Accommodation Services
Data Protection Privacy Notice
University for the Creative Arts
Accommodation Services - Data Protection Privacy Notice
The University for the Creative Arts takes its obligations with regard to data protection seriously. As such, we are providing this notice (“Privacy Notice”) to you so that you have information about how we collect and use your Personal Data (as defined below) in accordance with applicable data protection law, including the General Data Protection Regulation 2016/679 (“GDPR”). Please read this Privacy Notice, as it contains important information of which you should be aware.
For the purposes of this Privacy Notice, “UCA Student Resident” (“you” or “your”) means a University for the Creative Arts student who lives in student accommodation at the University for the Creative Arts and “UCA” (“we”, “us” or “our”) means the University for the Creative Arts.
UCA is the data controller with regard to the processing of your Personal Data. The data controller is the entity that determines how and why Personal Data is processed.
In addition to the accommodation-related functions described in this notice, the University may also maintain other policies from time to time dealing with your relationship with, and time at, UCA, such as the University’s Data Protection Policy and Procedures and the Student Regulations. These policies are available on UCA’s website and will be notified to you as necessary to comply with relevant data privacy laws.
This Privacy Notice does not form part of your contract with us for accommodation or of any other contract with us to provide services to you.
This policy applies only to Personal Data processed by or on behalf of UCA. Where our website contains links to other sites, we have no influence on whether or not they comply with data protection law. You should check their own privacy policies before providing them with personal information.
1. What do we collect and process?
In order for UCA to manage student accommodation, it is necessary for us to process Personal Data about you.
The term “process” means any action taken, with or without the help of electronic means, in connection with Personal Data, including collection, handling, use, transfer and disclosure by transmission, dissemination or otherwise making available, as well as recording, organisation, storage, retention, adaptation or alteration, access, retrieval, consultation, alignment or combination, blocking, anonymising, erasure, disposal or destruction.
“Personal Data” is information which (either on its own or in combination with other information UCA holds) allows UCA to identify, and manage our relationship with, a UCA Student Resident.
The Personal Data which we process may include the following:
- Name and (home and/or contact) address
- Contact information (including telephone number and email address)
- Title
- Age and date of birth
- Gender
- Photograph(s) of you
- Place of birth, nationality and area of residence
- Financial Information (including details of any outstanding debts owed to UCA)
- Bank account, payment card details and billing address
- Actual or suspected criminal offence or conviction information
- Name and contact details of parents, next of kin, guardians or advisers
- Details of the course(s) for which you are registered and your current campus
- Information about your health and/or disabilities
- Details of your status as a Care Leaver
- Disciplinary information
- Your interests, preferences, feedback and survey responses
- Personal Data provided voluntarily by you
- The Personal Data contained in any other communication you make, or authorise to make, to us, or which is made on your behalf
Personal Data will primarily be collected from you directly. However, some Personal Data may, where lawful to do so, be collected by UCA from third parties (including family members, government agencies (including Local Authorities), tax or law enforcement agencies, Student Finance or publically available information about you (e.g. social networking sites). We will only accept and use information about you from reputable organisations who have either obtained your permission to share your information with us or who have collated information about you from publicly available sources.
Please note that you are under no obligation to provide UCA with your Personal Data. However, not providing some of the Personal Data described above could prevent UCA from performing its obligations to you and prevent you receiving related services received from us.
2. Why and for what purpose do we process your Personal Data and what is our lawful basis for doing so?
Please note: this list below may be updated from time to time and we will provide notice as and when such updates are made.
|
Personal Information |
Basis of Processing |
Purposes of Processing |
|
Processing that is necessary to perform a contract or when taking steps in connection with a contract with you. |
(a) to help us identify you (b) to manage your contract with us for UCA accommodation and to perform related functions and services (c) to process the payment(s) of fees for your accommodation |
|
Where necessary, processing based on your freely given, specific, informed and unambiguous consent |
(a) to deal with any additional accommodation-related queries or needs you may have (b) student welfare/pastoral care (c) in an emergency (e.g. serious injury or illness) to contact parents, next of kin, guardians and/or advisers (d) [to send marketing information and surveys to you by email, post and text] (e) [to keep you updated on UCA services which may be of interest or relevance to you]
(f) [to use your Personal Data for our own marketing activities] |
|
Processing that is necessary to comply with a legal obligation to which we as the data controller are subject (other than a contractual obligation) |
(a) to comply with mandatory tax reporting to HMRC (b) upon lawful request by government authorities, law enforcement and regulatory authorities (c) to comply with applicable law relating to health and safety (d) to comply with relevant law relating to criminal offences and convictions (e) to comply with any other applicable laws |
|
Necessary to protect the vital interests of the data subject or of another natural person |
(a) In a medical emergency (b) in the case of serious concern for, or immediate risk to, the health, well-being or safety of you or another individual |
|
Necessary for the performance of a task carried out in the public interest |
(a) to take decisions on accommodation provision, disciplinary sanctions and/or safety measures to be taken in relation to actual or suspected criminal offences or convictions reported to us by the police or other law enforcement agencies (b) to make suitable and/or necessary arrangements for Care Leavers |
Personal Data – Legitimate Interests
|
Personal Information |
Basis of Processing |
Purpose of Processing |
Legitimate Interest Decription |
|
Processing that is necessary for our own legitimate interests [or those of third parties] provided these are not overridden by your interests and fundamental rights and freedoms |
(a) to identify you (b) to respond to and/or deal with requests, enquiries or complaints (c) for managing our business (d) to check for any monies owed by you and your financial history in respect of payments made or owed to us in respect of accommodation services (e) for marketing purposes (f) in response to legal process (g) to enforce UCA’sagreements and policies (h) to protect the rights, property or safety of UCA, its students, employees, agents and/or others (i) [for the prevention and detection of crime] (j) for improving and changing our services and processes (k) [to convert your Personal Data into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from that data. We may use this aggregated data to research analysis, including produce statistical research and reports. We may share such conduct and to anonymous aggregated data with third parties. Aggregated and anonymous information does not personally identify you and is therefore not Personal Data.] |
In respect of purposes (a), (b), (c), (d) and (j), the specific legitimate interest pursued is the efficient, cost-efficient and profitable management of our business. In respect of purposes (a), (e) and (k), the specific legitimate interest pursued is the analysis, monitoring, development, marketing and promotion of our services. In respect of purposes (a), (f) and (g), the specific legitimate pursued is protection enforcement of our legal rights and the defence of legal claims. In respect of purpose (a) (h) and (i), the specific legitimate interest pursued is for the safety and wellbeing of employees, students, agents and/or others, the protection of property and the management of risk associated with our obligations in this regard. |
Special Categories of Personal Data
In addition to the bases of processing and purposes of processing set out above, in respect of special categories of personal data, we have the additional bases and purposes of processing:
|
Personal Information |
Basis of Processing |
Purposes of Processing |
|
Processing is necessary for reasons of substantial public interest |
(a) to protect the rights, property and safety of UCA, its employees, students, agents and/or others (b) to comply with applicable law relating to health and safety |
|
Explicit consent Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent |
(a) to manage your health and disability-related accommodation needs and to provide any related services and support required (b) In a medical emergency (c) in the case of serious concern for, or immediate risk to, the health, well- being or safety of you or another individual |
We cannot administer our relationship with you without your personal data. Where we don’t need your personal data, we will make this clear, for instance we will explain if any data fields on our application are optional and can be left blank.
3. To whom will your Personal Data be disclosed?
Personal Data may be shared and transferred from us to:
(a) UCA’s Library & Student Services (LSS) (b) the Student Loans Company;
(c) Local Authorities;
(d) Police and Social Services;
(e) the Home Office;
(f) your next of kin, GP, mental health and/or emergency services;
(g) Students’ Union
(h) internal and external auditors;
(i) our insurers
(j) government agencies; and/or
(k) third parties that are performing services under contract for UCA, such as professional advisers, debt recovery agencies, IT hosting agencies[, and market survey companies.
for the purposes noted above, or for such other purposes as are notified by UCA to you from time to time.
Where any third party processes your personal data on our behalf (as our processor), we will make sure that they have appropriate security standards in place to make sure your Personal Data is protected and we will enter into a written contract imposing appropriate security standards on them.
Parents, family members and guardians are considered to be third parties and your personal data will not be disclosed to them unless consent is received from you or it is otherwise lawfully justified to make such a disclosure under GDPR and in accordance with the University’s Data Protection Policy and Procedures.
UCA will not transfer your Personal Data outside the European Economic Area, except that UCA may, where permitted (and having obtained any necessary consents as may be required by law), disclose Personal Data outside of the EEA where required as matter of law.
4. Security of your Personal Data
As stated above, UCA takes the protection of your Personal Data seriously and we have implemented technical, physical and organisational measures to ensure the Personal Data of UCA Students is kept accurate, up to date and protected against unauthorised or accidental destruction, alteration or disclosure, accidental loss, unauthorised access, misuse, unlawful processing and/or damage.
5. Data Retention
UCA will retain your Personal Data only for such period as is necessary to perform the purpose(s) for which it was collected. In most cases, this means that Personal Data will be retained for the duration of the time that you are a resident in UCA’s accommodation, and then for a reasonable time thereafter in order to manage our relationship with you, defend any claims, and/or for any other record keeping purposes. This period is typically a period of not less that 5 years [from the date that we collect your personal data.
6. Your Rights
[You can withdraw your consent or object to receiving marketing at any time by contacting us using any of the contact details provided below.]
We offer the following rights to you in respect of your Personal Data:
-
You can request access to, or copies of, the Personal Data that we hold about you. If you would like to exercise this right, please contact us using any of the contact details given below;
-
If you believe that any information we have about you is incorrect or incomplete, please contact us using any of the contact details given below as soon as possible. We will take steps to seek to correct or update any information if we are satisfied that the information we hold is inaccurate;
-
You can request that your Personal Data be deleted, where it is no longer necessary for the purposes for which it is being processed and provided there is no other lawful basis for which we may continue to process such information;
-
If we are processing your Personal Data to meet our legitimate interests or in the performance of a task carried out in the public interest, you can object to the processing of your personal information by us. If we are unable to demonstrate our legitimate grounds for that processing, we will no longer process your personal information for those purposes;
-
You can withdraw any consent given to processing (this will not affect the lawfulness of processing based on consent before its withdrawal);
-
You have an additional right of data portability where the Personal Data we use is processed automatically based on your consent or for the purposes of performing our contract with you. You can ask us to provide your Personal Data in a structured, commonly used and machine-readable format to you or to a third party, as instructed by you;
-
You can request that we restrict the processing of your Personal Data in certain circumstances when required by law; and
-
In certain circumstances, you have the right to object to our processing of your personal data where the processing is for the purposes of automated decision-making, including profiling.
If you would like to exercise any of your rights as described above (or if you have any questions about this Privacy Notice or concerns about our dealings with your Personal Data), please contact Mark Ellul, Chief Operating Officer at:
Email address: Mark.Ellul@uca.ac.uk
Address: University for the Creative Arts Falkner Road Farnham Surrey GU9 7HB
We will try to resolve any concerns you may have. However, if you consider that we are in breach of our obligations under data protection laws, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence or place of work. In the U.K., you may lodge a complaint with the Information Commissioner’s Office (https://ico.org.uk/global/contact-us/).
7. Updates to this Privacy Notice
UCA may change this Privacy Notice from time to time in order to reflect changes in the law and/or its privacy practices. When this happens and where UCA is required to do so by law, it will provide you with a new and/or updated Privacy Notice detailing how the use of your Personal Data is changing and, if necessary, obtaining your consent for the further Processing, as may be applicable.
Policy last updated: April 2021