Academic Registry - Student Privacy Statement

This statement explains how the Academic Registry of Aberystwyth University handles and uses your personal information (ie. any information which relates to or identifies you as an individual) during your time as a student and after you graduate. Further information on the Registry can be found at: https://www.aber.ac.uk/en/aqro/about/.

Aberystwyth University is the data controller and is committed to protecting the rights of students in line with the UK Data Protection Act 1998 (DPA), the new General Data Protection Regulation (GDPR) and any related legislation. Aberystwyth University has a Data Protection & Copyright Manager who can be contacted at infocompliance@aber.ac.uk or 01970 628593. The University has a range of data protection policies and procedures in place which can be found here: https://www.aber.ac.uk/en/infocompliance/.

What personal information do we collect about you?

The Registry will collect information about you at the point of application to study here, when you register as a student, whilst you progress through your course, or after you have ended your studies or graduated with a qualification from Aberystwyth University. We may also receive information about you from outside the University, such as information from UCAS relating to your application, as well as information supplied by referees. The type of personal information processed by the Registry includes, though is not limited to, the following:

Name, date of birth, contact details and other information submitted during the application, verification and registration processes;
Details of your course, modules, assessment marks and qualifications.
Details of any formal outcomes following on from any University processes and procedures, eg. academic appeals, disciplinary procedures, formal complaints, etc.
Contact details for next of kin to be used in an emergency.
For international students, copies of passports, visas and any other documents required to ensure compliance with Home Office requirements, as well as data for attendance purposes.

What is the purpose of the processing of any personal information and how will your information be used?

The Registry will process your personal information for a range of practical and administrative purposes which are all required as part of your registration as a student. AU is also required to declare the legal basis upon which this data is processed and this is also indicated below. Although it is not possible to state every purpose for which your information will be used, the following are examples of how it is likely to be used, by the Registry, while you are a student.

To administer your studies and record academic achievements (e.g. your course choices, examinations and assessments, produce certificates and transcripts, and the publication of pass lists and graduation programmes). Aberystwyth University is required to collect, store and process information about you for any purposes connected with your studies, eg. teaching, support, research, administration, and for any other reasons which are deemed necessary for the performance of your contractual agreement with the University (Article 6(1)(b) of the GDPR).
To communicate effectively with you by post, e-mail and telephone, and others in the event of an emergency. Aberystwyth University is required to collect, store and process information about you for any purposes connected with your studies, eg. teaching, support, research, administration, and for any other reasons which are deemed necessary for the performance of your contractual agreement with the University (Article 6(1)(b) of the GDPR).
To carry out investigations in accordance with academic regulations, and operate disciplinary, complaint and quality assurance processes and arrangements. Aberystwyth University is required to collect, store and process information about you for any purposes connected with your studies, eg. teaching, support, research, administration, and for any other reasons which are deemed necessary for the performance of your contractual agreement with the University (Article 6(1)(b) of the GDPR).
To monitor attendance and engagement of students on Tier 4 visas to ensure compliance with the terms of their sponsorship (Articles 6(1)(e) and 89).
To compile statistics and conduct research for internal and statutory reporting purposes (eg. HESA). Aberystwyth University is required to process your personal data where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the University (Articles 6(1)(e) and 89).

Who will we share your personal information with?

Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats, with access to this information being limited to AU staff who have a legitimate interest in it for the purpose of carrying out their contractual duties.

Where necessary, personal information will be shared internally within Institutes and with other departments across the University. Personal information is protected by the University and, other than those circumstances listed below, information will not be disclosed to third parties without consent. Listed below are the types of organisations and circumstances where your personal information may normally be disclosed by the Registry.

Higher Education Statistics Agency (HESA) – Aberystwyth University is required to send some of the information which we collect about students to HESA for statistical analysis purposes and to conduct the Graduate Outcomes survey.
Sponsors and parents where consent has been provided.
Higher Education Institutions where you may be spending a period of time, for example, as an exchange student, or a year abroad as part of your degree scheme.
Professional bodies (e.g. General Medical Council, Royal Society of British Architects, Law Society) in order to confirm your qualifications and accredit your course.
The University is licensed to sponsor migrant students under Tier 4 of the points-based system and under Short-term Study Visa. The University will provide data about students on the Tier 4 Student Visa and other non-Tier 4 students who are subject to immigration control, to the Home Office and its departments in order to fulfil its duties under its license.
Work placement sites or educational partners involved in joint course provision.
The Student Loan Company to confirm enrolment, attendance and identity in order that students can access financial support.
Debt recovery and control companies in order to recover debt on behalf of the University, where internal debt recovery procedures have been unsuccessful.
Potential employers or providers of education whom you have approached
The Higher Education Degree Datacheck (HEDD) online verification service, developed by Graduate Prospects, offers a centralised system for degree verification, for third parties only (eg. employers and agencies), to verify Aberystwyth University student awards. Consent will always be sought prior to personal data being released.
UK agencies with duties relating to prevention and detection of crime, collection of a tax or duty or safeguarding national security.
Plagiarism detection service providers in accordance with agreed contracts.
Local Authorities for purposes of council tax exemption where it is necessary for the pursuit of the legitimate interests of the Local Authorities or the student but only where the processing does not fall within our core public function, is not unwarranted and will not cause a prejudicial effect on the rights and freedoms, or legitimate interests, of the student.
Local Authorities for voting purposes: under a specific data sharing agreement, the University shares basic personal details with the County Electoral Services Office in order for them to contact you regarding self-registration. The University does not register students itself.
Aberystwyth University Students’ Union where it is necessary for the pursuit of the legitimate interests of the Students’ Union or the student in order totake part in democratic processes, benefit from representation services, join sports clubs and societies and receive communications. Where consent has been provided, the University will also share ethnicity data to enable the Student Union to monitor and promote BME engagement.

Any other disclosures that the University makes will be in accordance with GDPR legislation and, in each case, your interests will be carefully considered.

Where it may be necessary to process other information, which the Registry may be required to collect for legitimate purposes, you will normally be given further details about our use of any such data when we collect it from you.

How is my personal information used by the Registry after I graduate?

After you graduate, a core record of your studies is retained indefinitely so that details of your academic achievements and your periods of registration can be confirmed, that awards can be verified and that transcripts of marks can be provided as well as academic references if appropriate. The data may also be used for statistical or historical research.

How long will your information be held?

Aberystwyth University will retain your personal information in line with the University Records Management Policy, its Records Retention Schedule and also the model retention schedule published by the Joint Information Systems Committee (JISC). As noted above, a core record of your attendance will be retained indefinitely.

Further information can be found at: https://www.aber.ac.uk/en/infocompliance/rm/.

Security of your information

GDPR legislation requires the University to keep your information secure, both in paper form and electronic format. Your confidentiality will be respected, and all appropriate steps taken to prevent unauthorised access and disclosure. Only members of staff who need access to certain aspects of your information will be given the authority to do so.

How can I access my personal information?

You have the right to access your personal information that is held about you by the University. Further details are available at: https://www.aber.ac.uk/en/infocompliance/dp/request/

What do you have to do?

It is very important that you keep your personal details up-to-date, and can do so by visiting your on-line student record at: https://studentrecord.aber.ac.uk/en/

What are your rights?

As a data subject, you have certain rights over the data which we hold about you, depending on the basis on which we collect and process it.

More details can be found here: https://www.aber.ac.uk/en/infocompliance/policies/dp/data-subject-rights/ and also on the Information Commissioner’s website: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr

If you have provided information on the basis of consent, you have the right to withdraw that consent. You also have the right to ask us to correct any inaccurate personal information we hold about you (ie. any information you are not able to correct through your on-line student record), to delete personal information, or otherwise restrict our processing, or to object to processing or to receive an electronic copy of the personal information you provided to us.

Please visit the University Data Protection Website for further information in relation to your rights. You can also contact the University Data Protection and Copyright Manager at: infocompliance@aber.ac.uk.