About this Notice

We ask that you read this privacy notice carefully as it contains important information on who we are, how and why we collect, store, use and share personal data, your rights in relation to your personal data and on how to contact us and supervisory authorities in the event that you have a query or complaint.

The University of Warwick (“UoW”) is committed to protecting the privacy and security of personal data. The purpose of this notice is to promote transparency in the use of personal data, and to outline how UoW collects and uses personal data during and after your educational relationship with us, in accordance with the UK General Data Protection Regulation (“UK UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”).

The UoW collects, uses and is responsible for certain personal data about you. This is known as “processing”. When we do so we are regulated under the UK GDPR and DPA 2018 which applies across the UK and we are responsible as ‘data controller’ of that personal data for the purposes of those laws.

The purpose of this notice is to explain how the University of Warwick (“UoW”) will collect and use (process) your personal data, what rights you have in relation to that data and to provide transparency about the data collected about you.

The UoW is the data controller under the UK GDPR and the DPA 2018 and we will process your personal data in accordance with the UK GDPR and DPA 2018 at all times. You, as a ‘data subject’, therefore have specific rights to the data that we hold, collect and process.

Throughout this notice, “University”, “we”, “our”, and “us” refer to the UoW; “you” and “your” refer to those expressing an interest in becoming a student at the University (both prior to and during the application process), and those who later become enrolled students at the University.

If you would like this notice in another format (for example: audio, large print, braille), please contact us (see ‘How to contact us’ above).

The personal data we collect and use

Personal data:

The following are examples of personal data which may be collected, stored and used:

• Name
• Address
• Telephone Number
• Date of Birth
• NI Number
• Date of studying
• Exam results
• Predicted grades
• Final grades
• Employment
• Next of kin
• Gender
• Your photo
• Email address
• Marital status and personal relationships
• Complaints
• Appeals
• Extracurricular activities
• Educational background
• CCTV footage and other information obtained through electronic means such as swipe/identity card records
• Bank information
• Health records Disabilities
• Educational certificates

If you are being considered for a bursary or scholarship then additional information will be collected for qualifying criteria.

Special Category Data:

We may also collect, store and use what is known as ‘Special Category’ personal data such as that revealing your ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

How the University of Warwick obtains your personal data

We may collect your personal data in a number of ways, for example:

• From information provided to us by yourself when joining. This would include any applications you complete when joining us;
• Information you provide through UCAS and other admission procedures;
• Through communication to or from you by telephone, email, or via the website. For example, when you call to make enquiries about the course or when you are raising concerns.
• We may also gain your personal data from third parties, for example, from references, information from your sponsor and information from your previous educational establishments.

Some of your information you are legally or contractually obliged to provide. If you decline to provide the information to us we may not be able to provide services to you or to meet our legal obligations.

Purpose and associated lawful basis

Your personal data will be processed by the UoW for the purposes detailed below.

Lawful bases for processing your personal data under the UK GDPR and DPA 2018

Personal data will only be processed when the law permits this to happen. Most commonly personal data will be processed in the following circumstances:

• Where you have given us your consent. Please note that you have the right to withdraw consent at any time.
• In order to fulfil UoW’s obligations to you as part of any contract we have with you.
• Where UoW needs to comply with a legal obligation.
• Where it is necessary for UoW’s legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Our interests are the effective and efficient operation of the University.
• To protect the vital interests of you or of another person (for example, in the case of a medical emergency).
• In order to perform a task carried out in the public interest.

Details of how the University of Warwick applies these can be found below.

Special category data

We may only process special category personal data in the following circumstances where, in addition to a lawful basis for processing, there exists one of the following grounds:

• Explicit consent – where you have given us explicit consent.
• Legal obligation – where the processing is necessary for us/ you to carry out/ exercise obligations and rights of a legal nature.
• Vital interests – where the processing is necessary in order to protect the vital interests of you or another individual where you are physically or legally incapable of giving consent. This is typically limited to processing needed for medical emergencies.
• Not for profit bodies – where the processing is carried out in the course of the legitimate activities of a not-for-profit body and only relates to members or related persons and the personal data is not disclosed outside that body without consent.
• Public information – where the processing relates to personal data which is manifestly made public by you.
• Legal claims – where the processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
• Substantial public interest – where the processing is necessary for reasons of substantial public interest, on the basis of law.
• Healthcare – where the processing is necessary for healthcare purposes and is subject to suitable safeguards.
• Public health – where the processing is necessary for public health purposes and is based on law.
• Archive – where the processing is necessary for archiving, scientific or historical research purposes, or statistical purposes and is based on law. Member States can introduce additional conditions in relation to health, genetic, or biometric data.

UoW will only use personal data for the purposes for which it was collected unless it is considered reasonably that it is needed for another purpose and the reason is compatible with the original purpose. If the University needs to use your personal data for an unrelated purpose, it will notify you and will explain the legal basis that permits it to do so. The University may process your personal data without your knowledge or consent where this is permitted by law.

Retention of your personal data

The UK GDPR and DPA 2018 require that personal data should be kept for no longer than is necessary for the purposes for which the personal data are processed (except in certain specific and limited instances).

The University’s Record Retention Schedule (RRS) is a tool that enables the University to transparently demonstrate how the organisation complies with its data protection obligations by making provision for the time periods for which common classes of record are retained by UoW.

Full details of the retention periods of records can be found by viewing the records management page and selecting the University’s Record Retention Schedule (RRS), which is kept up to date separately.

Transfers outside the United Kingdom

If we have to transfer any of your personal data outside the UK we will let you know if the receiving country or organisation is deemed to have adequate data protection provision. Where a country or organisation does not have adequate protections we will put safeguards in place. Details of these safeguards can be provided to you upon request to Legal and Compliance Services.

Data subject rights

Under the UK GDPR and DPA 2018 you have a number of important rights free of charge.

You have the right to:

• Be informed of how we collect and use your personal data
• Access your personal data
• Require us to correct any mistakes in the data we hold on you
• Require the erasure of personal data concerning you in certain situations
• Restrict our processing of your personal data in certain circumstances
• Receive your personal data, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations
• Object in certain situations to our continued processing of your personal data or at any time to processing of your personal data for direct marketing; and
• Object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you.

To exercise any of these rights please find out more here. If a subject access request is made and the request for access is clearly unfounded or excessive, the University reserves the right to refuse to comply with the request in these circumstances.

Keeping your personal data secure

The UoW keeps your personal data secure at all times using organisational, physical and technical measures.

Where appropriate, we also take measures such as anonymisation to ensure data cannot be used to identify you and/or encryption to ensure that the data cannot be accessed without the right security accesses and codes.

Where UoW engages a third party to process personal data it will do so on the basis of a written contract which conforms to the security requirement of the UK GDPR.

UoW takes measures to enable data to be restored and accessed in a timely manner in the event of a physical or technical incident.

UoW also ensures that we have appropriate processes in place to test the effectiveness of our security measures.

How to Contact us

We hope that our Data Protection Officer (DPO) can resolve any query, concern or complaint you may raise about our use of your personal data on the contact details below:

The DPO can be contacted via email at infocompliance@warwick.ac.uk.

Or write to:

The Data Protection Officer

Legal and Compliance Services
University of Warwick
University House
Kirby Corner Road
CV4 8UW

The UK GDPR and DPA 2018 also gives you the right to lodge a complaint with the Information Commissioner who may be contacted at https://ico.org.uk/concerns/ or telephone: [0303 123 1113].

Changes to this Privacy Notice

This privacy notice was published on 23 May 2018 and last updated on 3 February 2023.

We may change this privacy notice from time to time, when we do we will inform you by putting a message on the website and/or email.

How we process your personal data

The table below will provide a detailed overview of the information that we collect on you, the purpose for collecting that information and the lawful basis we rely for processing that data.

Processing with Consent

As part of the enrolment process we specifically seek your consent to share your personal data with and to receive electronic communication from a number of other areas which will enhance your student journey. Please find below some more information in relation to each of the following areas:

1. Students' Union
2. Alumni and Fundraising
3. Warwick Sport

---

1. Students' Union

By providing your consent, you are explicitly consenting to the sharing of the following personal data with the Students’ Union and to receiving electronic communications from the Students’ Union:

1. Your full name
2. Your date of birth
3. Your Warwick email address
4. Your home and term time address
5. Your course details
6. Fee status
7. Equality and diversity data (including special category data such as disability, ethnic origin or data concerning a person’s sex life, sexual orientation or gender identity).

This information will be used to administer your membership of the Students' Union and all the benefits thereof. For further details on how the Student's Union specifically processes your personal data please see the Students' Union privacy notice.

---

2. Consent to receive electronic communication for Alumni and Fundraising

By providing your consent, you agree that your information can be used to receive alumni news and updates as well as information about fundraising by email, phone, text or any other type of electronic mail. For further details please see the Alumni privacy notice.

---

3. Warwick Sport

By providing your consent, you are explicitly consenting to the sharing of the following personal data with Warwick Sport and to receiving electronic communications from Warwick Sport:

1. Your full name
2. Your date of birth
3. Student status (UG/PG etc.)
4. Year of study
5. Your Warwick ID number
6. Your Warwick email address
7. Emergency contact details
8. Your student photograph
9. Your University start and end date
10. Equality and diversity data

This information will be used to sign you up as a member of Warwick Sport, participate in its wide range of activities as well as providing you with exclusive news, updates, and offers. For further details please see the Warwick Sport webpages.

---

Specific Purposes for use of personal data

As Part of Administration and Student Enrolment

Purpose/Activity	Lawful Basis
Admission, enrolment and administration of studies.	Necessary as part of your student contract and/or our legitimate interest.
Bursaries and awards – administration and consideration of eligibility/applications, administration of award and the publication of those awards.	Necessary for the performance of your student contract and/or our legitimate interest.
Creation of University email addresses.	Necessary for the performance of your student contract and/or our legitimate interest.
Administration of Alumni relations.	Our legitimate interest.
For provision of the University accommodation.	Necessary for the performance of your student accommodation contract.
Management of enquiries with prospective students.	If your enquiry relates to a marketing activity only then we will seek your consent.
For provision of related support services such as the library, IT use and similar.	Necessary for the performance of your student contract and/or our legitimate interest.
The production of student identification cards; and the inclusion of photographic images on the UoW cards.	Necessary for the performance of your student contract and/or our legitimate interest of maintaining security whilst allowing students access to university areas.
Correspondence with offer holders regarding next steps and the enrolment process.	Necessary for the performance of your student contract.
Marketing from Warwick Arts Centre	Legitimate interests and consent

---

As Part of your student journey

Purpose/Activity	Lawful Basis
Academic assessment and progression and conferral of awards.	Necessary for the performance of your student contract.
Administration of University policy which includes such areas as appeals, complaints, and disciplinary matters.	Necessary for the performance of your student contract and/or our legitimate interest.
Administration of induction events, including the registration of students on courses and the transfer of students to a different course.	Necessary for the performance of your student contract.
To provide Wellbeing support services where necessary.	Consent, support services are optional and therefore provided on request.
To provide Disability support services where necessary.	Legal obligation.
Monitoring student attendance.	Necessary for the performance of your student contract.
Careers and skills, to provide you with information to support you in developing your employability, academic and transferable skills and to enable you to access careers and skills services whilst a student and a graduate. Details of activities you undertake with Student Opportunity may be shared with you academic department (e.g. for module credit).	Legitimate interest of the student and the University.
Sending non-marketing communications to students about benefits, services and activities within the university community.	Legitimate interest of the student and the University.
Directory of student email addresses open to all students to enable collaboration and communication within the student and University community with regards to studying, research and wider extracurricular activities.	Legitimate interest of the student and the University.
The recording of online teaching sessions for the purpose of improving student experience of teaching sessions.	Necessary for the performance of a task carried out in the public interest (provision of higher education).
Monitoring your entry in to and movement within University buildings to ensure compliance with University regulations, policies/ procedures and relevant legislation – e.g. Health and Safety. Processing card access data to ensure the health, safety and wellbeing of persons present on campus, preventing crime and disorder and individual or group compliance with reasonable directions given by Campus Security, your department, University regulations and policies/procedures and the law. Sharing information internally, where appropriate, to identify individuals suspected of or failing to follow University regulations, policies/procedure regarding access to buildings. Issuing warnings and/or instigating (and progressing) disciplinary action and where appropriate sharing information with regulatory authorities such as the Police.	Compliance with a legal obligation (Health and Safety) Legitimate interest of maintaining safety and security of the University community and enabling the University and relevant regulatory authorities, including the Police, to consider and take further action including disciplinary action, where appropriate.

---

Other

Purpose/Activity	Lawful Basis
Research and statistical analysis.	As part of the University’s legitimate interest
To enable the University to deal with requests (from you or others) under Freedom of Information and other transparency legislation or Data subject rights requests under the UK General Data Protection Regulation.	Compliance with a legal obligation.
Processing and recovery of accounts.	Necessary for the performance of your student contract
Monitoring your use of our information and communication systems to ensure compliance with regulations and policies/ procedures. By the use of fixed CCTV and Body Worn Cameras ensuring the safety and security of persons present on campus, preventing crime and disorder and individual or group compliance with reasonable directions given by Campus Security, University regulations and the law. Sharing information internally, where appropriate, to identify individuals suspected or failing to obey reasonable instructions from Campus Security, those breaching regulations and the law. Issuing warnings and/or instigating (and progressing) disciplinary action and where appropriate sharing information with regulatory authorities such as the Police.	Necessary for the performance of your student contract and/or legitimate interest (safety and security of the Warwick community, visitors to campus and to enable the relevant regulatory authorities, including the Police, to consider further action).
If you are a Warwick Business School student, your personal data will be made available to WBS Careers Plus & Corporate Relations.	Legitimate interest of the student and the University.

---

Personal data provided to third parties within the UK

As Part of Administration and Student Enrolment

Third parties we contact	Lawful Basis
UCAS to administer the applications and clearing process.	Necessary for the performance of a task carried out in the public interest (provision of higher education).
To profession and industrial bodies, such as the Law Society, General Medical Council, the Solicitors Regulation Authority and others.	Necessary for the performance of a task carried out in the public interest.
The Higher Education Statistics Agency (HESA) and/or an organisation acting on its behalf for the purposes of carrying out surveys on the activities and perspectives of graduates. Further information can be found in the HESA privacy notice.	Necessary for the performance of a task carried out in the public interest.
The Education and Skills Funding Agency (ESFA), on behalf of the Department of Education (DfE) in relation to Degree Apprenticeships only.	Legal obligation (Further information can be found in the ESFA privacy notice).
Sponsors (including employers) and Degree Apprenticeship Partners.	Necessary for the performance of your student contract, legitimate interests and/or Consent of the student.
Student loan providers e.g. Lendwise, etc..	Legitimate interests of the University relating to the payment of your tuition fees.

---

As Part of your student journey

Third parties we contact	Lawful Basis
External professional accrediting bodies	Necessary for the performance of a task carried out in the public interest.
Higher Education Rankings	Legitimate interests of the University/necessary for the performance of contract
To UK based educational institutions and or third party placement providers for the purposes of placements/joint courses	Necessary for the performance of your student contract.
To direct mail and marketing and events agencies who may assist the University in the administration.	Necessary for the performance of your student contract.
Administration of induction events, including the registration of students on courses and the transfer of students to a different course.	Processing is necessary in the legitimate interest of communicating with students about benefits, services and activities.
Tribal Education Limited – for institution student records data and Gradintellence services provided to facilitate registration and participation in the Warwick Award, and for allowing access to the Higher Education Achievement Record (HEAR) and/or the Digital Degree Certificate.	Necessary for the performance of your student contract.

---

Other

Third parties we contact	Lawful Basis
To nominated emergency contact	Processing necessary to protect vital interest of our students and/or another and our legal obligations to provide a duty of care/safeguard.
The police or other regulatory bodies	Legitimate interests and our legal obligations.
DBS – Disclosure and Barring service	Legal obligation.

---

Personal data provided by third parties within the UK

Third parties we contact	Lawful Basis
If you are an overseas student, on a student visa that has registered for temporary employment with Unitemps, then your personal data will be processed in respect of your enrolment status for any job applications you make.	Legal obligation.

---

Personal Data provided to/from third parties

Third parties we contact	Lawful Basis
Home Office UK Visas & Immigration (UKVI), for non-UK offer-holders and students preparing and/or making and/or having made a visa application which permits study in the UK.	Necessary for the performance of your student contract and/or our Legal obligation.
Home office UK visa & immigration (UKVI), for non-UK students who have temporarily or permanently withdrawn from studies following initial enrolment but hold a visa sponsored or endorsed by the University of Warwick which has not expired.	Legal obligation.
UK Border Force, for non-UK offer-holders, students and graduates preparing and/or making and/or having made a student visa application and/or holding a valid visa which permits them to study at the University of Warwick, for the purpose of assisting them to re-enter the UK to commence or continue studies or to attend Graduation Ceremony.	Necessary for the performance of your student contract and/or Legal Obligation.
Local authorities for the purposes of assessing whether you are liable for Council Tax (or other similar taxes in the UK and overseas).	Necessary in order to comply with legal obligations.
Universities.	Necessary for the performance of a task carried out in the public interest (provision of higher education).
Potential employers and careers advisers.	Public task.
Our professional advisors e.g. insurers, auditors, lawyers, etc.	Legitimate interests.