Students

The Privacy Notice for Students should be read in conjunction with the overall Privacy Notice.

This section of the Privacy Notice applies to the individuals who are enrolled as a student at the University. It applies to students throughout a period of study, where it leads to an award of any kind or the gaining of credit from the University of Stirling (either singly or in collaboration with a partner organisation), regardless of their location of study.

The University requires to process and retain certain personal data relating to you, by virtue of your being a student of the University.

Sources of Data

The personal data the University holds about you is obtained from a number of sources, including the following:

  • Information you have provided when making enquiries to the University or as part of recruitment events
  • Information you have provided on your application form as part of the admissions process (including applications made via a third party such as UCAS or recruitment agencies)
  • Information from referees
  • Information you provide us with during the enrolment process
  • Information you provide us with during the course of your study
  • Information that the University requires to record about you during your studies e.g. grades
  • Funding organisations such as SAAS, the Student Loans Company or other sponsors
  • Statutory organisation such as the Home Office
  • Partner organisations such as professional bodies, employers, and other educational establishments for the purposes of external study or exchange.

What Personal Data we process about you

A full description of the categories of personal data that we process about you can be found in Record of Processing Activities – Student Data. Examples are name, gender, date of birth, contact details, education and training, student ID number, and some information about your personal circumstances such as whether you have dependents, if you have declared any criminal convictions and your racial or ethnic origin.

Purposes of Processing

The University requires to process the personal data it collects about you for the purposes of delivering a relevant educational programme of study to you, any other service you receive from us and to allow us to execute all the administrative and ancillary tasks relevant to our service delivery. A full list of the purposes for which we process your personal data can be found in Record of Processing Activities – Student Data. Examples include:

  • Delivering your programme of study.
  • Administration of your academic attainment e.g., marks and grades.
  • Hosting graduation ceremonies which are captured via live-streaming and photography, with audio and visual images shared via screens across campus and online, including on the University's social media channels.
  • Management and administration of University and privately-owned property (including accommodation services).
  • Administration of grants, loans and funds (e.g., loans from the Student Loans Company and access loans).
  • The provision of advice and support to students, including welfare, pastoral and academic services and careers services.
  • Management of behavioural or disciplinary issues and complaints.
  • Recording any criminal charges or convictions held at application or point of offer, as appropriate, and each year upon re-enrolment in line with our Criminal Charges and Convictions Policy and Procedure, so we are aware and can undertake any risk assessments as may be required or assist with any adjustments to course delivery as necessary where restrictions have been put in place as a result of a criminal charge or conviction.
  • Administering student experience surveys.
  • Preventing and detecting crime through the operation of CCTV and body-worn video cameras as described in the CCTV Policy.
  • Monitoring attendance and engagement to enable support to be directed to students as appropriate and to ensure adherence to University regulations, policies and procedures as well as external requirements such as UKVI compliance.  This includes the automated processing of personal data (profiling).  For more information see Attendance and Engagement.
  • Supporting successful outcomes for students by analysing data held in different systems and collected across different points in the student journey to enable planning ahead and decision-making on the best possible use of our resources to meet students' needs.  Where possible, we will use anonymised or aggregated data, but may process personal data for these purposes where we have a legitimate interest in doing so.

Legal Basis for Processing Your Personal Data

The law provides a number of bases on which Data Controllers such as the University can legitimise their processing activities. Given the breadth and depth of matters for which the University requires to process your personal data to provide you with the relevant educational programme or other service, the University legitimises its processing activities on a variety of lawful bases. We have set out in our Legal Justification for Processing Student Records how we legitimise each processing activity. However, the majority of our processing activities in relation to your personal data will be on the following grounds:

To fulfil the Student Contract

If you choose to accept an offer to become a student of the University, you are required to accept our student terms and conditions and this acceptance results in a contract being formed between you and the University. Once you are a student, we process your personal data where this is necessary for the performance of the student contract between you and the University. Examples include processing personal data to deliver the educational programme to you, dealing with absence management and disciplinary actions, providing you with student accommodation and administering the financial aspects of studying e.g., payment of fees, grants, loans etc. If you do not provide us with this information and allow us to process it as envisaged in this document, we may not be able to deliver the requested service to you.   

Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of our official authority

The University’s Charter and Statutes give the University official authority to carry out certain functions required to operate as a University. This includes functions related to teaching, examining and the promotion of research. The Charter details some specific powers in relation to students such as the granting of awards, holding examinations, disciplining students, providing accommodation, awarding scholarships, receiving fees and collaborating with other institutions. Along with the contract you have with the University mentioned in the paragraph above, the University will rely on this basis for the majority of the processing it does of your personal data. 

Compliance with a Legal Obligation

Sometimes we need to process your personal data to comply with a legal obligation on us. An example of this is in relation to the management of information relating to use of the Students’ Union under the Education Act 1994 or monitoring compliance with equality legislation under the Equality Act 2010, including complying with the Public Sector Equality Duty, e.g., when making anticipatory and reasonable adjustments for disabled students.  

Your Consent

There may be circumstances where we may not be able to legitimise the processing of your personal data unless we have your consent. Consent will be sought as and when required. You have the right to withdraw consent at any time without prejudice to your status within the University. If you do withdraw consent, this will not affect the lawfulness of processing based on your consent before your withdrawal.

Legitimate Interests

In a small number of cases, we will process your personal data as it is in the legitimate interests of the University to do so.  This will only be done when it has been assessed that the processing does not interfere with your rights and freedoms.  An example of processing carried out on the basis of legitimate interests is the University's CCTV system.

Sharing your personal data with other bodies

The main bodies to which the University discloses student personal data are detailed under the ‘Categories of Recipients’ section of the Record of Processing Activities – Student Data. By way of summary, the main categories of bodies that we may disclose your personal data to are: -

  1. Local Authority and Electoral Registration Office – your name and semester address will be released to the local authority for Council Tax exemption purposes and data such as your name, address and email address may be shared with the Electoral Registration Office in accordance with the Representation of the People (Scotland) Regulations 2001. 
  2. Statistical returns – submit statistical returns to the government or its agencies including the Scottish Funding Council, and other official bodies such as the Higher Education Statistics Agency (HESA). This may include sensitive data for equality monitoring purposes. For more information see the HESA Data collection notice. 
  3. The Home Office - If you are studying at the University on a Student visa you must comply with the terms of your visa and with all the University's requirements arising from our duties and obligations as a Home Office Student visa sponsor licence holder. The University is required to report to the Home Office details of students subject to immigration control who fail to enrol, who discontinue their studies, where their expected end date has changed or who fail to maintain contact with the University. We may also be required to provide the Home Office with other information about students. 
  4. Other Educational Institutions – if you are involved in a project with a third-party educational institution e.g., as part of a research project or a student-exchange project, we may need to transfer some of your personal data to that party.
  5. Our Service Providers – we use service providers to store or in some cases process personal data on our behalf.
  6. Third Parties - Where we receive requests from, or are otherwise obligated to inform, third parties such as, but not limited to, statutory, regulatory, law enforcement agencies, or other academic institutions, e.g., the Home Office, SAAS, the Police, the NMC, the Students’ Union etc., we may disclose your personal data as appropriate in line with data protection legislation.  Such circumstances might include where information is required for investigations, e.g., fraud, fitness to practise or visa compliance.  
  7. We may also disclose your personal data where this is strictly necessary to enforce or apply the student contract in place with you or to investigate potential breaches of it or where this is necessary, in our view, to protect the rights, property or safety of others including our staff and students. For example, if we consider the University’s Prevent duty may apply.

When we share your personal data with a third party as set out above or as referred to within our Record of Processing Activities – Student Data, in some cases, (e.g., where we use third party systems which may be Cloud-based, or in relation to overseas exchanges), these may involve a transfer of personal data to a recipient outside of the UK and/or European Economic Area and located within a country that may not be viewed as having adequate data protection laws by the European Commission. When doing all international transfers we will make sure that appropriate safeguards are in place to protect your information and your rights under privacy law and apply the same high standards of privacy and security wherever we process your data.

Retention of your personal data

Once you become an enrolled student, the University will retain your personal data in line with our data retention schedules relating to student data. Where an item of your data no longer requires to be retained, we shall securely remove it from our systems. If you enrol as a student at the University, some items of your personal data will be retained on a permanent basis. This is to ensure that the University can maintain an appropriate permanent archive of degrees and credit awarded and provide services to graduates/former students such as for replacement degree certificates.

Contact details relating to student data

If you are a student and would like to update your contact details this can be done via the Student Portal.

If you want further information about how your personal information is used or would like to request to correct, restrict or erase personal details should be reported to: