Privacy Notice for Student Applicants

This notice explains who we are, how and why we collect and use personal information about you as a student applicant, our lawful bases for processing, relevant retention periods, and how you can exercise your data subject rights. Please do read this notice to understand our practices and if you have any questions please get in touch using the contact information provided.

Who we are

Throughout this notice, “University”, “we”, “our” and “us” refer to the Manchester Metropolitan University. We are a higher education institution offering teaching, education, research and all necessary services to support those who study with us. The University is the Controller in respect of the personal information we hold about you. We manage all personal information in accordance with the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 and the University’s Data Protection Policy.

The personal information we collect about student applicants

We receive applications to the University via the Universities and Colleges Admissions Service (UCAS) and via direct application routes.

The personal information we collect about you may include the following:

Personal details such as title, name, address, telephone number, email address, date of birth, sex and gender;

Course applied for;
Qualifications, Education and employment history information;
Information contained within your Personal Statement;
Visa, passport and immigration information;
Funding and financial support information.
Whether you used an agent to assist you in the application process.

We may also process the following special category personal data:

Information about your country of birth, nationality, race or ethnicity, sexual orientation and religious beliefs;
Information about your health, including any disability and/or medical condition;
Information about criminal convictions and offences (if applicable to your course).

We also receive the following information from UCAS about our applicants purely for research, analysis and statistical purposes considered to be in the public interest (it is not used in anyway as part of the recruitment and admissions process): eligibility for free school meals at age 15, where our applicants live using POLAR4 data, income deprivation affecting children index (IDACI) and school type.

Where does the University get your personal information from?

Most of this information comes from your application, either via UCAS or your direct application. We also obtain information:

As part of the interview and selection process.
From your referees, and previous schools, colleges and universities.
From the Disclosure and Barring Service (if applicable to your course).
If you contact us, we may keep a record of that correspondence.

The purposes of the processing

We use your personal information to assess your application, specifically:

Identify you and verify the information you have provided.
Assess your application for study and enrolment at the University and decide whether to offer you a place on the course you have applied for.
Contact named referees.
Communicating our outcome to you together with any feedback.

Admissions decisions are not automated.

For other purposes related to your application, such as:

Assess your eligibility for funding, tuition fee status and your financial status.
Prevent and detect instances of fraud.
Equal opportunities monitoring under equalities legislation.
To help us to make reasonable adjustments for any disability, as requested by you as part of the application process.
To fulfil and monitor our legal obligations under immigration legislation, assess your eligibility to study in the United Kingdom, offer our support services to international students, including immigration welfare and applications for visas.
Performance of tasks we carry out in the public interest (e.g. admissions research);
For research and statistical purposes, but no information which could identify you will be published.
To allow us to consider any future accommodation requirements if you have applied for University accommodation.
Basic information relating to applicants under 18 years old will be shared with relevant academic and professional service departments to ensure that we take appropriate steps to safeguard our learners and so that relevant arrangements can be put in place to support those individuals.
To provide statutory returns required by applicable legislation. See Recipients for further information.
Where you have used the services of an international or education agent, providing feedback to your agent on the status and success of your application.
If we make you an offer, communicating with you and promoting the University to you; such as informing you about the University’s open days, events, services and benefits which we think will be of interest to you. You can opt out of this service by contacting us using the contact information below.

If you are successful in your application the information you provide will form the basis of your student record.

Our lawful bases for processing

The University relies on the following lawful bases from Article 6 of the GDPR in order to use your personal information for the purposes outlined above.

Where it is necessary to meet a task in the public interest – we assess applications as a public authority acting in the public interest with a clear basis in law under the ‘public task’ lawful basis. We assess applications as a core part of our responsibilities as a higher education institution for promoting the advancement of learning. Our clear basis in law is s124 of the Education Reform Act, which states that a higher education corporation has the power to provide higher education and do anything which appears to the corporation to be necessary to pursue its aims in this respect. For further information and a full explanation of our activities which we carry out under public task, please see our Statement of Tasks Carried Out in the Public Interest.
With a view to entering into a contractual relationship with you. E.g. the Student Contract – we assess your application to study with us as per the ‘contract’ lawful basis. E.g. recruitment and admissions activities.
Legitimate interests - In order to communicate information which we think will be of benefit to our offer holders, such as: open days, events, opportunities, and services and benefits of studying at the University.

The Universities relies on the following lawful bases from Article 9 of the GDPR in order to use personal information supplied by you which is defined as special category:

Your explicit consent - If we do, we will provide you with full details for the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent, which you can withdraw at any time.
The processing is necessary for reasons of substantial public interest, i.e. to consider reasonable adjustments, equal opportunities monitoring, to prevent fraud and other unlawful acts, public safety, protect the public from dishonesty and malpractice and to comply with immigration legislation,

The recipients or categories of recipients of the personal data

In addition to sharing your personal information with relevant University departments for the purposes of assessing your application, we will share your personal information for the above purposes as relevant and necessary with:

Your referees, and where relevant and as required and/or notified to you, your school/college or training organisation.
Your examination boards or awarding bodies.
Your funders and/or potential funders, including in the case of international applicants, the British Council or appropriate agencies.
Where relevant and as required, UK Visas and Immigration in order to act as your sponsor for visa purposes.
With the Higher Education Statistics Authority (HESA); there is a legal obligation upon universities to provide student data to the Higher Education Funding Councils. The HESA facilitate this process.
Where relevant and as required, governmental bodies including local authorities, the Home Office, and the Department for Work and Pensions and its agencies
UCAS for the purpose of investigation in cases where we need to verify aspects of the application.
When you confirm your place at the University, the University Students’ Union, in order to facilitate your membership of this and associated clubs and societies and to enable you to register for Student Union events. You have the opportunity to opt-out of membership of the Students’ Union following your student registration.
Other Higher Education organisations, in order to assist with tracking and research into access to Higher Education.
Organisations as processors providing specific services to, or on behalf of, the University under the terms of a contract.
Where appropriate to banks (and other payment agencies you may use), family members who are paying a deposit, application fees, or early tuition fee payments before student registration.
Where you have applied with the support of an educational agent we will share the details of your application, including whether your application has been successful. You will have provided your consent at the point of application for this sharing. Examples include: Global Online.
With Experian, subject to the terms of a G Cloud and data protection compliant contract, for ID verification and data quality purposes.
With Facebook, Instagram and Google in order to place targeted adverts for our offer holders, which we think will be of benefit to you, such as: open days, events, opportunities, and services and benefits of studying at the University. If you would prefer for your e-mail address not to be disclosed to Facebook, Instragram and / or Google for this purpose, please contact us using the contact information below.

Other than as set out above, we will not normally publish or disclose any personal information about you to other external enquirers or organisations unless you have requested it or consented to it, or unless it is in your vital interests to do so (e.g. in an emergency situation).

Withdraw your consent

Where we collect, use and share your personal information with your consent we will provide you with specific privacy notice information at the appropriate time. You can withdraw your consent at any point. To do so you are encouraged to refer back to the privacy notice which we provided to you when we collected your information or when we sought your consent to use your information in a specific way.

Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the use of your personal information conducted in reliance of other lawful bases. You may also use the contact information under the heading ‘How to Contact Us’ to withdraw your consent.

Data retention

The University will retain your personal information for no longer than is necessary; specifically:

Information relating to non-progressed applications shall be retained until the completion of the admissions process + 1 year.
Information relating to progressed application shall be retained as part of the student record until the end of your relationship with the University + 6 years. For further about progressed applications please see the main Students Privacy Notice.

For further information about the University’s retention and disposal practices please see the Retention and Disposal Schedule Page.

Your rights in respect of the processing

The GDPR provides data subjects with the following rights:

The right to be informed – the University seeks to collect and use your personal information in a transparent manner. We fulfil this right through the use of privacy notices such as this main Student Privacy Notice and our other privacy notice information provided at the point of collecting your information and available from our Privacy Notices page.
The right of access - Unless relevant exemptions apply, you have the right to be told whether we hold your personal information and, if so, to be given a copy of it. This is known as the right of access or subject access. The right exists to support individuals to be aware of, and verify, the lawfulness of the processing by organisations. For further information please see our Subject Access page.
The right to rectification - If you believe that the information we hold about you is inaccurate or incomplete, please contact us and we will investigate. If your information is inaccurate, we will rectify it. If it is incomplete, we will complete it. Once we have determined what we are going to do, we will contact you to let you know.
The right to erasure - also referred to as ‘the right to be forgotten’. This right is not absolute and applies only in certain circumstances. If you submit a request, once we have determined whether the right applies and what we are going to do, we will contact you to let you know.
The right to restrict processing – this right is not absolute and applies only in certain circumstances. If you submit a request, once we have determined whether the right applies and what we are going to do, we will contact you to let you know.
The right to object – this right is not absolute and applies in certain circumstances. Where applicable, in the first instance, please use unsubscribe links in any of our communications or use the contact information we provided within the privacy notice used at the point of data collection. If you submit a request, once we have determined what we are going to do, we will contact you to let you know.
The right to withdraw consent – where the University uses consent as our lawful basis for the processing of your personal information, you have the right to withdraw your consent at any time. In the first instance, please use unsubscribe links in any of our communications or use the contact information provided within the applicable privacy notice.

For further information about your subject rights please see our Data Subject Rights page. To protect the confidentiality of your information we may ask you to verify your identity before fulfilling any request.

Contacting us

For questions or concerns about this Privacy Notice, or our use of your personal information, please contact applicationinfo@mmu.ac.uk in the first instance.

Our Data Protection Officer can also be contacted using dataprotection@mmu.ac.uk, by calling 0161 247 3331 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority in respect of the processing of your personal data. We would encourage you to expend our internal complaints procedure through our initial contact and the University Data Protection Officer, prior to contacting the ICO. Please contact: casework@ico.org.uk or telephone: 0303 123 1113. For any further contact information please see: https://ico.org.uk/global/contact-us/.

Updates to this privacy notice

We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

This notice was last updated on the 16.06.22