Programme

City, University of London

Online Distance Learning Programme

Privacy Notice for Prospective, Present and Past Students

Our contact details

Name: City, University of London

Address: Northampton Square, London EC1V 0HB, United Kingdom

Phone Number: 020 7040 4000

E-mail: dataprotection@city.ac.uk

Who we are

This privacy notice explains how City, University of London, (“City”, “we”, “us” or “our”) collects, uses and shares your personal data as a prospective, present or past student of our Online Distance Learning Programme, and your rights in relation the data that we hold. City has partnered with an external organisation, Higher Ed Partners Limited (“HEP”), to carry out this activity. This notice should be read alongside City’s General Privacy Notice, Student Privacy Notice and Terms and Conditions of Study, as well as any further information provided to you at the time that your personal data is collected.

We respect your right to privacy and are committed to protecting the personal information provided to us and meeting our legal duties under the Data Protection Act (DPA) 2018, the UK General Data Protection Regulation (UK GDPR), and any other applicable data protection laws. We will keep any personal information you provide to us, or which we obtain about you, secure and confidential using appropriate organisational and technical measures. Your personal information will never be sold and will not be used for any other purpose unless the law permits us to do so.

City is a data controller in terms of the DPA 2018 and the UK GDPR. City is registered with the UK Information Commissioner’s Office (ICO) with the registration number Z8947127.

What information do City and HEP collect?

Information provided by you for the following purposes will include details such as:

Marketing and Student Recruitment

• Programme of interest
• Prospective student first name
• Prospective student last name
• Prospective student international dialling code
• Prospective student mobile telephone number
• Prospective student email address
• Information relating to Prospective students’ individual situations and requirements that may be provided by Prospective students to, and recorded by, the Supplier’s Student Success Coordinators in the course of telephone conversations or email communications with Prospective students relating to recruitment to Managed Programmes.
• Prospective student contact preferences for receipt of marketing information in relation to the Managed Programmes
• Prospective student website usage data, IP addresses, device/browser information

Application, Enrolment and Initial Registration

Prospective Students/Students

• Programme applied for
• Title
• Full name (first name, last name and other/middle name(s))
• E-mail address
• Password for online application account
• International dialling code
• Mobile telephone number
• Alternative telephone number
• Date of birth
• Gender
• Preferred pronoun
• Identified gender
• Relationship to emergency contact
• Home address and postcode
• Additional address and postcode
• Country of residence/domicile
• Funding method
• Term time accommodation
• Whether the individual is an alumnus of the Customer
• Parental higher education attendance
• Whether or not the individual has a university degree.
• Academic and professional background, including
  • Education level
  • English test
  • First degree institution
  • Qualification title
  • Degree class
  • Awarded status
  • Employment information/CV information
  • Motivation information for application
• Evidence, including evidence of academic qualifications, and English language competency
• Outcome of application screening (admissions eligibility criteria met/not met)
• Application status (successful/not successful)
• Upload a copy of the government official ID to CRM as required as per City’s student terms and conditions

Emergency Contacts/Next of Kin

• First name
• Surname
• Relationship to Prospective Student/Student
• Telephone number

Module Purchase/Payment Processing

Students

• Student personal information for identification
• Full name
• Customer student ID number
• University/personal e-mail address
• Delivery address(es) associated with a transaction
• Ordered Item(s) (list of all items purchased)
• Currency ISO Code
• Description of payment type (e.g. WorldPay Business)
• Amount of payment
• Discount (if offered)
• Payment Date
• Payment Status (completed, failed etc.)
• Payment method (e.g. credit or debit card)
• Payment Gateway Call
• Payment Gateway Response (indicating whether the payment was successful or not)
• Supplier Order ID
• WorldPay reference ID
• Details of any error/(s) that may have occurred during payment
• Employer/Sponsor and Sponsor payment (if course fees being paid on a Student’s behalf)

Frontline Student Support

Students

• Full name
• Customer student ID number
• University e-mail address
• International dialling code and mobile telephone number
• Information Students may disclose to the Supplier during the provision of student support services (e.g. nature of query, information concerning their personal circumstances)
• Indicators of engagement with Managed Programmes (e.g. re-enrolment of new modules within the Managed Programmes and Students’ self-declaration of completed learning)
• Information shared by the Customer with the Supplier to enable the provision of ongoing student support, including that a Student is not engaging with the Managed Programme, has withdrawn from the Managed Programme, or have postponed, deferred or suspended their studies

CATEGORIES OF SPECIAL CATEGORY PERSONAL DATA

Application, Enrolment and Registration

Prospective Students/Students

• Ethnicity
• Religion
• Sexual orientation
• Nationality/dual nationality
• Disability information (for the purposes of accessibility and reasonable adjustments)

Frontline Student Support

Students

Any Special Category Personal Data that students may disclose during the provision of student support services, including sickness absence information, medical or health information.

We are required to collect your personal data in order to facilitate your application process and to provide the requested services to you. If you do not provide the information requested, we may not be able to consider you for admission.

Sensitive (special category) personal data, including:

• health and medical conditions
• certain criminal convictions
• racial or ethnic origin
• religion or similar beliefs
• sexual orientation.

Through its Information Technology systems, City and HEP collect and process personal data relating to:

• the provision, operation and lifecycle of user IDs and email accounts;
• the use of authentication (sign-in) and authorisation systems to deliver teaching, research and administrative services and resources, run directly by City or third parties;
• supporting, monitoring and ensuring the quality and security of the networks, systems and services we operate (including where appropriate to monitor your use of those facilities in accordance with university policies, for example on the acceptable use of IT); and
• assessments of the usage and effectiveness of our IT facilities and services.

City also processes and stores CCTV footage for the security and safety of our students, staff and visitors. Further information is available here. City also records information collected via the use of your student ID card in order to access certain parts of our premises, again for the purposes of the security and safety of our students, staff and visitors.

We collect personal data about website usage through cookies, which are small files of letters and numbers that are stored on your device. Our website uses cookies to distinguish you from other users of the website. The cookies set may obtain information about you, how you use the website and any other information you post, email or otherwise send to us. Information relating to your computer IP address, operating system and browser type, as well as your use of our website and your general internet usage may also be obtained via this method.

How do we collect information?

City and HEP collect your personal information in a number of ways:

• If you express an interest in City we will ask you to provide us with some information so we can communicate with you effectively.
• In various other ways during the course of your studies, for example, when you interact with City services.
• City may, at times, ask third parties for information about you such as your sixth form college, funder or employer.

Most of the information that we process about you will be provided by you, typically by one of the following methods including:

• when you submit your details on the request information form on our website or paid traffic landing pages, by applying for admission via our online application form; and
• when you contact us by phone and provide information to one of our enrolment advisors. All our phone conversations are recorded for training and quality purposes.

We may get additional information from your referee or employer where one is required.

Why do we process this information?

City and HEP use the information provided by or collected from applicants and/or students (including information from application forms) to administer applications and to compile statistics about applicants and/or students that may be published or passed to government bodies or the Higher Education Statistics Agency (HESA). As of 4 October 2022, HESA merged with JISC, meaning that JISC is now the data controller of personal data previously controlled by HESA. For further information please see the HESA Student Data Protection Notice.

If your application is successful, City and HEP will also use the information provided by or collected from you:

1. to facilitate and deliver your programme of study and to provide you with teaching, research and educational services and support;
2. to administer your studies, including admissions procedures and maintenance of your academic records after admission;
3. to provide you with, and manage your use of, City’s facilities and services and your participation at events;
4. to monitor and maintain records of your performance, engagement and attendance;
5. to operate security, disciplinary, complaint and quality assurance processes and arrangements and to provide you with support;
6. to conduct research and to identify ways to enhance learning, teaching, assessment and the broader student experience;
7. to enable effective communication with you;
8. to administer the financial aspects of our relationship with you and any funders, including processing any payments made by you to City;
9. for credit scoring, credit assessment, debt tracing or fraud and money laundering prevention. City may disclose this information or data about you to credit reference agencies or other credit assessment, debt tracing and collectors, fraud prevention organisations or solicitors as appropriate;
10. for legal, personnel, administrative and management purposes including the processing of any sensitive personal data relating to you, which may include, as appropriate: information about your physical or mental health or condition in order to monitor leave from study or extenuating circumstances and take decisions as to your fitness for study or for other uses as may be required by law;
11. conduct equal opportunities monitoring and equality impact assessments using your ‘protected characteristic data’; and
12. for other activities that fall within the pursuit of the City’s ‘legitimate interests’ (including the development and maintenance of an alumni programme, or in the event that City is required to terminate our contract with you and withdraw you from City in accordance our Terms and Conditions of Study).

City and HEP may share your personal data with third parties to support us in fulfilling our obligations and responsibilities to, and in managing our relationship with, you under our Terms and Conditions of Study. The third parties may include sponsors or funding organisations, professional bodies, work placement partners and foundation course providers, potential employers, local government departments, the University of London and third-party suppliers providing services to City.

In addition, in certain circumstances, City and HEP may be under a duty to disclose or share your personal data (including sensitive personal data) in order to comply with any legal or regulatory obligations, and to protect City’s rights, property, or safety of our employees, students or others. The third parties may include health professionals, Student Loans Company, UK Visas and Immigration (UKVI) and/or the Police.

You may be given further information about the processing of your personal data when you use specific services and facilities offered by City, such as our Student Health and Wellbeing Service and CitySport.

When you leave the Online Distance Learning Programme, whether because you complete your programme of study or otherwise, your information will be retained for the purposes of maintaining your student record and/or where there is a legitimate business need to do so.

How Your Data Is Used

What is our lawful basis for processing?

To be able to process your personal information, we must have a valid legal reason for doing so.

We rely on several different lawful bases under the UK GDPR, depending on the processing being performed:

Article 6(1)(a): Consent – on specific occasions we will only process certain data if you consent e.g. on registration you only need to provide certain “special categories” of data only if you specifically agree to that. Where we rely on this legal basis to process your personal data, you have the right to withdraw your consent at any time, though this will not affect the lawfulness of any processing that takes place prior to your withdrawal of consent.

Article 6(1)(b): Necessary for the performance of your student contract pursuant to our Terms and Conditions of Study – on many occasions, your personal data will be processed to enable us to meet our commitments to you and enforce your commitments to us. Examples of the types of data and processing activities involved include: registration and re-registration information, , delivering information to you on the virtual learning environment or via SITS e:Vision, managing absence and academic engagement, managing disciplinary issues or complaints, and administration relating to financial issues (including payment of fees). We would not be able to deliver your programme of study without processing your personal data for these purposes. Please be aware that the processing of personal data, including special category personal data, for health and wellbeing purposes is usually provided under the lawful basis of a contract, as students agree to a set of terms and conditions with respect to provision of these services.

Article 6(1)I: Necessary to comply with a legal obligation – we may have legal obligations to provide your personal data to others e.g. JISC as the Designated Data Body for England under the Higher Education Research Act 2017.

Article 6(1)(d): Necessary for the purpose of protecting the vital interests of yourself or another person – sometimes, in extreme circumstances, we will have to release information to protect your interests or the interests of others e.g. in medical emergencies.

When considering whether to share personal data in these circumstances, we shall take into account sectoral guidance issued by Universities UK.

Article 6(1)I: Processing necessary for the performance of a task carried out in the public interest – City is an educational and research establishment, and in particular, our educational and research activity is conducted in the public interest (including your interest and the interest of others, including society at large) pursuant to our Royal Charter.

Article 6 (1)(f): Processing necessary for the purposes of the legitimate interests of City or a third party, subject to overriding interests of individuals – City (and occasionally third parties) has a broad legitimate interest in activities that connect to the activities and education of students. Subject to those interests not being overridden by the interests of fundamental rights and freedoms of students, it will process students’ personal data where this is necessary in order to pursue those interests. A good example of this legitimate interest would be the development of an alumni programme and alumni activities (including organising events and fundraising campaigns). Please refer to our alumni privacy notice for further information.

Special category data are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning an individual’s sex life or sexual orientation. We process such special category data, as well as information relating to criminal offences, in accordance with the requirements of Article 9 and/or 10 of the UK GDPR and Schedule 1 of the DPA 2018.

We will collect and process your personal data for a number of related reasons and the lawful basis will depend on information concerned and the specific context in which it is collected.

Please see the purposes listed below:

We will always highlight areas where we need to ask for your consent as the lawful basis and will give you the choice to opt-in. If you do consent or opt in, we will let you know how you can opt out in the future. We will not process your personal data for any other purpose other than those stated above without informing you first.

We may use your data for reporting purposes to improve targeting, personalisation and overall effectiveness of marketing activity. If we do this we will either aggregate your data or otherwise process it to ensure you cannot be identified.

Who City Shares Your Personal Data With

Do you share my information with others?

Where necessary City and HEP will disclose, outside the institution, relevant items of your personal data as set out below.

• Sponsors or funding organisations (including the Student Loans Company), where a contract exists, in accordance with the terms of the contract (which usually relate to attendance and progress reports).This does not include third parties (such as parents) who may be paying for your studies but with whom no formal contract exists.
• Professional bodies (e.g. Law Society or the Nursing and Midwifery Council).
• For the purposes of confirming your qualifications and the accreditation of your course.
• NHS Trusts in England and Wales where this is necessary for the purposes of your study.
• Work Placement sites or other educational partners involved in joint course provision where this is necessary for the purposes of your study.
• The Office for Students (OfS) and its agents, such as the Higher Education Statistics Agency (HESA) (now part of JISC) and the Quality Assurance Agency. You are also advised to refer to the collection notices on the HESA website for further details.
• Potential employers or providers of education whom you have approached for the purposes of confirming your qualifications.
• Local Government Departments, including Council Tax, Electoral Services and Transport for London for the purpose of assessing and collecting Council Tax and or supporting your registration to vote in elections.
• UK Agencies with duties relating to the prevention and detection of crime, apprehension and prosecution of offenders, collection of a tax or duty, or safeguarding national security. For example: Benefit or Tax Inspectors, the Police, the UK Border Agency (UKBA) or the Foreign and Commonwealth Office, as necessary, and with consideration of your rights and freedoms.
• The University of London for the purposes of allowing you access to shared facilities.
• City Students’ Union to provide support services for students.
• Foundation course partners for the administration of those courses.
• Providers supplying learning analytics services (e.g. JISC) to support students in their studies.
• HEP uses third parties for services such as website hosting, contact centres, information technology and data analysis.

In addition, City employs the services of various suppliers and agents as data processors. In each case your information will only be shared with these third parties in accordance with the data protection principles.

We will ensure that we have a robust data processing agreement in place with any third-party data processor we use. We will only share the minimum amount of personal data with any of the above and will always do so in accordance with the law.

In certain circumstances, it may be necessary for City and HEP to transfer your personal data (including sensitive personal data) outside the United Kingdom. In respect of such transfers, we shall comply with our obligations under applicable data protection laws, including taking reasonable steps to ensure an adequate level or protection for all personal data (including sensitive personal data) transferred outside the United Kingdom, including, where necessary, by ensuring that appropriate safeguards are in place for such transfers in accordance with applicable data protection laws. For further information as to any international transfers of your personal data, please contact dataprotection@city.ac.uk.

Sharing Personal Data in Cases Involving Harassment Complaints, Investigations and Disciplinary Proceedings

Where you make or are the subject of a complaint of harassment involving a member of staff, a student or visitor, City may share personal data relating to the complaint, including: the allegations made, the outcome of the complaint investigation process and/or any sanctions imposed at the conclusion of the process.

Such personal data may be shared internally within City (including with the individual making the complaint or the individual who is the subject of the complaint), and, where necessary in the circumstances, with external bodies, including the police. Decisions on the extent of any data shared in this context, and the individuals/organisations with whom such data are shared, will be made on a case-by-case basis, with due consideration being given to the proportionality of any data sharing, as well as the rights, interests and freedoms of the individuals concerned. When considering whether to share personal data in these circumstances, City shall take into account sectoral guidance issued by Universities UK.

Information is shared with relevant departments within City for the purposes outlined above.

In addition, specific data may be obtained from and shared with the following parties for the purposes specified:

How we store your information

Your information is securely stored as a mixture of paper and/or computer records. City and HEP have taken steps to implement appropriate technical and organisational measures with a view to protecting the personal data we process about our students.

All individuals working within City (including students) and HEP are aware of the confidential nature of these records and we will only release this information in accordance with the law.

How long do we keep your information for?

Personal information collected from you is retained where there is an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

The specific retention period will be dependent on the types of personal data being processed and our purposes for doing so. City has adopted the Jisc Records Management Retention Schedule.

When there is no ongoing legitimate business need to process your personal information, City and HEP will either delete or de-identify your personal data, or, if this is not possible (for example, because your personal information has been stored in backup archives), then your data will be securely stored and isolated from any further processing until deletion is possible.

De-identified aggregate data will be used for marketing analysis for marketing purposes.

Your Data Protection Rights

Under data protection law, you have various rights relating to your personal data, including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.

Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

Your rights in relation to automated decision-making – You have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal or other significant effects on you as an individual. In practice, however, City does not

usually undertake this form of processing activity (i.e. in essence, using computer software alone to make decisions about people) in the course of providing our services to you.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

If you wish to exercise any of these rights, please send your request to the Data Protection Officer via email or by post to:

City, University of London

Information Assurance Team

Northampton Square

London EC1V 0HB

United Kingdom

Further information

Further information regarding your individual rights is available from the Information Commissioner’s website.

City’s legal documents and policies can be accessed here. These include various privacy policies and related documents.

City also has a Data Protection Policy that sets out how we process personal data to ensure that it is always kept secure and only used appropriately.

How to Complain

Who can you contact if you have a concern?

City has appointed a Data Protection Officer, Dr Emma White, who can be contacted by email or by writing to her at our address:

City, University of London

Information Assurance Team

Northampton Square

London EC1V 0HB

United Kingdom

+44 (0)20 7040 4000

Website: https://www.city.ac.uk/

The Information Commissioner’s Office

The Information Commissioner’s Office (ICO) is responsible for making sure that personal data is collected and processed in accordance with the UK GDPR and the Data Protection Act 2018.

If you are dissatisfied with the way in which your personal data has been processed, you may lodge a complaint with them by contacting:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://ico.org.uk/

Changes to Privacy Notice

We will review this Privacy Notice at least annually. This privacy notice was last updated on 16 February 2024.

Application Form Terms and Conditions

Please review your application before submitting and read the following information:

After you have submitted the form, if you realise that any details are incorrect, please e-mail enrolments@technology.online.city.ac.uk or call +44 8000488040 as soon as possible.

City will verify all language tests with the provider you undertook your language test with.

By submitting I agree that:

I confirm to the best of my knowledge that the information I have provided in this application is complete and accurate. I understand that any offer of admission as a postgraduate student that I may receive from the University will be based upon the information given in this form and that if I am found to have given false information, the offer may be withdrawn.

I understand that the information supplied on this form will be retained by City and Higher Ed Partners Limited and will be used for the purposes of processing my application and collecting feedback on the admissions process.

I understand that City may share information with external agencies for the purpose of verifying academic documents.

I understand that if my application is successful that the information will form part of my student record. If admitted to the University, I agree to abide by the Terms and Conditions of Study at City, University of London.