Privacy Notice for Applicants, Students and Alumni

Introduction

1. This privacy notice applies to registered students, learners, former students, alumni and applicants in any of the educational programs or services at Northeastern University London (the University). It explains how the University processes your personal data. This notice does not form part of any contract.
2. The University may update its Privacy Notices at any time; please check back here regularly to review any changes.
3. The University holds a range of personal data about you. Most of this data is supplied directly by the applicant or student, and some of which is received from third parties.
4. Here are some examples of types of personal data the University holds:
   1. personal details such as name and title
   2. your contact details such as address, telephone number, email address
   3. country of nationality and domicile
   4. prior educational experience and attainment (with the University or with other schools)
   5. immigration information (such as passport details and language proficiency)
   6. health information (including any disabilities), information required to make reasonable adjustments 
   7.  equalities monitoring data, such as gender, religion, ethnicity, or sexual orientation that you provide to us
   8. materials submitted in support of your application, including essays, transcripts, references, or other supporting data
   9. financial information concerning the funding of your chosen course or program
5. In addition, if you come to study at the University, data stored and processed by the University will likely include:
   1. academic performance including grades, tests or quizzes, essays, or other materials submitted as part of a course
   2. attendance and progression in a course or program
   3. if relevant, breaches of the University’s policies or applicable law, to include data about the investigation, adjudication, and resolution of any disciplinary proceeding or alleged violation of law. 
   4. financial aid, invoicing, banking and payment information
   5. information concerning any alleged or actual academic misconduct or your conduct generally 
   6. appearance, voice and distinguishing features through filming video and photograph
   7. emergency contact or next of kin information that you provide
   8. references on your academic performance
6. The University may also collect, store and use information about your health, ethnicity or religion for the purposes of statutory reporting it is legally required to undertake in the European Economic Area, United Kingdom or United States (as well other jurisdictions which may be relevant).
7. The University processes personal data of alumni and former students once they leave the University for the purpose of tracking employment and educational outcomes, as well as providing networking or additional educational opportunities to this community. Information relating to alumni and former students will also be used for the purpose of charitable solicitation and other development activities.

How Does the University Use This Information and Why?

8. When you are an applicant, the University processes your personal data with the purpose of assessing your eligibility to be offered a place on an academic programme.
9. If you accept a place on a programme and/or register as a student at the University, the University processes your personal data for the purposes of providing its academic programmes and its related services, including identifying any support you may need or request. 
10. In general, this applies to personal data you provide to the University to process your application and, if enrolled, to monitor academic performance. Without that information, the University would be unable to provide you with your chosen academic programme and its related services.
11. Some personal data is also required to fulfil the University’s legal obligations regarding immigration. For example, a failure to provide certain information would interfere with your application for a UKVI Student Route or Tier 4 visa.
12. Some personal data is also required to fulfil the University’s legal obligations regarding reporting to regulatory bodies. A failure to provide that information could interfere with your application for student finance, or the University’s designation as a registered body.
13. The University only processes data for specified purposes and when is justified in accordance with data protection law. The table below shows examples of personal data the University processes and the justification for doing so.

14. There may be other processing in addition to the above, for example, when you access the University’s website which uses cookies, or when the University takes photos or video of our events and publishes them. This is done on the basis of our other policies, and the University will inform you about such processing at the time when the data is obtained. 
15. Where the basis of processing your personal data is a contractual necessity, and you don’t provide the University with the personal data needed, the University may not be able to process your application or provide you with the programme for which you have applied. 
16. A failure to provide immigration-related data may result in failure to obtain a Student Route or Tier 4 visa for those students who require it.

What Information Does the University Get From Third Parties?

17. Sometimes the University receives your data from third parties. The following table lists what information the University may receive from them.

With Whom Does the University Share Information?

18. Sometimes the University may need to share your data. The following table gives examples of this kind of data sharing.

Where in the World Is Your Personal Data Transferred to?

19. Your personal data may be transferred to Northeastern University in the US for the purposes of providing educational or other support services, or for administration of the University and its programs. 
20. Personal data may also be transferred offshore to third parties providing services to us or by those third parties themselves with our permission. 
21. The list of third party providers is subject to change as the needs of the University change. A current list of these third parties is available upon request. 
22. If any of our processing activities require your personal data to be transferred outside the United Kingdom, we will only make that transfer if:
    1. the country to which the personal data is to be transferred ensures an adequate level of protection for personal data;
    2. we have put in place appropriate safeguards to protect your personal data, such as an appropriate contract with the recipient;
    3. the transfer is necessary for one of the reasons specified in data protection legislation, such as the performance of a contract between us and you; or
    4. you explicitly consent to the transfer.
23. You can contact us for more information about the safeguards we use to ensure that your personal information is adequately protected in these circumstances (including how to obtain copies of this information).

How Long Does the University Keep Your Data?

24. The University must retain some staff and student personal data after they leave the University either because the law requires it or for other reasons, e.g. to provide transcripts and references or to keep tax records. Each type of data will be held for a set period, which is defined in the University’s Data Protection Policy.

What Are Your Rights in Relation to Your Data and How Can You Exercise Them?

25. At any point while we are in possession of or processing your personal data, subject to certain conditions you have the following rights:
    1. Right of access – you have the right to request a copy of the information that we hold about you. It helps us to find your information if you provide us with the relevant details for the nature of your contact with us.
    2. Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
    3. Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
    4. Right to restriction of processing – where certain conditions apply you can ask us to restrict the processing of your data.
    5. Right of portability – you have the right to have the data we hold about you transferred to another organisation.
    6. Right to object – you have the right to object to certain types of processing such as direct marketing.
    7. Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.
    8. Right to data portability – you have the right to receive the personal data which you have provided to us and which is processed by us by automated means, in a structured, commonly-used machine readable format.
    9. Right of withdrawal of consent – where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know. Your withdrawal of your consent won’ t impact any of our processing up to that point.

The Data Protection Officer

26. The University has appointed a Data Protection Officer.
    1. Their email address is:  dpo@nulondon.ac.uk
    2. Their postal address is:

Data Protection Officer

Northeastern University London

Devon House

58 St Katharine’s Way

London

E1W 1LP

Questions and Complaints

27. For more information on your rights, if you wish to exercise any right, for any questions, you may have or if you wish to make a complaint, please the Data Protection Officer.

Complaint to the Information Commissioner

28. You have a right to complain to the Information Commissioner’s Office (ICO) about the way in which the University processes your personal data. You can make a complaint via the ICO website.

Version History