The purpose of this notice is to explain how the University of Warwick (“UOW”) and more specifically the University’s Wellbeing and Student Support (“WSS”) will collect and use (process) your personal data, what rights you have in relation to that data and to provide transparency about the data collected about you.

The UOW is the data controller under the UK GDPR and the DPA 2018 and we will process your personal data in accordance with the UK GDPR and DPA 2018 at all times. You, as a ‘data subject’, therefore have specific rights to the data that we hold, collect and process.

Throughout this notice, “University”, “we”, “our”, and “us” refer to the UOW and WSS; “you” and “your” refer to those expressing an interest in becoming a student at the University (both prior to and during the application process), and those who later become enrolled students at the University.

WSS encompasses the departments of the Counselling and Psychotherapy Services, Disability Team and Wellbeing Support Team.

If you would like this notice in another format (for example: audio, large print, braille), please contact us.

Personal data

The following are examples of personal data which may be collected, stored and used by WSS:

• Personal identifiers and biographical information: Full name, ID number, date of birth and contact details: Home and term time address, telephone number, email address, emergency contact details or next of kin
• Course/academic details: Course, department, start and expected end date, exam results
• Ethnicity and diversity data: Gender
• Your photo
• Marital status
• Complaints
• Appeals
• Disclosed disability information

Special category data

Special category personal data is any identifying information including but not limited to the following racial or ethnic origin, political opinions, religious or philosophical beliefs, data concerning health or data concerning a natural person’s sex life or sexual orientation.

WSS may hold and collect your personal data in a number of ways, for example:

• From information provided to us by yourself when registering with Wellbeing and Student Support;
• Information you provide to the UoW for the purposes of admission;
• Through communication to or from you by telephone, email, or via the website. For example, when you call to make enquiries about the course or when you are raising concerns.
• We may also gain your personal data from third parties, for example, Statutory Services.

Personal data

Personal data will only be processed when the law permits this to happen. Most commonly personal data will be processed in the following circumstances:

• Where you have given us your consent.
• In order to fulfil UoW’s obligations to you as part of a contract or services (for example, certain data need to be processed to facilitate your studies at UoW).
• Where UoW needs to comply with a legal obligation (for example, the detection or prevention of crime and financial regulations).
• Where it is necessary for UoW’s legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• To protect the vital interests of the data subject or of another person (for example, in the case of a medical emergency).
• In order to perform a task carried out in the public interest.

Special category data

We may only process special category personal data in the following circumstances where, in addition to a lawful basis for processing, there exists one of the following grounds:

• Explicit consent - where you have given us explicit consent.
• Legal obligation related to employment - The processing is necessary for a legal obligation in the field of employment and social security law or for a collective agreement.
• Vital interests - The processing is necessary in order to protect the vital interests of the individual or of another natural person where the data subject is physically or legally incapable of giving consent. This is typically limited to processing needed for medical emergencies.
• Not for profit bodies - The processing is carried out in the course of the legitimate activities of a not-for-profit body and only relates to members or related persons and the personal data is not disclosed outside that body without consent.
• Public information - The processing relates to personal data which is manifestly made public by the data subject.
• Legal claims - The processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
• Substantial public interest - The processing is necessary for reasons of substantial public interest, on the basis of the law.
• Healthcare - The processing is necessary for healthcare purposes and is subject to suitable safeguards.
• Public health - The processing is necessary for public health purposes and is based on Union or Member the law.
• Archive - The processing is necessary for archiving, scientific or historical research purposes, or statistical purposes and is based on the law. The law can introduce additional conditions in relation to health, genetic, or biometric data.

UoW will only use personal data for the purposes for which it was collected unless it is considered reasonably that it is needed for another purpose and the reason is compatible with the original purpose. If the University needs to use your personal data for an unrelated purpose, it will notify you and will explain the legal basis that permits it to do so.

The University may process your personal data without your knowledge or consent, in compliance with this policy and procedure, where this is permitted by law.

WSS is committed to providing a confidential services and all WSS practitioners work to recognised standards of confidentiality from professional bodies.

Different areas of WSS may share your personal data in order to provide you with the best quality services and support with third parties where required by law, where it is necessary to administer the working relationship with you or where there is another legitimate interest in so doing including, but not limited to, for joint appointments with other external organisations. Third parties with whom we may share your data include:

Transfers of data outside of the UK

We may transfer the personal data we collect about you to countries outside the UK so long as there is a lawful basis for doing so or we have your consent. In certain circumstances we may seek your explicit consent to send your personal data outside of the UK. When doing so we will inform you in clear terms of the data protection framework in place in the relevant countries in order to enable you to make an informed decision.

Before sending your personal data to countries outside of the UK, we will ensure that adequate data protection provisions are in place, the processor has provided appropriate safeguards to ensure enforceable rights and legal remedies or other specified conditions are met under data protection law.

The UK GDPR and DPA 2018 requires that personal data should be kept for no longer than is necessary for the purposes for which the personal data are processed (except in certain specific and limited instances).

The University’s Record Retention Schedule (RRS)Link opens in a new window is a tool that enables the University to transparently demonstrate how the organisation complies with its data protection obligations by making provision for the time periods for which common classes of record are retained by UOW.

Full details of the retention periods of records can be found by viewing the records management pageLink opens in a new window and selecting the University’s Record Retention Schedule (RRS), which is kept up to date separately.

Under the UK GDPR and DPA 2018 you have a number of important rights free of charge.

You have the right to:

• Be informed of how we collect and use your personal data;
• Access your personal data;
• Require us to correct any mistakes in the data we hold on you;
• Require the erasure of personal data concerning you in certain situations;
• Restrict our processing of your personal data in certain circumstances;
• Receive your personal data, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations;
• Object in certain situations to our continued processing of your personal data or at any time to processing of your personal data for direct marketing; and
• Object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you.

To exercise any of these rights please refer to the Data Subject Rights page. If a subject access request is made and the request for access is clearly unfounded or excessive, the University reserves the right to refuse to comply with the request in these circumstances.

The UoW keeps your personal data secure at all times using both physical and technical measures.

Where appropriate, we also take measures such as anonymisation to ensure data cannot be used to identify you and/or encryption to ensure that the data cannot be accessed without the right security accesses and codes.

Where UoW engages a third party to process personal data it will do so on the basis of a written contract which conforms to the security requirement of the UK GDPR and DPA 2018.

UoW takes measures to enable data to be restored and accessed in a timely manner in the event of a physical or technical incident.

UoW also ensures that we have appropriate processes in place to test the effectiveness of our security measures.

We hope that our Data Protection Officer (DPO) can resolve any query, concern or complaint you raise about our use of your personal data on the contact details below:

Data Protection Officer can be contacted via email at .

Or write to:

The UK GDPR and DPA 2018 also gives you the right to lodge a complaint with the Information Commissioner who may be contacted at ico.org.uk/make-a-complaintLink opens in a new window or telephone: [0303 123 1113].

This privacy notice was last updated on 10 July 2023.