Privacy Notice for Students

Before we get into the detail, we want to make sure you know that your privacy is important to us. We know you have heard this all before, but we mean it. You have placed your trust in us by choosing to study at the University and by providing us with your personal information; we value that trust and want to uphold the data protection and privacy standards you expect. That means we are committed to appropriately protecting and safeguarding your information.

So anyway, here we go with the detail. This is our main privacy notice for our students; we have many other privacy notices, which are specific to certain student services that we offer and our activities that we conduct. Where we have a specific notice we have excluded most of the detail from this main notice in order to keep things as simple as possible.

This notice explains who we are, how and why we collect and use personal information about you as a student, what personal information is held, our lawful bases for processing, who we share your information with, relevant retention periods, and how you can exercise your data subject rights.

If anything does not make sense, or if you have any questions or confusions about our use of your personal information, please do contact us using the contact details below.

Who we are

Throughout this notice, “University”, “we”, “our” and “us” refer to the Manchester Metropolitan University. We are a higher education institution offering teaching, education, research and all necessary services to support those who study with us. The University is the Controller in respect of the personal information we hold about you. We manage all personal information in accordance with the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 and the University’s Data Protection Policy.

The personal information we hold about students

The personal information the University may process about you as a student includes:

Your unique University student number and other examples of unique system IDs. E.g. UCAS personal ID.
Your personal details and contact information; including: name, term-time and holiday addresses, date of birth, gender, phone numbers, e-mail addresses and your photograph.
Information about your trusted / emergency contact.
Information provided as part of your application to study at the University, or created during the application process. E.g. personal statement, education and employment history, interview scores, notes and references.
Information about your learning, examinations, assessments, results, academic marks, progress, modules completed, placements conducted and qualifications awarded. For students on placement, please see our specific Student on Placement Privacy Notice.
Attendance information, such as lecture attendance, leave of absence, authorised absence and exclusion data.
Information provided in relation to extenuating circumstances, exceptional factors, appeals and complaints.
Information about incoming and outgoing student exchanges, such as your interactions with your lecturers, tutors and supervisors.
Information about you as a user of our accommodation and residential services. Our specific Students in Accommodation Privacy Notice explains how we use your information when you apply for accommodation, and engage with our residential services.
Information about fitness to practice, plagiarism, disciplinary and other misconduct issues.
Information about your use of our library services, such as: your borrowing history, fines, and reservations.
Information about your engagement with our Counselling, Disability and Wellbeing Services. Our specific Counselling, Disability and Wellbeing Services Privacy Notice explains how we use your information when you register for and engage with these services.
Financial information, such as tuition and other fee charges, funding and payments. Information about your sponsor(s). For students on scholarships please see our specific Students on Scholarships Privacy Notice.
Visa and immigration information, including visa and passport details.
Information about honours and prizes you have been nominated for or have won.
Information regarding hobbies, interests, volunteer work and extracurricular activities with the University.
Information about your caring responsibilities.
Information about your engagement with our Jobs4Students services, such as positions applied for, outcomes and employment with the University. If you engage with Jobs4Students please see our specific Jobs4Students Privacy Notice.
Closed Circuit Television (CCTV) images. The University operates CCTV around its estate for security and crime detection purposes. You are recorded whilst entering and on University premises. For further information about our use of CCTV, please see our CCTV Policy.
Your leaving date and reason for leaving the University.
Other legitimate personal data relating to academic and pastoral support.

Special category and criminal conviction information

In addition to above, the University may need to collect, or you may choose to provide us with information which is classed as ‘special category’. We may ask for your consent to use this type of information. This includes:

Information revealing your race or ethnicity, religious beliefs, sex life or sexual orientation (whether or not indicated by your gender or gender identity) and political opinions. Such information will only be processed where you have volunteered it and where we need to process it in order to meet our statutory obligations under equality and other legislation. The use of this information is considered to meet a substantial public interest, and will be subject to suitable safeguards.

Information about your health, including any disability or medical condition, and dietary requirements. We will collect and use this information where it is necessary to make reasonable adjustments for disability and to monitor equal opportunities. Processing of this nature is necessary to meet our legal obligations under equal opportunities legislation. There may also be situations where we ask for your explicit consent to use and share information about your health. It may also be necessary in exceptional circumstances to use and share health information in order to protect your vital interests or those of another person.

The University may hold information about unspent and relevant criminal convictions and offence information if you have self-disclosed as part of the admissions process or at re-registration. If you applied for and have been accepted onto certain professionally regulated courses we use the services of a Disclosure and Barring Service electronic supplier to ascertain whether you have other conviction information. Our use of this information is explained within the specific Criminal Conviction Information Privacy Notice.

The University makes sure that access, use of and the sharing of your special category personal information is controlled very carefully.

Where does the University get your personal information from?

The information you provided to us within your application to study with the University, whether via the Universities and Colleges Admissions Service (UCAS) or direct application, forms the basis of your core student record. The University also obtains your information:

From you when you express an interest in applying to study with the University, e.g. when requesting a prospectus, registering to attend our open days or making contact with us.
From you as part of enrolling / registering and annual re-registration with the University.
From you, collected, entered and observed about you as you engage with the University during the course of your studies with us, and as we deliver our teaching and education services to you.
From you as you register, access and engage with the different services or resources that we offer as a University. E.g. careers advice, library services, IT services, counselling, disability and wellbeing services, pastoral care, and financial support services etc.
From third parties in the course of the application and admissions process, e.g. UCAS, referees, such as from your previous or current school, college, university or employer, and Government departments such as the Home Office and the Student Loans Company.
From third parties during the course of your studies, e.g. institutions that we partner with to deliver joint programmes as part of your course.

The purposes of the processing

In short, we need to collect and use your personal information so that we can function effectively as a higher education institution, provide you with the support you require in order to undertake your studies, achieve academic success, and meet certain legal requirements. Personal information is needed to provide you with the following services and to undertake the following activities:

To administer and deliver our teaching, education and related services to you, such as delivery of your course, academic support and development, academic assessment and supervision.
To administer and deliver our student services and facilities to you, e.g. student hubs, library, IT, accommodation, careers, pastoral care, sports, and counselling, disability and wellbeing services.
To monitor student attendance at lessons, leave and absence, the submission of assessment and engagement with course materials on Moodle. For further information, please see our Student Engagement Policy.
To conduct graduate outcome activities and analysis, which feed into the HESA reporting explained further below under the ‘The recipients or categories of recipients of the personal data’ heading.
To conduct research and analysis, including learner analytics and student predictive analysis, with the aim of improving our support available, improved student satisfaction, retention and attainment.
To administer academic appeals and extenuating circumstances.
To offer careers and employability support. The University has a range of careers support accessible via Careers Hub which is available to you as a student and graduate. The University will contact you from time to time to make you aware of Careers services, news and events. We engage certain external suppliers to enhance our careers service provision (such as Abintegro and SendinBlue) and will share some of your personal data with these suppliers so they may deliver services on our behalf.
To administer and deliver our support services to international students, including immigration welfare and applications for visa extensions.
To administer the financial aspects of your relationship with us and any funders, including the administration of financial awards and prizes, such as scholarship, bursaries, hardship funding and grants.
To keep you safe whilst on University premises.
Production, administration and management of MetCards, including monitoring usage of the cards.
To appropriately manage safeguarding and wellbeing concerns.
To review and improve the standard of our education services and University business. E.g. through surveys and feedback.
To administer job applications and employment contracts where you are employed by the University through schemes such as Jobs4Students.
To manage misconduct, complaints and disciplinary activities, investigations, including plagiarism, academic and non-academic misconduct. For further information please see our Procedure for Handling Academic Misconduct.
To administer, investigate and manage complaints and appeals brought against the University.
To fulfil and monitor our legal obligations under equalities, immigration and public safety legislation.
To conduct ethical approved internal and external research initiatives involving student information which are judged in the public interest, and do not target or make measures in respect of individual students.
To invite you to take part in internal and external research opportunities which we think will be of interest to you.
Granting of academic awards and managing graduation, including the publication of awards, marks, inclusion in pass lists.
To register you as a member of the University alumni community upon graduation.
To satisfy statutory reporting requirements to the Higher Education Statistics Agency.
To satisfy statutory reporting requirements to the Electoral Registration Officer for Manchester to maintain registers of parliamentary and local government electors.
To communicate effectively with you by post, e-mail, phone or other electronic media, including the distribution of relevant newsletters and information.

We do not use your personal data to carry out any wholly automated decision-making that affects you. As part of our layered approach to delivering our privacy notice information to you, many of these services and activities have specific privacy notices which contain further information.

What are our lawful bases for processing?

The University relies of the following lawful bases from Article 6 of the GDPR in order to use your personal information for the purposes outlined above.

Where it is necessary to meet a task in the public interest – we provide our teaching, education, research and all related and necessary support services to you as a public authority acting in the public interest with a clear basis in law under the ‘public task’ lawful basis. Teaching, education and research are tasks that we perform in the public interest in order to fulfil our responsibilities as a higher education institution for promoting the advancement of learning. Our clear basis in law is s124 of the Education Reform Act, which states that a higher education corporation has the power to provide higher education, to carry out research and do anything which appears to the corporation to be necessary to pursue its aims in this respect. For further information and a full explanation of our activities which we carry out under public task, please see our Statement of Tasks Carried Out in the Public Interest.

Because we have a contract with you or with a view to entering into a contract with you. E.g. the Student Contract and Residential Services Contract – we assess your application to study with us and provide you with the services set out in the Student Contract as per the ‘contract’ lawful basis. E.g. recruitment and admissions activities, provision of teaching, education and our student services, and provision of accommodation.

Where we need to comply with a legal obligation – where we are legally obliged to conduct an activity. E.g. the need to use your information relating to the monitoring of equal opportunities, immigration requirements, anti-money laundering legislation, health and safety, and safeguarding laws, preventing and detecting crime, assisting the police and other authorities with their investigations, and as required by law to provide data to the Higher Education Statistics Agency (HESA), regulatory and other governmental bodies.

Where it is necessary to meet our legitimate interests as a university – whenever we use the legitimate interest lawful basis, we undertake a legitimate interests assessment to ensure that our, your and others’ legitimate interests are balanced against relevant privacy concerns. Examples of activities conducted under the legitimate interest lawful basis include: monitoring the effectiveness and performance of our teaching, security activities, administrative and management functions, alumni relations, feedback, surveys and business improvement.

Where you have given us your consent – there will be occasions where we give you genuine choice and we ask for your consent for specific uses of your information. The method used to obtain your consent will depend on the scope and context. Examples include: disability services, marketing and promotional activity and in order to make disclosures to parents or other third parties at your request. We will provide specific privacy notice information to you at the appropriate time, explaining why we are seeking to collect your information, how we will use it, and how you can withdraw your consent.

Where it is necessary in order to protect vital interests – in exceptional circumstances it may be necessary to share or use your information in a way which we believe will protect you or another individual from serious harm.

As part of our layered approach to delivering our privacy notice information to you, many of these lawful bases are explained further within specific privacy notices.

The recipients or categories of recipients of the personal data

In order to perform our legal responsibilities, contractual and other purposes set out above, we may, from time to time, need to share your information with third parties as follows:

To the HESA, the body responsible for collecting and disseminating information about higher education in the UK and the Designated Data Body for England. This includes disclosure of your contact information to HESA to support various surveys including the Graduate Outcomes Survey which takes place 15 months after you graduate. For further information please refer to the HESA Student Collection Privacy Notice.
To your funders and sponsors, including the Student Loan Company, Student Finance, and grant funding bodies such as the Medical Research Council, Erasmus, internal embassies, and research councils.
To the Employment Skills Funding Agency and the Education Funding Agency. Further information about information disclosed to the Skills Funding Agency is seen within the Skills Funding Agency Privacy Notice
To your employer if you are part of an apprenticeship programme. E.g. disclosure of attendance, conduct and progress information.
To the Students Union so you can be registered as a member of the Union and receive the Union’s benefits and services. Students can decide not to be a member if they wish. For further information please refer to the Union’s Privacy Policy.
To other educational institutions which the University partners with in order to provide our teaching and educational services to you, to deliver placements, and to deliver joint or dual, and franchised or validated awards.
To Embanet UK Limited (trading as Boundless Learning) and their appointed sub-contractors if you are a student enrolled on a Global Online Managed Programme.
To external examiners for the purpose of assessment.
To external agents of the University in relation to the repayment of student debts, where internal recovery attempts have been unsuccessful.
To agents assisting the University with international admissions (limited to what is strictly necessary for the performance of the agent’s role) - this may include the disclosure of personal data outside the European Economic Area.
To the Police, Home Office, HM Revenues and Customs, UK Visas and Immigration, and other governmental bodies where pursuant to the investigation of crime, national security, immigration, tax and benefit matters.
To other institutions the University jointly conducts research work with or contracts to conduct research work with.
To the University’s insurers and external regulators such as the Health and Safety Executive in respect of accidents or incidents.
To printing, mailing and marketing agencies who assist us, under contract, to communicate with you.
To your trusted / emergency contact and the emergency services in respect of emergency situations. e.g. where your physical or mental health or wellbeing, or safety is at risk.
To potential employers and other educational institutions requesting a reference for a current or past student (consent is implied by providing the University’s details as a referee). This includes confirmation of awards.
To relevant professional, statutory and regulatory bodies, such as the General Medical Council, Bar Standards Board, Health and Care Professions Council, the Nursing and Midwifery Council and the General Teaching Council.
To professional and industry bodies, such as the Law Society, wishing to communicate with you about membership and career opportunities, and to confirm qualifications and accredit your course.
To our IT providers supplying, supporting and hosting our IT services, and other data processors acting on behalf of the University.
To local authorities (primarily Manchester City Council, but potentially other neighbouring authorities) - in relation to council tax exemption, administration of housing benefit and for processing care leaver bursaries.
To the Electoral Registration Officer for Manchester, disclosure of information of all enrolled students so that the officer may maintain registers of parliamentary and local government electors under s23 power to require information of the Representation of the People Regulations 2001.
To the Office for the Independent Adjudicator (OIA) if you raise a complaint;
To our banking and online payment processing service suppliers.
To suppliers offering plagiarism checking services, such as Turnitin and other academic institutions to identify instances of collusion in relation to plagiarism misconduct.
To third parties wishing to access a catalogue within the University library containing reference to student work.
To the Higher Education Degree DataCheck Service to allow employers and statutory bodies to verify basic degree information with your consent.

Where the University uses third parties to support us and provide services on our behalf (acting as data processors), a written contract will be put in place to ensure that your information will be held in accordance with the requirements of data protection legislation and that such data processors have appropriate security measures.

Parents, family members and other guardians are considered to be third parties and your information will not be disclosed to them unless you have given your consent for relevant information in certain circumstances to be shared, or we believe the disclosure is otherwise made in accordance with data protection legislation.

The right to withdraw consent

Where we collect, use and share your personal information with your consent we will provide you with specific privacy notice information at the appropriate time. You can withdraw your consent at any point. To do so you are encouraged to refer back to the privacy notice which we provided to you when we collected your information or when we sought your consent to use your information in a specific way.

Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the use of your personal information conducted in reliance of other lawful bases. You may also use the contact information under the heading ‘How to Contact Us’ to withdraw your consent.

Data retention

Your personal information will only be retained by the University for as long as it is necessary for the purposes outlined above. Many of the University’s retention periods are aligned to other higher education institutions and JISC standards.

Most of the University’s information about your application to study with us, registration, your study with the University as a student, academic progress, attendance, placements, accommodation, and your engagement with our support services will be retained for six years after your graduation or departure date, after which your information will be securely disposed of.

Core student information about you, e.g. your studies and academic awards (name, dates of study, courses studies, main academic details, units, marks and classification etc) will be retained indefinitely.

The University maintains a detailed schedule which sets out our retention and disposal periods. For further information about the University’s retention and disposal periods and procedures please see our Retention and Disposal Schedule

Your rights in respect of the processing

The GDPR provides data subjects with the following rights:

The right to be informed – the University seeks to collect and use your personal information in a transparent manner. We fulfil this right through the use of privacy notices such as this main Student Privacy Notice and our other privacy notice information provided at the point of collecting your information and available from our Privacy Notices Webpage.

The right of access - Unless relevant exemptions apply, you have the right to be told whether we hold your personal information and, if so, to be given a copy of it. This is known as the right of access or subject access. The right exists to support individuals to be aware of, and verify, the lawfulness of the processing by organisations. For further information please see our Subject Access Webpage.

The right to rectification - If you believe that the information we hold about you is inaccurate or incomplete, please contact us and we will investigate. If your information is inaccurate, we will rectify it. If it is incomplete, we will complete it. Once we have determined what we are going to do, we will contact you to let you know.

The right to erasure - also referred to as ‘the right to be forgotten’. This right is not absolute and applies only in certain circumstances. If you submit a request, once we have determined whether the right applies and what we are going to do, we will contact you to let you know.

The right to restrict processing – this right is not absolute and applies only in certain circumstances. If you submit a request, once we have determined whether the right applies and what we are going to do, we will contact you to let you know.

The right to object – this right is not absolute and applies in certain circumstances. Where applicable, in the first instance, please use unsubscribe links in any of our communications or use the contact information we provided within the privacy notice used at the point of data collection. If you submit a request, once we have determined what we are going to do, we will contact you to let you know.

The right to withdraw consent – where the University uses consent as our lawful basis for the processing of your personal information, you have the right to withdraw your consent at any time. In the first instance, please use unsubscribe links in any of our communications or use the contact information provided within the applicable privacy notice.

For further information about your subject rights please see our Data Subject Rights Webpage. To protect the confidentiality of your information we may ask you to verify your identity before fulfilling any request.

Alumni

On graduation, your information is passed to our Development and Alumni Relations Team so you can be automatically registered as a member of the University alumni. We do this so we can maintain a lifelong alumni and supporter relationship with you. You may receive information relating to alumni activities, such as news, events and fundraising opportunities. For further information about our alumni community and benefits please see our Alumni Webpage. Our Alumni and Supporters Privacy Notice explains how we use your personal data for alumni services when you graduate from the University. To opt out of joining our alumni community please contact our Development and Alumni Relations Team.

Other related student privacy notices

Our Enquirers and Prospective Students Privacy Notice explains how we use your personal information when you express an interest in applying to study with the University, e.g. when registering for open days, requesting our prospectus, or requesting further information from the University about the services we offer.

Our Student Applicants Privacy Notice explains how we use your personal information when you submit an application to study at the University, either direct from you via our direct entry portal or via your UCAS application to the University.

Our Students on Scholarships Privacy Notice explains how we use your personal information when you submit an application and are successful in studying at the University on a scholarship.

Our Students on Placements Privacy Notice explains how we will use your personal information if you go out on professional placement during the course of your studies with the University.

Our Students in Accommodation Privacy Notice explains how we will use your personal information if you apply for and reside in University accommodation during your relationship with the University.

How to contact us

For questions or concerns about this Privacy Notice, or our use of your personal information, please contact our Data Protection Team using dataprotection@mmu.ac.uk, by calling 0161 247 3884 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority for data protection. We would encourage you to use our internal complaints procedure through our Data Protection Officer, prior to contacting the ICO. Please contact: casework@ico.org.uk or telephone: 0303 123 1113. For any further contact information please see: https://ico.org.uk/global/contact-us/.

Updates to this privacy notice

We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

This privacy notice was last updated on: the 1^st April 2023.

Privacy notices

Privacy Notice for Students

Components

Privacy notices