become a student at the University, then you should refer to our applicant privacy policy.

What personal data will be processed?

The personal data we process will be:
The information that you provide to us when you fill in a form (for example, if you order a prospectus, register for an Open Day, meet us at a UCAS fair) such as:
  • your name and contact details
  • your date of birth
  • your ethnicity
  • your nationality, to determine whether you are a UK/EU or international student
  • your domicile, including postcode
  • your subject(s) of interest
  • the start year of the subject you are interested in
  • your predicted and achieved academic qualification.
Our registration for, and attendance at, University events (such as open days); and records of communications sent to you by the University or that we receive from you.
Occasionally we may need to process data which is classed as ‘special category’ or sensitive personal data. This data includes data about your ethnicity, sexual orientation, religious beliefs or health/disability data.

What is the lawful basis of the processing?

The University may rely on one or multiple grounds for processing your personal data including:
  • you have provided consent for the processing
  • there is a contractual commitment to provide the services and, therefore, processing is necessary to meet those contractual obligations
  • where processing of certain data is in the public interest, for example, the data is processed for scientific or historical research purposes or statistical purposes and the lawful basis for this is the performance of a task carried out in the public interest, for example where it promotes equality of opportunity, where it enables the delivery of the University’s charitable activities and the subsequent benefits to society
  • the information is available to the public at large; and/or
  • the processing is necessary for the purposes of legitimate interests of the University or other third parties and does not affect the fundamental rights and freedoms of the individuals concerned.
When we use your data to compile statistics and conduct research, we usually use anonymised data from which you cannot be identified, but where that is not possible, we do so on the basis that this is necessary:
  • in the public interest; or
  • for scientific or historical research or statistical purposes; or
  • for the purposes of the University’s legitimate business interests (for example, in order to manage and develop its business).
We will only process your special category data (which is sensitive information about you) with your explicit consent or if it is necessary:
  • for the establishment, exercise or defence of legal claims;
  • very occasionally, when it is needed to protect your or another person’s vital interests and you are not capable of giving your consent (for example, in an emergency);
  • archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
  • where processing is necessary for reasons of substantial public interest with, as the basis in law, the substantial public interest condition being equality of opportunity or treatment.
The following data will be added to the Higher Education Access Tracker (HEAT); name, date of birth, home postcode, gender, ethnicity and school. The data will be stored securely in the online HEAT database as evidence of us providing activities and will allow the University to track and monitor your data and progression in education. 
When you provide your personal details for a specific enquiry, such as an open day, we ask for your consent to process your personal data for marketing purposes that do not directly relate to your enquiry. You can withdraw your consent for this at any time by contacting: businessdevelopment@plymouth.ac.uk.
Where we have collected your data prior to the 25 May 2018 and where we see it meets the University’s legitimate business interests we will continue to contact you regarding your enquiry. There will be an option to opt-out at any time via our online preference centre or by contacting the admissions team.

How we use your data

The University uses your data to ensure we can provide you with the best possible experience, through our marketing, communications, recruitment and analytical reporting activities. We seek to respond in an appropriate, timely, and effective way when dealing with enquiries and use a customer relationship management (CRM) system to support this service. This means that you will not have to repeat all the details of a previous enquiry: each time you contact us we will be picking up where you left off. It also means that we can improve the information that we provide to you about our courses, services and processes in future.
The information you provide will be used to supply the information requested and, if you consent, send you further printed materials or electronic communications for the following purposes:
  • to provide you with information relating to Plymouth and the local area, and the University (including its facilities and services) to help you make an informed decision as to whether to apply to study with us;
  • to provide you with information about the subject(s) you are interested in and our services and facilities to help you make an informed decision as to whether to apply to study with us;
  • to tailor our communications and services to you based on your postcode, domicile, achieved and predicted academic qualifications as well as your subject(s) of interest;
  • to invite you to attend relevant events (such as open days);
  • to provide you with information about our visits to your city or country.
We will also process your data to fulfil and monitor our legal responsibilities, for example, under access and participation, equalities, immigration and public safety legislation. In addition, we will compile statistics and conduct research in relation to enquirers, applicants and students for the purpose of access and participation, planning, reviewing, managing and developing the University’s business, (but not to make any decisions about you).
If you disclosed to us that you have a disability, our Disability Services team will contact you to let you know how you can access the Learning Support, Disability and Mental Health services. You will be provided with further details about how your data will be used for this purpose at the relevant time.
We sometimes use ‘profiling’ software to help us make sure the information we send you is appropriate for you, but we do not use ‘profiling’ software to make any automated decisions about you.
We may also ask you to provide contact details for your intermediary contact (for example a parent / guardian or spouse) if we need to share information about your enquiry. You may choose to share their details with us via an online form but we will ask them to consent to receiving information from us.

Website tracking and personalisation

When you browse our website, we collect information to personalise your experience and improve our services.
What we collect:
  • Pages you visit and their titles to understand your interests
  • Your areas of interest based on courses and content you view
  • Marketing campaign information (UTM parameters) from links you click to measure which channels are effective
How we collect it:
We use browser storage (localStorage) to temporarily store this information on your device. When you submit an enquiry form, relevant data is sent to our servers and stored with your submission.
Data retention:
  • In your browser: 90 days (automatically expires)
  • On our servers: retained in line with our Records Retention Schedule
Your consent:
This tracking respects your cookie consent preferences set through Cookiebot:
  • Profile and browsing history require Preferences consent
  • Marketing attribution requires Marketing consent
You can clear this data at any time by clearing your browser storage or withdrawing consent via our cookie preferences.

Who will your personal data be shared with?

Within the University, your data is only shared with those University staff who need access for the processing purposes set out above.
Your personal data is shared as is necessary, on a considered and confidential basis, with several external organisations which assist the University with handling enquiries and student applications and with sending you information about studying here. These organisations act on our behalf in accordance with our instructions and do not process your data for any purpose over and above what we have asked them to do.
We make sure we have appropriate contracts in place with them. This includes
  • mailing houses
  • external research agencies
  • external media agencies to send you targeted messaging via social media. If you do not wish to receive these, you can amend your settings or preferences on the relevant social media platform.
We always have appropriate contracts in place before sharing your data with any other data controllers or contractors.
We may also share your personal information with third parties for the same purposes as listed above, and also for storage. These include; your school/college, partner(s) with whom we may have collaborated to organise and/or evaluate events, the Universities and Colleges Admissions Service (UCAS), the Higher Education Statistics Agency (HESA), the Department for Education, HEAT, any third parties managing HEAT’s database, and HEAT service subscribers and approved researchers. 
The majority of outreach events involve sharing your personal information with HEAT and related parties. These related parties include the following:
  • The Office for Students (OFS)
  • The Universities and Colleges Admissions Service (UCAS)
  • The Higher Education Statistics Agency (HESA)
  • The National Data Service (NDS)
  • The National Pupil Database
  • The Department for Education
  • Local Authorities
  • University of Plymouth’s education partners including Further Education colleges
  • Your school, academy or college.
We use Higher Education Access Tracker (HEAT) and Higher Education Statistics Agency (HESA) to manage our data. They each have their own privacy notices that you can refer to. Your data will be retained on these platforms to track and monitor so as to enable statistical aggregation and analysis. Enquirer data will be shared between HEAT and HESA (the Designated Data Body for England under the Higher Education Research Act 2017) and their respective policies can be seen here:
Sometimes your personal data is processed by these organisations outside the European Economic Area (e.g. because they use a cloud-based system with servers based outside the EEA), and if so, appropriate safeguards are in place to ensure the confidentiality and security of your personal data. We do not share your data with external organisations for marketing their products or services. We do not sell your personal data to third parties under any circumstances, or permit third parties to sell on the data we have shared with them.

Higher Education Access Tracker (HEAT) 

The Higher Education Access Tracker is a shared, central, online repository and reporting tool that has been developed collaboratively with Higher Education Institutions across the sector to provide a web-based data-capture system that tracks student engagement in widening participation outreach activities delivered by each subscriber organisation. We will use HEAT to process a student’s data (provided by themselves, their parents or by a third party such as a school or college) for the following purposes:
  • To ensure that we are working with students from the groups that are underrepresented in Higher Education (as defined by the OfS and detailed below).
  • To compile statistics and conduct research for reporting purposes to government departments and to selected third party organisations.
  • To comply with any relevant statutory obligations.
The groups identified by the OfS as underrepresented in Higher Education are: 
  • Disabled students
  • Black, Asian and Minority Ethnic (BAME) students
  • Looked After Children
  • Carers
  • Students that come from areas where participation in Higher Education is low as measured by the participation of local areas (POLAR) classification or tracking underrepresentation by area (TUNDRA) classification, which are area-based measures that use tracking of school pupils in England to calculate young participation in higher education
  • Students that come from areas of high social deprivation as measured by the Index of Multiple Deprivation (IMD)
  • Mature students, those students that are over the age of 21 when they start their course in Higher Education.
  • Students from Gypsy, Roma and Traveller communities
  • Refugees
  • Children from military families
The personal information that is recorded in HEAT is; name, date of birth, home postcode, gender, ethnicity and school.
  • HEAT is used to create a register of students that attend outreach and school engagement activities to provide us with the opportunity to collaboratively monitor, track and evaluate our services in supporting our outreach, and our Access and Participation Plan. 
  • The collaborative service will combine personal information recorded by the University of Plymouth with a number of other data sets to measure trends in applications and accepted applicants from groups of institutions and subsets of institutions. Therefore, data entered onto HEAT may be shared with education funding bodies, government departments and agencies, like the University and Colleges Admissions Services (UCAS) and Higher Education Statistics Agency (HESA).
  • We may use HEATs student profiler tool to allow us to see whether any consenting students have participated in other member outreach activities (where data is restricted to minimal details).
  • We may use HEATs postcode profiler tool to allow us to understand information regarding the area in which a student lives. The indicators include Indices of Multiple Deprivation (IMD), Income Deprivation Affecting Children Index (IDACI), participation of local areas (POLAR) and tracking underrepresentation by area (TUNDRA), which measure the proportion of the young population that go on to participate in higher education. This is also alongside information regarding whether a student’s postcode is part of a local ward that is supported through the Uni Connect programme.
  • We may use some of the anonymised data in research, reports and publications – we will never publish personal details or write them in a way that an individual can be identified.
  • Data on HEAT of individuals we first work with under the age of 21 years old will be kept until they are 30 years old and for those over 21, information will be kept for 10 years. If they enter university within this time, the data will be kept for 15 years after graduation.

How long is your data kept by the University?

If you do not apply to study with us, unless it has been recorded in HEAT, any data you provide to us as an enquirer is kept for two years after your indicated year of entry in line with our Records Retention Schedule. If you go on to make an application to the University of Plymouth, your enquiry data will be kept in line with our applicant privacy notice . We will also draw this to your attention when you apply.

Your rights in relation to your data

If you choose to receive further information from the University of Plymouth, you may change your mind at any time by writing to us or emailing us using the following contact details:
Mailing address:
Student Recruitment and Admissions
University of Plymouth
Drake Circus
Plymouth
PL4 8AA
You will also be able to update how you hear from us via an online preference centre. You will find a link to your online preference centre in every email communication we send to you.
You have the following rights in relation to your personal data:
  • the right to request your personal data is rectified if inaccurate
  • the right to request erasure of your personal data 
  • the right to request that the processing of your personal data is restricted
  • the right of portability in relation to your personal data
  • you can ask us to withdraw your details and if you wish to do this, all your personal information will be destroyed, unless it has already been used within reports
  • the right to object to the processing of your personal data
  • the right to object to processing which involves automated decision making or profiling.
For enquiries about Subject Access Requests or if you have a Data Protection query or complaint, please email dpo@plymouth.ac.uk. You also have the right to lodge a complaint about the processing of your personal data with the Information Commissioner’s Office.
This document is effective from 25 May 2018. It is reviewed when necessary and updated on this page.
This document was last reviewed in February 2026.