UCL (“we”, “us” or “our”) are committed to protecting and respecting your personal data. This privacy notice sets out how any personal data we collect about you will be processed by us, whilst you are a student for our online programme.
Please read the following carefully to understand how we process your personal data. It applies to personal data provided to us, both by you or by third parties and should be read in conjunction with the UCL student privacy notice which it supplements.
This privacy notice only covers information which is additional to the UCL student privacy notice.
We keep this Privacy Notice under regular review. It was last updated on 2 August 2019.
About us
UCL, a company incorporated by Royal Charter (number RC 000631), is the entity that determines how and why your personal data is processed. This means that UCL is the ‘controller’ of your personal data for the purposes of data protection law.
Personal data that we may collect about you
‘Personal data’ means any information which identifies you as an individual. It may include your name but it may also be other information such as your date of birth, nationality and gender which when combined identify you. This information may be collected in a variety of ways, including electronically, in paper form, by telephone or in person.
In addition to the information collected in accordance with the UCL student privacy notice, we may also collect, use, store and transfer your image and voice, which may be recorded when participating in the live teaching sessions.
Purposes for which we process your personal data and the legal bases for processing
Data protection legislation requires that we meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a “lawful basis” for the processing. The legal basis for this processing will be as follows:
|
Purpose |
Legal Basis |
|
To support your learning experience We will use your personal data to:
|
For all personal data Performance of a task in the public interest UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statements of Tasks in the Public Interest for further information. Performance of contract The processing of your personal data may be necessary in relation to the contract we will enter into with you if you become a student at UCL. |
We may also use anonymised data, meaning data from which you cannot be identified, for the purposes of:
- service evaluation; and
- promotional purposes.
Who we share your personal data with
Your personal data will be collected and processed primarily by our processors. We work in partnership with 2U Group (UK) Limited (2U) to provide this course and 2U processes your data on our behalf, as our processor. Access to your personal information is limited to staff who have a legitimate need to see it for the purpose of carrying out their job.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes – we only permit them to process your personal data for specified purposes and in accordance with our instructions.
We also share your personal data with:
- 2U - we share personal data, but not any criminal records information or special categories of personal data (for example, health data), with 2U to use as a controller rather than as our processor (as described above). We share this information on the lawful basis that it is necessary in 2U’s legitimate interest to use for developing and improving its services. Please see 2U’s privacy notice for further details about how 2U, as a controller, uses your personal data; and
- Referees - We provide your name and the programme title you have applied for to your chosen referees.
Programme Marketing
Please read this section if you have separately signed-up to receive marketing about our online MBA programme (on https://onlinelearning.ucl.ac.uk/mba/).
Marketing communications about the programme are sent in conjunction with 2U, where you have specifically agreed to receive this. We do not, however, receive any of your personal data arising from these marketing communications. 2U, alone, is the controller of any such personal data.
International transfers
There are many circumstances in which we may transfer your personal data outside the EEA, e.g. where we use a third party cloud services provider based outside the EEA to store personal data.
Please note that many countries outside the EEA do not have data protection legislation, or have different data protection or privacy regimes, and so may not always protect their personal data to the same standard as within the EEA.
Where we transfer your personal information across national boundaries to a third party, such as one of our service providers, we will protect your personal information by ensuring that those transfers are made in compliance with all relevant data protection laws. Generally, this means where we transfer your personal information to a third party that is located in a country which does not have adequate privacy protection, we will put in place a contract with the third party that includes the standard international data transfer contractual terms approved by the European Commission.
Our Partner, 2U, processes Personal Data in the USA and South Africa and may transfer your Personal Data to these countries on the basis of EU standard contractual clauses.
For further information on the measures in place, please contact us using the details set out in the ‘Contacting Us’ section below.
Information security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have established procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Data retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. We will keep your personal data according to the Records Retention Schedule.
Your rights
Under certain circumstances, you may have the following rights under data protection legislation in relation to your personal data:
- Right to request access to your personal data;
- Right to request correction of your personal data;
- Right to request erasure of your personal data;
- Right to object to processing of your personal data;
- Right to request restriction of the processing your personal data;
- Right to request the transfer of your personal data; and
- Right to withdraw consent.
If you wish to exercise any of these rights, please contact the Data Protection Officer.
Contacting us
You can contact UCL by telephoning +44 (0)20 7679 2000 or by writing to: University College London, Gower Street, London WC1E 6BT.
Please note that UCL has appointed a Data Protection Officer. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact our Data Protection Officer using the details set out below:
Data Protection & Freedom of Information Officer
Complaints
If you wish to complain about our use of personal data, please send an email with the details of your complaint to the Data Protection Officer so that we can look into the issue and respond to you.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) (the UK data protection regulator). For further information on your rights and how to complain to the ICO, please refer to the ICO website.