Privacy notice for Enquirers and Prospective Students
This Privacy Notice explains who we are, what personal data we collect and use about enquirers and prospective students, how we use your personal data, our lawful basis for processing, our relevant retention periods, and how you can exercise your privacy rights. This notice provides information that is in addition to information contained within the University’s privacy notice which was provided to you at the point of data collection and if applicable when we obtained your consent. Please do read this notice to understand our practices and if you have any questions please contact us using the contact details provided below.
Who we are
Throughout this notice, “University”, “we”, “our” and “us” refer to the Manchester Metropolitan University, an exempt charity under Schedule 2 of the Charities Act 1993 (amended by the Charities Act 2011). The University is the Data Controller in respect of any personal data held about you as an enquirers and / or prospective student.
The University is registered as a Data Controller with the Information Commissioner’s Office (ICO). We manage personal data in accordance with the General Data Protection Regulation (GDPR) and the University’s Data Protection Policy.
The personal data we process
We collect personal data about enquirers and prospective students directly from you. This may have been collected as part of: ordering a prospectus, signing up to receive one of our newsletters or whilst registering for a University open day, event or webinar etc. The exact personal data we hold will have been determined by the form you completed and the specific request you have asked us to fulfil, but is likely to include the following:
The purposes and lawful basis of the processing
Your information will enable us to:
Purpose - We use your personal data to answer the enquiry or to fulfil your specific request. For example, to receive a prospectus, to manage and administer your attendance at a University event, or to send you one of our newsletters etc.
Lawful basis - We process your personal data to fulfil your request in ways you would reasonably expect and which has a minimal privacy impact to you. As such, we rely upon the ‘legitimate interest’ lawful basis.
Purpose - To conduct promotional and marketing activity. This is likely to include sending you targeted promotional marketing communications about the University, its services, events courses, and benefits of studying with us which we think you will be interested in.
Lawful basis - You have given us your consent. You provided us with your consent to send you promotional and marketing related communications.
The University may use data processors to assist us in delivering our communications and services to you. Those third party providers include, but are not limited to, NetNatives, Gecko Labs Limited and Campaign Monitor. Where this is the case, this activity will take place under the strict terms of a data processing agreement. Such agreements will restrict the use of your personal data to the defined purposes stated above and incorporate important confidentiality and information security requirements.
Please note the University may also share limited personal data with social media providers such as Facebook so that we may communicate our advertising to you on their platforms. You have the option of these adverts by amending your setting or preferences on the relevant social media platform.
The right to withdraw consent
You can withdraw your consent for us to process your personal data for our promotional activities and to receive any or all of our promotional related communications using the contact information, which was provided in the original privacy notice at the point of data collection, by using unsubscribe links within our newsletters or by contacting: email@example.com.
Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data which relies on lawful processing grounds other than consent.
For further information about the University’s Retention and Disposal procedures please refer to our Retention and Disposal Schedule.
Your rights in respect of the processing
The GDPR provides data subjects with the following data subject rights:
The right to be informed – the original privacy notice used at the point of data collection, combined with this additional privacy notice information assists with fulfilling these obligations.
The right of access - You have the right to be told whether we are processing your personal data and, if so, to be given a copy of it. This is known as the right of subject access. The right of access to personal data held about you exists in order to be aware of, and verify, the lawfulness of the processing. You can find out more about this right on the University’s Subject Access Page.
The right to rectification - If you believe that personal data we hold about you is inaccurate, please contact us and we will investigate. You can also request that we complete any incomplete data. Once we have determined what we are going to do, we will contact you to let you know.
The right to erasure and right to object - You can ask us to erase your personal data in any of the following circumstances: we no longer need the personal data for the purpose it was originally collected; you withdraw your consent and there is no other legal basis for the processing; you object to the processing and there are no overriding legitimate grounds for the processing etc. Once we have determined whether we will erase the personal data, we will contact you to let you know.
The right to restrict processing - You can ask us to restrict the processing of your personal data in the following circumstances: you believe that the data is inaccurate and you want us to restrict processing until we determine whether it is indeed inaccurate, the processing is unlawful and you want us to restrict processing rather than erase it, we no longer need the data for the purpose we originally collected it but you need it in order to establish, exercise or defend a legal claim and you have objected to the processing and you want us to restrict processing until we determine whether our legitimate interests in processing the data override your objection. Once we have determined how we propose to restrict processing of the data, we will contact you to discuss and, where possible, agree this with you.
Please use the contact information below to exercise these rights.
For questions or concerns about this Privacy Notice, or our use of your personal information, please use the contact information provided within the privacy notice provided at the point of data collection or the: firstname.lastname@example.org e-mail address in the first instance.
Our Data Protection Officer can also be contacted using email@example.com, by calling 0161 247 3884 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.
Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority in respect of the processing of your personal data. We would encourage you to expend our internal complaints procedure through our initial contact and the University Data Protection Officer, prior to contacting the ICO. Please contact: firstname.lastname@example.org or telephone: 0303 123 1113. For any further contact information please see: https://ico.org.uk/global/contact-us/.
Updates to this privacy notice
We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.