Access and Participation in Higher Education privacy notice

Read about how we process personal data and find out about your rights.

This notice outlines the University’s processing activities relating to improving access and participation in Higher Education and covers the following:

Overview

The University of Sussex is registered as a data controller with the Information Commissioner’s Office (ICO). Our registration reference is Z6428144.

You can refer to the University’s Data Protection Policy for more information about our commitment to processing personal data in a way that is compliant with data protection legislation. This includes the Data Protection Act 2018, the UK General Data Protection Regulation (‘UK GDPR’) (as implemented by the Data Protection Act 2018), and the EU General Data Protection Regulation 2016/679.

The Data Protection Officer for the University of Sussex is Alexandra Elliott, Head of Information Management and Compliance. If you have any queries concerning your personal data and how it is processed, you can contact the Data Protection Officer at dpo@sussex.ac.uk.

The basis for processing your personal data

We process personal information to enable us to improve access and participation in Higher Education. Our activities are focused on ensuring that there are equal opportunities for individuals to access and succeed in Higher Education, including the degree outcomes that students achieve and their success in employment.

The University has a duty to improve the equality of opportunity for groups that are usually underrepresented in Higher Education and our Access and Participation Plan document details how we will support those individuals to access, succeed in and progress from Higher Education. To provide our activities we need to use the personal information of individuals in underrepresented groups, and we also need to use personal information for those individuals alongside all of our students to measure the success of our activities. The data relates to all stages of their journey and can include data before and after their time at university.

When we process personal data, there needs to be a legal basis for doing so and, if we process special categories of data, we need to meet additional conditions too. More information about legal basis and special categories data can be found on the University’s data protection webpages.

The University will be processing your personal data on the basis of our legal obligation to improve equality of opportunity in access to and success in Higher Education. We also process personal data where we consider there is a legitimate interest, of the University or another party, to do so but only where those interests are not overridden by your rights. Sometimes we will process your personal data on the basis of your consent.

Where we process special categories of data, such as ethnicity, gender identity, or health related information, including disability, it is necessary for reasons of substantial public interest related to equality of opportunity or because we have your consent to do so.

Personal data we collect about you and how we use it

We will collect the following personal data about you:

  • name
  • date of birth
  • contact details, postal address, including your postcode, email and mobile number
  • your school name and school year, subjects and qualifications
  • demographic information (including gender identity, ethnicity, health related information, including disability)
  • widening participation data (including care experience, if you are a young carer, estranged status, free school meal / pupil premium eligibility, service personnel status, eligibility for college/school bursary, refugee/asylum seeker status)
  • some personal data related to your parent/guardian/carer (including their name and email and mobile number).

Where special category data is collected, such as ethnicity, gender identity, or health related information, including disability, it is processed for statistical, reporting, and sometimes for event management purposes only. All reporting is pseudonymised and personal data enabling you to be identified is not included in any reports we produce. We occasionally also collect information on dietary and accessibility requirements for a limited range of purposes and only where necessary. Due to the sensitive and impactful nature of these categories of data, we will have additional security measures in place to keep it safe. We will take steps to stop this data being lost, stolen or disclosed inappropriately, and we will make sure that the correct controls are in place before we start to process the data.

The University of Sussex aims to provide a safe and enjoyable experience for every child or young person. The National Society for the Prevention of Cruelty to Children (NSPCC) recommends that it is a good practice to have a parental consent when enrolling children in one of our settings, so we have relevant information for each applicant. For this reason, we collect some personal data related to parents/guardians/carers limited to their name and contact details. If they prefer not to share their details with us, there will be a clear and easy option to opt out.

We will use the personal data in the following ways:

  • determining eligibility to participate in programmes
  • monitoring participation in events
  • recording data on the Higher Education Access Tracker database
  • tracking student access to, success in, and progress after higher education
  • ensuring the safety and wellbeing of participants on our programmes
  • evaluating the impact of Widening Participation programmes
  • for reporting and evaluation purposes.

For more general information about how we use personal data at the University, see our privacy notice.

Disclosure of personal data

We usually only disclose your personal data to a third party when we are required to by law or where we have your specific consent.

We often work with third parties to support our access and participation activities and we will disclose your personal data to them where it is necessary and where we have appropriate arrangements in place with regard to data sharing, including the security of your data. Third parties might include Regulatory bodies, Universities and College Admissions Service, Partner Schools and Colleges and online activity platforms such as Unibuddy.

We will also share personal data with the Higher Education Access Tracker (HEAT). HEAT is a nationwide database used by universities to monitor the effectiveness of their Widening Participation and Outreach programmes. Details of how HEAT processes your personal data and for what purposes, and your rights in relation to your personal data can be found in the relevant HEAT notices.

When you participate in programmes designed to widen participation in higher education, your Higher Education Statistics Agency (HESA) information may be linked to data held by these programmes for research purposes. For more information on how HESA information is linked to other data sources to enable more detailed research and analysis, please see HESA’s Data Protection Collection notices.

Retention of personal data

The University will only keep your personal data for as long as is necessary for the purpose for which it is processed. We will retain your data that we collect for the duration of three years to cover the current and two previous academic years. Personal data during your University course is processed and stored in line with the University’s Records Management Policy and the associated Master Records Retention Schedule, which sets out how long different categories of student data should be held by the University.

The data that we use to monitor and evaluate our performance against our Access and Participation Plan is anonymous in such a manner that you are not or no longer identifiable. However, information about how long data is held on you by HEAT can be found in their Data Privacy information.

Your rights including access to your data

You have a number of rights under the data protection legislation, including the right:

  • to rectify inaccuracies in personal data that we hold about you
  • to be forgotten in some circumstances, that is your details to be removed from systems that we use to process your personal data
  • to restrict the processing of your personal data in certain ways
  • to obtain a copy of your data in a commonly used electronic form
  • to withdraw consent where that is the legal basis of our processing and
  • to object to certain processing of your personal data by us.

Further information about your rights can be found on the ICO’s website. You may also contact the Data Protection Officer for further information.

You also have the right to ask to see what personal data we hold about you, known as a subject access request. For more information, refer to our data protection pages for guidance on how to submit subject access requests.

You have a right to complain to the ICO about the way in which we process your personal data. Find more information on how to report concerns to the ICO.

How to contact us

If you have any questions about this privacy notice or the information we hold about you, you can contact the University’s Data Protection Officer by email at dpo@sussex.ac.uk or you can write to Alexandra Elliott, Data Protection Officer, University of Sussex, Sussex House, Falmer, Brighton, BN1 9RH.

You can also find more information about data protection.

We keep our privacy notice under regular review and the notice was last updated on 6 September 2023.