Privacy notice for enrolled students

We collect your personal data in a number of ways including:

• from the information you provide to us before you join (for example, when you express your interest in studying at Kingston University or you attend an open day)
• from third party organisations through which you have expressed an interest in studying (for example, international representatives and agents, FindAMasters, Prospects, Hotcourses and the Student Room)
• when you apply to study at Kingston University directly, via the Universities and Colleges Admissions Service (UCAS), or other admissions processes
• when you communicate with us by telephone, email, social media or via our website (for example, in order to make enquiries or raise concerns)
• when you (or someone on your behalf) provides payment information either on the phone or via a University-managed website such as the KU Store or web payment portal
• when you interact with us during your time as a student of Kingston University, for the reasons set out in How we use your information
• via video and audio recording in classrooms, online teaching sessions and other learning and teaching scenarios such as field trips and site visits. You may opt out of being recorded by sitting out of camera/microphone reach in a classroom or setting privacy options online. If you opt out, you will still have the opportunity to contribute to the session. For more information, please see the Lecture capture policy
• when you interact with online platforms for specific services such as careers advice
• from other educational or employment organisations (for example, from your previous or current school, sixth form college, university or employers who may provide a reference about you or sponsor your studies)
• from publicly available information sources (for example, social media sites, Companies House and data cleaning agencies).

We collect the following types of personal data about you:

• your name, and contact information such as address, email and telephone number, as well as your date of birth, national insurance number (or other tax identification number) and sex
• your passport number or national identity card details, country of domicile, nationality, immigration status and right to study
• we will also allocate you a unique student number and an identity card (if you complete the enrolment process)
• information relating to your education and employment history
• records relating to assessments of your work, examination grades and other information in your student record
• your image, voice, online avatar and/or initials in online teaching sessions. We may also collect information about you expressed by others e.g. your name, and information about you expressed by yourself, which may include special category data
• information about your family or personal circumstances, and both academic and extracurricular interests (for example, when assessing your suitability to receive a bursary or in order to provide you with pastoral care)
• employer information
• bank details or credit/debit card information (in accordance with Payment Card industry Data Security Standards) to facilitate payments
• special category (sensitive) personal data and information about criminal convictions and offences, including:
  • your health and medical conditions (for example, disability and dietary needs)
  • criminal convictions where required for certain programmes of study or prior to certain placements (for example, where a Disclosure and Barring Service check is required)
  • unspent criminal convictions which, if declared, will require a risk assessment based on the seriousness and nature of the crime, this could involve consulting your probation officer or similar professional
  • information about your racial or ethnic origin, religion or similar beliefs
  • sexual orientation
• applications, CVs and information relating to graduate outcomes and your career progress after you leave the University.

The University processes personal data including special category data in different ways depending on your interaction with us.
We process student personal data for the following purposes:

To share with companies working on behalf of Kingston University

• educational services companies providing conversion services
• advertising companies
• marketing companies for the purposes of distributing mailouts and emails
• a company that prints and distributes prospectuses and other marketing materials for the University.

To manage the academic experience

• the provision of teaching, learning and research services (for example, registration, assessment, engaging with learning resources, managing progress, academic misconduct investigations and certification)
• to support and enhance student learning
• maintaining student records
• learning analytics including attendance
• assessing your eligibility for bursaries, scholarships and similar awards
• research (for example, academic research, evaluation research, student surveys and market research)
• providing library, IT and other information services.

Non-academic matters in support of our academic services, including:

• careers and employability-related analysis (for example, providing career guidance and programmes, understanding skills and future plans)
• safeguarding, promoting the welfare of students and providing student support services, including through any external partners including the Fairhill Medical Practice, the Fitness Centre, Kingston Students' Union
• ensuring students' safety and security including the use of CCTV
• mobile trail cameras may be present on site for wildlife and conservation monitoring. Footage that shows illegal or inappropriate human activity may be passed to the relevant authorities
• managing student accommodation
• managing car parking on the campuses
• managing the use of social media
• monitoring equal opportunities
• administering finance (for example, fees, scholarships and bursaries). Your information will be used to facilitate payment to the University and may be shared with payment service providers so that payments can be processed. Where necessary, information may be shared with debt collection agencies, solicitors and tracing agents to assist with the recovery of debt
• processing data and handling claims in relation to insurance (for example, travel insurance for students trips).

Other administrative purposes, including:

• institutional research or statistical analysis undertaken primarily for the benefit of the institution (for example, to support operational decision-making)
• Individualised Learner Record (ILR) shared with the Education and Skills Funding Agency (ESFA)
• carrying out audits (for example, to ensure compliance with our regulatory and legal obligations)
• providing operational information (for example, providing IT support, information about building closures or access restrictions on campus, or safety advice)
• promoting our services (for example, providing information about teaching and learning, research projects, summer schools, student exchanges, careers and employability programmes or other University activity both on and off campus)
• preventing and detecting crime (for example, detecting fraud)
• dealing with grievances and disciplinary actions
• dealing with complaints and enquiries (for example, queries sent via email or live chat helpdesks).

We will publish your personal data in the graduation ceremony programme. This information will also be passed to third parties involved in the ceremonies (for example, commemorative clothing suppliers).

• the level of award only (for example, BA or MA) not the classification (for example, first or second class) is published in the printed graduation brochure on the day. The level of award is not announced during the ceremony, only the graduate's name.

If you do not wish your personal data to be processed for these purposes, please contact the Graduations Team when you receive your invitation: graduations@kingston.ac.uk.

Graduates and guests should be aware that the graduation ceremonies are regarded as public events. The event will be filmed and photographed and images may be used for Kingston University publicity purposes. You can find our graduation policy online.

For a contract

We process some of your personal data because it is necessary for the performance of a contract with you or in order to take steps to enter into a contract. In this respect, we use your personal data for the following:

• to interact with you before you are enrolled as a student, as part of the enquiries and admissions process (for example, to send you a prospectus or answer enquiries about our courses)
• to provide you with the educational services set out in our student agreement with you
• to capture lectures and other learning and teaching scenarios
• to provide you with services that may not be set out in our student agreement but which are nevertheless a part of our academic and educational mission
• to provide you with support for a particular disability or medical condition
• to retain a record of your studies (for example, core student data to confirm your attendance and grades achieved)
• to recover money you owe to us
• to deal with any concerns or feedback you may have
• for any other purpose for which you provide us with your personal data.

For legitimate interest

We process your personal data because it is necessary for the purpose of a legitimate interest pursued by us or one of the third party organisations that we work with. In this respect, we may use your personal data for:

• activity related to your graduation (for example, publishing your name in the graduation programme)
• alumni relationship management activity (for example, contacting you to participate in non-statutory surveys and for providing careers support)
• to monitor and evaluate the performance and effectiveness of the University, including by training our staff or monitoring their performance
• to maintain and improve the academic, corporate, financial, estate and human resource management of the University
• to promote equality and diversity throughout the University
• fundraising purposes
• marketing purposes.

You have the right to object to this processing. Where we process your personal data for direct marketing this right is absolute.

To comply with legal obligations

We also process your personal data for our compliance with our legal obligations. In this respect, we may use your personal data for the following:

• to meet our compliance and regulatory obligations, such as compliance with immigration laws, anti-money laundering laws, safeguarding requirements, reporting requirements required by law or to regulatory bodies including the Office for Students
• for the prevention and detection of crime
• in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities.

Other legal bases

We may also process your personal data where:

• we have your specific or, where necessary, explicit consent to do so (for example, when you use one of our wellbeing or student support services)
• it is necessary to protect your vital interests or those of another person
• it is used for historical, statistical or scientific purposes including special category (sensitive) personal data (for example, with regard to national higher education surveys)
• it meets a condition in Schedule 1 of the Data Protection Act 2018 regarding employment, health and research or substantial public interest
• if you express special category data about yourself during a lecture or other learning and teaching scenario, this meets the condition for processing that it has been made public by the data subject.

Special category data

Where we process special category data, we usually do so under the conditions of substantial public interest - support for individuals with a particular disability or medical condition, or equality of opportunity or treatment

For the purposes referred to in this privacy notice and relying on the legal bases for processing, we may share your personal data with others within the University and certain third parties.

Marketing

Under GDPR the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. Marketing is also governed by the Privacy and Electronic Communication Regulations 2003 (PECR).

We may use your personal data for marketing processes, which includes passing your details to a third party to anonymise the data. This data is then used to help us to target our marketing activities. We do not sell your data to other organisations for marketing purposes or any other purposes.

During your time as a student we will also use your personal details to alert you to events and services of relevance to your studies and interests (for example, via the KU Extra portal).

Where we process your personal data for direct marketing purposes you have an absolute right to object.

Kingston Students' Union

We share some of the information we hold about you (including your name, date of birth, nationality, Kingston University email address and programme of study) with Kingston Students' Union, unless you opt out of students' union membership.

Please note, membership to the students' union is automatic during enrolment each year unless you choose to opt out. You should refer to their privacy information for further details.

Within Kingston University

• our employees, representatives and contractors where there is a legitimate reason for them to receive the information
• other students in your cohort, course or module and your student representative (name and Kingston University email only)
• recordings of lectures and other learning and teaching scenarios will be published/streamed only via an approved University system, where access to the recording is limited to the specific module occurrence. The recording will not be shared further without your consent.

Other Higher Education and related bodies

• the Higher Education Statistics Agency (HESA), which is now part of JISC. HESA collects and is responsible for the database in which HESA student records are stored. For more information about how HESA process your personal information, please see the HESA Collection Notices.
• other statutory and sector agencies including Advance HE
• third parties who work with us to enable us to deliver educational services
• organisations operating anti-plagiarism software on our behalf (such as Turnitin)
• internal and external auditors
• student sponsors (for example, the Student Loan Company, research sponsors and Research Councils)
• current or potential education providers (for example, where you take part in an exchange programme as part of your course)
• professional and regulatory bodies in relation to the confirmation of qualifications, professional registration, conduct and the accreditation of courses and schools
• Kingston University's UK and international partners and other universities (for example, to facilitate inter-library loans)
• third parties conducting surveys. For example, we may pass student contact details to survey contractors to carry out the National Student Survey and surveys of student views and finances for the organisations identified by HESA in their data protection privacy notices. These organisations and their contractors will use a student's details only for this purpose and will then delete them.

Government organisations

• government departments and agencies where we have a statutory obligation to provide information (for example, the Office for Students), the Home Office (in connection with UK visas and immigration), and council tax and electoral registration officers at relevant local authorities.

Other third parties

• third parties who we work with to conduct surveys (for example, the National Student Survey and the Graduate Outcomes Survey)
• third parties who work with us to provide student support services (e.g. counselling and careers guidance)
• third parties who work with us to provide student accommodation
• third parties who are contracted to provide personal data on our behalf, including software providers (for example, Library or Careers and employability systems providers)
• library service providers who enable us to deliver educational services including access to online library resources
• NHS trusts, NHS foundation trusts and Local Authorities (for the purpose of assessing whether you are entitled to free NHS treatment)
• local authorities, for the purpose of safeguarding, only where there is a legal obligation to do so, or we have conducted a legitimate interests assessment
• current or potential employers, to provide references and, where students are sponsored on their course by their employer, to provide details of progress and/or attendance
• placement providers, to provide details of progress and/or attendance. Some courses have additional requirements for disclosure of personal data to placement providers and you will be informed if this applies to you
• parents, guardians, and emergency contacts only where there is a specific legal basis for disclosure (for example, where you give us your consent to do so, or in a medical emergency to protect your vital interests)
• internal and external auditors
• the police and other law enforcement agencies, for the prevention and detection of crime.

Some of the personal data we process about you may be transferred to, and stored at, a destination outside the European Economic Area (EEA).

These processes include where the personal data is processed by our staff, contractors or suppliers who are based outside the EEA or who use storage facilities outside the EEA.

In these circumstances, your personal data will only be transferred on one of the following bases:

• where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (for example, standard data protection contract clauses).

When you leave Kingston University we retain some of your information to maintain a permanent record of your academic studies.

We retain graduate details in order to communicate with you regarding career opportunities, programmes and the Graduate Outcomes Survey.

Students may also be included in surveys that track the progress of leavers in the years after they graduate. If so, we will pass your contact details to the organisation that has been contracted to carry out that survey. The organisation will use your details only for that purpose and will then delete them.

In addition, we pass some of your personal data to our Development, Alumni Relations and Engagement (DARE) team.

In order to maintain your lifelong relationship with us, DARE will retain this personal data indefinitely. For more specific information about how your personal data is used by DARE, please see the Alumni Privacy Notice. If you do not want your personal data to be used for any of these purposes, please email: alumnidatabase@kingston.ac.uk.

We keep your personal data only as long as is necessary. For full details you can access the University retention schedule on the policies and regulations page on our website.

Data will be anonymised or securely destroyed at the end of its retention period.

In the absence of a retention period in the University's retention schedule and any other privacy notices, we will retain some of your personal data indefinitely in order to maintain your academic record or to support your alumni relationship with Kingston University.

It is important that the personal information we hold about you remains accurate. We cleanse and refresh our datasets including through the use of information from publicly available sources.

Under the GDPR and the Data Protection Act 2018, you have certain rights.

• to access the personal data we hold about you
• to require us to correct the personal data we hold about you
• to require us to erase your personal data
• to require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
• to receive your personal data, which you provided to us, in a structured, commonly used and machine-readable format and the right to transmit that data to another controller
• to object to any of our particular processing activities where you feel this has a disproportionate impact on your rights
• to not be subject to a decision based solely on automated processing, including profiling, which has a legal effect on you.

Please note that the above rights are not absolute and we may be entitled to refuse requests where exceptions apply.

When considering your personal data, students should ensure the information provided to the University remains accurate and up to date.

You should inform the University as soon as possible if details, such as your address, change.

When handling other people's personal data, students are required to maintain confidentiality and abide by the GDPR principles. These responsibilities are set out in our Data Protection Policy.

Please contact dataprotection@kingston.ac.uk if you have any queries about this privacy notice or how we process your personal data.

If you then wish to exercise your rights as a data subject, please use the Data Subject Request form on our website under policies and regulations.

If you are not satisfied, you can make a complaint to the Information Commissioner. You can find out more about your rights under data protection legislation from the Information Commissioner's Office website.