Privacy Notices

An important aspect of complying with data protection legislation is the requirement to process data fairly and lawfully. In order for the processing to be fair, the University must provide data subjects with accessible information about how their personal data will be used. The most common way to do this is through a privacy notice. A privacy notice is a term used to describe all the privacy information an organisation is obligated to make available to an individual when they are collecting personal data.

Links to the University’s core privacy notices can be found below:

The University of Warwick (“UoW”) is committed to protecting the privacy and security of personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”).

Throughout this notice, “University”, “we”, “our”, and “us” refer to the UoW; “you” and “your” refer to the individuals whose data is processed by UoW.

In this privacy notice, we will set out:

The processing of your personal data;
Your rights as a data subject; and
The various privacy notices applicable depending on your relationship with the UoW.

If you would like to receive this notice in another format (for example: audio, large print, braille) please contact us to discuss.

What is personal data?

The UoW defines personal data as any information that pertains to a living individual who is identified or identifiable. The 'processing' of personal data encompasses a wide range of activities, including the collection, organisation, use, and deletion of such data.

The duration for which we retain your personal data is determined by several factors, including the specific purposes for which it was collected, the nature and sensitivity of the data, and the potential risks associated with unauthorised access or use. We carefully assess these elements to ensure that your personal data is retained only as long as necessary to fulfil its intended purpose, while prioritising your privacy and complying with relevant legal obligations.

Your data will be kept in line with the retention periods set out in the relevant privacy notice. In absence of this, your data will be retained in line with our Record’s Retention Schedule.

What is special category data?

Certain sensitive types of personal data, referred to as “special categories of personal data,” are afforded additional protections under data protection laws. These include data related to an individual’s ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as the processing of genetic data, biometric data used to uniquely identify a person, health information, and data concerning a person’s sex life or sexual orientation.

UoW will only use personal data for the purposes for which it was originally collected, unless it is deemed necessary for another purpose that is compatible with the initial purpose. If the University needs to use your personal data for an unrelated purpose, it will inform you and provide an explanation of the legal basis that allows such use. In certain circumstances, the University may process your personal data without your knowledge or consent, where permitted by law.

The reasons we process your personal data

There must be a legal justification for us to process your personal data, this is known as a legal/lawful basis.

We will only process your personal data where one of the following apply:

You have provided consent to process your personal data,
To provide a service to you as part of a contract.
To comply with a legal obligation.
To protect someone’s life (vital interests).
To perform our official functions in the public interest.
In relation to a legitimate interest of UoW or a third party. As a public authority, we will not rely on this lawful basis for the purposes of our official functions.

How we process your personal data

Your personal data will be used to provide services or information requested by you.

Where third party service providers are used by UoW, we aim to ensure that any personal data is sufficiently protected by contractual provisions and comply with data protection legislation.

Where information is required to be transferred outside of the UK and EU, any such transfers will be conducted in accordance with data protection laws. Please see your applicable privacy notice for more details on such transfers.

Please note that this privacy notice does not cover the processing of personal data by third-party websites linked from our site.

How we keep your personal data secure

UoW keeps your personal data secure at all times using organisational, physical and technical measures.

Where appropriate, we also take measures such as anonymisation and Pseudonymisation to ensure data cannot be used to identify you and/or encryption to ensure that the data cannot be accessed without the right security accesses and codes.

Where UoW engages a third party to process personal data, it will aim to do so on the basis of a written contract which conforms to the security requirement of the UK GDPR.

UoW takes measures to enable data to be restored and accessed in a timely manner in the event of a physical or technical incident.

UoW also ensures that we have appropriate processes in place to test the effectiveness of our security measures.

Data transfers outside of the UK and/or European Union

The UoW may transfer your personal data outside of the UK and/or European Union (EU) under certain circumstances, particularly in connection with your employment or collaboration with the University. For example, if your role involves assignments at a partner institution, your data may be transferred as part of fulfilling contractual obligations.

Any transfers of personal data outside of the UK and/or EU are governed by an appropriate safeguard, which may include a data sharing agreement that incorporates the IDTA or Standard Contractual Clauses. These clauses ensure that your data remains protected in accordance with UK and EU data protection standards, even when transferred to countries outside of the EU.

The UoW may also work with third-party suppliers or partners who use cloud-based or hosted technologies. In these cases, the UoW conducts thorough due diligence to ensure that these external partners comply with stringent security and data protection standards. Appropriate contracts are put in place to ensure that these partners adhere to relevant accreditations and best practices.

Throughout any data transfer process, the UoW prioritises the confidentiality, security, and integrity of your personal data. We maintain strict safeguards to ensure your information is protected at all times.

The use of cookies

What Are Cookies?

Cookies are small text files placed on your computer or mobile device when you visit our website. They allow the website to remember specific details about your visit, such as your preferences, login status, or actions across different pages.

Why Do We Use Cookies?

Cookies enhance your browsing experience by remembering important information. For example, once you log in to your account, cookies ensure you're recognized as you move from page to page, so you don’t need to log in again. Without cookies, the website would treat you as a new visitor each time you navigate to a different page, making your experience less seamless.

Who Sets Cookies?

Cookies can be set by the website you’re visiting or by third-party services that provide content on the site. These third-party cookies help track your behaviour across different websites, often for analytics or advertising purposes.

For more information on how we use cookies and how they affect your browsing, please take a moment to review our Cookie Policy.

Your data protection rights

As a data subject, you have several rights over your personal data. The rights available depend on our reason for processing your personal data. Your rights include:

the right to access copies of your personal data,
the right to rectify inaccurate or incomplete information about you,
the right to erase your personal data in certain circumstances,
the right to restrict the processing of your personal data in certain circumstances; this includes where decisions are being taken by automated means (including profiling) which produce legal effects concerning you or similarly significantly affect you.
the right to object to the processing of your personal data in certain circumstances,
the right to withdraw your consent to our processing of your personal data (where we are relying on your consent to process your personal data),
the right to ask that we send your personal data to another organisation in certain circumstances (data portability)
the right to be informed about how and why we are processing your personal data.

Please see our guidance on how to make a request to access your rights.

If you have concerns about how we use your personal data, you have the right to make a data protection complaint directly to us.

If you would like to make a data protection complaint directly to us, please complete and submit the form below providing as much information as possible:

https://warwick.ac.uk/services/legalandcomplianceservices/dataprotection/complaints/complaintform/

Once we have received your complaint, we will:

acknowledge receipt of your complaint;
review the matters raised and make appropriate enquiries; and
keep you informed (where appropriate) and, without undue delay, report the outcome of your complaint to you.

If you are dissatisfied with the University’s response to your complaint, you have the right to escalate your complaint to the Information Commission (the ICO). You can contact the ICO at www.ico.org.uk.

Our contact details

We are the University of Warwick, and we are registered as a Data Controller with the Information Commission (registration number Z5856740) in accordance with the Data Protection Act 2018.

Please see our contact us page for details of how to contact us.

Our address is:

University of Warwick
Coventry
CV4 7AL
United Kingdom

Our Data Protection Officer is the Director of Legal and Compliance Services, who can be contacted via e-mail at infocompliance@warwick.ac.uk.

Changes to this policy

The UoW reserves the right to update or modify this policy at any time to reflect changes in legal requirements, operational needs, or best practices. Any significant changes will be communicated to relevant individuals through appropriate channels. We encourage you to regularly review this policy to stay informed of any updates. The most recent version of the policy will always be available for your reference.