London and South East University Group (LASE) Privacy Notice

This Privacy Notice outlines how London and South East University Group (LASE) collects, uses and manages the personal information of individuals in accordance with data protection law.

How we use your data

London and South East University Group is registered as a ‘Data Controller’ under registration number Z6638040. View the full entry on the register

London and South East University Group (‘the University Group’, ‘LASE’) is made up of the University of Greenwich and the University of Kent, which operate as academic divisions within the Group.

For information about how University of Greenwich (part of LASE University Group) processes your personal data, please refer to the existing University of Greenwich privacy notices here:

Privacy notices | About the university | University of Greenwich

For information about how University of Kent (part of LASE University Group) processes your personal data, please refer to the existing University of Kent privacy notices here:

Privacy Notices - Assurance and Data Protection - University of Kent

How we collect your personal information

We use different methods to collect data from and about you including through:

  1. Your interactions with us. You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
    • Apply for one of our courses
    • Create an account on our website
    • Subscribe to our newsletter or publication
    • Request marketing to be sent to you
    • Enter a competition, promotion or survey
    • Give us feedback or contact us.
  2. Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies (see below), and other similar technologies.
  3. Third parties or publicly available sources. We also receive personal data about you from third parties such as:
    • Technical Data is collected from Analytics providers (such as Google based in/outside the UK).

Categories of information we collect

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

  • Identity Data includes your title, first name, last name or username
  • Contact Data includes your email address, telephone number and any billing address
  • Financial Data includes bank account and payment card details
  • Transaction Data includes details about payments to and from you and other products or services you have purchased from us
  • Technical Data includes Internet Protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug in types and versions, operating system and platform, device ID or data (HTTP Agent or HTTP Referrer) and other technology on the devices you use to access this website
  • Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
  • Usage Data includes information about how you interact with and use our website, products and services.
  • Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.

Our lawful basis for processing your data

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

Performance of tasks in the public interest: This relates to personal data processed for purposes connected with teaching, support, research, administration, and with the operation of the University Group as a higher education institution.

Performance of a contract with you: This relates to processing of your personal data for purposes connected to any contract we have with you.

Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example where the processing relates to the safety and security of our IT systems, staff and students and buildings. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.

Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.

Vital interests: We rely on vital interests only where we need to process your data in an emergency where it is necessary to do so to protect a life.

Our public task basis is underpinned by our statutory obligations for example, under the Higher Education Act 2004 (which establishes the legal framework for reviewing student complaints); the Equality Act 2010 (which requires us to make reasonable adjustments and carry out equalities monitoring); and the Higher Education and Research Act 2017 (in particular the requirement to comply with the regulatory framework in section 75 and the conditions imposed by the Office for Students).

Where we also process your special category data and your criminal offence data, we must identify a further condition for processing that data.

We have a Special Category and Criminal Offence Data Appropriate Policy document in place throughout the time that we use your data and for 6 months after we cease to use it.

For specific information about the lawful basis relied upon for processing your personal data, please see the relevant privacy notice for the processing activity. The links to all University of Kent and University of Greenwich privacy notices are provided at the beginning of this privacy notice.

How we use your personal information

We will use your data to carry out our functions and activities as a University Group and Higher Education institution and Public body and to provide services to you.

We will use your personal data to fulfil our contracted commitments with you.

We perform tasks in the public interest as part of our role of being a teaching and research institution. We will use your information in a safe and protected manner to monitor, enable and evaluate the management of the University and the services it provides.

We also process your personal data for the administration and delivery of University Group services, including accommodation, sports, library and IT services.

In many cases we have a statutory or contractual basis to process your personal data and if we do not receive this personal data, we may not be able to process your request, enquiry, or application; facilitate your event booking; or provide you relevant educational or ancillary services.

For specific information about how we use your personal information, please see the relevant privacy notice for the processing activity. For example, if you are studying at the University of Kent, you should access the University of Kent Student Privacy Notice. The links to all University of Kent and University of Greenwich privacy notices are provided at the beginning of this privacy notice.

We have produced a privacy notice for participants in LASE research projects which you can download below.

Direct marketing

You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving the marketing.

We may also analyse your Identity, Contact, Technical, Usage and Profile Data to form a view which products, services and offers may be of interest to you so that we can then send you relevant marketing communications.

Third-party marketing

We will get your express consent before we share your personal data with any third party for their own direct marketing purposes.

Opting out of marketing

You can ask to stop sending you marketing communications at any time by following the opt-out links within any marketing communication sent to you or by contacting us at: infocompliance@lase.ac.uk.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes.

Cookies

For more information about the cookies we use and how to change your cookie preferences, please see below.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Who your information will be shared with

We use third party organisations (known as data processors) who carry out services on the University’s behalf under contract. We will ensure that only the minimum amount of relevant personal data necessary for the purpose is transferred. We will ensure that contractual agreements exist to ensure compliance with data protection regulations and that data is used solely under our instruction. In these circumstances personal data shall be deleted after the contract has terminated.

Sometimes it is necessary for your personal information to be shared:

  • with competent authorities (such as the police, National Crime Agency) or Action Fraud for law enforcement purposes (on substantial public interest reasons – Article 9(2)(g)) – for preventing or detecting unlawful acts, safeguarding or fraud purposes.
  • with our professional advisors where it is necessary for the establishment, exercise or defence of legal claims – Article 9(2)(f).

Occasionally the University may, if appropriate, legitimate and necessary, rely on relevant exemptions to UK GDPR provisions as are allowed under the Data Protection Act 2018 (in relation to crime and taxation, management forecasts, negotiations, confidential references and exam scripts and exam marks).

Transfer of your information outside of the UK

We may transfer your personal data to service providers that carry out certain functions on our behalf. This may involve transferring personal data outside the UK to countries which have laws that do not provide the same level of data protection as the UK law.

Whenever we transfer your personal data to service providers outside the UK, we ensure a similar degree of protection is afforded to it by ensuring that such transfers are made in compliance with all relevant data protection laws.

How long your personal data will be kept

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements

For specific retention schedules, please see individual privacy notices relevant to the processing activity.

In some circumstances you can ask us to delete your data: see ‘Your rights’ section below for further information.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Security

We will ensure that security measures are in place to prevent the accidental loss, unauthorised use or access to your data. Access is given to staff on a ‘need to know’ basis. Our staff are required to keep your data safe and complete data protection training.

We have procedures in place to deal with any data security incidents and will notify you and the ICO in the event of a data breach where we are required to do so.

Your rights

Please be aware of the following rights which can be accessed free of charge by contacting infocompliance@lase.ac.uk :

  • know how we are using your personal information and why (right to information)
  • access the personal data held by us (subject access request)
  • ask for correction of any mistakes (rectification)
  • to object to direct marketing
  • to complain.

In some circumstances you also have the right to:

  • object to how we are using your information
  • ask us to delete information about you (the right to be forgotten)
  • have your information transferred electronically
  • object to automated decisions which significantly affect you
  • restrict us from using your information.

For further guidance regarding your rights please see the ICO website.

Your rights- if you have given consent or explicit consent for a specific use of your personal data

You can withdraw your consent at any time.

You can do this by unsubscribing from any newsletters by clicking on the link within the email. This does not affect the lawfulness of the processing based on consent before its withdrawal.

Your right to complain

You have the right to raise a complaint to LASE University Group if you are dissatisfied with how we have handled your personal data. You can submit a complaint via our contact form or via email to infocompliance@lase.ac.uk.

Further details about the LASE Data Protection complaints process can be found on our website and How to make a subject access request | About the university | University of Greenwich

You also have the right to lodge a complaint with the Information Commissioner's Office.

Their helpline telephone number is: 0303 123 1113.

Contacts

If you have any questions or concerns about the way the University Group has used your data, or wish to exercise any of your rights, please consult the website for the relevant academic division as below.

For University of Greenwich (part of LASE University Group): Information compliance | About the university | University of Greenwich

For University of Kent (part of LASE University Group): Assurance and Data Protection - University of Kent

The Data Protection Officer can be contacted at: infocompliance@lase.ac.uk

Cookies