Updated November 2023

Introduction

The UK General Data Protection Regulations (UK GDPR) and Data Protection Act 2018 (and, where applicable, the EU GDPR) govern the way that organisations use personal data. Personal data is information relating to an identifiable living individual.

Transparency is a key element of the UK GDPR and this Privacy Notice is designed to inform you:

• how and why the University uses your personal data,
• what your rights are under UK GDPR, and,
• how to contact us so that you can exercise those rights.

We keep our privacy notices under regular review. Any changes we make to this privacy notice in the future will be posted on this page and, where appropriate, notified to you by email or post.

Please check back frequently to see any updates or changes to our privacy policy.

This Privacy Notice is for enquirers, applicants and those who have been offered a place on a course up to the point of provisional enrolment.  Please see additional notices for currently enrolled students and for alumni[AF1].

On this page

Data subject rights • Why are we processing your personal data? • Which personal data do we collect and use • Sources • Who do we share your data with?• Security• Retention• Contact us• Further information and support

Data subject rights

One of the aims of the UK General Data Protection Regulation (UK GDPR) is to empower individuals and give them control over their personal data.

The UK GDPR gives you the following rights:

• The right to be informed
• The right of access
• The right to rectification
• The right to erase  
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling

For more information about these rights please see here and the Contact Us section at the end of this Privacy Notice.

Back to top

Why are we processing your personal data?

It is necessary for the University to process your personal data in order to enter into a student contract with you and fulfil that contract:

• To manage and assess applications, support applicants, conduct interviews, issue offers and prepare for enrolment
• To process payments to and from you or made on your behalf
• To identify you and manage access to our facilities and services
• To provide support services including, library, IT, financial, careers, disability and wellbeing support and to enable offers of additional support to you
• To enable us to investigate, consider, respond to and monitor
  • reasonable adjustments
  • appeals
  • complaints
  • application misconduct
  • fitness to study cases
  • fitness to practice cases and to provide information to professional and regulatory bodies which deal with such matters

It is necessary for the University to process your personal data in order to meet our public tasks (learning and teaching, research, knowledge exchange)

• To conduct outreach work with underrepresented groups, promote higher education and raise aspirations
• To account for our use of public funds and to measure the impact and effectiveness of our activities
• To monitor review and evaluate the quality, standards and effectiveness of our outreach activities
• To produce reports and returns for funding agencies, government departments, and public bodies
• To conduct and share research on applications data

It is necessary for the University to process your personal data in order to comply with legal obligations

• To ensure the health, safety and security of those on campus
• To monitor and promote equality and diversity within the University
• To comply with immigration compliance checks
• For safeguarding purposes and to carry out background and suitability checks where required for your course

It is necessary for the University to process your personal data in order to protect your vital interests or those of another individual

• To protect the vital interests of students and others, i.e. in emergencies/life or death situations/where we believe that a student or another individual is at significant risk of harm

There are also a number of legitimate business purposes for which the University processes your data

• To plan, deliver and review our services, events, and facilities.
• To evaluate and report on our recruitment and admissions activities and improve the applicant experience
• To process payments for international recruitment agents

With your consent we also use your data

• To register you for events such as open days
• To contact you about the University, our courses, our facilities and our other services
• To respond to your enquiries such as responding to requests for information about our courses including prospectus requests.

To answer enquiries the University may use a customer relationship management system (CRM). It is in the University's legitimate interests to provide you with further information which we believe is relevant to your enquiry.  You will have the opportunity to manage your preferences which includes the right to object to this processing and unsubscribe from further communications at any time.  In these cases, the University will respond promptly to any such request. In any case you will be removed from our mailing lists after two years.

We may also ask for your consent to use your personal data for other purposes. You will be given additional information for each purpose and have the right to withdraw your consent at any time.

Where we process sensitive personal data/special categories of personal data, we will rely on the conditions in Article 9 of the UK GDPR: explicit consent, vital interests, substantial public interest, occupational medicine, archiving/research.

Back to top

Which personal data do we collect and use?

In order to provide our services we need to collect and use your personal data. Below is a list of what this may include:

* Denotes information which may contain data classified as sensitive personal data/special categories of personal data under the GDPR and as such is subject to a greater level of control and protection.
^ Denotes information which you provide on a voluntary basis or where you are given the option of “prefer not to say” or "information refused".

a) Contact information and personal details

• Name(s)
• Address(es)
• Telephone number(s)
• Email address(es)
• Next of kin (incl relationship)^
• Nationality
• Age/Date of Birth
• Gender/sex^
• Disability*^
• Specific circumstances (e.g. care leaver / looked after child / estranged)
• Photograph(s)
• Names changes (including reason and evidence)
• Area/Country of residence & birth
• National Insurance number (where required)
• Criminal convictions*
• Proxy (from application form)

b) Your academic and learner records

• Schools/colleges attended
• Qualifications and grades
• Unique Learner Number (ULN)
• Course and stage details
• Diagnostic assessments*
• Learning Contract*
• Academic references (including personal statement & predicted grades)
• Use of and engagement with University services and events

c) Financial information

• Income (yours/parental/household)
• Previous student debt
• Sponsor
• Bank / card / payment details
• Funding, bursary and fee-related information

d) Additional equality/statutory monitoring information

• Religion/belief*^
• Sexual Orientation*^
• Ethnicity*^
• Gender identity*^
• Pregnancy, maternity, paternity, adoption*
• Socio-economic background

e) Information relating to your health, disability, wellbeing and safety

• Evidence of disability*
• Health records*
• Reasonable adjustments
• Occupational health referrals and reports

f) Information relating to your career and employment

• Curriculum Vitae
• Fitness to Practice*
• Career readiness
• DBS checks*
• Research passport
• References
• Employer details (current / previous)
• Teacher reference number
• Employment status

g) For international students the following data may be collected and used

• Details of recruitment agent
• Financial statements
• Passport details
• Academic Technology Approval Scheme (ATAS)
• Visa/BRP details (including previous visas)

h) Information relating to your enquiry and application

• Event registration and attendance
• Queries
• Subjects and courses
• Personal statement
• Application form
• Social media engagement / contact
• Calls and communications sent to you
• Accommodation applications

Back to top

Sources

Most of the data that we hold is collected directly from you as the data subject but other sources of personal data include:

• UCAS
• recruitment events/conventions that you have attended
• recruitment agents that you have used
• referees
• collaborative teaching/research partners
• schools
• assessment centres
• funding bodies, employers and sponsors - i.e. where an organisation is paying your fee
• immigration authorities

Back to top

Who do we share your data with?

You should be aware that in order to provide our services we may need to share your personal or sensitive personal data within the organisation or outside Sheffield Hallam University. The privacy of your personal data is paramount and will not be disclosed unless there is a justified purpose for doing so.  The University NEVER sells personal data to third parties.

Your data may be shared with:

• University staff who need the information for administrative and student support purposes. In the case of international students, this includes staff in our overseas offices.
• UCAS and your designated proxy if you have applied via UCAS
• Sheffield Hallam Students’ Union to enable the Union to enrol members, contact members, plan and promote its services, facilitate elections for student course reps and officers, and for the administration of the student rep system, student societies, volunteering programmes and the Hallam Award. Students may opt out of membership of the Union by contacting Registry services via si-helpdesk@shu.ac.uk. Please see the Code of Practice relating to the Operation of the Students' Union for more information
• Accommodation providers/landlords for the administration of student accommodation and to provide support during the tenancy
• Parents, guardians and other family members only where you have given your consent or in the event of an emergency where the disclosure of personal data is considered in your best interests or pertinent to your safety and well-being. Please see statement to family members.
• Contractors and suppliers, where the University uses external services or has outsourced work which involves the use of your personal data on our behalf. The University will ensure that appropriate contracts and/or data sharing agreements are in place and that the contractors and suppliers process personal data in accordance with the GDPR and other applicable legislation.  Examples of suppliers include IT services and support, confidential waste disposal, mailing services, election ballot services. If we need to transfer your personal information to another organisation for processing in countries that aren’t listed as 'adequate' by the European Commission, we’ll only do so if we have model contracts or other appropriate safeguards (protection) in place.
• Government bodies and departments, in the UK and overseas, responsible for:
  • public funding
  • sponsorship
  • statistical analysis, monitoring and auditing
  • regulatory matters
• The University shares data with a number of organisations to facilitate academic, financial, and administrative functions essential to your contract with us:
  • student funding organisations in connection with grants, fees, loans and bursaries
  • employers, other education providers or others sponsoring students to provide references, and updates on attendance, progress, conduct and matters relating to fees and funding
  • ovalidating and professional bodies in connection with registration and awards
  • collaborating organisations that provide teaching, assessment or student support for a University course or apprenticeship (only for relevant applicants/students)
  • placement providers to facilitate placements
  • international recruitment consultants and agents in relation to the students that they recruit
  • ooccupational health provider to assess fitness to study
  • 3rd party organisations who collate data with regards to national student activity and attainment for the purposes of statistical analysis, monitoring and use by member organisations to inform recruitment and other activities.
  • the University's insurers, legal advisers and auditors
• The University may share data with external services to provide additional support for individual students
  • the emergency services and/or other support organisations called upon in the case of an emergency where the disclosure of personal data is considered in the student's best interests or pertinent to their safety and well-being
  • specialist external support services, e.g. external Disabled Student Allowance (DSA) services
• The University is also required to provide information to a number of government and public bodies to assist with their public tasks:
  • the Home Office and relevant UK immigration agencies
  • the police and/or other organisations responsible for safeguarding or investigating a crime where an applicant may be involved

Back to top

Security

The University takes a robust approach to protecting the information it holds. This includes the installation and use of technical measures including firewalls and intrusion detection and prevention tools on the University network and segregation of different types of device; the use of tools on University computers to detect and remove malicious software and regular assessment of the technical security of University systems. University staff monitor systems and respond to suspicious activity. 

Alongside these technical measures there are comprehensive and effective policies and processes in place to ensure that users and administrators of University information are aware of their obligations and responsibilities for the data they have access to. By default, people are only granted access to the information they require to perform their duties. Training is provided to new staff joining the University and existing staff have training and expert advice available if needed.

Back to top

Retention

Relevant information collected prior to your enrolment (from your application, from pre-enrolment communications with you, and from previous outreach activities) will form part of your student record.  Data is then collected from you at enrolment and updated throughout your course.  Relevant information from your student record will form the basis of your alumni record which will be held and used after graduation.

Most student data is held for the duration of your course plus one further academic year.  Some data is held for audit purposes beyond this time and the retention period depends on the type of audit (up to 7 years).  Some data is held for statistical reporting purposes and analysis for a further 6 years.  Data from complaints, appeals, disciplinary, fitness to practice and fitness to study cases are kept for 6 years in case of further queries or actions.  Your core student record, including details of your award is kept permanently so that your award can be verified in the long-term to future employers and educational providers. 

Data relating to unsuccessful applicants and applicants who do not enrol at the University is kept for two years from the end of the cycle in which you apply (last week in October each year), this is to support any repeat application within this timeframe.

Where an application is cancelled within the 14 day ‘cooling off’ period, if no decision is made within that timeframe the data will be deleted immediately. If a decision has been made, the data will be retained until the end of the cycle in which you have applied to support data analysis and any contact within the remainder of the application cycle.

Back to top

Contact us

• If you would like to request copies of your personal data held by the University please see our information about SARs (a subject access request).
• If you would like to exercise your other rights (e.g. to have inaccurate data rectified, to restrict or object to processing) please contact our Data Protection Officer. 

You should also contact the Data Protection Officer if:

• you have a query about how your data is used by the University
• you would like to report a data security breach (e.g. if you think your personal data has been lost or disclosed inappropriately)
• you would like to complain about how the University has used your personal data

Data Protection Officer
Governance, Legal and Sector Regulation
City Campus
Howard Street
Sheffield
S1 1WB

DPO@shu.ac.uk
Telephone: 0114 225 5555

Back to top

Further information and support

Please see more information about how the University uses personal data here

The Information Commissioner is the regulator for GDPR.  The Information Commissioner's Office (ICO) has a website with information and guidance for members of the public.

The Information Commissioner's Office operates a telephone helpline, live chat facility and email enquiry service.  You can also report concerns online. For more information please see the Contact Us page of their website.

The University is required to provide data to HESA for regulatory and analytical purposes. Please see the HESA privacy notices.

Please see the UCAS Privacy Notices here.

Back to top

Sheffield H