Study

Privacy statement for applicants

Information for applicants about how we use your personal data and who we share it with.

Where does the University get your personal data from?

We obtain personal data about you from the following sources:

  • From your application, and from any additional information you provide as part of a pre-application enquiry, to supplement or clarify your application, or as part of a feedback request, appeal or complaint.
  • From third party sources (e.g. UCAS or other institutions involved in collaborative programmes). When we obtain personal data about you from third party sources, we will aim to ensure that the third party has lawful authority to provide us with your personal data.

Purposes for processing

The information you provide will be used by the University to give you accurate pre-application advice, for the assessment of your application, to invite you to take part in on campus or online events, and for the consideration of appeals and complaints.

We set out in table 1 of this notice (below) the purposes for which we will process your personal data in detail.

Why we process your personal data

There are various legal bases for why we use your information. You will find the appropriate legal basis listed alongside each of the purposes for processing your data shown in table 1.

Here is a brief explanation of each of the legal bases:

Consent
On specific occasions the University will only process certain data if you consent, e.g. on your application form, you only need to provide certain “special categories” of data if you agree to that.
Necessary for entering into a student contract 
On many occasions the University will process your data to enable it to meet its commitments to you, e.g. assessing your application for an offer of a place.
Necessary for the performance of a task carried in the public interest 

The University is an educational establishment and in particular its educational activity is conducted in a public interest (including your interest and the interest of others).

Necessary for the purposes of the legitimate interest of the University or a third-party subject to overridden interests of the data subject

The University (and sometimes third parties) has a broad legitimate interest in activities that connect to the activities and education of students. Subject to those interests not being overridden by the interests of fundamental rights and freedoms of students, it will pursue those interests. A good example of this legitimate interest would be conducting surveys to better understand people’s reasons for declining an offer of a place. Where Article 6(1)(f) is used the “legitimate interest” is generally the interest of the University (or third party) in providing or supporting the provision of higher education to its students.

Special category data is personal data which is more sensitive, and so needs more protection. This data would include anything that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. To process these types of data additional legal bases are required:

  • Processing “special categories” of data where you have given consent – the University will process certain sensitive information about you with your consent, for example, to contact you in relation to any adjustments you may require as a result of a disability, or to combat fraud.
  • Processing “special categories” of data where necessary for reasons of substantial public interest.

Sharing your information

Information about Scottish and EU applicants may be shared with Scottish Funding Council for statistical purposes.

Information about successful non-EEA applicants will be shared with United Kingdom Visas and Immigration (UKVI).

Police forces within United Kingdom can request information about an applicant’s contact details, programme and start date that the University may share under the General Data Protection Regulation and Data Protection Act 2018. These requests are stored for 6 years. Any requests from outside the UK will be reviewed by the Head of Student Administration Services.

Information provided by applicants about their qualifications may be shared with awarding bodies, previous academic institutions or national or international verification services to verify qualifications and grades.

Information about applicants for professional degrees who have accepted an offer from the University of Edinburgh may be shared with relevant professional registration bodies.

Information about successful applicants for degrees awarded jointly by the University of Edinburgh with partner organisations, and where the University of Edinburgh is processing the applications, is shared with the partner organisation.

Information about postgraduate research applicants who have accepted an offer from the University of Edinburgh is shared with the relevant Research Council.

The Protecting Vulnerable Groups (PVG) Scheme application form which is completed by a successful applicant for a degree programme which requires PVG Scheme membership and which is given to the University of Edinburgh for verification and countersignature, will be passed to Disclosure Scotland once the form has been countersigned.

Information about applicants who have firmly accepted an offer to study at the University of Edinburgh is shared with the Edinburgh University Students' Association.

Information technology systems

The university is made up of many services and departments who collect, process and store your data in a variety of sub-systems to deliver their services. These local systems are part of the corporately-supported information technology architecture, which maintains a live service as well as copies of the live systems used for software development and testing. These development and testing systems will also contain your data and respect the University’s data retention periods. It is in the legitimate interest of the University to use your data in this way to ensure that the services you interact with are secure and provide the best student experience possible.

Surveys

Your information may be used to allow us to carry out surveys. These include the decliners’ survey which is sent to applicants who have declined an offer of a place at the University of Edinburgh, or surveys of applicants who have participated in offer holder events, and help us to improve our services and the applicant experience.

Management information, research, and learning analytics

We may analyse data on applications, offers and acceptances in order to: understand the relationship between pre-University qualifications and student achievement; assess underrepresentation in different groups of students, assess the impact of contextual admissions, admissions policies, changes in education and exam systems, government initiatives. While we will where possible use anonymised data for these purposes, in some cases we will use personal data where there is a legitimate interest in doing so. Where we use personal data for these purposes, we will ensure that any published information is anonymised.

Contact

If you have any questions, please contact applicant.privacy@ed.ac.uk.

Table 1: uses of your data

“Retention period” refers to the number of academic years that your data will be held for after you complete your studies.

Uses of your data
Data category Short description Specific purpose Legal basis Retention period
Pre-application enquiries.

Potential applicants provide personal data, and sometimes sensitive personal data, in order to get advice and information from admissions staff which is tailored to their own specific circumstances.

As a prospective applicant, you may provide us with contact information so that admissions staff can reply to your query, and you may provide personal information related to your health, disability, criminal convictions, care status, financial circumstances etc. so that we can provide the most accurate advice possible, specific to your circumstances.

Potential applicants expect us to retain the information they have given us so that admissions staff will have access to it if they go on to make an application at a later date.

Consent.

To the end of the current admissions cycle.

   

We may use contact information you have shared with us to invite you to take part in on campus and online activities and events which we believe may be of interest to you, or to send you information about the university.

Legitimate interest. To the end of the current admissions cycle.
Applications

The admissions process collects information submitted by applicants in order to assess their suitability for a place on the chosen programme of study.

The decision-making process will require communication and interaction with an applicant.

Your application must include information about identity such as name, title, date of birth and gender. It must also provide information regarding your educational background such as previously-attained qualifications, transcripts, personal statements or research topics, and professional experience where relevant to support the application. Undergraduate applications include demographic information which is used to assess your contextual status (see the contextual admissions policy for further information)

The information contained on the application is used to screen applications to ensure that applicants meet the minimum criteria required for their chosen programme of study, and to select applicants who will receive an offer, or who will progress to the next stage of selection where appropriate, which may involve an invitation to attend an interview, or consideration of a portfolio.

Performance of contract.

Completion plus 5 years for successful applicants.

 

To the end of the admissions cycle plus 1 year for unsuccessful applicants.
    Contact information provided by applicants may be used to invite them to take part in on campus and online activities and events, or to send you information about the university. Legitimate interest. To the end of the current admissions cycle.
Fee status assessment. Fee status determines both the expected fees that would be due as part of an offer to study at the University, and the fee status group within which an application will be considered.

We will use information from your application including your nationality and residency to establish which fee status group you will be part of. This determines both the expected fees that would be due as part of an offer to study at the University, and the fee status group within which your application will be considered.

If the information provided on your application cannot clearly define your fee status then you may be required to complete a Fee Status Questionnaire. You may have to provide evidence of your place of birth, previous schools, copies of your passport and your parents’ passports.

Additionally you may be asked to disclose information about scholarships and bursaries that you receive.

Performance of contract.

Legal obligation (Education (Fees and Awards) (Scotland) Regulations 2011.

Completion plus 5 years for successful applicants.

To the end of the admissions cycle plus 1 year for unsuccessful applicants.

Immigration.

The University of Edinburgh provides Tier 4 visa sponsorship to remain in the UK during your studies. All non-EU/EEA/Swiss nationals will require permission to enter or remain in the UK.

Your nationality and country of birth are used to ascertain if you requires a visa to study, and this is communicated to you during the admissions process.

Tier 4 sponsorship is provided in the form of a Confirmation of Acceptance for Study (CAS). A CAS is an electronic document that confirms to the UK Home Office that the University of Edinburgh wishes to sponsor your migration to the UK for the purpose of study. This document will be created for you, and you can use this as part of your visa application.

You need to supply a copy of your visa and passport as the University is responsible for verifying these documents.
Legal Obligation (Part 3, Section A57B. In paragraphs A57A to A57H of the UK Immigration Rules). Indefinitely.
  Academic Technology Approval Scheme (ATAS) The Academic Technology Approval Scheme (ATAS) is one of the UK government’s measures to prevent the spread of knowledge and skills used to develop weapons of mass destruction and associated technology. Applicants to certain science and technology programmes in the UK require you to have ATAS clearance and this must obtained before making a Tier 4 visa application.   Indefinitely.
Widening participation. The University’s policy on Widening Participation aims to address the discrepancies in the uptake of higher education opportunities between different social groups.

The University works to raise educational aspirations and attainment among prospective students from under-represented groups. Information about the area where you live, the school you attend, whether you have spent time in local authority care, and your participation in a recognised widening participation scheme is used to assess whether you are eligible to receive a contextual offer, under the terms of the contextual admissions policy.

Consent.

TBD by SRA’s policy.
    This data is also used to track the progress and success of applicants and students from their first contact with the University, through admissions and to the completion of their degree, to help the University understand how best to support all students. Legitimate interest. TBD by SRA’s policy.
Disability support.  

Any information you provide on your application about your disability is used in accordance with the University’s Admissions policy for students who have disclosed a disability.  The Student Disability Service will use information provided on the application to initially contact you to share information about the service and to invite you to meet and discuss any support requirements you may have.

Legal Obligation (Equality Act 2010), as this is health data and considered "special category" personal data under the GDPR the further legal basis of 'Public interest based on law' applies.

Completion plus 5 years for successful applicants.

To the end of the admissions cycle plus 1 year for unsuccessful applicants.
Criminal convictions.   If you apply for a degree programme which is exempt from the Rehabilitation of Offenders Act (1974), you will be required to indicate on your application if you have any criminal convictions. You may also be asked to join the PVG Scheme before we can make an offer of admission. Any information you give us about criminal convictions will be used only to assess your suitability for the degree programme you have applied for, in accordance with the University’s criminal convictions policy. Public interest based on law.

Unsuccessful applicants: information destroyed following notification of outcome, allowing sufficient time for an appeal to be submitted.

Successful applicants: at the end of their degree programme.
Admissions fraud.   If you are found to have committed fraud in the application and admissions process, in accordance with the University’s Policy and Procedure regarding Admissions Fraud, we reserve the right to retain your personal information so that any future applications you submit can be identified. Legitimate interest. In perpetuity.
Postgraduate taught application fees and deposits. Application fees and deposits are required from applicants for some postgraduate taught degrees. Where an application fee or a fee deposit is paid, the University will use information we hold from your application to record your compliance and to allocate any fee deposit income to your fees account. Performance of a contract.  
Admissions Appeals.  

Unsuccessful applicants may provide contact information in order to receive a response to an admissions appeal, and may provide personal information related to health, disability, care status, financial circumstances etc. which will need to be taken into account in consideration of their appeal.

 

Performance of contract.

 
Complaints  

Applicants may provide contact information in order to receive a response to a complaint, and may provide personal information related to health, disability, care status, financial circumstances etc. which will need to be taken into account in consideration of their complaint.

Performance of contract.  
Equality monitoring   The University of Edinburgh is committed to equality of opportunity for all its students and staff, and promotes a culture of inclusivity. To this end we collect equalities information including your ethnicity and any disabilities so that we can analyse data and produce statistics to ensure the University is meeting the requirements of Scottish regulations under the Equality Act 2010. Legal obligation (Equality Act 2010), as this is health data and considered "special category" personal data. Under the GDPR the further legal basis of 'Public interest based on law' applies.  
Pre-arrival and induction Provision of information which may be useful to applicants who have accepted an offer before they matriculate as students.

Applicants who have accepted an offer from the University of Edinburgh will be contacted using details they have provided in their application with information about services that may be useful to them before they arrive at the University, including Accommodation Services; Student Disability Services; Student Counselling Services; Scholarships and Student Funding.

Applicants who have accepted an offer will be contacted by the University, and by the appropriate academic school or subject area, with information about arrangements for Welcome Week, and guidance on the things they will need to do when they arrive at the University.

Performance of contract.  

University privacy statements

The University maintains several other privacy statements that are specific to services delivered.

General Privacy Notice