Policies, Procedures, and Regulations

Anglia Ruskin University Higher Education Corporation (ARU) is committed to protecting your personal information when you use our services.

When saying “we”, “our” or “ARU”, we’re referring to Anglia Ruskin University.

Please read the following privacy policy to understand how we use and protect the information obtained via the following online services:

any ARU website that links to this Privacy Policy
social media or official ARU content on other websites
mobile device applications (apps)
chatbots

It also relates to us using any personal information that you provide by phone, SMS, email, in letters and other correspondence, and in person.

This Privacy Policy explains the following:

who we are
what personal data we may collect about you
where get your personal data from
how we will use personal data we collect about you
who we share your personal data with
how long we hold your personal data
the legal basis for processing your personal data
your rights regarding the personal data you provide to us
the use of cookies on our websites and how you can reject them

By providing us with your personal data and using our services, you agree to the collection and use of this information in accordance with the purposes described above in this privacy notice or as otherwise explained to you.

If you have any requests concerning this Privacy Policy, your personal information, or any queries with regard to our processing please contact dpo@london.aru.ac.uk.

How do we use your personal data?

The information we obtain from you is used to enter into a contract of education with you or to perform ARUL’s obligations under your contract of education, to comply with a legal obligation imposed on ARUL or where it is necessary for ARUL's legitimate interests or those of a third party, provided your interests and fundamental rights do not override them. For example:

To perform all tasks associated with your admission and delivery of your education including, but not limited to, applications, student support services, residential services, library usage, attendance monitoring, sports facilities, and alumni services;
To enable us to supply you with the services and information which you have requested;
To ensure that content is presented in the most effective manner for you and for your computer;
To analyse the data we collect so that we can administer, support and improve our services;
To provide you with information, products or services that you request from us or which we feel may interest you, where you have agreed to be contacted for such purposes.
To notify you about changes to our service.

We set out in the legal basis section of this policy all the purposes for which we may process your personal data, identifying the legal basis and those external parties to whom we may disclose that personal data.

Our use of your personal contact details

The University prefers to contact students through the email account we provide to you. However, there may be circumstances in which it is appropriate for us to contact you using the personal contact details we hold for you. This may include a personal email address, mobile number etc. Typically we would try and utilise your ARUL email address in the first instance and if this proves unsuccessful we would look for alternatives. These circumstances are instances where the legitimate purpose for contacting you by these means would mean your consent would not be required, and may include (but not be limited to):

Making you aware of information relevant to your studies in the post-registration period where the University is still setting-up IT accounts for new starters and therefore we can’t expect to reach all new students through their ARUL email addresses.
Where there is outstanding debt owed to the University by you.
Where the University has been made aware of a cause for concern relating to your wellbeing and we need to establish whether you need support.
Where there is urgent and important information we need to make you aware of to keep you safe; for example COVID-19, other public health measures, concerns about threats of harm against buildings (which affect users), groups or individuals, weather events or major incidents affecting safe travel etc.

For initiatives that are discretionary (i.e. it is entirely up to you whether or not you participate and they have no bearing on the duties we have as a University) we would typically ask for your consent to use your personal contact details for those purposes.

We may share your personal contact details if we are asked to do so for law enforcement enquiries, where the law permits us to do so.

We may share your details, or those of your declared alternative contacts, with other support providers in emergency circumstances where we have not been able to obtain your consent or your condition may prevent you from providing it but in our judgement it is urgently necessary for your wellbeing.

How long do we keep your personal data?

Your personal data will be held confidentially for as long as necessary to fulfil the purposes for which it was it collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

We retain personal data collected from applicants, students and alumni in accordance with our Records Retention Schedule. In general terms most student data it is retained for 6 years after your last engagement with us but some personal data may be kept for longer so that we can verify your award if you apply for a job, or apply for another course of study.

Information Security

ARUL is committed to holding your data securely and uses information security best practice to transmit personal data. Data is held in accordance with the Corporate Information Security Policy . For example, your personal data is accessible only by those authorised and who have a business need for access. When shared with third parties, your personal data is shared with encryption or in password protected files.

Where we have given you (or where you have chosen) a password that enables you to access our systems, you are responsible for keeping this password confidential. You must not share passwords with anyone.

Although we maintain a number of safeguards, fraudulent email requests are occasionally delivered to staff and students. We will never ask for your username or password by email. Any message that does so should be treated as a potential breach of security, no matter how legitimate it may appear. If you are in any doubt, do nothing until you have spoken to a member of the IT Services Customer Support Team.

ARUL have put in place procedures to deal with any suspected data security incident and will notify you and any applicable regulator where we are required to do so. If you have any concerns that personal data has been compromised please contact

Processing outside the UK & European Economic Area (EEA)

The law requires us to let you know if we or our suppliers process your personal data outside the UK and the EEA (The European Union Member States plus Norway, Iceland & Lichtenstein) and what we have in place to make sure your rights in UK Data Protection law remain in place. We do use suppliers such as software providers, IT support providers and online learning module delivery providers as well as ad hoc IT project suppliers who either host our data or access data for support purposes in countries outside the UK and EEA. We will at all times have in place, in our Agreements with these suppliers, features which protect your data rights as required by GDPR. These include: The relevant country has an ‘Adequacy decision’ in place (meaning UK law recognises its Data Protection laws as equivalent to our own), or the contract contains ‘UK Standard Contractual Clauses’ which are an approved mechanism to legally require suppliers to comply with UK law. At present our data processing outside the EEA meets the demands of UK law.

What is the legal basis for using your personal data?

The purposes for which we process your data and share it with others is explained in the tables below as well as the relevant legal basis.

A: Before you enrol

Specific Purpose	Legal Basis
1.Management of enquiries with prospective students and communication of information about our services, events, and activities	Necessary for entering into a contract of study with prospective students
2. To UCAS to administer the applications and clearing process	Necessary for the performance of a task in the public interest, namely the provision of education services
3. Processing of applications for study and enrolment as a student which can include the processing of criminal convictions data and DBS checks	Necessary for the performance of a task in the public interest, namely the provision of education services
4. Correspondence with offer holders regarding the next steps in the application and enrolment processes	Necessary for entering into a contract of study with students
5. To direct mail and marketing and events agencies who may assist us in the administration of mailing to enquirers, applicants, offer holders, students and our alumni and the booking of events. Examples of such agencies include SurveyMonkey, MailChimp, EventBrite	Processing is necessary for the legitimate purpose of communicating with students and offer holders about benefits, services, activities and events or agree to communicate such information to enquirers and applicants
6. To the Home Office and other international and national governmental and regulatory bodies in connection with the assessment of immigration status	Necessary for: compliance with legal obligations or for the performance of public tasks in the immigration context
7.Providing you with an account to allow you to use the Application Tracker app, which supports you in completing the process of applying to study with us	Necessary for: Our legitimate interest in supporting applications to study
8. Administering interviews and tests prior to acceptance on some of our courses, and sharing information about the outcome of these with regulatory bodies where they have a role in ensuring the process is managed consistently across the Higher Education Sector	Necessary for: the performance of a task in the public interest, namely of assessing the suitability of candidates fairly and consistently with University/College and/or regulatory body standards.
9. Contacting you in order to provide support for your additional needs regarding health issues and financial matters, where you have declared this on your application, to support you through the application process and to ensure adjustments and support are available to you when you arrive to study with us.	Necessary for entering into a contract of study with prospective students Where we process Special Category data for these purposes, we do so with your explicit content

B: When you become a student: At or around enrolment

Specific Purpose	Legal Basis
1. Confirming your right to live and study in the UK	Legal obligation to comply with our obligations under immigration law specifically the UK Visa & Immigration (UKVI) Tier 4 Sponsor Guidance.
2. Production of student identification cards and related student services.	Necessary for the performance of a task in the public interest, namely the provision of education and providing a safe educational environment.
3. Administration of induction events, registration of students on courses and transfers to new courses	Necessary for the performance of a task in the public interest, namely the provision of education services
4. The provision of University accommodation. This processing may include processing personal data you disclose regarding health condition or disabilities relevant to your accommodation.	Necessary for the performance of our contract with its students or explicit consent to the extent that any sensitive personal data is obtained
5. Disclosure to the Students Union of student details for registration of students as members of the Union and provision of University benefits and services See Section M for further details Follow this link to opt-out of membership and to stop data-sharing	Legitimate purpose of providing students with automatic access to our University’s Students Union and their services
6. Disclosure to local authorities for council tax assessment purposes or electoral purposes and for processing of care leaver bursaries	Necessary for performance of task in the public interest, namely local authorities’ functions of assessing council tax payments, supporting local authority care leavers, and managing electoral services
7. Disclosure of all student data of those students enrolled on the Global Online Managed Programmes to our provider, Pearson Limited, and their appointed subcontractors	Legitimate purpose of engaging third party provider to deliver the Global Online Managed Programmes

C: When you become a student: Assessments

Specific Purpose	Legal Basis
1. Evaluation of academic assessments and other course work	Necessary for the performance of a task in the public interest, namely the provision of higher education
2. Granting of academic awards (including the publication of awards, marks, and inclusion in pass lists)	Necessary for the performance of a task in the public interest, namely the provision of higher education.
3. Disclosure to other UK based and international educational institutions which we partner or collaborate with to deliver placements, joint or dual awards or franchised or validated awards	Processing necessary for the performance of our contract with students or legitimate purpose of providing students to exchange opportunities.
4. Disclosure to external examiners for assessment	Necessary for the performance of a task in the public interest, namely the provision of higher education
5. Disclosure to other institutions we: jointly conducts research work with or contracts to conduct research work on behalf of us to inform the other parties of authorised ARUL representation; supporting the effective conducting of the research and to support the standards reviews of other parties wishing to engage with us.	Necessary for the performance of a task in the public interest, namely the provision of scientific research or for statistical purposes.
6. Disclosure to external agencies offering plagiarism checking services such as TurnItIn and other academic institutions to identify instances of collusion in relation to plagiarism misconduct	Necessary for performance of a task in the public interest, namely provision of higher education services (necessary to maintain academic quality standards and integrity)
7. Promoting special academic attainment awards.	Publicising data about award winners through ARUL and award sponsors with your consent.
8. Submitting details of participants in grant applications for evaluation by external research funding bodies.	Necessary for the performance of a task in the public interest, namely the provision of education services.
9. Processing of Disclosure & Barring Service (DBS) checks where you are undertaking ‘regulated activity’ as part of your studies, for example, to undertake a research project or a work placement involving vulnerable children and/ or adults.	Necessary to fulfil a legal obligation in preventing unsuitable people in regulated activity adversely impacting students, staff and vulnerable groups. Where we process Special Category data for these purposes, we do so because it is: necessary for reasons of substantial public interest
10. 10. Supporting our partners, under contract, to deliver all or part of our learning services to you	Necessary to perform a public task namely the delivery of learning services Where we process Special Category data for these purposes, we do so because it is necessary for reasons of substantial public interest

D: When you become a student: IT and Library

Specific Purpose	Legal Basis
1. Disclosure to offer facilities and services central to your studies such as Library access and computing access	Necessary for the performance of a task in the public interest, namely the provision of higher education.
2. Monitoring of use of IT services in accordance with our Acceptable Use Policy.	Legitimate purpose of ensuring network security.
3. Disclosure to external IT service providers delivering externally hosted IT services or products to us such as Microsoft Office, Unit 4, and Amazon.	Legitimate purpose of providing students with modern IT solutions and services to support their studies.
4. Disclosure to any third party wishing to access a catalogue within the our library containing reference to student work.	Legitimate purpose of providing open access to research and academic works where students have agreed to publication of this work or are required to publish under the terms of any funding or sponsorship agreement.
5. Using your ARUL email (and personal email if you have stopped or finished your studies) to contact you regarding outstanding Library fines or matters relating to the return of IT equipment or IT account management.	Legitimate purpose of effectively managing our assets.

E: When you become a student: Coming to class

Specific Purpose	Legal Basis
1.Monitoring student attendance at lessons, the submission of assessment and engagement with course material available on software tools. Further detail about this processing activity is set out in the Student Engagement Dashboard.	Legitimate purpose of ensuring that students achieve academic success through full engagement with their studies. As well as analysing student data to help make informed decisions which can lead to improved student satisfaction, retention, and attainment
2. Monitoring attendance and evidence of absence for students studying on a tier 4 visa. You can read more about tier 4 student requirements here: Tier 4 Student Compliance	Legal obligation to comply with our obligations under immigration law specifically the UK Visa & Immigration (UKVI) Tier 4 Sponsor Guidance.
3. Keeping employers informed about the progress of apprentices’ Degrees at Work courses, involving routine sharing of academic progress and reasonable adjustments, and on demand sharing of data relating to conduct and engagement as per funding body requirements.	Necessary for the performance of tasks in the public interest namely to support the Secretary of State’s functions regarding apprenticeships delivery.
4. Contacting you to let you know about lecture and event cancellations or changes to timetables and related arrangements.	Legitimate purpose of providing access to our learning services.

F: When you become a student: Offering support

Specific Purpose	Legal Basis
1. Assessment and provision of support services to students, including the provision of disability support services and study support services.	2. Legitimate purpose of providing appropriate support to students based on their needs. Where we process Special Category data for these purposes, we do so because it is necessary: for reasons of substantial public interest
2. To monitor our compliance with equalities legislation	Legal obligation to comply with our obligations under the Equality Act 2010. Where we process Special Category data for these purposes, we do so because it is necessary for: reasons of substantial public interest
3. To offer and provide additional support services such as careers advice,counselling services, financial advice, and access to sporting activities, and to develop and improve those services.	These services are optional and you can stop using them at any time. Each service will advise of the relevant condition below when you access them: Your consent (for services such as accounts for 'self-help') Our legitimate interest in retaining records of the support provided to you, and to develop and improve services Necessary for the performance of a contract (e.g. a Counselling Contract) Records of support provided to you are necessary for the performance of a task in the public interest, namely the delivery of specialist services to support and develop students, and to measure the effectiveness of the services.
4. Processing of safeguarding concerns to ensure the safety and wellbeing of our students.	Legitimate purpose of ensuring the safety and wellbeing of our students such as acting in the vital interests of an individual, or members of the public. Where we process Special Category data for these purposes, we do so because it is necessary: for reasons of substantial public interest and/ or in your vital interests
5. Recording lectures and other sessions in compliance with the Equality Act 2010.	Legitimate purpose of providing facilities to assist disabled students with lecture content to deliver a modern learning experience for our students.
6. Provision of immigration welfare services for international students, including applications for visa extensions.	Legitimate purpose of supporting international students.
7. Disclosure to close family or next of kin and emergency services where there is an emergency such as illness or serious injury.	Necessary for: Where we process Special Category data for these purposes, we do so because it is necessary: the performance of a task in the public interest or in exceptional circumstances to protect the vital interests of an individual or members of the public. Where we process Special Category data for these purposes, we do so because it is necessary: for reasons of substantial public interest or to protect vital interests.
8. Disclosure of personal email address (unless you opt-out) to the ‘buddy’ scheme when you enrol with us in order to provide you with support from a current student at the beginning of your time with us.	Legitimate purpose of providing support to new students.
9. Providing Personal Development Tutors (PDTs) with information about your circumstances to better support your academic and welfare needs.	Necessary to perform a public task namely to provide welfare support to improve the learning experience Where we process Special Category data for these purposes, we do so because it is necessary for reasons of substantial public interest .
10. Managing your interest in or carrying out voluntary or paid roles for ARUL initiatives such as championing special interests and ARUL’s values and interests.	We will process this information for this purpose only with your consent. Where we process Special Category data for these purposes, we do so with your explicit consent.

G: When you become a student: Surveys, Stats and Mailing Lists

Specific Purpose	Legal Basis
1. Administration of external and internal student surveys, including collection of feedback on distinct services such as Library services and Careers services. You can read more about the surveys we administer or facilitate.	Necessary for the performance of a task in the public interest, namely the provision of higher education. Agreement to participate is obtained from students who complete the surveys.
2. Disclosure to the Higher Education Statistics Agency, the Higher Education Funding Council and Government Departments such as the Department for Education, for the analysis of student statistics and/or to enable them to carry out their statutory functions as applicable. For more information on the information shared with HESA please refer to HESA’s privacy notice (this disclosure may include sensitive personal data about ethnicity, sexual orientation, gender reassignment and religion).	Necessary for the performance of a task in the public interest, (statutory functions or responsibilities of Government Departments and public bodies). Where we process Special Category data for these purposes, we do so because it is necessary: for statistical and research purposes.
3. Disclosure of apprentice personal data to Education and Skills Funding Agency (ESFA) and others. More information about the data shared with the ESFA is published in the ESFA Privacy Notice. See also: information on the maintenance of your Individualised Learning Record (ILR) and Ofsted’s Privacy Notice.	Necessary for the performance of tasks in the public interest namely to support the Secretary of State’s functions regarding apprenticeships delivery.
4. Disclosure to direct mail and marketing and events agencies who may assist us in the administration of mailing to enquirers, applicants, offer holders, students and our alumni and the booking of events. Examples of such agencies include SurveyMonkey, MailChimp, EventBrite	Processing is necessary for the legitimate purpose of communicating with students and offer holders about benefits, services, activities and events or agree to communicate such information to enquirers and applicants.
5. Improving our services through analysis of data on your past engagement with and your feedback about our services	Processing is necessary for the legitimate purpose of improving our services Where we process Special Category data for these purposes, we do so because it is necessary in the substantial personal interest.

H: When you become a student: Appeals, Complaints and Investigations

Specific Purpose	Legal Basis
1. Administration of academic appeals issued by students and other complaints brought against us.	Necessary for performance of a task in the public interest, namely higher education provision (necessary to provide an avenue to raise appeals regarding academic assessments and any other grievances). Where we process Special Category data for these purposes, we do so because it is necessary for: reasons of substantial public interest and/ or for managing legal claims
2. Administration of complaints, investigations and disciplinary proceedings concerning student misconduct, including investigations into academic misconduct in accordance with our procedure for handling academic misconduct.	Necessary for performance of task in the public interest, namely higher education provision, (Investigating complaints concerning misconduct is necessary to maintain integrity of University’s assessment process, our academicstandards, our reputation and the welfare of our students and staff). Where we process Special Category data for these purposes, we do so because it is necessary for: reasons of substantial public interest and/ or for managing legal claims
3. Disclosure to our insurers in respect of accidents or incidents occurring with the institution and external auditors and external regulators such as the Health and Safety Executive.	Legitimate purpose of managing our insurance claims or reporting such incidents to regulators and auditors. Where we process Special Category data for these purposes, we do so because it is necessary for: reasons of substantial public interest and/ or managing legal claims and/ or with your explicit consent
4. Disclosure to the police or other regulatory bodies where pursuant to the investigation or disclosure of a potential crime or national security matters such as Benefits or Tax Inspectors, UK Visas & Immigrations and the Foreign and Commonwealth Office.	Processing necessary for the performance of a task in the public interest, namely prevention and detection of crime. Where we process Special Category data for these purposes, we do so because it is necessary for: managing legal claims Disclosures are normally made under the crime and taxation exemptions
5. Administration of our CCTV system in accordance with our CCTV Code of Practice	Necessary for the performance of a task in the public interest, namely the provision of higher education and providing a safe educational environment facilitate prevention and detection of crime and assist with investigation into potential breaches of University regulations and policies. Where we process Special Category data for these purposes, we do so because it is necessary for: managing legal claims Disclosures are normally made under the crime and taxation exemptions

I: When you become a student: Fees and Finances

Specific Purpose	Legal Basis
1. Processing and recovery of University fees, including course and accommodation fees.	Necessary for the performance of our contract with students.
2. Administration of financial awards and prizes such as scholarships, bursaries, and grants, including grants and scholarships provided by third parties	Legitimate purpose of administering financial support for students.
3. Administration of financial aid, such as hardship funding and loans	Legitimate purpose of administering financial support for students.
4. Disclosure to our external agents in relation to the repayment of student debts, where internal recovery attempts have proved unsuccessful.	Legitimate purpose of recovering student debts.
5. Disclosures to grant funding bodies to evidence allocation of grant funding payments,including payments of salaries and contact details of students undertaking grant funded work (examples of grant funding organisations will include the Medical Research Council, Erasmus, the European Commission, and International Embassies).	Legitimate purpose of administrating grant funds in accordance with funder requirements.
6. Disclosure to Student Loans or Grants providers such as the Student Loans Company (SLC), SAAS, SUSI etc to administer student fees and confirm enrolment on course and payments.	Necessary for performance of a task in the public interest, namely the proper administration of student funding support
7. Disclosure to organisations providing banking and online payment processing services such as Western Union, RBS etc.	Legitimate purpose of engaging third parties to process and manage our financial transactions
8. Administration of job applications and employment contracts where the students are employed by us or through services such as the Employability Service.	Necessary for the purposes of entering into an employment contract with students. Where we process Special Category data for these purposes, we do so because it is necessary for: the purposes of preventive or occupational medicine and for the assessment of the working capacity of the employee.
9. Disclosure of engagement and attainment information to a private sponsor where this is a condition of sponsorship.	Legitimate purpose of supporting a contract to study between sponsor and student or necessary for the performance of a contract between the sponsor and ARUL.

J: When you become a student: Health and Safety

Specific Purpose	Legal Basis
1. To provide help or request assistance any time you are on campus, or in ARUL owned accommodation.	For the purpose of compliance with a legal obligation. Where we process Special Category data for these purposes, we do so because it is necessary: in your vital interests and/ or in the substantial public interest
2. Using absence and sickness details to support your wellbeing.	For the purposes of: performing its contract with you and/or complying with a legal obligation imposed upon ARUL and/or a task carried out in the public interest and/or protecting your vital interests including but not limited to: Ascertaining your fitness to attend lectures and/or managing sickness absence. Complying with health and safety obligations. Where we process Special Category data for these purposes, we do so because it is necessary: with your explicit consent and/or in your vital interests
3.Holding recorded footage of you obtained from CCTV cameras for preventing and detecting crime, internal investigations of breaches of policy, and your health and safety.	Necessary for the performance of a task in the public interest, namely the provision of higher education and providing a safe educational environment.
4. Public Health matters: using health data shared by you to inform our Emergency Plan activities	Necessary for the performance of a task in the public interest, namely the provision of a safe educational environment and supporting public health emergency initiatives. Where we process Special Category data for these purposes, we do so because it is necessary: with your explicit consent to protect your vital interests

K: When you become a student: Other Support for Learning

Specific Purpose	Legal Basis
1. Disclosure to professional and industrial bodies wishing to communicate with students about career opportunities and membership of or registration with their body and where relevant to confirm your qualifications, accredit your course, provide references/statements of good character and on health with regard to fitness to practice	Necessary for performance of a contract of study in circumstances where membership of a professional body necessary condition of study and/or for the performance of a task in the public interest namely for a regulated statutory registration scheme (e.g. the General Medical Council for medical students or National Midwifery Council, etc) Where we process Special Category data for these purposes, we do so because it is necessary: with your explicit consent to protect vital interests
2. 2. Sharing information with commercial partners to support work placements/ apprenticeships where these are part of your course in order to deliver our learning services, support your wellbeing and safety and to investigate any incidents.	Necessary for performance of a contract of learning where such placements are a requirement of your course Where we process Special Category data for these purposes, we do so because it is necessary: in your vital interests and/ or in the substantial public interest to support your safety and welfare whilst on placement
3. Sharing your details with affiliated institutions, research partners and study event organisers to support study placements and events where these are part of your course.	Necessary for performance of a contract of learning where such placements are a requirement of your course Where we process Special Category data for these purposes, we do so because it is necessary: in your vital interests and/ or in the substantial public interest to support your safety and welfare whilst on placement
4. Promoting your studies and the University’s activities through publishing on your Faculty’s internet pages your basic personal details, University contact details and details of your research.	We will process this information only with your consent.

L: When you graduate

Specific Purpose	Legal Basis
1. Disclosure to the Higher Education Degree DataCheck service which allows employers or statutory bodies and their agents to verify basic degree and enrolment information about you with your agreement. You should note University degrees are a matter of public record and we can disclose details of your qualification without your consent.	Necessary for performance of a task in the public interest, namely provision of higher education services (necessary to maintain academic quality standards and integrity)
2. Registration as a member of University alumni upon graduation. Your data as an alumni member will be processed in accordance with our policies and this Privacy Notice. Contact alumni@ARUL.ac.uk to opt-out or amend preferences	Legitimate purpose of maintaining our relationship with graduates.
3.Disclosure of Graduate Outcomes survey results to the Higher Education Statistics Agency. 15 months after you graduate from us.	Necessary for the performance of a task in the public interest namely statistical purposes (HESA’s statistical analysis of graduate employment routes)
4. Disclosure to professional and industrial bodies wishing to communicate with students about career opportunities and membership of their body and where relevant to confirm your qualifications and accredit your course	Necessary for performance of a contract of study in circumstances where membership of professional body necessary condition of study (e.g. the General Medical Council for medical students)
5. Inviting students who have achieved an Award from us to attend (or otherwise participate in) a Graduation Ceremony	Necessary for performance of a contract of study of which the celebration of academic achievement is a part
6. Administer your attendance/ participation at a Graduation Ceremony, publication of Award details in the Event Brochure and to facilitate suppliers in providing associated services e.g. formal gown hire and memorabilia	Legitimate purpose of organising a Graduation Event

M: ARUL Student Union

Specific Purpose	Legal Basis
1.Disclosure of your name, contact, study, fee status, ethnicity, disability details and carer status to ARUL NUS to facilitate your membership and their support activities.	Legitimate purpose of providing students with automatic access to our University's Students Union and their services
2.Disclosure of details supplied to ARUL regarding sexual orientation and gender change only where you have stood or applied to vote in an election where proof of this information is a pre-requisite.	We will share this information where the NUS has stated that you have given your explicit consent.

What personal data will ARUL collect about me?

We may receive your personal data when you: participate in, access or sign up to any of our services, activities or online content – such as newsletters, competitions, live chats and webinars – phone or email us, vote, pay money to ARUL, reserve a place at an event, apply for one of our programmes or create an account on our website. We will collect some or all of the following:

your name, and contact information such as address, email address and telephone number, as well as your date of birth, country of domicile and your nationality
your passport or national identity card details and where relevant your visa or biometric residence permit and immigration history.
information relating to your education and employment history, the school(s), sixth form college(s) and other colleges or universities you have attended and places where you have worked, the courses you have completed, dates of study and examination results.
records relating to assessments of your work, details of examinations taken, your predicted and actual examination grades and other information in your student record;
details of your engagement with your course and the services we offer.
your national insurance number (or other tax identification number) and bank details if you want to work for us during your studies
data about how you use ARUL mobile apps, websites or other university-related online content, and the device(s) you use to access these services. This includes collecting unique online identifiers such as IP addresses, which are numbers that can uniquely identify a specific computer or other network device on the web. For more information, please see see the section on cookies within this policy.

Anyone taking part in university activities that they may be photographed, filmed, videoed or otherwise captured in image form. Where possible and practical to do so, we will seeks written agreement to image capture. Where this is not possible for practical reasons, unless express objections are received, individuals attending an event at ARUL are deemed to have given their agreement by attending or remaining at the event. Any queries should be raised with the event host in the first instance.

Use of Sensitive Personal Data

This is defined by the General Data Protection Regulation (GDPR) as data relating to racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life and sexual orientation and criminal convictions and offences.

We may process special categories of personal data in the following circumstances where:

we need to carry out our legal obligations or exercise rights in connection with your education.
it is needed in the public interest
it is needed in relation to legal claims.
it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your agreement.
we need to ensure meaningful equal opportunity monitoring and reporting
we need to undertake data analysis to improves the services we provide, where possible your data will be anonymised.
you have already made the data public.
where you have given your explicit written consent.

Processing will be carried out in accordance with our policy on processing special categories of personal data and the additional safeguards in place for such processing.

Updating and correcting your personal data

We aim to keep your data current and it is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. You can do this via your e.vision account or in person at the iCentre.

We may contact you by post, telephone or fax as well as by email, SMS and MMS. If you change your mind about being contacted in the future by any of these means you will be given the option to change your preferences.

Where do we get your personal data from?

From you when you make an application or enroll as a student, or from open day activities; and
From third party organisations (this can include UCAS, Student Loans Company, Government Departments such as the Home Office or Department of Education, other institutions involved in the delivery of joint programmes). In using third party sources we will check to ensure they have a legal basis for providing us with your personal data.
From you when you disclose your personal data, as a student, during the course of your relationship with us when accessing or using any of our services such as financial support, careers advice or counselling services.
When you use ARUL mobile apps, websites or other university-related online content, and the device(s) you use to access these services. For more information, please see see the section on cookies within this privacy notice.
We may also obtain data from you if you use our QR (Quick Response) codes, attend open day activities, register as a student or apply for one of our courses.

Who do we share your personal data with?

Authorised personnel within Anglia Ruskin University and its partners will be able to access the personal data you provide to us. We may also disclose your data to other third parties who act for us for the purposes set out in the policy or for purposes approved by you.

Please note that where you nominate a third party or an agent to discuss your application/course with us or to make decisions on your behalf and you provide contact details for that third party/agent, you are agreeing for us to disclose data relating to your application/course to that third party/agent.

Please note that some data that is held about you will be sent to the Higher Education Statistics Agency (HESA). For further information on how this data will be used please visit the HESA website.

All our third-party service providers are required to take appropriate security measures to protect your personal data in line with our policies. We only permit a third-party service to process your personal data for specified purposes and in accordance with our instructions. We do not allow them to use your personal data for their own purposes.

Please note that countries outside the European Economic Area do not always have the same strong data protection laws. However, we will always take steps to ensure that your data is used by third parties in accordance with the terms of this Privacy Policy.

Unless required or permitted to do so by law, we will not otherwise share or distribute any of the personal data you provide to us without your agreement. We respect your personal data and will never sell it to third parties.

Your rights under GDPR

Please read about your rights under Data Protection legislation. It is important to note that the ‘legal basis’ we rely on (above) to process your data determines which of your rights are available. You are not expected to know these details, it is our responsibility to understand how the law applies and to explain it to you when responding to a request from you. Our Rights guidance is an opportunity to provide you with information on how you can expect us to handle your requests.

The law provides for the following rights:

To be informed
To access your data
To rectify (change, update or correct) your data
To erase (remove, delete or destroy) your data
To restrict our use of your data
To data portability
To object
To not be subject to automated decision-making and profiling

To complain to the Information Commissioner’s Office (ICO): the ICO is the UK supervisory authority for data protection issues. For more information please visit the ICO website.

Download Prospectus

Privacy information for current and prospective students