Data Controller
- Ulster University
Data Protection Officer
- Eoin Coyle, Data Protection & Information Compliance Manager, M1207, Magee BT48 7JL, email: E.Coyle2@ulster.ac.uk
This Privacy Notice explains how Ulster University (Ulster) collects, uses and shares student personal data and explains students’ rights in relation to the data that the University processes about current, past and potential future students (both prior to and at formal application stage).
Ulster is registered as a ‘data controller’ with the UK Information Commissioner’s Office (ICO). The ICO is the independent supervisory authority set up to promote and oversee compliance with GDPR legislation. A copy of the University’s ICO registration is available at: www.ico.org.uk
1. Purpose of processing personal data
The University processes data about you for various teaching, research and administrative purposes.
Examples of how your data is used are as follows:
- supporting registration and enrolment, recording assessment results, academic progress and awards, and organising graduations;
- providing support to students in relation to careers and employability;
- providing student support services, for example in relation to welfare issues, disability, health, counselling;
- providing facilities such as IT and Library services;
- setting and payment of fees;
- administering tenancies of University controlled properties;
- monitoring equal opportunities and providing management statistics;
- holding student photographs to assist staff in identifying and recognising students and to produce ID cards;
- maintaining contact with alumni;
- fundraising and marketing;
- processing student academic appeals and student discipline cases.
- to contact you and/or your emergency contact in the event of an emergency
2. Lawful basis for processing data
The University will apply the following conditions for processing as appropriate:
Consent
The individual has given consent to the processing for one or more specific purposes.
Necessary for performance of a contract
The processing is necessary for the performance of a contract with the individual.
Legal obligation
The processing is necessary for compliance with a legal obligation to which the data controller is subject.
Vital interests
The processing is necessary in order to protect the vital interests of the individual. This is typically limited to processing needed for medical emergencies
Public functions
The processing is necessary for administering justice, or for exercising statutory, governmental or other public functions.
Legitimate interests
The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
Controllers are required to undertake a legitimate interest test which involves a careful assessment of the processing to ensure it properly balances the interest of the controller against any possible intrusion to the individual’s privacy.
3. How we collect your data
Personal data is normally collected during admissions, updated by you during enrolment and added to by staff during the academic year. You have access through the Portal to Student Self-Service where you can view some of the data held on you.
You have a responsibility to check the accuracy of the data and to inform the University immediately of any errors or omissions.
4. How long does the University hold your data?
The University’s Retention and Disposal Schedules includes guidance on retention and disposal periods.
5. Categories of personal data processed by Ulster
Health Information
Information on your health may be required prior to admission to certain programmes of study and also as supporting evidence where you have been prevented from submitting coursework or taking examinations.
Emergency Contact Details
Details of your next of kin or emergency contact. The University may need to contact your next of kin or emergency contact in the event of a serious concern about your welfare.
Published Data
The details of your academic award and its classification are regarded as public information (but not information on those that have failed).
Names of students who have successfully completed their course are published on the University’s website, in the graduation booklet and in the press; they are also forwarded to your former school.
Prevention or Detection of a Criminal Offence
The University is required to release information to the police, the Social Security Agency or other relevant agencies for the purposes of prevention or detection of a criminal offence, or if required by a court in relation to civil proceedings.
Placements and Study Abroad
If your course requires study, employment or a placement at another organisation it will be necessary for the University to transfer personal data to the other university or employer, whether this is within the UK or abroad.
Partner Institutions
If you are a student of a Partner Institution, the University holds data on you if you are taking a course leading to an award of the University. The data is held to record your academic progress and to provide you with an award certificate and transcript on completion of your course.
The data is not transferred to any other individuals or organisations other than the institution at which you are registered.
Photographs
You will be photographed at enrolment to provide a digital image to be printed on your University ID card which is used for the purpose of identification and, if necessary, to prevent or detect fraud.
The photograph may also be displayed on School notice boards or on Faculty intranets within the University and displayed in your record within Faculty Self- Service where it can be viewed by members of University staff (intranets and Self- Service are password protected).
You may also be required to provide photographs that can be attached to paper student files stored securely in School and/or Faculty offices.
The University may also commission photography on campus or at specific events, such as award ceremonies, for use in published promotional material.
Computer Use
The University routinely logs information about use of IT facilities for statistical purposes and to ensure effective systems operation.
The University may also monitor electronic communications to ensure that they are being used in accordance with the University’s Acceptable Use Code of Practice, available online at:
The University uses Google Analytics software to collect information about how you use the website ulster.ac.uk. We do this to help make sure the site is meeting the needs of its users and to help us make improvements.
Criminal Convictions and Criminal Records Checks
The University asks you to disclose information about serious past criminal convictions that are not spent prior to offering a place on its programmes.
The University also undertakes mandatory criminal records checks if you are accepted to a course which involves regulated activity with children or vulnerable adults.
If subsequent to your enrolment you obtain a criminal conviction, you are required to disclose this to the University.
6. Who do we share your data with
Ulster University Students’ Union
The University will pass student data to the Students’ Union to enable it to provide services to students, including lists of students for use during elections to posts within the Union.
Disclosures to Third Parties
The University has a statutory obligation to disclose your personal data to government departments, to the Higher Education Statistics Agency (HESA), the Student Loans Company and Education and Library Boards/Local Authorities.
The University will also pass your contact details to the organisation contracted to carry out the National Student Survey.
The information provided to HESA is used for statistical purposes and no information will be published that would enable you to be identified personally.
The University will send information from the Destination of Leavers in Higher Education (DLHE) form to HESA. HESA may pass student data to other government departments or statutory bodies that need the data to carry out their functions connected with higher education.
If you have any concerns about the use of your information, you can contact HESA directly at: https://www.hesa.ac.uk
The University may need to disclose your personal data to organisations contracted to work on its behalf such as auditors or consultants.
The University may share your personal data with our partner institutions, for example: FE Colleges, for the purposes of facilitating your academic progress and awarding qualifications.
The University will also share personal data with external organisations providing services to us such as technology platforms and cloud storage providers.
All third-party service providers that process data on our behalf are required to take appropriate security measures to protect your data in line with our policies. We do not allow them to use your data for their own purposes. We permit them to process your data only for specified purposes and in accordance with our instructions.
Your data is also passed to Stryder Corp (“Handshake”) which hosts a database that enables you to access the range of services provided by the University’s Career Development Centre.
In no circumstances will contracted organisations pass on such data to other organisations or individuals.
In certain circumstances the University passes the personal data of student debtors to an external debt collection agency if the University has been unable to recover the debt using its internal processes.
The University may share your personal data with third parties who provide student support services for example in relation to welfare issues, disability, health, counselling.
Students on Courses Leading to Professional Recognition
The University will pass your data to professional bodies to enable you to be registered with such bodies in order to take up employment within the profession.
For example, data on those taking teacher training courses is passed to the General Teaching Council for Northern Ireland as there is a statutory requirement for students completing teacher training courses to be registered with the Council prior to being able to take up a teaching post.
Similarly the University passes data of students on nursing courses to the Nursing and Midwifery Council to enable such students to be registered in order to practice as nurses.
Photography and video at Ulster
Ulster occasionally takes photographs and videos of students at events and in various university settings to capture and showcase student life, as well as the wider Ulster experience.
These images and video clips can be shared both internally and externally, across a range of channels and media including the University’s website, prospectuses, course materials and other marketing materials.
We aim to inform all students involved in photography or filming and obtain the appropriate consents, where possible and practical to do so.
Where this is not feasible, for example at large gatherings and events, or unless you have explicitly requested otherwise, we will assume that you have given your permission to be involved in image or video capture and for its subsequent use in any print or online promotional materials.
Postgraduate Research Experience Survey (PRES)
The PRES is a national, biannual survey that asks research postgraduate students to feedback on their experiences of their studies. The survey includes the processing of personal data to allow for analysis by personal characteristics. The national PRES is co-ordinated by Advance HE. The local survey is administered by the University using the JISC Online Survey platform to collect responses. The survey is optional for students to complete.
Survey data which has your name and e-mail address removed, so not to identify you, is disclosed to Advance HE for research purposes, including the production of national reports about the characteristics and views of postgraduate researchers, and the state of postgraduate research. The survey data is stored in the JISC online survey platform, JISC act as a data processor of the survey data.
7. International data transfers
Some of the personal data we process about you will be transferred to, and stored at, a destination outside the European Economic Area ("EEA"), for example where it is processed by staff operating outside the EEA who work for the University or for one of our suppliers, or where personal data is processed by one of the University’s suppliers who is based outside the EEA or who uses storage facilities outside the EEA.
In these circumstances, your personal data will only be transferred on one of the following bases:
- where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission);
- a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of protection; or
- there exists another situation where the transfer is permitted under applicable law (e.g. where we have your explicit consent).
8. Your rights as a Data Subject
As a University data subject you have the right to:
- access and obtain a copy of your data on request;
- require Ulster to change incorrect or incomplete data;
- require Ulster to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
- object to the processing of your data where Ulster is relying on its legitimate interests as the legal ground for processing; and
- ask Ulster to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override Ulster's legitimate grounds for processing data
If you have any queries
If you would like to exercise any of these rights or if you have any queries about this Privacy Notice please contact the University’s Data Protection Officer:
Eoin Coyle, Ulster University, Room M1207, Magee, Londonderry BT48 7JL
Telephone: 028 71675525 Email: gdpr@ulster.ac.uk
If you are not satisfied with how Ulster is processing your personal data, you can make a complaint to the ICO. Further information about your rights under the GDPR legislation are available on the ICO’s website at: www.ico.org.uk