Career Zone approach to teaching and learning

MyCareerZone: Privacy Notice

 1)       Introduction

This Privacy Notice explains how the University processes your personal data when providing the Career Zone service, including the use of our third-party platform, MyCareerZone, operated by GTI Futures.

We are committed to protecting your privacy and handling your information securely and lawfully in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This notice functions alongside the Student Privacy Notice, Staff Privacy Notice and Alumni Privacy Notice. 

The University is the Data Controller for personal data processed as part of the Career Zone service.

Opting out

You can opt out of MyCareerZone by emailing careers@exeter.ac.uk. Once you’ve opted out, your data will be removed from the platform.

2)        Purpose of processing

We use MyCareerZone to deliver student and graduate employability support, including:

• Access to careers guidance, appointments, and events
• Vacancy management and employer engagement
• Skills development opportunities
• Work experience, placements, and internship administration
• Communications relating to employability opportunities, workshops, and services
• Monitoring service usage and evaluating service effectiveness
• Meeting institutional obligations to support students’ career development

 3)       What information is being collected about me?

To provide these services, the University imports certain information about you directly from the Student Information System into MyCareerZone.

This includes:

• Name
• University email address
• Student ID
• Course title and course level (e.g., undergraduate, postgraduate)
• Year of study
• Campus location
• Faculty or academic school
• Fee Status (e.g. Domestic or International status)
• Country of Domicile
• Swipe card ID
• Expected year of completion
• Student status (e.g., enrolled, intermitting)

You may also provide additional information voluntarily—for example, when booking appointments, completing profiles, uploading CVs, or responding to surveys.

4)        Special category data

The Career Zone service does not routinely require or seek special category data.

However, you may choose to disclose relevant information (e.g., disability status for reasonable adjustments during events or employer schemes).

Such information is always processed with heightened safeguards and only where strictly necessary.

5)        Legal basis for processing

Under Article 6(1)(f) UK GDPR, the University relies on Legitimate Interests to process your personal data for careers and employability service provision.

Our legitimate interests include:

• Providing support that enhances students’ employability
• Enabling efficient management of careers appointments, events, and placements
• Communicating relevant opportunities that align with your studies and career development
• Ensuring effective service planning, reporting, and quality assurance

Where special category data is processed, it is done under Article 9(2)(a) (explicit consent) or Article 9(2)(g) (substantial public interest), depending on the context.

6)        How do we use your data?

Your data is used to:

• Create and maintain your MyCareerZone account
• Authenticate your identity through Single Sign-On (SSO)
• Tailor careers guidance and resources
• Manage event bookings, workshops, and employer engagement activities
• Send service-related communications
• Produce anonymised or aggregated statistics to monitor performance and improve services

We do not use your data for automated decision-making with legal or significant effects.

7)        Sharing your data

Your data may be shared with:

a) GTI Futures Ltd (Third-party service provider)

MyCareerZone is operated by GTI Futures acting as a Data Processor on behalf of the University.

Processing is governed by a legally binding Data Processing Agreement ensuring compliance with UK GDPR.

 b) Internal University departments

Only where necessary to provide services and opportunities, for example:

• Faculties or Schools (e.g., student support or placement administration)
• Student Services teams supporting employability initiatives

c) External organisations

Only with your consent or where you take specific action:

• Employers posting roles, internships, or events
• Partners delivering employability programmes
• Placement providers, where required to arrange your placement

 8)       How long do we keep your data?

Your personal data is retained within the MyCareerZone platform for three years after you have graduated, in line with your access to the Career Zone service.

After this period, you will be contacted by the platform provider to ask if you still want to access the MyCareerZone features. If you do not, your data will be securely deleted.

  9)      How do we manage your data subject rights?

You have the right to:

• Ask us to see, correct or delete the data we hold about you
• Object to specific data uses, as described above
• Object to receiving communications
• Object to the transfer of your data electronically to a third party.

The University’s Data Protection Officer (DPO) is responsible for monitoring compliance with relevant legislation in relation to personal data and can be contacted at dataprotection@exeter.ac.uk, you can also contact the DPO if you have any queries or concerns about the University’s processing of your personal data. You have the right to lodge a complaint with the Information Commissioner’s Office.

10)      Security measures

The University and GTI Futures implement appropriate technical and organisational measures including:

• Access controls and role-based permissions
• Authentication via Single Sign-On
• Encryption in transit and at rest
• Audit logging
• Staff training and confidentiality agreements

11)      Further information

This Privacy Notice will be kept under review. Any changes will be updated on our website and communicated to you as appropriate. This Privacy Notice was last updated in January 2026.