Student Privacy Notice

Swansea University is the data controller and is committed to protecting the rights of students in line with the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018. Swansea University has a Data Protection Officer who can be contacted through dataprotection@swansea.ac.uk

This statement explains how the University handles and uses your personal information during your time as a student and after you graduate. The University is committed to protecting your information and being transparent about what information it holds. The University is registered as a Data Controller with the Information Commissioner’s Office (ICO) to process personal data. Reg no Z6102454.

Personal information may also be collected by other parts of the University such as Student Support Services and fair processing notices will be provided at the point of collection as required

Swansea University will collect information about you in the course of its dealings with you as a current or former student for example, when you apply, when you enrol and as you progress through your course. We may also receive information about you from outside the University, such as information from UCAS relating to undergraduates' UCAS applications, as well as information supplied by referees. Type of personal information processed includes, though is not limited to, the following:

• Contact details and other information submitted during the application and enrolment processes.
• Details of courses, modules, timetables and room bookings, assessment marks and examinations.
• Financial and personal information collected for the purposes of administering fees and charges, loans, grants, scholarships and hardship funds.
• Photographs and visual images including video recordings.
• Information about an individual’s engagement with the University such as attendance information and use of electronic services such Blackboard. Contact details for next of kin to be used in an emergency.
• Information relating to the prevention and detection of crime and the safety and security of staff and students, including, but not limited to, CCTV recording and data relating to breaches of University regulations.
• Attendance data (including any suspension or exclusion information).
• Information relating to disciplinary or conduct issues.
• Student health data gathered for the purposes of equal opportunities monitoring.
• Personal and special category data including racial or ethnic origin, religious or philosophical beliefs, biometric data, and physical or mental health data relating to the provision of advice, support and welfare, such as data relating to the use of the services offered by the Student Support Service.
• For international students: Copies of passports, visas and any other documents required to ensure compliance with Home Office requirements as well as data for attendance purposes.
• For UK and EU students:  Copies of passports or any other documents required to ensure eligibility to receive financial support from the UK government and in compliance with right to study and identification requirements.
• In some cases, the University is required to process special category data and data about actual or alleged criminal convictions and any associated proceedings.
• Your Personal Learner Record (PLR) supplied to the University from the Education and Skills Funding Agency (EFSA).
• Information relating to Welsh language skills for the purpose of Welsh medium provision.

Although it is not possible to state every purpose for which your information will be used, the following are examples of how it is likely to be used while you are a student. The number in brackets refers to the legal basis, as defined by the UK General Data Protection Regulation and detailed in the table below, relied upon by the University, in order to lawfully process your data.

• To administer your studies and record academic achievements (e.g. your course choices, examinations and assessments, and the publication of pass lists and graduation programmes). 6(1)(b), 6(1)(e).
• To assist in pastoral and welfare needs and providing information, advice and guidance services (e.g. the counselling service, services to students with disabilities and other support services) the University will sometimes need to process your personal data; which may include the sharing of your personal data, with other departments across the University and with the relevant exchange partner if your course involves a placement in the UK or a period of study or employment overseas in order to offer appropriate student support services, safeguard and promote the welfare of students and ensure a student’s safety and security. Where your consent is not appropriate, such processing will only take place where it is necessary to protect the vital interests of the student or of another where the student is physically or legally incapable of giving consent or where sharing the information is necessary for reasons of substantial public interest, on the basis of UK law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. 6(1)(a), 6(1)(d), 9(2)(a), 9(2)(c), 9(2)(g)
• To provide you with academic services such as tutor support and study advice and guidance to help to achieve your academic potential. 6(1)(e)
• To ensure your health and safety whilst registered at the University and to assess your fitness to study, travel, take part in placements, provide appropriate reasonable adjustments and where you request it, to make decisions relating to applications for extenuating circumstances 6(1)(b), 6(1)(e), 9(2)(b), 9(2)(g)
• To assess and make decisions with regards to your fitness to practise for courses with professional placements 6(1)(e), 9(2)(b), 9(2)(g)
• To manage our Study Abroad or Erasmus+ programmes including nomination review, allocation of study places, invitations to apply, registration, teaching and learning, assessment and financial assessments (6)(1)(e)
• To administer timetabling and room allocations 6(1)(b)
• To communicate key messages to you in relation to your studies and student experience as well as information in connection with our legal responsibilities and our responsibilities as an Education provider 6(1)(c), 6(1)(e).
• To fulfil any legal requirements for example requirements on the University under the Prevent Duty 6(1)(c), 6(1)(e), 9(2)(g).
• To enable access to, and security of, University facilities (including library services, computing services, sports and conference facilities 6(1)(b) 6(1)(e).
• Internal and external auditing purposes 6(1)(c).
• For the purpose of recording lectures, meetings, student assessment and examinations 6(1)(b) 6(1)(e) 6(1)(f) Recording of Meetings and Lectures Privacy Notice - Swansea University
• To administer support for all your employability needs (e.g. accessing careers advice). Your information will be processed by a third party under contract in order to ensure you have access to a range of employability services that complement the University’s own resources. Your information will be held after you graduate in order to ensure you maintain access to the full career development support that the University offers all of its graduates. Further information on the support available is at: http://www.swansea.ac.uk/sea/ 6(1)(e).
• To administer financial aspects of your enrolment as a student (e.g. payment of fees, debt collection) 6(1)(b), 6(1)(e).
• To enable interactive group discussions using technology to support distance learning courses across multiple locations worldwide 6(1)(e).
• To carry out investigations in accordance with academic and misconduct regulations 6(1)(b), 9(2)(g).
• To enable the University’s Occupational Health Department to complete student health assessments necessary for student field trips etc. 6(1)(e), 9(2)(h)To operate security, disciplinary, complaint and quality assurance processes and arrangements 6(1)(b).
• To produce management statistics and to conduct research into the effectiveness of our programmes of study as well as produce statistics for statutory purposes 6(1)(e), 9(2)(j)
• To monitor engagement of students on Tier 4 Visas to ensure compliance with their terms of their sponsorship 6(1)(e)
• To maximise individual’s opportunities to succeed through the use of learning analytics which are used to monitor individual’s engagement with their studies. This will involve the processing of data such as attendance, assessment and VLE (Virtual Learning Environment) usage to develop an overall picture of engagement. Such processing will only take place where it is necessary for the pursuit of the legitimate interests of the University or the student and only where the processing is not unwarranted and will not cause a prejudicial effect on the rights and freedoms, or legitimate interests, of the student. Sensitive / special category personal data will only be processed where the University is looking at trends and pattern analysis to produce management statistical reports 6(1)(f), 9(2)(j)
• To monitor our responsibilities under equal opportunities policies 6(1)(e), 9(2)(g)
• To access the PLR Portal in order to verify student qualifications and help ensure accurate attainment data is reflected in University metrics 6(1)(e)
• For Higher Education Statistics Agency (HESA) purposes - Swansea University is required to send some of the information which we collect about students to HESA for statistical analysis purposes 6(1)(e), 9(2)(j).
• For Higher Education Statistics Agency (HESA) and/or a third party under contract, to conduct the Graduate Outcomes Survey after you graduate 6(1)(e). 
• For the Higher Education Achievement Report (Diploma Supplement) – to provide more detailed information about a student’s learning and achievement than the traditional degree classification system 6(1)(e)
• To conduct surveys - from time to time the University runs surveys designed to gather student feedback about the experience of teaching, learning, assessment, facilities and skills development so that we are able to make improvements for all students. We may use your details to make initial contact however the resulting data is anonymised –results are aggregated to programme/department/College level if there are a minimum of 10 responses. Such processing will only take place where it is necessary for the pursuit of the legitimate interests of the University or the student and only where the processing is not unwarranted and will not cause a prejudicial effect on the rights and freedoms, or legitimate interests, of the student. 6(1)(f).
• To conduct module surveys – from time to time the University run surveys designed to gather student feedback about individual modules taught across the institution, so that we are able to make improvements for all students. We may use your details to make initial contact however the resulting data is anonymised – results are aggregated at module level.  Swansea University will not identify any individuals when reporting module evaluation results internally.  Your personal data will be used only by relevant Swansea University staff where the data is necessary for them to undertake their designated role.  Such processing will only take place where it is necessary for the pursuit of the legitimate interests of the University or the student and only where the processing is not unwarranted and will not cause a prejudicial effect on the rights and freedoms, or legitimate interests, of the student. 6(1)(f).
• To collate student concerns via a digital platform where it is in the legitimate interest of the University to enhance overall student experience 6(1)(f).
• To enable communications to you with regards to registering with the University’s campus safety app in order to provide students with the required information and tools to remain safe on campus 6(1)(b). You may choose to download the app and provide further personal data and location data. 6(1)(a)
• For Council Tax exemption purposes where personal information is collated at enrolment and shared with Local Authorities where it is necessary for the pursuit of the legitimate interests of the University, the Local Authority or the student and only where the processing is not unwarranted and will not cause a prejudicial effect on the rights and freedoms, or legitimate interests, of the student. 6(1)(f).
• For voting purposes: where your consent has been provided the University will register you to vote in the UK local and General Elections 6(1)(a).
• To process your personal data after you graduate and make contact with you about alumni membership and events, new developments at the University and to update your communication preferences to ensure your experience of Swansea University Alumni Association is as rewarding as possible 6(1)(a)(f).
• To invite you to take part in and inform you about internal and external research activities which we think will be of interest to you 6(1)(e).
• To conduct and facilitate ethical approved internal research initiatives using student data in an anonymised form or aggregated with the data of others (where you will not be identifiable) 6(1)(e).
• To facilitate activities of the University including online teaching and online assessment activities that are carried out by third-party service providers.  Any transfer will be subject to an appropriate, formal agreement between the University and the third party service provider 6 (1)(B)
• Recordings/reviews of remote assessments in order to provide a remote proctoring solution for assessments 6(1)(e)
• To assist in the recording of crime, discipline issues, health and safety issues, incidents, requirements for security  and the protection of buildings and assets (of Swansea University, of other occupants of the buildings and of their respective staff and visitors). This processing is in the legitimate interests of Swansea University and other occupants in managing their businesses and ensuring the health and safety of their staff, students and visitors. 6 (1)(f) 6(1)(d), 9(2)(c) and 9(2)(g)
• In order to independently review or investigate a complaint, including complaints that have that have been brought to the attention of a Regulatory body. 6(1)(b),(c),6(1)(e) and 9(2)(g)
• To support the NHS Wales Test, Trace Protect service in the event that the contact tracing process is initiated where it is in the public interest to ensure the safety of all of our staff, students and visitors on campus. 6(1)(e)
• Should you accept a fully-funded place on the Approved Mental Health Professional programme at Swansea University, Swansea University will share unratified and ratified results with your sponsor. 6(1)(b) 
• To be offered, if eligible, specific support to gain work experience opportunities through the GO Wales programme. For more information see: https://www.gowales.co.uk 6(1)(a),9(2)(a)

• For accommodation administration purposes where personal data may be processed internally or shared with accommodation service providers for the operation and management of student accommodation (6(1)(f))

• To be able to manage the health and safety of our students in the legitimate interests of the University and wider community and in the substantial public interest e.g. Covid 19 pandemic  (6(1)(f), 9(2)(g))

For processing in connection with the Swansea University Students’ Union where it is necessary for the pursuit of the legitimate interests of the Student Union or the student in order to take part in democratic processes, benefit from representation services, join sports clubs and societies and receive communications. Where explicit consent has been provided, the University will also share ethnicity data to enable the Student Union to monitor and promote BME engagement 6(1)(f), 9(2)(a).

Where we process special category data and data about criminal convictions for the purposes set out in this notice, we rely on the legal bases outlined below. Further information about the legal bases from Schedule 1 DPA on which we rely to process special category data can be found in the policy Data Protection: Processing special category data and criminal convictions data.

Who receives your information?

Where necessary, personal information will be shared internally within Colleges and with other departments across the University. Personal information is protected by the University and information will not be disclosed to third parties without consent, or, is otherwise permitted by law. This section outlines the major organisations and the most common circumstances in which we disclose information about students. Where this involves international transfer, information will only be transferred if it meets the conditions set down under current Data Protection legislation.

• SU Pathway College Limited, Navitas UK Holdings Limited, Navitas Limited, the International College Wales Limited and SwaN Global Education LLP trading as The College, for the purposes of administration, enrolment and academic programme performance in connection with the joint venture. This information is shared for the purposes of administering a public task in the public interest.
• Higher Education Statistics Agency (HESA) - Swansea University is required to send some of the information which we collect about students to HESA for statistical analysis purposes and to conduct the Graduate Outcomes survey. This information is shared for the purposes of administering a public task in the public interest.
• The Higher Education Funding Council Wales (HEFCW) in line with our statutory responsibilities. This information is shared for the purposes of administering a public task in the public interest.
• The University is licensed to sponsor migrant students under Tier 4 of the points-based system. The University will provide data about students on the Tier 4 Student Visa to the Home Office and its departments in order to fulfil its duties under its license. This information is shared for the purposes of administering a public task in the public interest or where it is necessary to fulfil a legal obligation.
• Parents, guardians and other relatives - other than in the most exceptional of circumstances, the University will not to disclose a student's personal data to parents, guardians and any other relative. If students have provided a nominated contact in the event of a medical problem or emergency then some personal data may be provided. Further details can be found in the section Releasing information to parents, other relatives and third parties. This information is shared with your consent unless we believe it is in your vital interests, or the vital interests of another, to do so.
• Other Higher Education Institutions if for example your programme of study involves spending a period of time at an institution outside Swansea University, including at an HEI abroad or if you have come to Swansea University as a visiting or exchange student, we may need to share information about you with the other institutions involved in the exchange. This will be done for the administration of the visit, exchange or study abroad, and so that the other institution can carry out its duties in regard to your studies. We will disclose this data to the Institution because it is necessary for the performance of our tasks carried out in the public interest. Special category personal data relating to your health or a disability will not be shared without your express consent unless required by law or in your vital interests in an emergency situation.
• Professional bodies (e.g. General Medical Council, Royal Society of British Architects, Law Society) in order to confirm your qualifications, confirm that you are fit to practise, and accredit your course. This information is shared for the purposes of administering a public task in the public interest.
• Work placement sites or educational partners involved in joint course provision. This information is shared for the purposes of administering a public task in the public interest.
• Employers and funding councils for funded students and apprenticeships -the University will also share personal information with funders of your course and the Education and Skills Funding Agency if you are on an apprenticeship. This information is shared for the purposes of performing a public task in the public interest or where there is legal obligation.
• Sponsors, loan organisations and scholarship schemes - where students have a sponsor, scholarship scheme or a loan provider, the University may disclose student personal data to these organisations to determine whether support should continue. Personal data about students may be disclosed to third parties attempting to recover debt on behalf of the University where internal procedures have failed. The data is shared in connection with the performance of your student contract.
• Employment agencies, prospective employers and third parties requesting confirmation of awards - the University will routinely ask for the consent of students before disclosing details of any award. However in circumstances where there is any reason to suspect the validity of an award declared to any of the above, or where a false declaration of an award is suspected, we may share limited information as to whether the award declared matches our records without consent, where this is the case it will be shared for the purposes of performing a public task in the public interest.
• UK agencies with duties relating to prevention and detection of crime, collection of a tax or duty or safeguarding national security. This information is shared for the purposes of performing a public task in the public interest or where there is legal obligation.
• Plagiarism detection service providers such as Turnitin for the purposes of enabling assessors to check students’ work for improper citation and potential plagiarism. This information is shared in connection with the performance of your student contract.
• Local Authorities for purposes of council tax exemption where it is necessary for the pursuit of the legitimate interests of the Local Authorities or the student but only where the processing does not fall within our core public function, is not unwarranted and will not cause a prejudicial effect on the rights and freedoms, or legitimate interests, of the student.
• External facilities management who provide some of the University’s accommodation services where information shared will be in connection with the performance of your student or accommodation contract.

• The University shares information about its students with accommodation service providers for the operation and management of student accommodation. Information is shared in connection with the provision, administration and management of the accommodation including (but not limited to): 

  - the detection and prevention of crime 

  - the allocation of rooms and security access 

  - the management of student complaints and damage reporting 

  - the health and wellbeing of students including information relating to health for reasons of substantial public interest e.g. Covid 19 pandemic.  

• Service providers acting as processors who provide IT and system administration services where it is necessary for the pursuit of the legitimate interests of the University or the student but only where the processing does not fall within our core public function, is not unwarranted and will not cause a prejudicial effect on the rights and freedoms, or legitimate interests, of the student.

• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers based who provide consultancy, banking, legal, insurance and accounting services. Where this is the case it may be shared for the purposes of performing a public task in the public interest or where the processing is under contract or necessary to fulfil a legal obligation.
• Local Authorities for voting purposes: where your consent has been provided the University will register you to vote in the UK local and General Elections.
• Swansea University Students’ Union Student Union where it is necessary for the pursuit of the legitimate interests of the Student Union or the student in order to take part in democratic processes, benefit from representation services, join sports clubs and societies and receive communications. Where consent has been provided, the University will also share ethnicity data to enable the Student Union to monitor and promote BME engagement.
• Safezone – The University utilises Critical Arc software to enhance its response to incidents and emergencies under our legal duty of care
• Third party service providers who support the University’s provision of teaching and assessments online. (E.g. Zoom, TestReach and Respondus)
• ISARR is the Swansea University Security Services reporting system.
• Personal data may be shared with Regulatory Bodies in order to independently review / investigate a complaint that has been brought to their attention e.g. Office of the Independent Adjudicator (OIA) and the Information Commissioner’s Officer (ICO)
• NHS Wales Test, Trace, Protect Service when required to support the contact tracing process
• Should you accept a fully-funded place on the Approved Mental Health Professional programme at Swansea University, Swansea University will send a copy of your transcript to your sponsor after your final results have been confirmed by an exam board.
• Personal information may be shared with organisations (including other education providers) with whom we work collaboratively and with other agencies (including the Welsh Government) where there is a requirement on the University to report on outcomes, progression or for equality monitoring purposes.

Any other disclosures that the University makes will be in accordance with Data Protection Legislation and your interests will be considered.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. After graduation the University will need to maintain some records in order that it can verify awards, provide transcripts of marks and to provide academic references for career support. We will retain your personal information in line with the University Records Management Policy. 

Personal data specifically collected for the purpose of the NHS Wales Test, Trace, Protect Service will be held for 21 days from the date of each separate visit made

Data Protection legislation requires us to keep your information secure. This means that your confidentiality will be respected, and all appropriate measures will be taken to prevent unauthorised access and disclosure. Only members of staff who need access to relevant parts or all of your information will be authorised to do so. Information about you in electronic form will be subject to password and other security restrictions, while paper files will be stored in secure areas with controlled access. 

Some processing may be undertaken on the University’s behalf by an organisation contracted for that purpose. Organisations processing personal data on the University’s behalf will be bound by an obligation to process personal data in accordance with Data Protection legislation.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

We may transfer your data outside the European Union (EU). Whenever we transfer your personal data out of the EU, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.
• Where there is a legally binding agreement between public authorities or bodies.
• Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.
• Where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between the Europe and the US. For further details, see European Commission: EU-US Privacy Shield.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EU

We may also conduct limited profiling activities to maximise individual’s opportunities to succeed through the use of learning analytics which are used to monitor individual’s engagement with their studies. This will involve the processing of data such as attendance, assessment and VLE (Virtual Learning Environment) usage to develop an overall picture of engagement.

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

You have a right to access your personal information, to object to the processing of your personal information, to rectify, to erase, to restrict and to port your personal information. If you have provided consent to the Swansea University to process any of your data then you also have a right to withdraw that consent. Please visit the University Data Protection webpages for further information in relation to your rights.

Any requests or objections should be made in writing to the University Data Protection Officer:-

Digital Services
7th Floor Faraday Tower
Swansea University
Singleton Park
Swansea
SA2 8PP

Email: dataprotection@swansea.ac.uk

If you are unhappy with the way in which your personal information has been processed you may in the first instance contact the University Data Protection Officer using the contact details above.

If you remain dissatisfied then you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at: -

Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

ico.org.uk

You have a responsibility to keep your personal details up-to-date. During the course of your studies you may have access to personal information about others. You are expected to treat this in a responsible and professional manner and are legally required to do this under data protection legislation, as well as any professional ethics or codes of conduct. If you are made aware of personal information in confidence then you are expected to not tell anyone without the individual’s consent, unless there are exceptional circumstances. You should also not seek to gain others’ personal data if you are not entitled. Disciplinary action will be considered for any University member who breaches Data Protection Legislation or a duty of confidence.