Privacy notice: applicants

This privacy notice tells you what to expect us to do with your personal information when you apply to study at UCLan. Personal information (or personal data) is any information which relates to and identifies you. Data protection legislation (the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA)) set out how we should handle your personal information.

The University of Central Lancashire Higher Education Corporation is the controller of the personal information we process, unless otherwise stated. We are registered with the Information Commissioner’s Office and our registration number is Z5512420.

There are many ways you can contact us. View our main contact details.

UCLan’s Information Governance Manager and Data Protection Officer can be contacted via email. View further information and contact details.

To assess your application to study here, the University uses the information you provide on your UCAS application form or other type of application form, as well as any supporting documents, references or records from interviews provided as part of the admissions process. If you are an international applicant and apply through one of our approved Agents, we will also use information about you provided by the Agent.

If we decide to offer you a place on a course, we will also collect information about whether or not you have certain types of criminal convictions, which may include conducting a check with the Disclosure and Barring Service.

We will also invite you to tell us if you have a disability or any other needs for support, to enable us to begin the process of assessing your support needs, obtaining funding, and putting in place the required support in time for your arrival at UCLan. Providing this information while you are an applicant is optional and you can wait until you have enrolled to tell us, if you prefer. 

When you apply to study at UCLan, we will use your information for the purposes set out below. The application process starts when you submit your application and ends when you successfully enrol.

For the administration of your application

We use your information to verify your identity; check your eligibility to study here, including making visa and immigration checks; assess your application, including requesting any additional information necessary for that purpose; assess your suitability to study on a particular course e.g. if that course leads to a career in a regulated profession and/or has an integral work placement which could not be undertaken in certain circumstances, such as because you have a relevant criminal conviction or need to pass an occupational health assessment; decide whether or not to offer you a place, whether conditional or unconditional; and communicate with you throughout the admissions process until your successful enrolment, including providing feedback on unsuccessful applications, where appropriate.

Where you have been offered a place, we will ask you to declare whether or not you have certain types of criminal convictions (regardless of whether or not you are applying for a course which leads to a career in a regulated profession) and may make additional checks in the event you do declare a criminal conviction. We use this information to consider whether it is appropriate to admit you to the University, in the context of helping to provide a safe community in which staff and students can teach and learn, and in which we can safeguard children (those under 18 years old) and adults at risk. If you apply for and accept an offer of a place on a course which leads to a career in a regulated profession, we will also undertake checks with the Disclosure and Barring Service to ensure you meet the suitability requirements of the course and to ensure that you can attend any mandatory placements which form an integral part of your course.

If you choose to provide information and evidence about your disability and needs for support to us at the point you are still an applicant i.e. prior to your successful enrolment, we will use information and evidence about your disability and support needs, and associated funding, to begin to assess and arrange your support needs so that they are in place in time for your arrival at UCLan.

If you have accepted an offer of a place on a regulated course which requires occupational health clearance or assessment, we will share your information with our external occupational health provider, whose staff will contact you directly to undertake any required assessments or immunisations, and confirm to us whether or not you are ‘fit to study’ on your chosen course. Our occupational health provider is a separate controller for UK GDPR purposes and is responsible for how it handles your occupational health data.

If you are required to come onto one of our campuses as part of the admissions process e.g. to attend an applicant interview or selection process, you will be captured on our CCTV system. Please see our CCTV System privacy notice for further information.

Communicating with you

We will use your information to communicate effectively with you throughout the admissions process until you successfully enrol, via email, post, telephone, text (SMS), social media or other methods, as appropriate. We will also use your information to send you messages about University events, activities, services and facilities, and to keep you updated about a variety of things which will be helpful if you are considering whether or not to accept an offer of a place here or have already accepted an offer. If you have accepted an offer, we will also keep you informed of important updates using newsletters, circulars or other methods. You can opt out of receiving communications which are considered to be marketing by contacting Course Enquiries. Only some of the communications we send are marketing so you cannot opt out of everything we send you.

Research, reporting and statistics

We will use and analyse your information to undertake surveys and market research to help with corporate planning, reporting and University administration. We will use external agencies to carry out market research on our behalf.

We will also use your information for statutory reporting purposes to external agencies, where required, as well as for purposes associated with our ongoing registration with the Office for Students.

Your information will also be used for research purposes, including research by UCLan staff for planning and development purposes, and UCLan researchers for the purposes of academic research. We may also use your information to participate in research carried out by third parties including those unrelated to UCLan, such as research that would benefit current and future UCLan students or the student population generally, or research that would help formulate government policy. Your information will only be used in this way where the law allows us to and we consider it appropriate under the circumstances.

Monitoring and compliance

We will use your information to ensure and monitor our compliance with legislation including laws relating to equality, health and safety and immigration. We will also use your information to monitor our compliance with regulatory requirements set by external agencies.

The University relies on the following lawful bases from the UK GDPR to process information about you for the purposes set out in this notice:

Article 6(1)(b), which allows us to process personal data when it is necessary for the performance of a contract you are a party to or for steps taken prior to you entering into a contract. You enter into a contract with us when you accept an offer of a place (the student contract) and your application and our assessment of that application, which includes the assessment of any criminal convictions you declare, are the first steps to entering into that contract. Under your student contract, we deliver and administer your studies, administer finances, operate the University’s regulations, rules, procedures and codes of conduct, communicate with you and deliver facilities and services, among other things. We require you to provide any information we reasonably request for the purposes of your application, otherwise we cannot assess your application with a view to making an offer and putting in place your student contract.

Article 6(1)(c), which allows us to process personal data when it is necessary to comply with a legal obligation. We are legally required to provide some reports and statistics to external agencies, as well as monitoring compliance with laws relating to immigration (e.g. visas) and equality, among other things.

Article 6(1)(e), which allows us to process personal data where it is necessary to perform a task in the public interest. Research and teaching; some monitoring and internal reporting; auditing; and the provision of student support (including disability support) is carried out as part of our public tasks. We may also rely on this lawful basis to process personal data where it is necessary for the public tasks of other organisations, such as when we disclose information to third parties for surveys and research purposes which are not directly related to UCLan.

Article 6(1)(f), which allows us to process personal data where it is in our, or someone else’s, legitimate interests to do so and it does not unduly prejudice your rights and freedoms. We rely on this condition to, among other things:

• communicate marketing messages to you (unless you opt out). It is in the University’s legitimate interests to promote its services, courses and events to those who may be interested.
• deliver some services and facilities to you such as IT services, which you will be given access to prior to enrolment, once you have accepted an unconditional offer.
• produce some internal reports, research and statistics. It is in our legitimate interests to use these to evaluate, plan and assess how the University is operating and make any changes we think are appropriate and will benefit current and future applicants and students. 

We also process some information only if you provide your consent, such as when you choose to declare a disability and request support prior to enrolment. In this case, Article 6(1)(a) applies, and Article 9(2)(a) applies where the information is special category data (special category data is information about your race, ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used for ID purposes, health, sex life or sexual orientation). It will be clear where we are relying on your consent to collect and use your information because consent will be requested at the time you provide the information. When you are asked for consent, we will explain why we are asking for the information and how we will use it if you choose to provide it. Consent can be withdrawn at any time and we will explain how you can do this in each individual case.

Where we process special category data and data about criminal convictions for the purposes set out in this notice, we rely on the following additional lawful bases from the UK GDPR and DPA:

Article 9(2)(g) UK GDPR, which allows us to process special category data if the processing is necessary in the substantial public interest and there is a basis to do so in law. The law which allows us to rely on Article 9(2)(g) is section 10 DPA by virtue of Schedule 1 DPA, which also provides the lawful basis for processing data about criminal convictions. The specific conditions from Schedule 1 DPA on which we rely for this type of processing are as follows:

• Schedule 1(6), which allows us to process special category data and/or data about criminal convictions to comply with a statutory or legal function. Such functions include the duties set out in the Equality Act 2010 and the requirement to comply with the registration conditions imposed on us by the Office for Students under the Higher Education and Research Act 2017.
• Schedule 1(8), which allows us to process special category data to monitor equality of opportunity or treatment.
• Schedule 1(10), which allows us to process special category data and/or data about criminal convictions to prevent or detect unlawful acts.
• Schedule 1(11), which allows us to process special category data and/or data about criminal convictions to carry out protective functions to protect members of the public against dishonesty, malpractice or other seriously improper conduct, or unfitness or incompetence. We rely on this to process information about the outcomes of your occupational health checks, DBS checks and other suitability checks required for regulated courses.
• Schedule 1(12), which allows us to process special category data and/or data about criminal convictions to comply with regulatory requirements which require us or another party to establish if you have been involved in dishonesty, malpractice or other seriously improper conduct. We rely on this to undertake DBS checks and other suitability checks for regulated courses to enable us to meet the regulatory requirements and good practice principles associated with your course.
• Schedule 1(18), which allows us to process special category data and/or data about criminal convictions to safeguard individuals at risk and children.

When processing special category data or data about criminal convictions in reliance on the above conditions from Schedule 1 DPA the University must have an appropriate policy document, which can be read here: Data Protection: Processing special category data and criminal convictions data.

Article 9(2)(j) UK GDPR, which allows us to process special category data for archiving, scientific or historical research purposes or statistical purposes, where there is a basis to do so in law. The law which allows us to rely on this basis is section 10 DPA by virtue of Schedule 1(4) DPA. We will also rely on Schedule 1(4) DPA if we process personal data relating to criminal convictions for archiving, research or statistical purposes.

We share your information with a range of external organisations and bodies, some of which are processing personal data on our behalf. We only share your personal data with another person or organisation where the law allows us to and we consider it to be appropriate under the circumstances. The external parties we may share information with include the following:

• Higher Education bodies such as Office for Students (OfS), Research England, UK Research and Innovation, Universities and Colleges Admissions Service (UCAS), and the Office of the Independent Adjudicator.
• Government agencies and authorities, including the police and DWP for the prevention and detection of crime, apprehension and prosecution of offenders, the collection of tax or duty and safeguarding national security, among other things.
• Executive agencies or non-departmental public bodies such as UK Visas and Immigration, HM Revenue and Customs and the Health and Safety Executive.
• Loan providers and funding organisations: This includes the Student Loans Company, Student Finance England, any agencies providing grants or funding for disabled students if you have asked us to support you with this process, EU and overseas research partners, consortium partners and research councils. We also share information if the terms of the loan or funding contract require information about attendance and/or progress. 
• Our occupational health provider if you require occupational health clearance as part of the admissions process for your course. Our occupational health provider is currently TP Health Limited.
• Embassies, consulates and other sponsors: we may share information if a sponsor or similar can show they have a legitimate need
• Your main education provider if you are an exchange student.
• Partner institutions where you study at a UK or overseas partner institution and we are the awarding body for your course.
• UCLan colleagues overseas if you are an international applicant and it is necessary to share the data for the purposes of your application.
• Cambridge Education Group ONCAMPUS if you are an international applicant and you give us consent to share your information.
• International Agents if you are an international applicant and you apply via an International Agent.
• Internal and external auditors to provide assurance that the University is following its risk management, governance and internal control processes and to independently inspect our financial statements and records.
• Companies or organisations acting on our behalf: We use processors which are third parties that provide elements of services for us, such as our application system used for International Admissions or UniBuddy. We have contracts in place with our processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will hold it securely and retain it for the period we instruct.

Occasionally we may need to send your personal information outside the EEA e.g. to communicate with our international agents or partner institutions; to communicate with our colleagues overseas in Africa, India or China (if you are an international applicant) or obtain a service from a processor. These transfers are usually carried out with your consent or because they are necessary steps in the process of entering into your student contract. All transfers are carried out with appropriate safeguards in place to protect your information and ensure it remains secure, such as the UK International Data Transfer Agreement. 

If you apply but your application is unsuccessful, we will retain your information for two years after the end of the application cycle in which you applied.

If you are offered a place, accept and enrol at UCLan, your application information will form part of your student record, which we will keep for six years after you graduate or withdraw. 

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. Further information about each of these rights can be found on the Information Commissioner’s Office website. To make a request to exercise any of these rights, please contact the Information Governance Manager and Data Protection Officer via email.

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. For further information or to make a request, please see our the data protection pages of our website.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances.

Your right to object to processing

You have the right to object to any processing we carry out, if we carry it out on the basis that it forms part of our public task or is in our legitimate interests. You also have the right to object to your personal information being used for direct marketing purposes.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information because we have your consent or because you have a contract with us and it is necessary for the performance of that contract, and the processing is automated.

We work to high standards when it comes to processing your personal information. If you have queries or concerns, please contact our Admissions team, or the Information Governance Manager and Data Protection Officer, and we will respond. 

If you remain dissatisfied, you can make a complaint about the way we process your personal information to the Information Commissioner’s Office, which is the UK supervisory authority for data protection. Further information can be found on the data protection pages of our website.