Third Parties and Visitors to Site Privacy Notice

This privacy notice applies to third parties and visitors to the University of Warwick (“you” and “your”), including visitors, tenants, licensees, contractors, suppliers, consultants, external collaborators, event attendees, and other individuals who visit or engage with the University of Warwick (“Warwick”, “UoW”, “us”, “we” and “our”). It explains how we collect, use, and protect your personal data in accordance with the Data Protection Act 2018 and the UK GDPR (“data protection law”).

Please note that this notice is for informational purposes only and does not form part of any contract or agreement between you and the University.

What personal data do we collect and use?

As part of our relationship with you, we may collect, store, and process a range of personal data. This includes, but is not limited to:

Full name, title, date of birth, home address, telephone numbers, and email addresses
Emergency contact information and next of kin details where relevant
Employer details, company name, company registration number, job title, qualifications, personal signatures and working arrangements
Vehicle registration details and parking permit information
Photographs and identification documentation
CCTV footage from the CCTV system and data collected from access systems (e.g. swipe/ID cards and visitor passes)
Information relating to your use of our IT and communication systems
Records relating to your attendance at meetings, conferences, training sessions, or events hosted by the University
Information relating to contracts, licences, or services provided to or by the University
Correspondence and communications between you and the University
Information collected through your use of University websites, portals, and online systems, including IP addresses, browser type, device information, login details, cookies, and website usage data.

We may also collect and use more sensitive personal data where necessary, including:

Information about your race or ethnicity, religious beliefs, or other equality and diversity information where relevant for monitoring and reporting purposes
Health-related information, including medical conditions, disabilities, accidents, incidents, or emergency information where relevant to your visit or engagement with the University
Criminal convictions and offences where relevant to safeguarding, security, or legal obligations

In some cases, you are legally or contractually required to provide specific personal data. Failure to provide this information may prevent us from providing services, granting access to university facilities, or meeting our legal obligations.

How do we obtain your personal data?

The University of Warwick collects personal data relating to visitors, tenants, licensees, contractors, suppliers, external collaborators, and other third parties directly from you, from your employer or organisation, or through your interactions with the University.

Personal data may be collected through:

Visitor registration and event booking processes
Contracts, procurement, and supplier onboarding activities
Parking permit and campus access arrangements
Communications with University departments or staff
CCTV systems, access control systems, and other security measures
Information provided by third parties such as employers, referees, recruitment agencies, or regulatory bodies where relevant
Permit to work systems and inductions

We may also collect additional personal data throughout the duration of your engagement or interaction with the University.

How do we use your personal data and which legal bases do we rely on?

Purpose	Legal Basis
To manage your visit, engagement, tenancy, licence, contract, or other relationship with the University	Performance of a contract and/or legitimate interests
To provide professional or support services	Legitimate interests of the University in delivering services effectively
To register visitors and manage access to university premises	Compliance with a legal obligation and/or legitimate interests
To issue identity cards, visitor passes, or access credentials	Legitimate interests of maintaining security whilst allowing appropriate access to university facilities
To provide parking permits and administer parking arrangements	Performance of a contract
To ensure the safety and security of the University, its people, systems, and facilities	Compliance with a legal obligation and/or legitimate interests
To conduct surveillance via CCTV, including body-worn cameras where applicable, for the prevention, detection, and investigation of crime and other incidents	Legitimate interests of maintaining a safe and secure environment and compliance with legal obligations
To monitor entry into and movement within university buildings to ensure compliance with university regulations, policies, procedures, and relevant legislation	Compliance with a legal obligation and/or legitimate interests
To monitor your use of our information and communication systems, where applicable, to ensure compliance with University IT policies and network security requirements	Legitimate interests of ensuring proper usage and network security of University IT systems
Business management and planning, including accounting, auditing, procurement, and contract management	Compliance with a legal obligation and/or legitimate interests of sound management of the business of the University
To prevent fraud, unauthorised access, or misuse of university systems and facilities	Compliance with a legal obligation and/or legitimate interests
To investigate complaints, incidents, disputes, misconduct, or breaches of university regulations or contractual terms	Compliance with a legal obligation and/or legitimate interests
To comply with legal, regulatory, safeguarding, health and safety, and security obligations	Compliance with a legal obligation
To enable the University to deal with requests under Freedom of Information legislation, Environmental Information Regulations, or data protection legislation	Compliance with a legal obligation
To conduct internal research, analysis, and reporting for operational or institutional purposes where there is no direct impact on individuals	Legitimate interests
To administer procurement, tendering, supplier due diligence, and contract management activities	Performance of a contract and/or legitimate interests
To manage deliveries, collections, and logistics arrangements on university premises	Legitimate interests
To maintain records of external organisations and their representatives engaging with the University	Legitimate interests
To coordinate site access requirements for contractors and external service providers	Compliance with a legal obligation and/or legitimate interests
To assess eligibility for access to restricted, specialist, or high-risk areas of the University	Compliance with a legal obligation and/or legitimate interests
To manage incident reporting, risk assessments, and operational escalations	Compliance with a legal obligation and/or legitimate interests
To support continuity of university operations during emergencies, disruptions, or critical incidents	Vital interests and/or legitimate interests
To administer and manage insurance-related matters, claims, and investigations	Legitimate interests and/or legal obligation
To enable the University to establish, exercise, or defend legal claims	Legitimate interests and/or compliance with a legal obligation
To cooperate with regulators, public authorities, and statutory bodies exercising official functions	Compliance with a legal obligation and/or Recognised Legitimate Interests
To support fraud detection, cyber security monitoring, and the protection of university assets and infrastructure	Legitimate interests and/or compliance with a legal obligation
To enable users to access and use the University’s websites, online services, and digital platforms	Legitimate interests
To maintain the security, functionality, and performance of university websites and online systems	Legitimate interests and/or compliance with a legal obligation
To monitor website usage, diagnose technical issues, and improve website functionality and user experience	Legitimate interests
To administer online accounts, registrations, bookings, or enquiries submitted through university websites	Performance of a contract and/or legitimate interests
To manage and respond to enquiries, requests, or communications submitted via website forms or portals	Legitimate interests and/or performance of a contract
To prevent unauthorised access, misuse of university websites, or malicious activity affecting University systems	Legitimate interests and/or compliance with a legal obligation
To use cookies and similar technologies in accordance with the University’s Cookie Policy	Consent and/or legitimate interests
To analyse aggregated website usage and engagement trends for service improvement and planning purposes	Legitimate interests
To support accessibility, functionality, and continuity of digital services provided through university websites	Legitimate interests
To maintain records of website interactions where necessary for security, troubleshooting, audit, or evidential purposes	Legitimate interests and/or compliance with a legal obligation
To safeguard vulnerable individuals (e.g. children and vulnerable adults)	Recognised Legitimate Interests
To protect public/national security and defence (e.g. measures to help prevent harm and support safety)	Recognised Legitimate Interests
Emergency response (e.g. where there is a need to act in relation to events or situations that pose a threat or risk to human welfare and/or the environment)	Vital interests and/or Recognised Legitimate Interests
To detect, investigate or prevent crime, or apprehend or prosecute offenders	Recognised Legitimate Interests
To assist public bodies and bodies carrying out public tasks	Recognised Legitimate Interests

In certain circumstances, the UoW may seek your written consent to process particularly sensitive data. If this occurs, UoW will provide you with comprehensive details regarding the information required and the reasons for its collection, allowing you to make an informed decision about whether or not to grant your consent.

Should you choose to provide consent for the collection, processing, and transfer of your personal data for a specific purpose, you retain the right to withdraw that consent at any time. To do so, simply contact us at infocompliance@warwick.ac.uk.

Once UoW is notified of your decision to withdraw consent, we will immediately cease processing your data for the purpose(s) you initially approved. However, if there is another lawful basis for continuing to process your data, we will notify you of this legitimate reason.

Which third parties may we share your personal data with and what legal bases do we rely on?

The UoW may share your personal data with third parties when required by law, when necessary to manage our working relationship with you, or when there is a legitimate interest in doing so. This includes, but is not limited to, sharing data for joint appointments with external organisations. The third parties with whom we may share your data include:

Third Parties	Legal Basis
Car Parking Partnership (CPP) and ParkingEye	Performance of a contract and/or legitimate interests
Community Safety and relevant University departments	Legitimate interests and/or compliance with a legal obligation
Law enforcement agencies and regulatory authorities	Compliance with a legal obligation and/or recognised legitimate interests
Professional advisers such as insurers, auditors, and legal advisers	Legitimate interests
Contractors and service providers acting on behalf of the University	Performance of a contract and/or legitimate interests
IT service providers and system support providers	Performance of a contract and/or legitimate interests
Government departments, public bodies, and organisations carrying out public tasks	Compliance with a legal obligation and/or recognised legitimate interests
Website hosting, cloud storage, and IT infrastructure providers	Performance of a contract and/or legitimate interests
Website analytics and performance monitoring providers	Legitimate interests and/or consent
Providers supporting digital communications, online forms, and enquiry management systems	Legitimate interests and/or performance of a contract
Payment processing providers where online payments or bookings are made	Performance of a contract
External service providers supporting the delivery, maintenance, and security of university websites and online services	Legitimate interests and/or performance of a contract
Emergency services	Vital interests and/or Recognised Legitimate Interests
Law enforcement bodies/agencies	Recognised Legitimate Interests
Local authorities	Recognised Legitimate Interests
Healthcare providers where necessary in relation to emergencies or safeguarding	Recognised Legitimate Interests
Environmental protection and regulatory bodies	Recognised Legitimate Interests
Specialist safeguarding, welfare, security, or crisis management service providers	Recognised Legitimate Interests
Government departments, public bodies and other bodies carrying out legally authorised public tasks.	Recognised Legitimate Interests

Where visitors use University parking facilities, UoW may share vehicle registration information and permit details with parking management providers for enforcement and administration purposes.

We will only share your personal data with third parties where there is a lawful basis for doing so and appropriate safeguards are in place. We will never sell your personal data or share it with third parties for their own marketing purposes. Please note that, where we rely on your consent, you have the right to withdraw your consent at any time. If we need to transfer your personal data outside the UK, we will ensure that appropriate safeguards are put in place where required by data protection law. Further details of these safeguards can be provided upon request to Legal and Compliance Services.

How long do we keep your personal data?

The University retains personal data in accordance with its Records Retention Schedule.

Personal data will be kept only for as long as necessary for the purposes for which it was collected, including meeting legal, regulatory, accounting or reporting requirements.

Further information on retention periods can be found in the University Records Retention Schedule.

What rights do I have in relation to my personal data?

Data protection law gives you specific rights over your personal data, as follows:

the right to access personal data held about you;
the right to be informed about how and why your data is used;
the right to have your data rectified, erased or restricted;
the right to object to the processing of your data;
the right to portability of your data; and
the right not to be subject to a decision based solely on automated processing.

If you have concerns about how we use your personal data, you have the right to make a data protection complaint directly to us.

If you would like to make a data protection complaint directly to us, please complete and submit the form below providing as much information as possible:

https://warwick.ac.uk/services/legalandcomplianceservices/dataprotection/complaints/complaintform/

Once we have received your complaint, we will:

·acknowledge receipt of your complaint;

·review the matters raised and make appropriate enquiries; and

·keep you informed (where appropriate) and, without undue delay, report the outcome of your complaint to you.

If you are dissatisfied with the University’s response to your complaint, you have the right to escalate your complaint to the Information Commission's Office (the ICO). You can contact the ICO at www.ico.org.uk.

How can you obtain more information about this privacy notice?

If you have any questions about this privacy notice, please do not hesitate to contact our Data Protection team and/or Data Protection Officer at: infocompliance@warwick.ac.uk.

This privacy notice was last updated on 5 October 2026. We reserve the right to update or modify this notice at any time to reflect changes in legal requirements, operational needs, or best practices. Any significant changes will be communicated to relevant individuals through appropriate channels (e.g. on our website). The most recent version of the notice will always be available for your reference.