By accepting an offer to study at the University, the University will process your personal data (including sensitive personal data), for the purposes and in the manner set out in this notice and for other legitimate purposes connected with your education and enrolment as a student of the University.

The University of Exeter (the University) is a data controller and will only process your personal data in accordance with current data protection legislation.

The details of the University’s Data Protection Officer can be found on our website.

Given the complexity and variety of the relationships that the University has with its students, it is not possible to set out an exhaustive list of all the ways in which your personal data may be processed by the University. Further information on how long the University will keep your data is available in the Retention Schedules which form part of the University’s Information Governance and Security Policies.

This notice may be updated from time to time to ensure continued compliance with current legislation and to reflect best practice.

The type of personal data and sensitive personal data the University may process about you includes, but is not limited to:

• Your name and your student number
• Any student photograph
• Your permanent and term time addresses and your contact details including email and other electronic identifiers
• Residency status
• Your date of birth
• Your nationality and your ethnic origin
• Details regarding your next of kin
• Relationship information where a conflict of interest may exist (staff/student relationships)
• Your academic record including your previous qualifications and your academic record whilst at the University
• Your attendance at the University (including any engagement, suspension, or exclusion information)
• Incidental video/audio capture whilst in recorded academic sessions (see Lecture Capture Policy for more details)
• Any disability or other medical information that has been provided to the University
• How your studies are funded, including fee information and any sponsorship details.
• Information that allows you to join the University network, including IP, Mac address, access points and other electronic identifiers.

Your personal data is collected by the University to enable the University to fulfil its contractual obligations to you in the delivery of your studies. Data is also collected to fulfil legal/regulatory and security obligations.

The University collects your personal data from the following sources:

• The information contained on your application form and on enrolment
• Information provided by you whilst at the University and in relation to your studies, including attendance monitoring data (such as our digital check-in system and your engagement on university education platforms)
• Information collected during the use of University support and services (for example accommodation, wellbeing and the library)
• The information provided to the University by a third party in relation to your admission/enrolment and/or your subsequent study at the University (for example data provided by UCAS and any reference provided to the University from your previous place of study or work)
• Information provided by the Home Office or other third party in relation to your status as a home or international student
• The information provided by a third party in relation to your funding (for example the Student Loans Company, your sponsor etc.)
• Each time you connect to the University Network, our many security applications and infrastructure create logs to protect your data and alert Exeter IT and the Data Protection Officer of any threats to our data and system security.
• Information provided by individuals or supplied by 3rd party Public agencies in response to emergency situations.

These are some of the ways we will use your personal data; this is not exhaustive, but is intended to provide you with an idea of the things that we may need to do throughout your programme of study.

• The administration and delivery of your studies (teaching, learning, research etc.) including the delivery of teaching, administration of exams, the issue of your results, the recording of academic and other relevant achievements (which may include extra-curricular activities).
• We may use personal data (where anonymisation is not possible) for management and organisational planning including statistical analysis.
• We collect and hold data about your attendance, your achievements, your performance, and your engagement with University systems. In addition to the obvious uses of this data (including sharing this information with third parties like any sponsor or the Home Office) we may analyse this information to help support and enhance your time as a student.
• Medical evidence supplied to your College will be kept on your student record throughout your programme of study and may be used in applications for mitigating circumstances. 
• We may use home addresses to provide information about our friends and family charitable programme
• We may use personal data to investigate appeals, complaints, or alleged breaches of University regulations.
• We may use your data to meet regulatory and legal obligations the University is bound to.

We use data collected during your connections to the network to protect equipment and the security of our network and data held within.
This processing is necessary for the:

• performance of the contract in place between you and the University for the administration and delivery of your studies
• performance of the contract between you and the University to enable you to use University services (for example accommodation, welfare, and sport facilities)
• University’s compliance with any legal obligation imposed on the University
• public interest (such as our widening participation activities)
• University’s legitimate interest to use the data for business purposes where this does not outweigh your rights as a data subject.
• vital interests of yourself or another person, such as when emergency intervention may be required (medical, evacuation etc.).
• security of our network and to protect data

Some of the personal data the University processes about you will be sensitive personal data. This category of personal data will be subject to additional protections. Sensitive personal data is defined as information about your:

• racial or ethnic origin,
• political opinions,
• religious or similar beliefs,
• trade union membership,
• physical or mental health or condition,
• sexual life,
• commission of or proceedings for any offence committed or alleged to have been committed by you, and
• biometric data.

This information may be processed for one of the reasons set out above.

Information concerning your health may be disclosed within the University so that an appropriate level of care and facilities can be offered. It will only be sent to people who need to know this information to support you. Wellbeing Services will contact all students declaring a disability to confidentially discuss available help.

In addition, sensitive personal data may be collected to meet regulatory and legal requirements, monitor our equal opportunities policies, statistical analysis and to provide appropriate support that under-represented groups may require. Further information on our widening participation activities can be found on our Success For All pages.

In processing your personal data and/or sensitive personal data, the University may have reason to share your personal data and/or sensitive personal data with a third party, some of these circumstances are as follows:

• If you are on an employability or course related placement (including overseas/study abroad placements), involved in exchange programmes, joint/double degrees, a validated programme, or a Doctoral Training Partnership we will release relevant personal data to these institutions or related organisations as required to facilitate your studies and/or involvement.
• If you are participating in University managed internships, mentoring schemes or other employability activities (including Degree Apprenticeships and other employment placement providers) we will release personal data to employers, alumni, funders, and relevant stakeholders as required, to facilitate your involvement in these schemes. This may involve direct liaison with your manager or other relevant overseer within the organisation and in certain circumstances may include attainment (results/progress) information. International students should be aware that personal information including information about your enrolment, attendance and progress may be passed to the Home Office for purposes connected with immigration; results may also be shared when you seek to extend your studies with us.
• We will disclose limited information in connection with your academic progress to sponsors, loan organisations and scholarship schemes to enable such organisations to establish eligibility for the sponsorship/loan/award.
• We will disclose some personal information regarding Undergraduates and most Postgraduate taught students to GradIntelligence, the service through which the Higher Education Achievement Report (HEAR) will be delivered, this will enable access to your HEAR.
• Should you fall into arrears of payment to the University, we may disclose your personal data to a third party (e.g., solicitors, debt recovery agents, Courts) to help pursue and recover the debt.
• Teaching and events in University rooms and online events may be recorded and made accessible to relevant students and appropriate staff. 
• Some of your personal data will be passed to the Students’ Guild and/or the Falmouth and Exeter Students’ Union (FXU) to enable the provision of membership services.
• We may securely share your personal information with Falmouth Exeter Plus (FXPlus) to enable the provision of services and facilities at Falmouth and Truro Campuses.
• Exeter Online students’ personal data may be shared with our provider Keypath Education to enable the provision of online study. 
• We may share personal data with our partners INTO University of Exeter LLP where necessary to facilitate joint courses or courses you have enrolled on run by our partners.
• We may disclose details of full-time registered students to the relevant Council so that liability for Council Tax may be established. We disclose limited personal information of all students to the Electoral Registration Officer at the relevant Council.
• Information relating to your attendance record may be disclosed within references to a relevant third party requesting such information.
• Some personal data is sent to the Higher Education Statistics Agency (HESA) for statistical analysis. Contact details (including phone numbers) of graduates will also be sent to HESA for the Graduate Outcomes survey. See HESA's collection notices for full details.
• Certain, limited personal data may be sent to the Office for Students (OfS), Government education departments, funding councils, Student Loans Company, the Education Skills Funding Agency, Higher Education England, the UK Visa’s and Immigration Authority, grant awarding bodies, course relevant professional standards and registration bodies, government agencies and local authorities and emergency services for legitimate purposes. Data may also be checked for accuracy against external data sources. 
• Degree Apprenticeship students will be subject to requirements of Ofsted inspection which under their authority may require us to share extensive data.
• Contact details (including phone numbers) of undergraduate finalists will be sent to the OfS via Ipsos MORI for the National Student Survey, see the Ipsos MORI privacy notice for more information. The University may also invite you to participate in surveys.
• It may be necessary during distance learning to provide your name/address details to a supplier for provision of resources normally made available during on site campus sessions. Where this data is shared, we will seek assurances that the information will only be used for the stated purpose/s.
• In exceptional circumstances where we are concerned about your safety/wellbeing or consider you to be a risk to yourself or others we may share limited information both internally and with relevant third parties (for example: Ambulance, Police, NHS Trusts etc.) to ensure appropriate support is available.

On conclusion of your studies, the University will retain a certain amount of personal data which will form part of the student records archive. These data are retained in order to provide a record of your registration as a student and your achievements at the University, to allow the University to respond to requests for information from graduates and other leavers, and to report on performance or any other relevant aspect of the student body either at course, school or university level. Details on how long the University with retain this data is available in the University Retention Schedule.

Some information may be retained for statistical purposes.

On graduation, you will also automatically become a member of the University’s Alumni community. Some personal data from your student record will be transferred to the University’s Alumni database. Details on how this information will be used is available on the Alumni Data Protection Notice which also provides details if you do not want to receive alumni communications and/or do not wish to continue to be a member of the University’s Alumni community.

As a member of the University’s Alumni, you will have access to various benefits and services as set out on our Alumni website.

As part of your membership, the University may contact you and provide you with information relevant to the Alumni Association. This may include sending you a copy of the Alumni Magazine and providing you with details of reunion events, professional lectures and other career-related opportunities. You may also be contacted in connection with the University’s fundraising activities.

You have a number of rights in relation to your personal data. Read further information about your rights and how you can exercise them.

The University will endeavour to be transparent about its processing of your personal data. However, should you have any queries about the University’s processing of your personal data, further information may be obtained from the University’s Data Protection Officer.

If you think that any of your personal data held by the University is incorrect (for example if you move address and the University has your old address), please let us know so that we can update our records accordingly. You have the right to complain to the Information Commissioner if you have any concerns in respect of the handling of your personal data by the University.

We may notify your previous school or college of your enrolment at the University of Exeter, this enables them to promote where their students have gone on to, request former students to attend and encourage younger students to consider aiming for a place at the University of Exeter.

To change your consent options please confirm in writing to Dr Karl Devincenzi.

Please be aware if you are removing previously given consent and we have already shared some information with your school or college we will notify them of the change. The University is not responsible for any action your former school or college may have already taken with previously provided data, therefore you may wish to contact the school or college in question if you have any concerns.

While you are a student with us, and after you finish your studies, you can expect to receive news about the University, information related to your studies and career information on a regular basis. We may use email, post, telephone, our iExeter app or text messaging to contact you.

We would also like to contact you with additional information that you may find useful but have a choice in receiving. These marketing communications may include information about further study opportunities (including scholarships), paid-for sports provision, discounts and offers from our campus shops, and events and opportunities relevant to alumni (graduates and other former students) of the University. We may use email, text, post, telephone, or other electronic means (for example through social media) to contact you with this additional information.

We take your privacy seriously and won’t share your details to be used in this way with any external or third parties

All communications will have a link to enable you to unsubscribe from that mailing list at any time, you can also change some preferences within specific systems about the types of communications you receive including:

• Careers

To start receiving these or to remove yourself completely from all marketing communications please confirm in writing to the Information Governance Office. Please be aware you may continue to receive some marketing communications whilst systems are updated.

If you have given us your mobile phone number then we might text you with important information - for example, letting you know when lectures have been cancelled.

You can find further information and change your preferences on our IT webpages.

We want to support you to effectively engage with your studies and as part of our overall approach to your wellbeing and safety we require you to provide details of a trusted contact as part of the annual registration process.

The reason that we ask you for this is so that we may contact your trusted contact in the unlikely event of a very serious circumstance occurring. Very serious circumstances include instances where we are concerned about your safety/wellbeing or consider you to be a risk to yourself or others. Asking for a trusted contact at registration is sector best practice recommended by Universities UK.

It is your choice as to who you nominate as your trusted contact. Typically, it would be a parent, carer, guardian or family member. Your trusted contact should be in a position to be able and willing to act on your behalf in very serious circumstances.

You should ensure that your trusted contact is:

a) aware that they have been nominated

b) aware that their contact details (which would wherever possible include a phone number in order to make swift contact) have been given to the University for this purpose

During the registration process, you are able to include additional information that you wish to share about your trusted contact which would be useful to know, for example if they might require interpreters or translation support when interacting in English.

A ‘next of kin’ is usually a family member with whom you have the closest relationship. Your trusted contact and ‘next of kin’ may be the same person. We ask you if your trusted contact is the same as your ‘next of kin’ during the registration process.

The reason that we ask about ‘next of kin’ is because there are some circumstances where this information can help us to support you. These circumstances include where we need to work with other agencies to support you, such as the NHS in the event of serious illness. It is very unlikely that we will need to get in touch with your next of kin.

Your trusted contact and next of kin details are held on the University’s student record system (SRS) in accordance with our Current Students Privacy Notice. You are able to update this information at any time by logging into SRS.

We know that that all of our students are individuals and have their own personal circumstances and we want to support you.

Every student rightly has the expectation that the University holds your information safely and securely and that it will not be shared inappropriately. We will always make sure that we fully consider this before sharing information about you with your trusted contact and/or next of kin. It is very unlikely during your time as a student that we would need to get in touch with your trusted contact and/or next of kin and wherever reasonably possible we would try to get your consent first.

Where there are very serious concerns about your safety or wellbeing, we may decide to share information about you with your trusted contact and/or next of kin without your consent. We would only do this where we believe that it is necessary; for example where you are involved in, or where there is the risk of, an incident or very serious event where we believe you or others may come to serious or lasting harm.

When we make the decision to share information about you without your consent, we would consider any potential risks involved and how to mitigate them, for example sharing only necessary and critical information (on a ‘need to know’ basis) in order to balance your safety with your privacy and wishes.

Every instance where we decide to get in touch with your trusted contact and/or next of kin is considered and assessed on its own merit and your individual circumstances. Some examples of this could include (but are not limited to):

• Where you have unexpectedly been admitted to hospital for non-routine treatment
• Where you have not been seen for an extended period of time - for example not seen in your accommodation or not engaging with your studies - and you cannot be contacted to confirm your safety and wellbeing
• Where you have an ongoing illness which appears to be significantly deteriorating
• Where you are experiencing a serious mental health crisis
• Where you are behaving in ways which may pose a significant risk to your own or others’ safety and wellbeing
• Where you have been a victim of a serious crime
• Where other agencies – for example emergency services (ambulance, police) and the NHS – ask for ‘next of kin’ details in order to support you in immediate and vital circumstances

This is a non-exhaustive list of events/circumstances which may mean that we make contact with your trusted contact/next of kin. It does not set out the circumstances where contact will be made, this will be tailored to individual circumstances and considerations.

For students under the age of 18 years old decisions are taken on the basis of our Safeguarding Policy.

It is very unlikely that we will need to get in touch with your trusted contact / next of kin.

A decision to get in touch and share information about you with your trusted contact and/or next of kin without your consent would be taken by a University senior manager. This would usually be the Head of Wellbeing (in Exeter) or the Director of Student and Library Services (in Cornwall). The Director of Education and Student Experience may also make this decision. Out-of-hours, this decision may be made by the senior on-call officer (a Senior Welfare practitioner for example).

We would inform you of our intention to get in touch with your trusted contact/next of kin without your consent unless to do so may increase the risk of harm to you or another person.
Where we share personal information about you to your trusted contact/next of kin we keep a record of the rationale for this decision, what information has been shared, who it has been shared with and the time and date that it took place.

If we make contact with your trusted contact or next of kin about a particular incident this does not mean that we will have an ongoing dialogue with them in future, unless you have agreed this as part of a support process.

If your trusted contact or next of kin contacts the university we would not share specific information with them about you (such as your marks or contact details) unless there was a prior agreement in place, for example if you had agreed this as part of a support process.

Generic course information or information about the academic cycle for example course deadlines, dates of results release may be shared.

If your trusted contact or next of kin contacts us and is concerned for your welfare we would usually seek to contact you before any information is shared. If we cannot contact you and any of the circumstances outline above apply, we may share information with your trusted contact.

If you receive sponsorship for your programme an agreement may be in place, which you would have been party to, to share certain information with an external funding body. This would depend on the specific criteria which you have agreed to.

You might find these other information sources helpful:

• Safeguarding Framework  -  Compliance and Risk 
• Policies -  Information Governance 
• The Student Contract