General Privacy Notice and Copyright Statement

When we process your personal data, we need to have a lawful basis to do so. A lawful basis is a reason in law that permits us to use your data for a specific purpose. The lawful basis we use depends on what we are doing with your data (our purpose for having it).  We have summarised our key lawful basis and our purpose for having your data below. 

In order to protect your data, we ensure that there are appropriate technical and organisational controls in place on all of our systems and continuously review these controls to ensure they are effective. Examples of our controls include:

Technical measures such as role based access contorls, encryption, password protection, antivirus and antimalware mechanisms and intrusion detection systems.

Organisational measures including robust policies, documented processes, staff training, and managing access to data.

Wherever possible, we will store personal data within the UK or in a data centre located within the European Union or European Economic Area. In some cases, we may use suppliers who run their operations outside the European Economic Area (EEA). Although they may not be subject to same data protection laws as companies based in the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law. The steps we take will depend on the type of data and the location of the supplier however, some of our measures include a robust due diligenceprocess, technical measures to protect your data and contractual measures that require our suppliers to treat your data securely and in a way that maintains confidentiality.  

Some of our legal and regulatory obligations require us to disclose data about you to third parties. Each disclosure request will be considered carefully, and we will only disclose the minimum amount of personal data required to meet our obligations. The following organisations will receive information about you if a valid request is received or if we are legally required to provide it.

• The police and law enforcement agencies for the prevention and detection of crime
• Regulatory bodies including the Office for Students, the General Medical Council and the Disclosure & Barring Service.
• Statistical agencies including HESA.
• Examination and Assessment Boards.
• Student Finance England.
• The Home Office and UK Visas and Immigration.
• The Department of Work and Pensions.
• The Health & Safety Executive.
• Trade Unions including the UCU, UNISON, UNITE and the GMB.  
• Pensions Providers.
• Occupational Health Providers.
• Public Heath England.

How long we keep your data depends on what we have collected it for and whether there is a law that sets a minimum legal retention period. We have a dedicated retention schedule that sets out how long we keep personal data. You can obtain a copy of our retention schedule by emailing recordsmanagement@brunel.ac.uk.

For applicants who decide not to study with us, we will keep your enquiry details on file one year after your specified year of entry expires.

You can update, cleanse or delete your own data via our enquiry platform, to ensure we have accurate contact details for you. If and when you apply to Brunel University London, your enquiry details will be overwritten by your application details.

To understand who is applying to our courses we will segment the information we hold about student applicants based on demographics and interests. Such data will be de-identified and used for statistical and analytical purposes only.  Analysis of this helps us understand our enquiries and ensure we tailor our courses to meet the latest needs and expectations of learners who want to study with us.

When you use our website, we will seek your consent to place analytics cookies on your computer. These cookies will give us information about the parts of the website you visit and how you interact with our pages. If you do not want us to place analytics cookies on your computer, please select “Use Necessary Cookies only” when prompted by the cookie banner at the bottom of a webpage. For more information about how we use cookies, please read our cookies policy. 

When we send prospective applicants, or alumni electronic direct marketing, we must comply with the legislation called the Privacy & Electronic Communications Regulations 2003. This law sets rules that we have to follow to make sure that our electronic marketing is fair and respects peoples’ privacy.  It is always the choice of the individual as to whether they want to receive information about studying at Brunel, our events and the ways people can get involved. We will always ask if you want to hear from us with these communications. If you do not want us to use your personal information in these ways, please indicate your preferences on the form on which we collect your data. You can also opt out of our marketing communications at any time by clicking the ‘unsubscribe’ link at the end of any of our marketing emails. You can also change any of your contact preferences at any time or you can opt-out of your data being utilised via the enquiry platform after you log in. Finally, you can withdraw your consent to receive direct marketing by emailing data-protection@brunel.ac.uk.

We will not use your personal information for marketing purposes if you have indicated that you do not wish to be contacted by us for such purposes when you enquire to study at Brunel. However, once you apply to study at Brunel, we will contact you about your application and about life at Brunel. This is not considered direct marketing and we need to send you this information as part of a contract between us.  

In the UK everyone has rights about how their personal data is managed. The rights are:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling.

You can make an information rights request at any time by contacting our data protection team via email: data-protection@brunel.ac.uk

or by post: Data Protection Officer, Brunel University London, Kingston Lane, Uxbridge, UB8 3PH.

There is no charge to submit a rights request, but we may ask you to verify your identity. We may also communicate with you to determine the scope of your request. 

In most cases we have one calendar month to respond to your request when we have verified your identity. Where a request is complex, we are permitted to extend that deadline by a further two months, but we will write to you and let you know ahead of the deadline if we need to do this.