Privacy notice for prospective students

Data Controller

The Data Controller is the University of Brighton, Mithras House, Lewes Road.

If you would like information about how the university uses your personal data please contact dataprotection@brighton.ac.uk, 01273 642010.

Data Protection Officer

The Data Protection Officer is responsible for advising the university on compliance with data protection legislation and monitoring its performance against it.

If you have any concerns regarding the way in which the university is processing your personal data, please contact Rachel Page, Head of Data Compliance and Records Management, dataprotection@brighton.ac.uk, 01273 642010.

What information does the university collect?

Information held about you may include:

• your name, and contact details, including address, email address and telephone number
• nationality
• gender preference
• date of birth we are required to ask for parental consent to provide information to anyone under 16 years of age
• your communication preferences
• prior education, including university attended, subject studied and year of graduation
• subject and course interests
• dietary requirements, including allergies
• details of your qualifications, skills, experience and employment history
• whether or not you have a disability
• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

Where personal information is collected on our website, for instance through a web form, please read our website privacy notice.

Why do we collect your data?

We collect and process your information to deliver the recruitment-related services you have requested through activities such as:

• sending you a prospectus
• sending you news and information related to your course or other aspect of your study, such as campus, or being an international student
• reserving you a place at an event such as an open day or campus tour
• sending you further information you have requested after attending an event
• participating in live chat or other online events.

We may also receive the information required to provide these services from third party sources such as a UCAS fair or an International agent.

We may also use the information you provide us

• to better understand your needs and inform improvements to aspects of our service
• to communicate with you and provide other information that we believe you may be interested in.

If you provide consent but later decide you want to withdraw this, you have the right to change your mind. Please see the section below “your rights”.

How your data is held?

Depending on the service you require your personal data could be held within our email system Dotmailer, the Student Data CRM, Eventbrite, Unibuddy, the university edublog network, or the content management system which we use to run our website.

Your data may also be held in the HEAT database, inline with our outreach data protection policy.

These systems are accessed by staff within the Marketing and Communications department who manage the recruitment process.

Who has access to data?

We may share your details with other teams within the university in order to fulfil the service your require. These teams may use a range of systems to store and process data, including, but not limited to the CMS for the website, the Student Data CRM, Dotmailer, Eventbrite, Unibuddy and SITS.

We work with organisations who help us to process data. Some personal details are held on:

• Our customer relationship management database hosted by a company called Student CRM.
• Some recruitment events are managed through Eventbrite.
• The Unibuddy platform which provides online chat with student ambassadors
• We provide a range of blogs via the edublog network.
• Dotmailer direct email system
• Akero content management system
• The Content Management System which runs our website
• Social media channels including Facebook, Instagram and Twitter may hold your personal data if you contact us through that medium

All data relating to student recruitment is held within the EEA and will not be transferred outside of the EEA.

How does the university protect data?

The university takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

How long we will keep your data?

Your data is kept until the end of the recruitment cycle in which you contacted us. If you ordered a 2021 prospectus in December 2019 we will keep you data until October 2021, for example. If you become a student with us, this data will be then kept according to the student records retention schedule – which for most data is 6 years after completion of your last year of study.

Data subject's rights: access, rectification, erasure, restriction of processing, objection to processing, right to data portability

As a data subject, you have a number of rights. You can:

• access and obtain a copy of your data via a subject access request
• require the university to change incorrect or incomplete data
• require the university to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing
• object to the processing of your data, in certain circumstances, for example, where the university is relying on its legitimate interests as the legal ground for processing; or for direct marketing purposes
• ask the university to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override the university's legitimate grounds for processing data
• withdraw your consent at any time, where we have requested and obtained your consent
• where our lawful basis is consent or performance of a contract we will allow portability of your data.

If you would like to exercise any of these rights, please contact Rachel Page, Head of Data Compliance and Records Management, 01273 642010, dataprotection@brighton.ac.uk.

The existence of automated decision making, including profiling, information about the logic involved, including the significance and the envisaged consequences of such processing for the data subject

We will not use your personal data for automated decision making or profiling about you as an individual.

The right to complain to the ICO

If you are unsatisfied with the way the university has processed your personal data, or have any questions or concerns about your data please contact dataprotection@brighton.ac.uk.

If we are not able to resolve the issue to your satisfaction, you have the right to apply to the Information Commissioner’s Office (ICO).

Privacy notices

Changes to this notice

We keep our privacy notices under regular review. This privacy notice was last updated in January 2019.

Other privacy notices

We do our utmost to protect your privacy. Please be aware that other privacy notices exist within the university in respect of data held, including but not limited, to activities in relation to your enquiries, application, current students, alumni and use of our website.