Privacy Notice for Visitors and Events

University services process your personal data to provide specific services to you. These services include access to IT Systems, access to campus facilities, your safety and wellbeing and participation in university hosted events.

Personal data means any information about an individual from which that person can be identified.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes your name, title, date of birth, gender and copies of identity documentation
• Contact Data includes your address, email and telephone number(s). This also includes contact information provided in relation to third parties, for example; emergency contact information
• Financial Data includes bank account and payment card details
• Public Health Data includes data that we may need to collect about you
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us
• Profile Data includes purchases made by you, your interests, educational and employment history, equality data, preferences and feedback and survey response
• Usage Data includes information about how you use our services including attendance, complaints and investigations
• Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences
• Images includes CCTV and surveillance, film and photography

We also collect, use and share aggregated data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing one of our services.

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• Participation in guest event activities, including the application and monitoring of reasonable adjustments
• Provision and administration of our services to you, including the use of services such as library, IT and parking
• Ensuring for your safety, health and wellbeing
• Where we need to comply with a legal obligation
• Prevention, reduction, detection and investigation of crime and other incidents

We also receive personal information indirectly, from the following sources in the following scenarios:

• A third party who identifies you as having a vested interest in the delivery and provision of our services, for example an applicant who registers their guardian or careers details

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal basis we are relying on to process your personal data where more than one basis has been set out in the table below.

Marketing and Promotions

1. We may use your identity, contact, technical, usage and profile data to form a view on what we think you may want or need, or what may be of interest to you and based on this market services to you
2. You will receive marketing communications from us if you have requested information from us or purchased services from us and you have not opted in to receiving that marketing
3. We will not share your personal data with any third party for marketing purposes
4. You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you
   

Information will be shared with third parties only when necessary as part of the provision of our services to you and/or we have a legal or regulatory requirement to do so. We anticipate that we will share information with the following third parties for the following purposes:

• Department of Health (or relevant government body) to meet regulatory requirements in relation to public health
• Emergency services in the event of a significant incident
• Third party event hosts delivering services to you on behalf of the university
• Financial service providers to enable the completion of transactions

We do not anticipate the transfer personal data outside of the United Kingdom/European Economic Area (EEA). If such transfer is required we shall only do so with adequate legal protections in place.

1. We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. At the end of a retention period, your personal data will be deleted securely and safely.
2. Your personal data will be retained in accordance with the retention periods set out in our Records Retention Schedule and is recorded in the university Information Asset Register

The university recognises and respects individual rights under the UK General Data Protection Regulation (GDPR). For further information please see our overarching Privacy Notice and Privacy webpage detailing your privacy rights.

Please see our overarching Privacy Notice for information on how to complain.

We keep our privacy notices under regular review. This privacy notice was last updated on 23 June 2023.