Schools and Colleges

Privacy Statement

Why we collect data

This statement explains what information we gather and lets you know how this information is used and protected.

University of Essex Schools and Colleges Privacy Notice

About this notice

Privacy notices explain what personal information or “data” an organisation holds about you, and how that data is stored, used and kept safe. Personal data is any information, held in any form, that relates to you as an identifiable individual. This Privacy Notice applies to your personal data shared online, stored in our computer system or in hard copy. The personal data that we collect, and hold is important to us and is handled in accordance with this Privacy Notice. 

 In this notice “we” means the University of Essex and our wholly owned subsidiaries University of Essex Campus Services (UECS) and WHH Ltd, and “you” means staff and employees of the University, UECS or WHH Ltd.

 If you would like this notice in another format (for example: audio or large print), please contact us.

Who we are

The University of Essex is an exempt charity, and our registered address is Wivenhoe Park, Colchester, CO4 3SQ.

University of Essex Campus Services is a wholly-owned subsidiary company of the University. It is a private limited company and its company number is 02534817. Wivenhoe House Hotel is also a wholly-owned subsidiary of the University and its registered company number is 07075571.

The University of Essex is registered as a Data Controller with the UK’s Information Commissioner’s Office (ICO). Registration Number: Z699129X

The University of Essex work predominately throughout Essex, Suffolk, Thurrock and East London to support young people in areas where certain members of the population are under-represented in Higher Education. This is known as ‘outreach’ or ‘widening participation’ (WP).

The University’s student recruitment and outreach teams provide a range of events, activities, talks and interventions to help young people, their parents/guardians and their teachers/advisors become more aware of the options that are available after school, sixth form and/or college. At all events and activities, information, advice and guidance (IAG) is given with the aim of helping students to make informed decisions about their future education and career path.

The Office for Students requires the University of Essex to provide evidence that the work we do with schools, sixth forms and colleges is making a difference. This is achieved by reporting on targets that are set in the Access and Participation Plan.

Your information

Why we use your data – and our legal basis for doing so

When we collect data we need both a purpose (i.e. a reason) and a legal basis. There are several legal bases allowed, and we generally rely on four of those when processing your personal information.

The University of Essex’s Outreach and Recruitment teams collect information so that we can:

  • Plan and manage virtual and face-to-face activities, events programmes and competitions.
  • Monitor participation in virtual and face-to-face activities, events programmes, prize-draws and competitions.
  • Evaluate and report on the effectiveness and impact of the activities, for example, to evidence where activities have increased the number of young people going to higher education. To do this, the Outreach and Recruitment teams keep a record of events and activities that individuals attend to see which of those people progresses to further study and collect their feedback.
  • Provide the OfS with the evidence it requires to judge whether the work the University of Essex’s Outreach team does is making a difference.

The University of Essex is committed to protecting the privacy of all users of our website and our services and we hold any personal data that is shared with us or collected by us, securely. We are committed to ensuring that your privacy is protected.  We will always explain clearly what data we are collecting about you and why.  We will only collect data we need to give you a better experience; to improve and deliver our services to you; and to meet our responsibilities to you.

Legitimate Interests

We may need to use your data to pursue our legitimate, or the legitimate interests of others such as your school or College.

The University of Essex’s Outreach and Recruitment teams rely on the legal basis of legitimate interests for the purposes of:

  • Planning and managing activities.
  • To contact you with updates and information about our events, programmes and activities that may be relevant to you where you have not objected to us doing so (please see below for more details).
  • To take photographs, audio and video footage at our events, programmes, and activities for use in Outreach and Recruitment digital and printed materials, communications, publications, and social media sites to promote the benefits of our activity.
  • Monitoring participation.
  • To monitor and evaluate the effectiveness of our programmes, events, and activities, through data tracking, research, statistical analysis, feedback and surveys.
  • Record keeping.


We ask for consent to process your personal data where:

  • We request the personal data of children: Where data for pupils under 13 will be collected then parental consent will be required and consent will be the lawful basis relied upon until such time as the pupil reaches age 13 and their data can be processed under legitimate interest. 
  • We are processing special category data: We collect sensitive personal information to ensure activity can be tailored to participants. We will ask for your consent to this data [e.g. data about access or health requirements] for residential activity, to collect data from you in the absence of a data sharing agreement with your school or college, or if you are registering for an event or activity as an individual, rather than as part of a school/college group.
  • We are marketing to you: For promoting events to students (marketing) we will always ask for your consent we won’t use the information you give us to contact you with marketing (promoting our activities) without your permission, and we never share your information with other organisations for marketing purposes.

You will be asked for your consent by completing the relevant field on our web forms, event registration forms, programme application forms and/or evaluation forms.

Please note: If you are a teacher/advisor with whom we have an existing relationship we may send marketing without your consent if you have not objected to us doing so.

If you do not want us to use your data in this way you do not need to provide your consent, and you can use the unsubscribe link in our email communications at any time to opt out.

Legal Obligation

As a Higher Education institution we have various legal obligations relating to our learners and we need to process data about our them in order to carry our obligation to widen access and participation.

We rely on the legal basis of legal compliance:

  • To ensure your safety and wellbeing during events, programmes, and activities in line with relevant health and safety law.
  • To comply with, and monitor our compliance with, Equality legislation.

Where there is statutory or other legal requirement to share the information.


 When we need to perform services relating to a contract we have entered into with you, we may need to process your personal data, this would include:

  • For application and registration purposes prior to participating in an event, programme or activity.
  • To support, deliver and administer our prize-draws, competitions, programmes, events and activities and to update or inform you about them.
  • To ensure your safety and wellbeing during our events, programmes and activities.

Other Legal Basis

We may also use your personal information in the following situations, which are likely to be rare:

  • Where we need to protect your interests (or someone else's interests).
  • Where it is needed in the public interest or for official purposes.

What type of information we collect about you

We may collect and process personal data about students, parents/carers and teachers who participate in one of our programmes, activities, events or webinars.

This may include personal details such as:

  • Your name
  • Date of birth
  • Postcode
  • Email address
  • School/institution or organisation
  • Information relating to your past and future academic progress, educational or professional background,
  • Your communication preferences
  • Details of emergency contacts
  •  Bank details to award bursaries

 For some events, programmes and activities, we may also collect special categories of data such as:

  • Information about health conditions
  • Ethnicity
  • Disability
  • Care/carer status
  • Refugee status
  • Gypsy/traveller status
  • Service children status
  • Dietary requirements

Where the data we hold comes from

Information such as your name, date of birth, postcode and email address will be gathered directly from your school or college when a data sharing agreement is in place to govern this. If a data sharing agreement is not in place between The University of Essex and your school or college, or if you are directly registering for an activity, you will be asked to share this data with us via online or hard copy forms.

Whom we share your data with

We will only share your data when there is a legal basis to do so. Any data we share will only be used by the third-party organisation for the purposes of:

  • Delivering virtual and face-to-face activities, events, programmes, prize-draws and competitions to you.
  • Monitoring and evaluation in line with this notice.
  • Helping to evaluate the effectiveness of our outreach programmes, events and activities as part of OfS policy to widen participation in Higher Education. 

For example, sometimes we need to share data from HEAT with the OfS, CFE Research, the Higher Education Statistics Agency (HESA) and the University and Colleges Admissions Service (UCAS). Please see the relevant privacy notices for each organisation if you would like to know more about how your data is processed by them. If relevant, we may also provide your school/college with details of which activities you have attended over the course of an academic year. In the case of administering bursaries, your details will be shared with the University of Essex finance department.

Data will only be shared using secure data transfer methods and stored by us and our partners on secure systems. We and our partners will not use your personal data in any way that would affect you individually.

Any data released into the public domain by The University of Essex will only appear in aggregate form and will be fully anonymised to prevent identification at an individual level.

We never share your information with other organisations for marketing purposes.

Where we keep your data and how long we keep it for

The University of Essex Outreach team uses the national Higher Education Access Tracker (HEAT) database, as well as a purpose-built Microsoft Dynamics 365 Customer Relationship Management (CRM) system to store the information collected on the people who take part in the programme. These databases are where we store details on the programmes, events and activities you participate in. A back-up copy of this data may also be stored for a short period on secure, internal cloud storage systems.

Some personal data, such as your name, may also be stored in online platforms that are used to deliver programmes, events, and activities to you and/or to present evaluation forms to you.

Your data is stored inside the UK and EEA. If data is stored outside the UK or EEA on the CRM then we have ensured that it meets the same privacy standards that we expect.

Further information about our Privacy Notice.

Data Retention

If you are under 21 years old at the time you first engage with The University of Essex:

  • Your data will be retained in HEAT and CRM for 15 years after graduation or until 30 years of age (whichever comes first).

If you are over 21 years old at the time you first engage with The University of Essex:

  • Your data will be retained in HEAT and CRM for 15 years after graduation or for 10 years after your first activity with us (whichever comes first).

After this time, data will be anonymised in bulk at the beginning of the next academic year. This retention policy will be reviewed each year in line with the HEAT retention policy to ensure it remains fit for purpose and compliant with relevant legislation

This is so we can look at the long-term impact of The University of Essex Outreach and Recruitment activities to assess whether young people who take part are any more likely to progress to Higher Education. It is also to comply with the requirements agreed with the OfS as part of our Access and Participation Plan.

Data recorded in HEAT will be held securely for the duration of the longitudinal programme and anonymised according to anonymisation protocols as appropriate by the HEAT Service. The Information Commissioner’s Office ( has approved HEAT’s retention schedule which shows how long information is kept for. You can read the data privacy information for HEAT on their website.

Back-up data stored on secure, internal cloud storage systems will be held for the duration of the academic year and deleted at the end of the Summer Term ahead of the next academic year. 

Your personal data and your rights

Under data protection law, you have rights including:

  • The right of access - You have the right to access and ask for a copy of any information The University of Essex Outreach and Recruitment teams holds about you.
  • The right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
  • The right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
  •  The right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances e.g. withdraw consent where that is the legal basis of our processing.
  • The right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
  • The right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

If you would like to exercise any of these rights, please contact the Data Protection Officer at the University of Essex, 01206 874853.

If you have any further questions about how your data is being used, or about any of your other data rights, contact the Data Protection Officer at the University of Essex, 01206 874853.

How Cookies are used

A cookie is a small file which asks permission to be placed on your computer's hard drive. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences such as identifying your computer's previous visits to a website, ascertaining the most popular features of a website or enabling an organisation to present specific information to you.

More information on how this website collects and uses data can be found on our website privacy and cookies statement.


If you are unsatisfied with the way the University has processed your personal data, or have any questions or concerns about your data please email our Data Protection Officer.

If we are not able to resolve the issue to your satisfaction, you have the right to apply to the Information Commissioner’s Office (ICO).

Changes to this notice

We keep our privacy notices under regular review. This privacy notice was last updated in August 2021.