This notice explains who we are, how and why we collect and use personal information about you as a student applicant, our lawful bases for processing, relevant retention periods, and how you can exercise your data subject rights. Please do read this notice to understand our practices and if you have any questions please get in touch using the contact information provided.
Who we are
Throughout this notice, “University”, “we”, “our” and “us” refer to the Manchester Metropolitan University. We are a higher education institution offering teaching, education, research and all necessary services to support those who study with us. The University is the Controller in respect of the personal information we hold about you. We manage all personal information in accordance with the General Data Protection Regulation (GDPR), the Data Protection Act 2018 and the University’s Data Protection Policy.
The personal information we collect about student applicants
We receive applications to the University via the Universities and Colleges Admissions Service (UCAS) and via direct application routes.
The personal information we collect about you may include the following:
Personal details such as title, name, address, telephone number, email address, date of birth, sex and gender;
- Course applied for;
- Qualifications, Education and employment history information;
- Information contained within your Personal Statement;
- Visa, passport and immigration information;
- Funding and financial support information.
We may also process the following special category personal data:
- Information about your country of birth, nationality, race or ethnicity, sexual orientation and religious beliefs;
- Information about your health, including any disability and/or medical condition;
- Information about criminal convictions and offences (if applicable to your course).
Where does the University get your personal information from?
Most of this information comes from your application, either via UCAS or your direct application. We also obtain information:
- As part of the interview and selection process.
- If you contact us, we may keep a record of that correspondence.
- From your referees, and previous schools, colleges and universities.
- From the Disclosure and Barring Service (if applicable to your course).
The purposes of the processing
We use your personal information to assess your application, specifically:
- Identify you and verify the information you have provided.
- Assess your application for study and enrolment at the University and decide whether to offer you a place on the course you have applied for.
- Contact named referees.
- Communicating our outcome to you together with any feedback.
Admissions decisions are not automated.
For other purposes related to your application, such as:
- Assessing your eligibility for funding, tuition fee status and your financial status.
- Prevent and detect instances of fraud.
- Equal opportunities monitoring under equalities legislation.
- To help us to make reasonable adjustments for any disability, as requested by you as part of the application process.
- To fulfil and monitor our legal obligations under immigration legislation, to deliver our support services to international students, including immigration welfare and applications for visas.
- Performance of tasks we carry out in the public interest (e.g. admissions research);
- For research and statistical purposes, but no information which could identify you will be published.
- To allow us to consider any future accommodation requirements if you have apply for University accommodation.
- To provide statutory returns required by applicable legislation. See Recipients for further information.
- If we make you an offer, communicating with you to inform you about the University’s open days, events, services and benefits which we think will be of interest to you.
If you are successful in your application the information you provide will form the basis of your student record.
Our lawful bases for processing
The University relies on the following lawful bases from Article 6 of the GDPR in order to use your personal information for the purposes outlined above.
- Where it is necessary to meet a task in the public interest – we assess applications as a public authority acting in the public interest with a clear basis in law under the ‘public task’ lawful basis. We assess applications as a core part of our responsibilities as a higher education institution for promoting the advancement of learning. Our clear basis in law is s124 of the Education Reform Act, which states that a higher education corporation has the power to provide higher education and do anything which appears to the corporation to be necessary to pursue its aims in this respect. For further information and a full explanation of our activities which we carry out under public task, please see our Statement of Tasks Carried Out in the Public Interest.
- With a view to entering into a contractual relationship with you. E.g. the Student Contract – we assess your application to study with us as per the ‘contract’ lawful basis. E.g. recruitment and admissions activities.
The Universities relies on the following lawful bases from Article 9 of the GDPR in order to use personal information supplied by you which is defined as special category:
- Your explicit consent - If we do, we will provide you with full details for the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent, which you can withdraw at any time.
- The processing is necessary for reasons of substantial public interest, i.e. to consider reasonable adjustments, equal opportunities monitoring, to prevent fraud and other unlawful acts, public safety, protect the public from dishonesty and malpractice and to comply with immigration legislation,
The recipients or categories of recipients of the personal data
In addition to sharing your personal information with relevant University for the purposes of assessing your application we will share your personal information for the above purposes as relevant and necessary with:
- Your referees and where relevant and as required and/or notified to you, your school/college or training organisation.
- Your examination boards or awarding bodies.
- Your funders and/or potential funders, including in the case of international applicants, the British Council or appropriate agencies.
- Where relevant and as required, UK Visas and Immigration in order to act as your sponsor for visa purposes.
- With the Higher Education Statistics Authority (HESA); there is a legal obligation upon universities to provide student data to the Higher Education Funding Councils. The HESA facilitate this process.
- Where relevant and as required, governmental bodies including local authorities, the Home Office, and the Department for Work and Pensions and its agencies
- UCAS for the purpose of investigation in cases where we need to verify aspects of the application.
- When you confirm your place at the University, the University Students’ Union, in order to facilitate your membership of this and associated clubs and societies and to enable you to register for Student Union events. You have the opportunity to opt-out of membership of the Students’ Union following your student registration.
- Other Higher Education organisations, in order to assist with tracking and research into access to Higher Education.
- Organisations as processors providing specific services to, or on behalf of, the University under the terms of a contract.
- Where appropriate to banks (and other payment agencies you may use), family members who are paying a deposit, application fees, or early tuition fee payments before student registration.
- Where you have applied with the support of an educational agent we will share the details of your application with them with your consent.
Other than as set out above, we will not normally publish or disclose any personal information about you to other external enquirers or organisations unless you have requested it or consented to it, or unless it is in your vital interests to do so (e.g. in an emergency situation).
Withdraw your consent
Where we collect, use and share your personal information with your consent we will provide you with specific privacy notice information at the appropriate time. You can withdraw your consent at any point. To do so you are encouraged to refer back to the privacy notice which we provided to you when we collected your information or when we sought your consent to use your information in a specific way.
Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the use of your personal information conducted in reliance of other lawful bases. You may also use the contact information under the heading ‘How to Contact Us’ to withdraw your consent.
The University will retain your personal information for no longer than is necessary; specifically:
- Information relating to non-progressed applications shall be retained until the completion of the admissions process + 1 year.
- Information relating to progressed application shall be retained as part of the student record until the end of your relationship with the University + 6 years. For further about progressed applications please see the main Students Privacy Notice.
For further information about the University’s retention and disposal practices please see the Retention and Disposal Schedule Page.
Your rights in respect of the processing
The GDPR provides data subjects with the following rights:
- The right to be informed – the University seeks to collect and use your personal information in a transparent manner. We fulfil this right through the use of privacy notices such as this main Student Privacy Notice and our other privacy notice information provided at the point of collecting your information and available from our Privacy Notices Webpage.
- The right of access - Unless relevant exemptions apply, you have the right to be told whether we hold your personal information and, if so, to be given a copy of it. This is known as the right of access or subject access. The right exists to support individuals to be aware of, and verify, the lawfulness of the processing by organisations. For further information please see our Subject Access Webpage.
- The right to rectification - If you believe that the information we hold about you is inaccurate or incomplete, please contact us and we will investigate. If your information is inaccurate, we will rectify it. If it is incomplete, we will complete it. Once we have determined what we are going to do, we will contact you to let you know.
- The right to erasure - also referred to as 'the right to be forgotten'. This right is not absolute and applies only in certain circumstances. If you submit a request, once we have determined whether the right applies and what we are going to do, we will contact you to let you know.
- The right to restrict processing – this right is not absolute and applies only in certain circumstances. If you submit a request, once we have determined whether the right applies and what we are going to do, we will contact you to let you know.
- The right to object – this right is not absolute and applies in certain circumstances. Where applicable, in the first instance, please use unsubscribe links in any of our communications or use the contact information we provided within the privacy notice used at the point of data collection. If you submit a request, once we have determined what we are going to do, we will contact you to let you know.
- The right to withdraw consent – where the University uses consent as our lawful basis for the processing of your personal information, you have the right to withdraw your consent at any time. In the first instance, please use unsubscribe links in any of our communications or use the contact information provided within the applicable privacy notice.
For further information about your subject rights please see our Data Subject Rights Webpage. To protect the confidentiality of your information we may ask you to verify your identity before fulfilling any request.
For questions or concerns about this Privacy Notice, or our use of your personal information, please contact firstname.lastname@example.org in the first instance.
Our Data Protection Officer can also be contacted using email@example.com, by calling 0161 247 3331 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.
Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority in respect of the processing of your personal data. We would encourage you to expend our internal complaints procedure through our initial contact and the University Data Protection Officer, prior to contacting the ICO. Please contact: firstname.lastname@example.org or telephone: 0303 123 1113. For any further contact information please see: https://ico.org.uk/global/contact-us/.
Updates to this privacy notice
We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. This notice was last updated on the 17.10.19.