Where does the University get your personal data from?
We obtain personal data about you from the following sources:
- From your application, and from any additional information you provide as part of a pre- or post-application enquiry, to supplement or clarify your application, or as part of a feedback request, appeal or complaint.
- From third party sources (for example, UCAS or other institutions involved in collaborative programmes). When we obtain personal data about you from third party sources, we will aim to ensure that the third party has lawful authority to provide us with your personal data.
Purposes for processing
The information you provide will be used by the University to give you accurate pre-application advice, for the assessment of your application, to invite you to take part in on campus or online events, and for the consideration of appeals and complaints.
We set out in table 1 of this notice (below) the purposes for which we will process your personal data in detail.
Why we process your personal data
There are various legal bases for why we use your information. You will find the appropriate legal basis listed alongside each of the purposes for processing your data shown in table 1.
Here is a brief explanation of each of the legal bases:
Consent
On specific occasions the University will only process certain data if you consent. For example, on your application form, you only need to provide certain “special categories” of data if you agree to that.
Necessary for entering into a student contract
On many occasions the University will process your data to enable it to meet its commitments to you, for example assessing your application for an offer of a place.
Necessary for the performance of a task carried in the public interest
The University is an educational establishment and in particular its educational activity is conducted in a public interest (including your interest and the interest of others).
Necessary for the purposes of the legitimate interest of the University or a third-party subject to overridden interests of the data subject
The University (and sometimes third parties) has a broad legitimate interest in activities that connect to the activities and education of students. Subject to those interests not being overridden by the interests of fundamental rights and freedoms of students, it will pursue those interests. A good example of this legitimate interest would be conducting surveys to better understand people’s reasons for declining an offer of a place. Where Article 6(1)(f) of the UK General Data Protection Regulation (UK GDPR) is used, the “legitimate interest” is generally the interest of the University (or third party) in providing or supporting the provision of higher education to its students.
Special category data is personal data which is more sensitive, and so needs more protection. This data would include anything that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. To process these types of data additional legal bases are required:
- Processing “special categories” of data where you have given consent – the University will process certain sensitive information about you with your consent, for example, to contact you in relation to any adjustments you may require as a result of a disability, or to combat fraud.
- Processing “special categories” of data where necessary for reasons of substantial public interest.
Sharing your information
Information about Scotland Fee Rate applicants may be shared with Scottish Funding Council for statistical purposes.
Information about successful applicants who require a Student visa will be shared with United Kingdom Visas and Immigration.
Police forces within United Kingdom can request information about an applicant’s contact details, programme and start date that the University may share under the UK GDPR and DPA 2018. These requests are stored for 6 years. Any requests from outside the UK will be reviewed by the Head of Student Administration Services.
Information provided by applicants about their qualifications may be shared with awarding bodies, previous academic institutions or national or international verification services to verify qualifications and grades.
Information about applicants for professional degrees who have accepted an offer from the University of Edinburgh may be shared with relevant professional registration bodies.
Information about successful applicants for degrees awarded jointly by the University of Edinburgh with partner organisations, and where the University of Edinburgh is processing the applications, is shared with the partner organisation.
Information about individual postgraduate research applicants who have accepted an offer from the University of Edinburgh is shared with the relevant Research Council. Anonymised data about all postgraduate research applicants may also be share with the relevant Research Council.
Protecting Vulnerable Groups (PVG) Scheme applications are normally completed by applicants online. Where a hard copy of the PVG Scheme application form is completed by a successful applicant for a degree programme which requires PVG Scheme membership and is given to the University of Edinburgh for verification and countersignature, this will be passed to Disclosure Scotland once the form has been countersigned.
Information about applicants who have firmly accepted an offer to study at the University of Edinburgh is shared with the Edinburgh University Student Association.
If you write to us in Gaelic, we may be using a third party translator to translate your message into English and our response back into Gaelic.
Ma sgrìobhas sibh litir no post-d thugainn sa Ghàidhlig, tha e comasach gun cleachd sinn eadar-theangair airson do theachdaireachd eadar-theangachadh bhon Ghàidhlig gu Beurla agus freagairt air ais dhan a’ Ghàidhlig.
Information technology systems
The University is made up of many services and departments who collect, process and store your data in a variety of sub-systems to deliver their services. These local systems are part of the corporately-supported IT architecture which maintains a live service as well as copies of the live systems used for software development and testing.
These development and testing systems will also contain your data and respect the University’s data retention periods. It is in the legitimate interest of the University to use your data in this way to ensure that the services you interact with are secure and provide the best student experience possible.
Surveys
Your information may be used to allow us to carry out surveys. These include the decliners’ survey which is sent to applicants who have declined an offer of a place at the University of Edinburgh, or surveys of applicants who have participated in offer holder events, and help us to improve our services and the applicant experience.
Management information, research, and learning analytics
We may analyse data on applications, offers and acceptances in order to:
- understand the relationship between pre-University qualifications and student achievement
- assess underrepresentation in different groups of students
- assess the impact of:
- contextual admissions
- admissions policies
- changes in education and exam systems
- government initiatives
- student recruitment activities
While we will where possible use anonymised data for these purposes, in some cases we will use personal data where there is a legitimate interest in doing so. Where we use personal data for these purposes, we will ensure that any published information is anonymised.
Contact
If you have any questions, please contact applicant.privacy@ed.ac.uk.
Table 1: uses of your data
“Retention period” refers to the number of academic years that your data will be held for after you complete your studies.
Data category | Short description | Specific purpose | Legal basis | Retention period |
---|---|---|---|---|
Pre- and post-application enquiries | Potential and current applicants provide personal data, and sometimes sensitive personal data, in order to get advice and information from admissions staff which is tailored to their own specific circumstances. | As a prospective or current applicant, you may provide us with contact information so that admissions staff can reply to your query, and you may provide personal information related to your health, disability, criminal convictions, care status, financial circumstances etc. so that we can provide the most accurate advice possible, specific to your circumstances. Potential applicants expect us to retain the information they have given us so that admissions staff will have access to it if they go on to make an application at a later date. Current applicants expect us to retain the information they have given us so that any necessary adjustments can be made during the admissions process. Successful applicants expect us to retain the information they have given us, so that any adjustments required when they are studying with us can be made. | Consent. | Prospective and current applicants: To the end of the current admissions cycle plus 1 year. |
Information sent to us electronically or by post which does not include a pre-application enquiry, and which we can’t match to a current application, will be securely destroyed at the end of the admissions cycle in which it was received. | Consent. | To the end of the current admissions cycle. | ||
We may use contact information you have shared with us to invite you to take part in on campus and online activities and events which we believe may be of interest to you, or to send you information about the university. | Legitimate interest. | To the end of the current admissions cycle plus 1 year. | ||
Partially completed applications | Prospective applicants provide personal data in order to start an application, whether or not a completed application is submitted. | We will use information provided on a partially completed application to tell you about any significant changes to the programme you are applying for, for example changes to entry requirements. | Legitimate interest. | To the end of the current admissions cycle. |
Applications | The admissions process collects information submitted by applicants in order to assess their suitability for a place on the chosen programme of study. Admissions requires communication and interaction between an applicant and the University, and when it is deemed material to the application, additional information provided by an applicant will be added to the application record. | Your application must include information about identity such as name, title, date of birth and gender. It must also provide information regarding your educational background such as previously-attained qualifications, personal statements or research topics, and professional experience where relevant to support the application. You may be required to provide documents such as transcripts, certificates, evidence of English language proficiency, or research proposals, or other relevant information in support of your application or to demonstrate that you meet offer conditions. Undergraduate applications include demographic information which is used to assess your contextual status (see our widening access statement for further information). The information contained on the application is used to screen applications to ensure that applicants meet the minimum criteria required for their chosen programme of study, and to select applicants who will receive an offer, or who will progress to the next stage of selection where appropriate, which may involve an invitation to attend an interview, or consideration of a portfolio. | Performance of contract. | Successful applicants should refer to the Student Privacy Notice for retention periods. Unsuccessful applicants:
|
Information provided on your application may be used to invite you to take part in on campus and online activities and events. We may send you information about the university, and about services which might be useful to you. If you accept an offer, we will send you information about arrangements for Welcome Week, and guidance on the things you will need to do when you arrive at the University. We may also use your data to track the impact of our information and events but please note that this will have no influence on any admissions decisions made by the University. | Legitimate interest. | To the end of the current admissions cycle. | ||
Fee status assessment | Fee status determines both the expected fees that would be due as part of an offer to study at the University, and the fee status group within which an application will be considered. | We will use information from your application including your nationality and residency to establish which fee status group you will be part of. This determines both the expected fees that would be due as part of an offer to study at the University, and the fee status group within which your application will be considered. If the information provided on your application cannot clearly define your fee status then you may be required to complete a Fee Status Questionnaire. You may have to provide evidence of your place of birth, previous schools, copies of your passport and your parents’ passports, and evidence of your settlement status in the UK. Additionally, you may be asked to disclose information about scholarships and bursaries that you receive. | Performance of contract. Legal obligation (Education (Fees and Awards) (Scotland) Regulations 2011. | Successful applicants should refer to the Student Privacy Notice for retention periods. Unsuccessful applicants:
|
Immigration | The University of Edinburgh provides Student visa sponsorship to enter and remain in the UK during your studies. Non-UK nationals (this includes EU/EEA/Swiss nationals who do not have permission to be in the UK under the EU Settlement Scheme) will require permission to enter or remain in the UK. | Your nationality and country of birth are used to ascertain if you requires a visa to study, and this is communicated to you during the admissions process. Student visa sponsorship is provided in the form of a Confirmation of Acceptance for Study (CAS). A CAS is an electronic document that confirms to UK Visas and Immigration (UKVI) that the University of Edinburgh wishes to sponsor your migration to the UK for the purpose of your programme of studies. This document will be created for you, and you can use this as part of your visa application. Tier 4 sponsorship is provided in the form of a Confirmation of Acceptance for Study (CAS). A CAS is an electronic document that confirms to the UK Home Office that the University of Edinburgh wishes to sponsor your migration to the UK for the purpose of study. This document will be created for you, and you can use this as part of your visa application. You need to supply a copy of your visa and passport as the University is responsible for verifying these documents. | Legal Obligation (Immigration Act 1971/Immigration Rules HC395/Student Sponsor Guidance). | Successful applicants should refer to the Student Privacy Notice for retention periods. |
Academic Technology Approval Scheme (ATAS) | The Academic Technology Approval Scheme (ATAS) is one of the UK government’s measures to prevent the spread of knowledge and skills used to develop weapons of mass destruction and associated technology. Applicants to certain science and technology programmes in the UK require you to have ATAS clearance and this must obtained before making a Tier 4 visa application. Whether ATAS clearance is applicable to you will depend on your nationality and on the programme you want to study. If applicable, an ATAS certificate must obtained before making a Student visa application. | Successful applicants should refer to the Student Privacy Notice for retention periods. | ||
Widening participation | The University’s Widening Participation Strategy aims to address the discrepancies in the uptake of higher education opportunities between different social groups. | The University works to raise educational aspirations and attainment among prospective students from under-represented groups. Information about the area where you live, the school you attend, whether you have spent time in local authority care, and your participation in a recognised widening participation scheme is used to assess whether you are eligible to receive a contextual offer, under the terms of the contextual admissions policy. | Performance of a Contract
| Successful applicants should refer to the Student Privacy Notice for retention periods. Unsuccessful applicants:
|
This data is also used to track the progress and success of applicants and students from their first contact with the University, through admissions and to the completion of their degree, to help the University understand how best to support all students. | Legitimate interest | |||
Disability support | Applicants are encouraged to indicate on their application if they have a disability. | Any information you provide on your application about your disability is used in accordance with the University's Admissions Policy. The Student Disability Service will use information provided on your application to tell you about the services available to you and to invite you to meet and discuss any support requirements you may have. | Performance of a Contract Necessary for reasons of substantial public interest linked with Schedule 1, Condition 6 of the Data Protection Act 2018. | Successful applicants should refer to the Student Privacy Notice for retention periods. Unsuccessful applicants:
|
Criminal convictions | Applicants for some programmes have to provide information about their criminal convictions. | If you apply for a degree programme which is exempt from the Rehabilitation of Offenders Act (1974), you will be required to indicate on your application if you have any criminal convictions. You may also be asked to join the Protecting Vulnerable Groups (PVG) Scheme before we can make an offer of admission. Any information you give us about criminal convictions will be used only to assess your suitability for the degree programme you have applied for, in accordance with the University’s criminal convictions policy. | Legitimate interest Necessary for reasons of substantial public interest linked with Schedule 1, Condition 6 of the Data Protection Act 2018. | Successful applicants should refer to the Student Privacy Notice for retention periods. Unsuccessful applicants: information destroyed following notification of outcome, allowing sufficient time for an appeal to be submitted. |
Admissions fraud | The University of Edinburgh will not admit a student on the basis of an application which is found to be fraudulent. | If you are found to have committed fraud in the application and admissions process, in accordance with the University’s Policy and Procedure regarding Admissions Fraud, we reserve the right to retain your personal information so that any future applications you submit can be identified. | Legitimate interest. | In perpetuity. |
Postgraduate taught application fees and deposits | Application fees and deposits are required from applicants for some postgraduate taught degrees. | Where an application fee or a fee deposit is paid, the University will use information we hold from your application to record your compliance and to allocate any fee deposit income to your fees account. | Performance of a contract. | To the end of the current admissions cycle plus 1 year. |
Admissions Appeals | Unsuccessful applicants may appeal the admissions decision we have made. | Unsuccessful applicants may provide contact information in order to receive a response to an admissions appeal, and may provide personal information related to health, disability, care status, financial circumstances etc. which will need to be taken into account in consideration of their appeal.
| Performance of contract. Necessary for reasons of substantial public interest linked with Schedule 1, Condition 6 of the Data Protection Act 2018. | To the end of the current admissions cycle plus 1 year. |
Complaints | Complaints may be submitted by applicants, or potential applicants, and may include personal data. | Applicants may provide contact information in order to receive a response to a complaint, and may provide personal information related to health, disability, care status, financial circumstances etc. which will need to be taken into account in consideration of their complaint. | Performance of contract Necessary for reasons of substantial public interest linked with Schedule 1, Condition 6 of the Data Protection Act 2018. | 5 years. |
Equality monitoring | Information on protected characteristics is collected as part of the application process. | The University of Edinburgh is committed to equality of opportunity for all its students and staff, and promotes a culture of inclusivity. To this end we collect equalities information including your ethnicity and any disabilities so that we can analyse data and produce statistics to ensure the University is meeting the requirements of Scottish regulations under the Equality Act 2010. | Legitimate interest Necessary for reasons of substantial public interest: Equality of opportunity or treatment. | Successful applicants should refer to the Student Privacy Notice for retention periods. 10 years for unsuccessful applicants. Anonymised equality data will be kept in perpetuity. |
University privacy statements
The University maintains several other privacy statements that are specific to services delivered.