Student Privacy Notice

This Privacy Notice outlines how Canterbury Christ Church University (the Data Controller) collects, uses, and protects personal data in relation to individuals who apply, enrol or register to study at the University. It applies to prospective students, current students, postgraduate, research students, apprentices and students on short courses.

We are committed to handling your personal data responsibly and transparently, in accordance with the Data Protection Act 2018 and UK General Data Protection Regulations (GDPR) and any other relevant legislation. This notice is intended to ensure you are fully informed about how your personal information is used and the rights you have in relation to it.

You can access our Data Protection Policy here.

What personal information do we collect about you?

When you engage with the University in relation to studying with us, including through UCAS, we collect and retain relevant personal data. This information is used for the purposes set out in Section 3 of this Privacy Notice.

We may process the following categories of personal data about you:

Your name, address and contact details, including email address and telephone number, date of birth and gender
The terms and conditions of any courses you enter with the University
Details of your qualifications, including information provided on any applications made to the University
Information about your marital status, next of kin and trusted contacts
Information about your nationality
Record of course attendance, including sickness absence and other reasons for leave
Details of any disciplinary or grievance proceedings in which you have been involved, including any warnings issued to you and related correspondence
Assessments of your performance, improvement plans and related correspondence
Details of accidents, incidents and near misses, related to University activities, that you have either reported of have been involved in
Equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief
Any disability/access requirements or medical issues
Any information you provide to access specialist support/services
Bank details and/or payment card details
Visual images/photographs
Computing and email information including login details, network access and library usage
Passport number and details of travel undertaken with the University whilst on your course
For international students, we may collect additional information on visa details and date of entry to the UK and/or government issued identification numbers
A record of reports of any personal relationships you may have with staff at the University

In some circumstances, we may also hold information relating to criminal offences where it is a requirement of a course you have undertaken. You can find more information about how we process this data in the Use of Special Category Data in our Students Privacy Notice.

We may contact you about your studies or for administration and support purposes. It could be by e-mail, letter, Blackboard, Teams or telephone.

How do we collect your information?

The University may collect your personal data through a range of methods and sources, depending on your relationship with us and the nature of our interaction. We may collect your personal information:

Directly from you – for example

You may give us information about “special categories” of data, including your racial or ethnic origin, religious beliefs, physical or mental health, or sexual orientation
You might have to give us information about any criminal convictions. You must provide it if you are on a course that requires placements where there are vulnerable groups or leads to professional registration
You will give us further personal information when you use our services, for example, the library, IT, support and disability services, the bookshop, the Chaplaincy and career development
We may collect bank and credit card information for payments of fees and accommodation charges. We also collect bank account information to pay bursaries and student travel expenses

Through automated technologies – for example

We automatically collect information about your participation in learning and assessment activities and your use of the virtual learning environment (Blackboard) and the library. We automatically collect information about assessment activities such as coursework and examinations.
We will also add to your record any activities you conduct on our website. We may automatically collect technical information when you browse our websites. We give further details about this in our Privacy and Cookies Policy.
Should you use your University e-mail address and other Microsoft Office 365 services, we will collect data about your use of the service.

From third parties – for example

We receive information from UCAS (Universities and Colleges Admissions Service) who collect your personal data to manage and support your application to higher education.
We may also contact the Higher Education Statistics Agency (HESA) or other educational institutions to confirm qualifications you obtained.
Should you have your fees paid by loan through the Student Loan Company (SLC), another funding authority or government agency, such as a loan or grant, we will receive information from the funding provider. If another organisation pays your fees, this organisation may provide some information about you to us.
Should part of your studies require you to undertake a placement, we will process the information we receive from the placement provider.
If you are studying and registered with a collaborative partner institution, we may receive information about you from our partner.
We may also enhance our records with third-party data if you are not currently studying. This is to ensure we have up to date contact details for you and offer you relevant communications.
When we obtain personal data about you from a third party source, we ensure the third party has a lawful basis to provide us with the data.

How do we use your personal data?

We collect and process a broad range of your personal data to deliver our services and support you. We use this personal data to manage our operations effectively, and to meet our legal obligations.

The purposes for which we may use personal data (including special category personal data) we collect include:

Administration matters including:

recruitment and admissions
arranging for the issue of a CAS for students applying for a student (formerly Tier 4) visa and communicating with the UKVI over immigration status
providing library, IT and information services
monitor attendance to ensure engagement and assist with international student visas
record educational activities. We make the recording for the legitimate purpose of providing online access to lecture content to deliver a learning experience for our students. You can opt out and request an edit of recordings. Except in agreed exceptional circumstances, we do not permit students to record educational activities other than for personal study purposes.

Academic matters, including:

the provision of our core teaching, learning and research services (e.g., registration, assessment, attendance, managing progress, academic misconduct investigations, certification, graduation)
maintaining student records

Providing professional support services, including:

providing student support services (e.g. through personal tutors and Schools, Disability and Additional Learning Support, Career Development, Student Wellbeing)
improving our offer of education
monitoring equal opportunities
safeguarding and promoting the welfare of students
ensuring students’ safety and security, including recording and reporting accidents, incidents and near misses
managing student accommodation
managing the use of social media
managing car parking on campus
administering the financial aspects of a student registration (e.g. fees, rents, debt collection, scholarships and bursaries), including assessing eligibility for bursaries and scholarships
dealing with enquiries and complaints
organising and maintaining placements as part of your studies
dealing with disciplinary actions
conducting research and statistical analysis to improve our efficiency and effectiveness as a higher education provider
conducting audits (e.g., to ensure compliance with our regulatory and legal obligations)
providing operational information (e.g., providing IT support, information about building and campus closures, access restrictions on campus, securing and promoting health and safety)
promoting our services (e.g. student exchanges or other events happening on and off campus)
preventing and detecting crime
managing health and safety
organising graduation ceremonies
booking travel and making travel arrangements

The lawful basis we use to process your data

Data protection law sets out reasons for collecting and processing your personal data. In this section, we outline the legal bases the University uses.

We will be processing your data under:

Article 6(1)(a) Consent "the data subject has given consent to the processing of his or her personal data for one or more specific purposes"

We might collect and process your data with your consent in specific situations. We will need to process your personal data under this lawful basis for the following reasons:

Offering and providing additional support services such as career advice, counselling services, financial advice and access to sporting activities. The University will seek specific consent where sensitive personal data needs to be obtained to provide a service.
Administration of external and internal student surveys, including the collection of feedback on distinct services such as Library, Learning Skills and Careers.
Administration of exceptional circumstances applications.

You may withdraw your consent at any time. You need not give a reason.

Article 6(1)(b) Contract "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract"

When you become a student at the University, you enter into a contract with us so that we can provide you with an education. This also apples if you live in our residential accommodation as by doing so, you are also entering into a contract with us so that we can provide you with accommodation. This will also apply if you are employed through UNITEMPS.

Article 6(1)(e) Public Task "processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller"

We may need to process your data where we are required to perform a task in the public interest or for our official functions. We will need to process your personal data under this lawful basis for the following reasons:

Processing applications for study and enrolment that includes the processing of criminal convictions data and DBS checks. This is done for the safeguarding of vulnerable groups.
The provision of immigration welfare services for international students including applications for visa extensions.
To award qualifications and ensure we maintain academic standards.
Administration of financial awards and prizes such as scholarships, bursaries and grants, including those provided by third parties.
Administration of induction events, registration of students on courses and transfers to new courses. This may include special category data where necessary.
Digital Learning Capture (DLC) of lectures to support the inclusive curriculum approach that seeks to make learning resources available to all students.
Providing facilities and services central to studies such as library and computing access.
Production, administration and issue of student identification cards used for purchasing goods and services which includes the monitoring of usage for the purpose of registering students and providing benefits relating to the use of cards.
Monitoring student attendance and engagement with course material available on the VLE.
Recording and monitoring actions provided to students to support engagement with their studies, welfare and wellbeing.
Research and statistical analysis into Learner Analytics.
Evaluation of academic assessments and coursework.
The making of academic awards for example by inclusion in the Higher Education Achievement Report.
Administration of student academic appeals, complaints, disciplinary and sexual misconducts including requests for information from the Office of the Adjudicator (OIA) should the student complain to this service.

Article 6(1) (f) Legitimate Interests "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child"

In specific situations, we require your data to pursue our legitimate interests in a way that it is reasonable to expect as part of running the University. We do this in a way that does not materially affect your rights, freedom or interests.

We may need to process your personal data under this lawful basis for the following reasons:

Maintaining contact with former students through our alumni relations.
The University works with system vendors, external software houses and external consultancy firms (our partners) to diagnose system issues and enhance system provision. Wherever possible, we will do this work using anonymised data however, some types of work require using actual data. Therefore, there are occasions when we will provide our external partners with access to your data. Where this is the case, we require the external partner to take appropriate measures to protect your personal data.

We may need to process your data in order to ensure we are complying with our statutory obligations and legal requirements.

Article 6(1)(c) Legal obligation "processing is necessary for compliance with a legal obligation to which the controller is subject"

We will need to process your personal data under this lawful basis for the following reasons:

Monitoring to ensure we meet our statutory obligations, including those related to diversity, equal opportunities and health and safety.
The assessment and provision of support services to students including the provision of disability support services and, learning and research support skills services.
Compliance with law enforcement and regulatory bodies such as passing on details of those involved in fraud or criminal activity.
The evaluation of academic assessments and coursework where the University has a legal obligation under the Office for Students Requirements relating to entry on the Register of HEI Providers.
Provide data for surveys, including the National Student Survey (NSS) and the Destinations of Leavers from Higher Education (DHLE).
The making of academic awards such as inclusion in the Higher Education Achievement Report
Processing support and welfare concerns to ensure the wellbeing, safety and safeguarding of students.
The administration of student academic appeals, complaints, disciplinary and sexual misconduct, including responding to requests for information from the Office of the Independent Adjudicator (OIA) should the student complain to this service.
Recording and reporting accidents, incidents and near misses where there is a legal obligation.
The use of CCTV within University grounds to provide a safe University environment and to facilitate the prevention and detection of crime.

We may need to process your personal data to protect your vital interests or those of another individual.

Article 6(1)(d) Vital Interests "processing is necessary in order to protect the vital interests of the data subject or of another natural person"

It will take place only where we cannot process your data on another legal basis.

Where we process Special Category Data, we will do so under the following legal basis:

Article 9(2)(a) Explicit consent
Article 9(2)(g) Reasons of substantial public interest (with a basis in law)

Where we process Criminal Offence Data, we will rely on:

Article 10 Authorised by domestic law providing for appropriate safeguards for the rights and freedoms of data subjects

We have an appropriate Policy document in place which records our processing in relation to Special Category Data and Criminal Offence Data.

Who do we share your personal data with

We may share your personal data with trusted third-party service providers who act as data processors on our behalf. These partners are:

Students Union (CCSU)
Higher Education Statistics Agency (HESA)
Office for Students (OfS)
Student Loans Company (SLC)
Student Finance England (SFE)
A relevant professional or statutory body (e.g.,Health & Care Professions Council, General Medical Council, British Psychological Society)
A collaborative partner institution
Police or other authority to comply with any legal obligation.
Third parties involved in graduation ceremonies
Third parties for debt collection purposes
Third parties for the booking of travel

All third parties are required to handle your data securely and in accordance with data protection legislation.

We may also disclose your personal data where necessary to meet our legal or statutory obligations under the Data Protection Act 2018 and UK GDPR. This may include sharing information with government departments, regulatory bodies, funding agencies, or law enforcement authorities where disclosure is legally required.

Whoever we share your information with, we will only share what is relevant and necessary to perform the specific task or to meet our legal obligations.

How long do we keep your personal data

We retain personal data only for as long as is necessary to fulfil the purposes set out in this Privacy Notice, including to satisfy legal, regulatory, and contractual obligations. This includes our obligations under the Data Protection Act 2018, UK GDPR and other relevant legislation.

How long we keep your personal information depends on our purpose for using the information and our legal obligations.

We have a retention schedule for information and keep identifiable records only for as long as they have a legal or business purpose.

When identifiable records are no longer required for the purposes set out in this Privacy Notice, they are either anonymised or securely disposed of according to our Confidential Waste Policy.

How do we protect and store your personal information

We are committed to safeguarding the personal data we process and have robust internal policies and controls to prevent unauthorised access, accidental loss, destruction, misuse, or disclosure of personal data. Access to personal information is strictly limited to authorised University personnel who require it for the performance of their duties.

The Strategic Information Technology System (SITS), is the student record keeping system used at the University and contains data for current and former students. SITS is where we create and maintain student Records. Students who started a course prior to 2022 will also have data stored on Agresso QL Students, known as QL. This is the student records system used prior to SITS and contains student data for students prior to 2022.

We are Cyber Essentials accredited, demonstrating our commitment to implementing industry-recognised cybersecurity practices to protect against common online threats and ensure a secure IT environment.

Where personal data is shared with third-party processors, such parties are contractually required to act solely on our instructions, implement appropriate technical and organisational safeguards, and comply fully with the requirements of the Data Protection Act 2018 and UK GDPR.

The data controller and further information

Canterbury Christ Church University is the Data Controller for this personal data. Please click the link below to access further information regarding:

Version control

Title: Student Privacy Notice
Process Owner: Head of Data Protection
Department responsible: Governance & Legal Services
Date approved: 24 July 2025
Date of review: 24 July 2027
Date last amended: 24 July 2025

Return to

Privacy Notices

In this section

Downloads

Student-Privacy-Notice-2025_Who-is-my-data-shared-with

184.9 KB

Retention-Schedule-Nov-2023

330.5 KB