Privacy Notice for Students

Before we get into the detail, we want to make sure you know that your privacy is important to us. We know you have heard this all before, but we mean it. You have placed your trust in us by choosing to study at the University and by providing us with your personal information; we value that trust and want to uphold the data protection and privacy standards you expect. That means we are committed to appropriately protecting and safeguarding your information.

So anyway, here we go with the detail. This is our main privacy notice for our students; we have many other privacy notices, which are specific to certain student services that we offer and our activities that we conduct. Where we have a specific notice we have excluded most of the detail from this main notice in order to keep things as simple as possible. 

This notice explains who we are, how and why we collect and use personal information about you as a student, what personal information is held, our lawful bases for processing, who we share your information with, relevant retention periods, and how you can exercise your data subject rights.

If anything does not make sense, or if you have any questions or confusions about our use of your personal information, please do contact us using the contact details below.

 

Who we are

Throughout this notice, “University”, “we”, “our” and “us” refer to the Manchester Metropolitan University. We are a higher education institution offering teaching, education, research and all necessary services to support those who study with us. The University is the Controller in respect of the personal information we hold about you. We manage all personal information in accordance with the General Data Protection Regulation (GDPR), the Data Protection Act 2018 and the University’s Data Protection Policy.

 

The personal information we hold about students

The personal information the University may process about you as a student includes:

 

Special category and criminal conviction information

In addition to above, the University may need to collect, or you may choose to provide us with information which is classed as ‘special category’. We may ask for your consent to use this type of information. This includes:

The University makes sure that access, use of and the sharing of your special category personal information is controlled very carefully. 

 

Where does the University get your personal information from? 

The information you provided to us within your application to study with the University, whether via the Universities and Colleges Admissions Service (UCAS) or direct application, forms the basis of your core student record. The University also obtains your information:

 

The purposes of the processing

In short, we need to collect and use your personal information so that we can function effectively as a higher education institution, provide you with the support you require in order to undertake your studies, achieve academic success, and meet certain legal requirements. Personal information is needed to provide you with the following services and to undertake the following activities:

We do not use your personal data to carry out any wholly automated decision-making that affects you. As part of our layered approach to delivering our privacy notice information to you, many of these services and activities have specific privacy notices which contain further information.  

 

What are our lawful bases for processing?

The University relies of the following lawful bases from Article 6 of the GDPR in order to use your personal information for the purposes outlined above.

As part of our layered approach to delivering our privacy notice information to you, many of these lawful bases are explained further within specific privacy notices.  

 

The recipients or categories of recipients of the personal data 

In order to perform our legal responsibilities, contractual and other purposes set out above, we may, from time to time, need to share your information with third parties as follows:

Where the University uses third parties to support us and provide services on our behalf (acting as data processors), a written contract will be put in place to ensure that your information will be held in accordance with the requirements of data protection legislation and that such data processors have appropriate security measures.

Parents, family members and other guardians are considered to be third parties and your information will not be disclosed to them unless you have given your consent for relevant information in certain circumstances to be shared, or we believe the disclosure is otherwise made in accordance with data protection legislation.

 

The right to withdraw consent 

Where we collect, use and share your personal information with your consent we will provide you with specific privacy notice information at the appropriate time. You can withdraw your consent at any point. To do so you are encouraged to refer back to the privacy notice which we provided to you when we collected your information or when we sought your consent to use your information in a specific way. 

Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the use of your personal information conducted in reliance of other lawful bases. You may also use the contact information under the heading ‘How to Contact Us’ to withdraw your consent.

 

Data retention

Your personal information will only be retained by the University for as long as it is necessary for the purposes outlined above. Many of the University’s retention periods are aligned to other higher education institutions and JISC standards.

Most of the University’s information about your application to study with us, registration, your study with the University as a student, academic progress, assessments, attendance, placements,  accommodation, and your engagement with our support services will be retained for six years after your graduation or departure date, after which your information will be securely disposed of.

Core student information about you, e.g. your studies and academic awards (name, dates of study, courses studies, main academic details, units, marks and classification etc) will be retained indefinitely.

The University maintains a detailed schedule which sets out our retention and disposal periods. For further information about the University’s retention and disposal periods and procedures please see our Retention and Disposal Schedule

 

Your rights in respect of the processing

The GDPR provides data subjects with the following rights: 

For further information about your subject rights please see our Data Subject Rights Webpage. To protect the confidentiality of your information we may ask you to verify your identity before fulfilling any request.

 

Alumni 

On graduation, your information is passed to our Development and Alumni Relations Team so you can be  automatically registered as a member of the University alumni.  We do this so we can maintain a lifelong alumni and supporter relationship with you. You may receive information relating to alumni activities, such as news, events and fundraising opportunities. For further information about our alumni community and benefits please see our Alumni Webpage. Our Alumni and Supporters Privacy Notice explains how we use your personal data for alumni services when you graduate from the University. To opt out of joining our alumni community please contact our Development and Alumni Relations Team.

 

Other related student privacy notices 

 

How to contact us 

For questions or concerns about this Privacy Notice, or our use of your personal information, please contact our Data Protection Team using dataprotection@mmu.ac.uk, by calling 0161 247 3884 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.

 

Right to lodge a complaint with the supervisory authority 

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority for data protection. We would encourage you to use our internal complaints procedure through our Data Protection Officer, prior to contacting the ICO. Please contact: casework@ico.org.uk or telephone: 0303 123 1113. For any further contact information please see: https://ico.org.uk/global/contact-us/.

 

Updates to this privacy notice 

We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. This privacy notice was last updated on: the 1st September 2019.

Privacy Notices