The Privacy Notice for Students should be read in conjunction with the overall Privacy Notice available here.
This section of the Privacy Notice applies to the individuals who are enrolled as a student at the University. It applies to students throughout a period of study, where it leads to an award of any kind or the gaining of credit from the University of Stirling (either singly or in collaboration with a partner organisation), regardless of their location of study.
The University requires to process and retain certain personal data relating to you, by virtue of your being a student of the University.
The personal data the University holds about you is obtained from a number of sources, including the following:
A full description of the categories of personal data that we process about you can be found in Record of Processing Activities – Student Data. Examples are name, gender, date of birth, contact details, education and training, student ID number, and some information about your personal circumstances such as whether or not you have dependents and your racial or ethnic origin.
The University requires to process the personal data it collects about you for the purposes delivering a relevant educational programme of study to you, any other service you receive from us and to allow us to execute all the administrative and ancillary tasks relevant to our service delivery. A full list of the purposes for which we process your personal data can be found in Record of Processing Activities – Student Data. Examples include:
The law provides a number of basis on which Data Controllers such as the University can legitimise its processing activities. Given the breadth and depth of matters for which the University requires to process your personal data in order to provide you with the relevant educational programme or other service, the University legitimises its processing activities on a variety of lawful basis. We have set out in our Legal Justification for Processing Student Records how we legitimise each processing activity. However the majority of our processing activities in relation to your personal data will be on the following grounds:
To fulfil the Student Contract
If you choose to accept an offer to become a student of the University you are required to accept our student terms and conditions and this acceptance results in a contract being formed between you and the University. Once you are a student we process your personal data where this is necessary for the performance of the student contract between you and the University. Examples include processing personal data to deliver the educational programme to you, dealing with absence management and disciplinary actions, providing you with student accommodation and administering the financial aspects of studying e.g. payment of fees, grants, loans etc. If you do not provide us with this information and allow us to process it as envisaged in this document, we may not be able to deliver the requested service to you.
Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of our official authority
The University’s Charter and Statutes give the University official authority to carryout out certain functions required to operate as a University. This includes functions related to teaching, examining and the promotion of research. The Charter details some specific powers in relation to students such as the granting of awards, holding examinations, disciplining students, providing accommodation, awarding scholarships, receiving fees and collaborating with other institutions. Along with the contract you have with the University mentioned in the paragraph above, the University will rely on this basis for the majority of the processing it does of your personal data.
Compliance with a Legal Obligation
Sometimes we need to process your personal data to comply with a legal obligation on us. An example of this is in relation to the management of information relating to use of the Students’ Union under the Education Act 1994 or monitoring compliance with equality legislation under the Equality Act 2010.
There may be circumstances where we may not be able to legitimise the processing of your personal data unless we have your consent. Consent will be sought as and when required. You have the right to withdraw consent at any time without prejudice to your status within the University. Please note that if you do withdraw consent, this will not affect the lawfulness of processing based on your consent before your withdrawal.
The main bodies to which the University discloses student personal data are detailed under the ‘Categories of Recipients’ section of the Record of Processing Activities – Student Data. By way of summary, the main categories of bodies that we may disclose your personal data to are:-
When we share your personal data with a third party as set out above or as referred to within our Record of Processing Activities – Student Data, in some cases, in particular to our use of Cloud based facilities including Box or in relation to overseas exchanges, these may involve a transfer of personal data to a recipient outside of the European Economic Area and located within a country that may not be viewed as having adequate data protection laws by the European Commission. When doing all international transfers we will make sure that appropriate safeguards are in place to protect your information and your rights under privacy law and apply the same high standards of privacy and security wherever we process your data.
Once you become an enrolled student, the University will retain your personal data in line with our data retention schedules relating to student data. Where an item of your data no longer requires to be retained, we shall securely remove it from our systems. Please note that if you enroll as a student of the University, some items of your personal data will be retained on a permanent basis. This is in order to ensure that the University can maintain an appropriate permanent archive of degrees and credit awarded and provide services to graduates/former students such as for replacement degree certificates.
If you are a student and would like to update your contact details this can be done via the Student Portal.
If you want further information about how your personal information is used or would like to request to correct, restrict or erase personal details should be reported to: