Student Privacy Notice About

Whilst you are a student at London Metropolitan University and after you leave and become an alumnus/a, the University needs to collect, store, use and disclose certain data about you. We require this information for our normal business purposes, including providing you with teaching and administrative support.

The UK General Data Protection Regulations (“UK GDPR”) sets out requirements for when and how the University can process personal data about you, which we must comply with by law. The legal basis for processing this information falls under Article 6(1)(e) of UK GDPR – “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”. Where we process special category personal data about you, we will seek your explicit consent. However, there will be some circumstances where consent is not appropriate. In those circumstances, we will process this data as detailed in the table under 'How we use your data'.

The principles of the UK GDPR state that personal information must be:

• Processed lawfully, fairly and in a transparent manner.
• Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
• Accurate and, where necessary, kept up-to-date, every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
• Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
• Processed in a manner that ensures appropriate security for the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

As a data controller, the University shall be responsible for, and be able to demonstrate compliance with, the above principles.
This statement explains in general terms what information we collect about you, how that data will be used and to whom it will be disclosed. It is not exhaustive, as it is not possible to describe all the ways in which the personal data of students is used by the University. If you have any queries about how we process your personal data, please contact the Data Protection Officer (see ‘Further information’).

The information held by the University is that provided by you on application and enrolment. Further information will also be collected throughout the duration of your attendance at London Metropolitan University. 

The type of information the University may hold about you includes (but is not limited to):

• Your name
• Your contact details
• Details of your emergency contacts
• Your date of birth
• Your nationality
• Your ethnic origins
• Your academic background and qualifications
• Your academic record while at London Metropolitan University, including details of any degrees which you are awarded
• Any disabilities that you have disclosed to us
• Medical information, such as information held by the counselling service
• Fee information and sponsorship details
• Your use of University facilities, such as the Library
• Any disciplinary action taken against you
• A digital photograph of you, which is used to produce your student ID and for security and identification purposes

By enrolling as a student at London Metropolitan University you consent to the University collecting, storing, using and processing data about you for any purpose connected with your studies at the University. We will only use your data fairly and lawfully in accordance with our responsibilities under the UK General Data Protection Regulations.

We will process criminal convictions data where it goes to fitness to practice requirements on certain regulated courses, or where you are working with children or vulnerable adults. You will be notified before the processing if this a requirement for enrolment on your course. 

The legal basis for the processing is set out below:

• Regulatory requirements relating to unlawful acts or dishonesty
• Safeguarding of children and of individuals at risk
• Preventing or detecting unlawful acts

Further details on criminal convictions is available on our website.

London Metropolitan University will only share information about you with your consent, or where disclosure without your consent is required or permitted by law. The University may share your personal data with the following third parties:

• The Higher Education Statistics Agency (HESA)
• The Office for Students, or parties acting on its behalf (for example, Ipsos MORI conducting the National Student Survey)
• Student Loans Company
• London Met Students' Union (LMSU) – the University will share the personal data of those students who have not opted out, for the purposes connected with your membership of LMSU via the SU data sharing agreement
• UK Visas and Immigration (UKVI)
• Local Authorities – in relation to Council Tax exemptions and maintaining the electoral roll
• Regulators – where students/graduates have studied on a regulated course
• External examiners
• The police (and/or other law enforcement agencies)
• Sponsors and funding bodies
• Collaborative partners
• Potential employers and other educational institutions

Only members of staff who need access to relevant parts your data will be authorised to do so. Information about you in electronic form will be subject to password and other appropriate and proportionate security restrictions, while paper files will be stored in secure areas. Personal data is retained for no longer than necessary. Details of how long the University retain your personal data for, can be found in our records retention schedule.

After you leave, the University will continue to hold data about you in electronic and paper form, for a range of purposes including statistics, audit, legal and regulatory requirements and to maintain a permanent record of your achievement.

Graduates automatically become members of London Metropolitan Alumni Association. We maintain a list of all graduates, as it is in the legitimate interests of the University and for historical and archival purposes.

If you consent, the university will maintain contact with you and will provide you from time to time with information which we consider to be relevant to alumni, such as newsletters, events, alumni activities and information about fundraising campaigns. You can withdraw your consent at any time: to do so, please contact alumni@londonmet.ac.uk.

The University's Careers and Employability Services are available to students for three years after graduation and will maintain contact to support recent graduates. If you no longer wish to be contacted or supported by the service, please contact them via their webpage. 

Under data protection legislation you have the following rights;

• Right of access to personal data held by us about you
• Right to rectification, to require us to rectify any inaccurate personal data we hold about you
• Right to erasure, to request we erase personal data we hold about you. This right only applies in certain circumstances, for example if we no longer need the personal data for the purpose we collected it
• Right to restrict processing of your personal data. This right only applies in certain circumstances, for example if you dispute the accuracy of the data we hold
• Right to data portability
• Right to object to the processing of your personal data

Under UK GDPR you are entitled to request a copy of the personal data we hold on you. This involves completing our subject access request form, and sending it to the Information Compliance Manager with proof of ID. 

If you wish to make a subject access request for your personal data, please refer to the information on our subject access page.

If you require further information on how London Metropolitan University handles student data, please contact the Data Protection Officer at the following address: 

Data Protection Officer
Legal Services
London Metropolitan University
166-220 Holloway Road London
N7 8DB 

Email: dsar@londonmet.ac.uk