Student Survey Privacy Notice

This Privacy Notice outlines how Canterbury Christ Church University (the Data Controller) collects, uses, and protects personal data in relation to surveys carried out with a focus on the student experience. It applies to all students who take part in student surveys.

We are committed to handling your personal data responsibly and transparently, in accordance with the Data Protection Act 2018 and UK General Data Protection Regulations (GDPR) and any other relevant legislation. This notice is intended to ensure you are fully informed about how your personal information is used and the rights you have in relation to it.

You can access our Data Protection Policy here.

1. What personal information do we collect about you?

When you engage with the University in relation to student surveys, we collect and retain relevant personal data. This information is used for the purposes set out in Section 3 of this Privacy Notice.

We may process the following categories of personal data about you:

Information on your behaviours and attitudes as requested within the questionnaire or supporting interview for the purposes of gathering insight and monitoring trends.

Gender

Ethnic and geodemographic information

Information on studies and course participation.

Event attendance and opinions held by you.

Data collected may include numerical, written, audio, audio visual, imagery and observation data.

This includes all survey respondents, and individuals contacted to be invited to take part in surveys irrespective of whether research was subsequently carried out.

2. How do we collect your information?

The University may collect your personal data through a range of methods and sources, depending on your relationship with us and the nature of our interaction. We may collect your personal information:

Directly from you – when you fill in surveys or attend interviews as part of the surveys.

3. How do we use your personal data?

The University may process your personal data for the following purposes:

To enable the University to deliver Higher Education more efficiently and effectively.

To improve the quality of the University’s services and facilities.

To comply with statutory and regulatory requirements, including those under the Data Protection Act 2018 and UK GDPR.

4. The lawful basis we use to process your data

Data protection law sets out reasons for collecting and processing your personal data. In this section, we outline the legal bases the University uses.

We will be processing your data under:

Article 6(1)(a) Consent "the data subject has given consent to the processing of his or her personal data for one or more specific purposes"

We may process your data under this lawful basis when you are invited to take part in student surveys and any further interviews. You may withdraw your consent at any time. You need not give a reason. To withdraw your consent, contact: studentsurveyunit@canterbury.ac.uk.

Article 6(1) (f) Legitimate Interests "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child"

We may process your personal data under this legal basis to enable us to deliver Higher Education more efficiently and effectively and to meet our obligations to students, staff and other parties; and to help improve the quality of the University’s services and facilities. We will use this legal basis for the following surveys:

Postgraduate Taught Experience Survey (PTES) for postgraduate taught students

Postgraduate Research Experience Survey (PRES) for postgraduate research students

UK Engagement Survey (UKES) for non-final year undergraduates

We may need to process your data in order to ensure we are complying with our statutory obligations and legal requirements.

Article 6(1)(c) Legal obligation "processing is necessary for compliance with a legal obligation to which the controller is subject"

We will use this legal basis to process your personal data in order to ensure we are complying with relevant laws and legislation. We will need to process your personal data under this legal basis for the following surveys:

Carrying out the National Student Survey (NSS)

Carrying out the Graduate Outcomes survey; part of HESA/Jisc

Where we process Special Category Data, we will do so under the following legal basis:

Article 9(2)(j) Archiving, research and statistics (with a basis in law)

We have an Appropriate Policy Document in place which records our processing in relation to Special Category Data and Criminal Offence Data. If you are a student, you may access the document here.

5. Who do we share your personal data with

We may share your personal data with trusted third-party service providers who act as data processors on our behalf. These partners are JISC, HESA, IPSOS, the Office for Students (OfS) and CACI Ltd. who support with the administration, operation and analysis of the surveys, such as collecting and holding survey responses in an online platform. All third parties are required to handle your data securely and in accordance with data protection legislation.

We may also disclose your personal data where necessary to meet our legal or statutory obligations under the Data Protection Act 2018 and UK GDPR. This may include sharing information with government departments, regulatory bodies, funding agencies, or law enforcement authorities where disclosure is legally required.

Whoever we share your information with, we will only share what is relevant and necessary to perform the specific task or to meet our legal obligations.

6. How long do we keep your personal data

We retain personal data only for as long as is necessary to fulfil the purposes set out in this Privacy Notice, including to satisfy legal, regulatory, and contractual obligations. This includes our obligations under the Data Protection Act 2018 and UK GDPR.

In relation to survey data collected for the historical time series, we retain personal data for up to 10 years to enable appropriate statistical and historical analysis as the need arises. Personal data collected for one off research projects is to remove and destroy all personal identifiers from data sets so that all remaining information is anonymised within 12 months of the close of field work.

When identifiable records are no longer required for the purposes set out in this Privacy Notice, they are either anonymised or securely disposed of according to our Confidential Waste Policy.

7. How do we protect and store your personal information

We are committed to safeguarding the personal data we process and have robust internal policies and controls to prevent unauthorised access, accidental loss, destruction, misuse, or disclosure of personal data. Access to personal information is strictly limited to authorised University personnel who require it for the performance of their duties in connection with the administration and management of student surveys.

Where personal data is shared with third-party processors, such parties are contractually required to act solely on our instructions, implement appropriate technical and organisational safeguards, and comply fully with the requirements of the Data Protection Act 2018 and UK GDPR.