This Data Protection Statement applies to students and student apprentices registering after 1 August 2024.
If you are a student apprentice you should additionally refer to the supplementary statement at the bottom of this page.
Understanding Data Protection
To carry out its functions and obligations with regards to your study at the university, it is necessary for the University of Bath to collect, store, analyse and when appropriate disclose your personal data.
Where we refer in this statement to your ‘personal data’, it refers to any recorded information that is about you and from which you can be identified. It does not include data where your identity has been removed (anonymous data).
Where we refer to the ‘processing’ of your personal data, we mean anything that we do with that information, including collection, use, storage, disclosure, deletion or retention.
The University is legally responsible for processing your personal data in accordance with the Data Protection Act 2018. This statement is designed to highlight the areas of Data Protection which are particularly relevant to you, and to help you understand how information about you will be collected, stored, used and disclosed.
The University of Bath is registered as a Data Controller with the Information Commissioner’s Office (ICO) to process personal data, our registration number is Z6290890.
Understanding what student information the University will store
The University of Bath will collect data about you in the course of our dealings with you as a future, current or former student: for example, when you apply, when you register and as you progress through your course. We may also receive data about you from outside the University, such as information from UCAS relating to applications, and information supplied by referees. If you are a current or former student, examples of the data which the University may hold about you include:
- Your name
- Your student number and any other University assigned identification codes
- Details of your qualifications achieved and/or currently being undertaken
- Details of relevant criminal convictions
- Identity document/s such as your passport information
- Any student photograph
- Your permanent home and semester/term/placement time addresses
- Your contact details including email and other electronic identifiers
- Your identified gender
- Date of birth
- Your nationality
- Medical information
- Your University attendance, suspension or exclusion information
- How your studies are funded, including fee information and any sponsorship details
- Equality of opportunity monitoring data
- Details of your academic record including qualifications, skills, experience and educational and employment history
- Details of your examination and assessment results during your time at the University
- Details of any pastoral, financial, care or academic support given prior to, or during, your time at University
- Details of any disciplinary or conduct issues
- Details of any professional body registration
- Your provided photograph(s) - Your photograph will be used, where necessary, for the purposes of identifying you in the course of the university’s legitimate business and will appear on your university Student ID card. Appropriate provision will be made for those wishing to cover their face for religious reasons.
- Trusted contact details - Where you provide us with trusted contact details you should let that person know that you are sharing that information with the university.
- Feedback on university experience you have provided to external organisations (e.g. NSS) - NSS information is shared with us by the Office for Students (OfS) via the responses you provide to the Ipsos MORI survey.
This personal data includes categories of data classed as ‘special categories’ such as that collected for equality of opportunity monitoring such as ethnicity, religious beliefs or sexual orientation.
The university collects this information in a variety of ways. For example, data might be collected through the application process, or obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the enrolment; or through interviews, meetings or other assessments.
We will also hold information supplied by third parties such as references and information from criminal records checks (if necessary for your course).
Data relating to Criminal Offences and Convictions
The University of Bath requires any data relating to criminal offences and convictions in order to determine your eligibility to participate in regulated programmes of study and to appropriately assess the risks of any licence condition(s) or other restrictions you may have in place. This information will be treated confidentially by the appropriate members of staff.
This personal data is processed under the Article 6 Legal Basis of Public Task and the Article 9/Schedule 1 conditions for processing data relating to criminal offences and convictions are Clause 11 – Protecting the public against dishonesty, malpractice or other seriously improper conduct; and where appropriate Clause 18 - safeguarding of children/individuals at risk.
What is our Lawful Basis for processing your personal data?
To process your personal data, the University requires a valid Lawful Basis, the most relevant bases are set out below, however personal data may be collected separately by other parts of the University (e.g the Sports Training Village, Student Support etc) where relevant privacy notices will be provided at the point of providing personal data. For the bulleted sections below see the ICO guide to lawful basis.
By registering at the University of Bath, we will be required to collect, store, use and otherwise process information about you for any purposes connected with teaching, support, research, administration, your health and safety and for other reasons including any disciplinary process, deemed necessary for the purpose of entering into or for the performance of your contractual agreement with the university. We will also use your information for certain purposes after you cease to be student. See GDPR Article 6(1)(b)
Processing is carried out with your consent. Where we rely on your consent to process we will do so to provide a positive opt-in in a clear and concise manner with an explanation as to how you can withdraw your consent. See GDPR Article 6(1)(a)
There will be circumstances where the processing of your personal data may be necessary in the pursuit of the University’s legitimate interests where the reason is separate to our functions as a Public Authority. See GDPR Article 6(1)(f)
Processing of your personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the university and for statistical and research purposes. See GDPR Article 6(1)(e)
Processing is necessary for compliance with a legal obligation to which the University is acting as the Data Controller is subject. See GDPR Article 6(1)(c)
Processing of your personal data is deemed necessary in order to protect the vital interests – of the data subject or of another natural person. For example, in the case of a medical emergency where you are unable to provide consent. See GDPR Article 6(1)(d)
We will only process your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose.
Please note that we may process your data without your knowledge or consent where this is required or permitted by law.
How the data will be used
The University will only use your data fairly and lawfully in accordance the obligations and principles enshrined in the Data Protection Act. The following are examples of how your personal data may be used at the University however, due the complex relationship between the University and its students, this list cannot be exhaustive:
- To administer your studies and record academic achievements (e.g., your unit choices, examinations and assessments, and the publication of pass lists)
- To assist in pastoral and welfare needs (e.g., Therapeutic, Mental Health & Wellbeing services, services to students with disabilities, and support for students with low or non-engagement with their programme of study)
- To enable engagement monitoring for student visa holders
- In the event of medical needs or emergencies, for example where we have reason to believe that you or another person may suffer harm
- To administer financial aspects of your registration as a student (e.g., payment of fees, debt collection) or to administer entitlement to scholarships or bursaries
- To manage course facilities, such as computing facilities, sports facilities and clubs, and the Library
- To produce management statistics and to conduct research into the effectiveness of our courses and services
- To monitor our equality and diversity policies (e.g., compliance with the Equality Act)
- To contact you with tailored placement and careers opportunities
- To communicate relevant support or other group-specific information direct to applicable students
- Text messaging for relevant activities or reminders about surveys, e.g., NSS.
- To administer employment processes, if you choose to work for the University
- For security and disciplinary purposes
- For internal and external audits, and quality assurance exercises
- For marketing and alumni relations purposes
The University also takes photographs on campus and during events and may record lectures, seminars, tutorials, presentations and other events. The student data captured or held may therefore include visual images of students and audio recordings of their voices. The University retains the right to record any words that you may speak or performances that you may give in lectures, presentations or other events including graduation ceremonies which are recorded in accordance with our Intellectual Property Policy and Ordinance 22.
Sharing the data
The University of Bath may disclose your personal data with relevant third parties where appropriate however, when information is shared with third parties, we will seek to share the minimum amount necessary. All third-party service providers that process data on our behalf are required to take appropriate security measures to protect your data in line with our policies. We permit them to process your data only for specified purposes and in accordance with our instructions.
Students' Union
We will share relevant data with the Students' Union to enable them to, for example:
- Assist in pastoral and welfare support
- Monitor their compliance with the Equality Act and in support of their equality and diversity policies
- Communicate relevant support or other group-specific information direct to applicable students
Data relating to disciplinary matters can also be shared.
You can specify your preferences for communications from the SU by logging in to your account at www.thesubath.com.
If you do not want to be a member of the Students' Union, please read the Code of Practice for the Students' Union (SU).
Alumni
We will share data with the University’s Advancement Office to form part of the Alumni database. If you do not want to be on the Alumni database, or you wish to specify your preferences for communication from them, you can contact the Advancement Office.
For further information on how your personal information is processed and used by the Advancement Office please read their Privacy Notice.
Higher Education Statistics Agency (HESA)
The University is required to send some of the information which we collect about students to HESA, where it forms part of the student's HESA record. If your data is supplied to HESA, HESA may then pass all or some of the data to various government departments and agencies to enable them to carry out their statutory functions. These bodies and HESA will mainly use your data to produce anonymised statistics. HESA and the recipients of HESA data are also bound by the Data Protection Act to process your data fairly and lawfully.
National Students Survey (NSS)
The NSS is an annual survey of undergraduate students who are in the final stages of their programmes of study. It is designed to gather students' views on the quality of the teaching, assessment and support which they have experienced. This information is used to produce statistics and provide summary feedback to individual institutions and student unions. The survey is commissioned by the Office for Students (OfS) on behalf of a range of funding bodies and Higher Education providers and can be found on the National Student Survey.
Other Student Surveys
Both during your time at the University and after you graduate, we also pass your details to respected third parties where applicable (e.g., the Financial Times Rankings for MBAs) in order for those parties to contact you directly in order for you to provide details, should you choose to do so, about your time at the University and subsequently.
Sponsors and funding bodies
The University may disclose student information to the Student Loans Company, Student Finance England and any other financial sponsor (including your Embassy if relevant) to enable financial matters including the clarification of fee status to be determined. Disclosure to such organisations and/or sponsors will only be made where there is a legitimate reason for so doing.
In other cases, the University will not release data about you to bodies or individuals who have funded your education (such as your parents or employer), unless you tell us that we can do so. However, if you are under 18 years of age you consent to the University advising your parents as to the amount and nature of any debts you owe to the University from time to time.
Agent, marketing, and student recruitment partners
The University has a network of third-party network providers and partners, including international agents, that are authorised to act on behalf of the University to support student recruitment, marketing and engagement activities. The University may disclose student information to these providers and partners for reporting and reconciliation purposes.
Study abroad/placement/University partnership arrangements
If your course involves spending a period of time at an institution outside the University, at an organisation for a work placement or if you have come to the University as a visiting, exchange or junior year abroad student, we may need to share information about you with the other institutions involved in the exchange (within or outside the European Economic Area). This will be done for the administration of the visit, placement, exchange or study abroad, and so that the other organisation can carry out its duties in regard to your studies. If you are involved in a visit, placement, exchange or study abroad the University may transfer the data about you as necessary for purposes connected with your studies.
If you are registered at the University but are studying at a partner institution (e.g MPharm at Plymouth) then your details will need to be shared in order to be properly registered with our partner.
References and confirmation of qualifications
The University may release data about you in response to a request for a reference or for confirmation of your qualifications. The details of your award (e.g., degree subject and classification) are regarded as public information and will be published on open pass lists and accessible by third parties such as newspapers and prospective employers.
Graduation services
The University may share information about you and the award you are aiming for with third parties for the purpose of ensuring the appropriate provision of services such as gown hire.
UK Visas and Immigration
This section applies to students who require a visa to enter the UK to study at the University.
To assist in preventing immigration fraud, the University is required to report to the UK Visas and Immigration (UKVI) details of students subject to immigration control who fail to register, who discontinue their studies or who fail to maintain contact with the University. We may also be required to provide UKVI with other information about students. From time to time, the University also receives enquiries from UK immigration officials regarding the status of applicants or students, e.g., to check whether an offer of a place has been made or whether a student has enrolled.
The University will normally provide information about applicants and students when requested to do so by UK immigration officials. Failure to do so, in some cases, could lead to the University's removal from the list of institutions approved to receive overseas students. We will maintain the records about students (e.g., attendance) which we are required to maintain to meet UKVI's requirements.
Other disclosures
Examples of some of the other situations in which we may disclose information about you include:
- Disclosure to law enforcement agencies, where necessary for crime prevention or detection
- Disclosure to local authorities, for purposes connected with electoral registration, council tax or the investigation of benefit fraud
- Disclosure to the Office for Students and/or Office for Standards in Education, Children's Services and Skills (Ofsted) during institutional review and other quality assessment exercises
- If you leave the University owing money to the University, we may at our discretion pass this information to a debt collection agency
- We may disclose information for the purpose of verifying the data about you held by the University, by another higher education institution or by government agencies
Where the University uses a third party to process your personal data on its behalf a contract will be in place to ensure that any personal data is processed in accordance with the Data Protection Act.
International transfers of your data
There may be occasions when we transfer your data overseas, for example, to obtain a reference or to verify information in your application. Such transfers will only take place if one of the following applies:
- the country receiving the data is considered by the UK to provide an adequate level of data protection, this includes countries in the European Economic Area
- the organisation receiving the data is covered by an arrangement recognised by the UK as providing an adequate standard of data protection
- the transfer has your consent
- the transfer is necessary for the performance of a contract with you or to take steps requested by you prior to entering into that contract, or
- the transfer is governed by approved contractual clauses.
How long your information will be held
The University of Bath will retain your personal information in line with the university Records Retention Schedule.
The university will maintain a core student record of your studies permanently. Details of what will be held as part of that record can be found at Section 5 of the Records Retention Schedule.
All graduates automatically become members of the University of Bath Alumni Community (except for those enrolled on continuing and professional education or development courses. As such, some personal data is processed by the Advancement Team beyond graduation in order to keep you informed of developments and to offer engagement opportunities.
Understanding your responsibilities
The University will make every reasonable effort to keep your details up to date. However, it is your responsibility to provide us with accurate information about yourself when you apply and when you register, and to let us know of any subsequent changes to your details, such as changes to your name or address.
Understanding your rights
You have a number of rights under the Data Protection Act in respect of the information which the University of Bath holds about you, and how we can use that information. These include:
- The right to prevent us from using your data for direct marketing purposes
- The right to prevent us from processing your data in a way which causes or is likely to cause you substantial damage or distress. You can do this by serving us with a notice under section 10 of the Data Protection Act. However, we may refuse to accept such a notice in certain circumstances: For example, if doing so would prevent us from processing data which is necessary for our contract with you as a student
- The right to require us to correct, erase or destroy inaccurate data
- The right to get access to the data which we hold about you
Obtaining advice or further information
Data Controller
The Data Controller is the University of Bath. Our Registration Number in the Data Protection Public Register is Z6290890. Our Data Protection Officer is Samuel Sherry, who can be contacted at Risk, Resilience & Compliance, WH Level 8, University of Bath, Claverton Down, Bath, BA2 7AY or dataprotection@bath.ac.uk
Or consult the University’s Data Protection Act guidance.
Links to useful advice from other organizations are as follows:
- HESA Data Protection Guidance
- Research Councils Data Protection Guidance in the Joint Electronic Submissions (Je-S) Handbook
- UK Visas and Immigration
Student apprentices
If you are a student apprentice, the University will also:
- Disclose information to the Education and Skills Funding Agency (ESFA), and your employer, to enable financial matters including the confirmation of eligibility for funding to be determined. This will include personal information as required by the terms of the ESFA’s Funding Rules, and will be shared on a regular basis.
- Regularly share information relating to your studies and your apprenticeship between the University and your employer.
Education and Skills Funding Agency (ESFA) PRIVACY NOTICE
Each apprentice must read the ESFA Privacy Notice. This explains how it will use your personal information and can be viewed at the Privacy notice for Key Stage 5 and adult education.
How to raise a query, concern or complaint
If you still have queries, concerns or wish to raise a complaint; you can contact the University Data Protection Officer or visit the Information Commissioner’s Office website.
This version was updated on 9 August 2024.