UNIVERSITY OF GLASGOW STUDENT PRIVACY NOTICE

The University of Glasgow (the University) will be what’s known as the ‘Data Controller’ of your personal data processed in order to facilitate, administer and manage your time as a student with the University. This Privacy Notice will explain how the University will process your personal data.

Changes to this notice

The University may update this notice at any time and may also provide you with furthermore detailed notices on specific occasions where we collect and process personal data about you. These additional privacy notices are supplemental to this main Privacy Notice. You should check this Notice regularly to be aware of any changes. However, where any change affects your rights and interests, we will bring this to your attention and clearly explain what this means for you.

Your personal data and why we need it

As a student of the University, you will have a core “student record”, this will be formed by the information provided by you as part of your application, during the registration process and other information added throughout your student life. The University will collect and process both personal data[i] and special category data[ii] including but not limited to those listed below.

• Personal and family details (including emergency contact details)
• Social circumstances
• Financial information
• Education and student records
• Disciplinary and attendance records
• Relevant employment details
• Images, for authentication and identification purposes
• Goods or services provided

Processing of special category data will only be undertaken in very limited circumstances and will be to meet a legal obligation or more usually, with your explicit consent in advance. Such data is defined as:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data, biometric data for the purpose of uniquely identifying an individual
• Health data
• Sex life or sexual orientation

Why we process your personal data

Generally, we process your personal data in order to facilitate, administer, support and manage your time as a student with the University, this includes but is not limited to

• Administrative purposes, including the administration of fees, management of funding, facilities administration, timetabling purposes, provision of services
• Provision of pastoral care/duty of care responsibilities including health and safety and safeguarding requirements and related legal obligations
• Academic purposes, providing you with learning and teaching and support services, academic, advisory and supervisory, in person and remotely online, and other optional services e.g., Library, Careers Service, in order to carry out required examination and assessment of knowledge, record academic progression and confer awards
• Security, safety and prevention and detection of crime
• Legal and statutory reporting
• Archiving and research purposes, including research and statistical analysis into learning analytics
• Promotion of the University (only with your consent) 

Legal basis for processing your personal data

We must have a legal basis for the processing of all personal and special categories data. An explanation of the legal bases, as defined in the General Data Protection Regulation (GDPR), that may be relied upon by the University are listed below:

Article 6(1)(a) Consent – in certain instances the University will only process certain data if you consent e.g. on registration you may agree and provide details of additional support needs or certain “special categories” of data in order to use the services of the University’s Disability Service.

Article 6 (1)(b) necessary for the performance of a contract –the University will process your data to enable it to meet its commitments to you as outlined in the Student Contract e.g. those relating to teaching and assessment.

Article 6 (1)(c) necessary to comply with a legal obligation – the University has legal obligations to provide your personal data to others e.g. Electoral registration officers.

Article 6 (1)(d) necessary to protect the vital interests of yourself or another – in extreme circumstances the University may have to release information to protect your interests or the interests of others e.g. in medical emergencies.

Article 6 (1)(e) necessary for the performance of a task carried in the public interest or in the exercise of official authority – the University is an educational establishment and in particular its educational activity is conducted in a public interest (including your interest and the interest of others).

Where Article 6(1)(f) is used, the “legitimate interest” is generally the interest of the University (or third party) in providing or supporting the provision of higher education to its students.

Article 22(2)(a) automated decision making necessary for performance of a contract – the University will sometimes automate decisions relating to services it is providing to you.

Article 9(2)(a) processing “special categories” of data where you have given consent – the University will process certain sensitive data about you with your consent.

Article 9(2)(g) processing “special categories” of data where necessary for reasons of substantial public interest.

Article 9(2)(f) processing “special categories” of data in connection with legal claims. 

It is recognised that some of the above grounds may overlap and that the University may rely on multiple grounds when justifying its lawful basis for processing.

Who we share it with and why

Upon booking a course your data will be collected by Accessplanit, which is third party online book and pay, training management system. To find out more about how your data is held on the Accesplanit platform please see the Accessplanit software security document .

In order to process your payment, some deatils will also be shared with the e-commerce payment system, Opaya.

There may be other instances that require the University to share your personal data with third parties, including

• Partner institutions, student exchanges, joint/collaborative agreements
• Student sponsors e.g. the Student Loan Company, funding organisations such as the Scottish Funding Council (SFC) or the Higher Education Funding Council for England (HEFCE), mobility funding schemes such as the Erasmus and Turing Scheme, scholarship/bursary providers and embassies
• Authorised staff and elected Officers of the Students’ Representative Council (SRC) for the purpose of verifying the registration status of nominated SRC Officer Bearers (and their proposers) and also for elected SRC Office bearers and other elected student representatives in the performance of their duties, as representatives of the University student community
• Professional and accreditation bodies such as the Law Society of Scotland, General Medical Council, The Nursing & Midwifery Council, General Dental Council, General Teaching Council for Scotland, Association of MBAs
• Progression data, which will be shared with the UK Clinical Aptitude Test (UKCAT) Consortium for research purposes
• External examiners for academic administration and progression purposes
• Relevant Government Departments to whom the University has a statutory obligation to release information, for example UK Visas and immigration
• Local authorities, for council tax purposes
• Provision of systems and services facilitated by third party auditing, legal services and IT providers
• Law enforcement agencies or other bodies with regulatory powers
• Relevant regulatory and investigatory bodies such as the Scottish Public Services Ombudsman, Office of the Scottish Information Commissioner and Information Commissioner’s Office
• Work placement sites, for example, those students studying medicine, dentistry, education and veterinary medicine or other educational partners, for example, such as Glasgow International College, or partners involved in joint/collaborative course or student exchange provision
• Potential employers or providers of education who have been approached by students, for reference provision purposes
• In emergency situations, the University may provide emergency contact details and other appropriate information to those relevant authorities dealing with the emergency
• Home institutions will receive an academic transcript for each international visiting student attending the University on study abroad and exchange programmes
• Electoral registration officers
• Higher Education Statistics Agency (HESA), including for the purposes of conducting research surveys such as the National Student Survey (NSS) and in the case of graduates, the Graduate Outcomes survey
• Public Health Scotland and Environmental Health for the purposes of reporting and investigating COVID-19 outbreaks
• The University's appointed Travel Management provider, Selective Travel, for the purposes of booking business travel (primarily for PGRs but this may include other students) 

Automated individual decision making, including profiling

This is where we may make decisions automatically about you without human intervention.  The University will rarely do this, but where it does it will be detailed in supplementary privacy notices.

Information sources

The University will obtain your personal data directly from you through your application and the registration process, during your time with the University and from third parties such as UCAS, funding bodies (e.g. the Student Awards Agency for Scotland (SAAS) or similar), sponsors, partner institutions and Government departments.

Transferring personal data outwith the European Economic Area (EEA)

There may be instances where to achieve the purposes for which we are processing your personal data we may need to share your personal data with other organisations based outwith the EEA, for instance if you are part of the Go Abroad Programme or studying at the University on a joint/collaborative programme with an international partner or if you apply via an international agent. When it is necessary to share your data with organisations outside of the EEA, we will ensure that there are appropriate safeguards in place. 

Keeping your personal data safe

The University has a series of technical and organisational measures in place to ensure that your personal data is protected and safeguarded. Please see the University’s Information Security webpages for more information. 

Graduation Ceremonies

The University considers Graduation ceremonies to be public events and audio and visual images of ceremonies will be made available online (live streaming will be available only during the ceremonies). Names of graduands, including those graduating in absentia will be published in the graduation programme. Lists are also published in newspapers and there will be an opportunity to choose to be included when you enrol for your graduation. 

General Council

All graduates of the University are members of the General Council, the graduate and academic body of the University. The University has a statutory obligation to retain a list of General Council members, to conduct General Council elections and to inform members about General Council activities. 

Alumni

The University’s Development and Alumni Office process and stores personal information relating to alumni and students. Alumni include graduates, former students receiving non-graduating qualifications and former exchange students. The Development and Alumni Office has produced its own Privacy Notice in relation to these activities. 

CCTV

The University operates CCTV systems throughout its campuses for the purposes of public safety and the prevention and detection of crime. The University’s CCTV Policy will be published online. 

Retention

Your personal data will only be held by the University for as long as is necessary for the purposes described in this Notice. After completion of studies (or cessation of studies), please note that the University will be required to retain some data to meet requirements to keep records for particular periods in accordance with applicable law. Minimal data will also be retained permanently in order to ensure a record of your educational achievements and qualifications is retained. 

Your rights*

Under data protection legislation and as a student of the University, you have a number of rights including the right to:

• withdraw consent, at any time, where that is the legal basis of our processing
• access your personal data and obtain a copy, free of charge
• rectify inaccuracies in personal data that we hold about you
• erasure, that is, have your details removed from systems that we use to process your personal data
• restrict the processing in certain ways
• obtain a portable copy of data you have given to us in a commonly used electronic form and
• object to certain processing of your personal data by us. 

* Please note that the ability to exercise these rights will vary and depend on the legal basis on which the processing is being carried out.

Please see the University’s webpages for further information on your rights as a data subject

If you wish to exercise any of these rights, please contact dp@gla.ac.uk. 

Complaints

If you wish to raise a complaint on how we have handled your personal data, you can contact the University Data Protection Officer who will investigate the matter.

Our Data Protection Officer can be contacted at dataprotectionofficer@glasgow.ac.uk

If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law, you can complain to the Information Commissioner’s Office (ICO) https://ico.org.uk/ 

For further information

If you are unsure about anything within the Privacy Notice, then please contact the University’s Data Protection Officer at dataprotectionofficer@glasgow.ac.uk

For further information on data protection, please see the University’s webpages and the Information Commissioner’s Office website

[i] Personal data is defined as any information relating to an identified or identifiable individual, who can identified, directly or indirectly, in particular by reference to an identifier such as name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

[ii] Processing of special category data is defined as the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership and the processing of genetic data, biometric data for the purpose of uniquely identifying an individual, data relating to an individual’s sex life or sexual orientation.

Updated January 2023

v.1.6