This privacy notice is for University of York students. It sets out the ways in which the University of York gathers, uses, stores and shares your data. It also tells you what to expect when the University of York records photographs or videos which include you, and sets out how long we keep your data and what rights you have in relation to your data under the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018.
For the purposes of this privacy notice, University of York is the Data Controller as defined in the UK GDPR. We are registered with the Information Commissioner’s Office. Our registration number is: Z4855807.
The University of York’s Short Courses team captures photography and video for marketing purposes. These photos and videos are used to provide information about and promote the University’s summer school and short courses, research and other activities to audiences including potential UK and international students, parents, the public, policy-makers, benefactors and other stakeholders.
When capturing photography and video, we do so under the legal basis of ‘legitimate interests’ and we employ the following practices to consider and protect people's rights and interests.
Much of the data we hold on you comes from your application form. Additional information may also have been provided by you as part of your interactions with us before applying or once enrolled. Information relating to you may also have been provided to us by third parties e.g. your sponsor, agent, referee or previous employer, college or university.
Personal data including name, date of birth, home postal address, email address, telephone number, parent/guardian and emergency contact details, education records (past and present), disciplinary and attendance records.
Special category data including information about disability, health, ethnicity and racial origin.
The University needs to collect and retain certain types of data, in various formats, about its current and past students in order to fulfil its functions as an education provider and to maintain its lifelong relationship with its alumni community. The University considers summer school and short course participants as part of its alumni community.
Typically, data will be processed:
When capturing photography and video do so under the legal basis of 'legitimate interests'.
This means that the University benefits from being able to record events to provide information about and promote the University’s courses, research and other activities, and that we are able to use photographs of you to do this, as long as it does not unfairly impact you.
The University may process your personal data (including special category data) for the following purposes:
In addition, please note:
Your image may be used in printed media produced by the University of York, such as prospectuses, guides, and training products, and/or in non-University materials such as magazines and newspapers. It may also be used on websites or social media channels managed by the University of York or associated organisations. Images may also be used around the University campus, for example on information screens or hoardings. Please note that video footage or quotations may be edited to keep them concise. We won't change the meaning of what you have said when editing.
You may appear on video recordings which will be used by the Centre or the University of York on webpages or on a live stream of the event. This content may be available to the general public at any point in the future.
The University may share your data with:
The University may also disclose your data to other 3rd parties not listed above on a case-by-case basis. Disclosures will be made in full accordance with the data protection legislation and only where necessary. Consent will be sought from you where appropriate and you will be told about such disclosures unless exceptional circumstances apply.
Where the University, Government or their respective agents (e.g. Office for Students) hold personal information provided by students, they may need to check the accuracy of this information against external data sources. This might involve contacting institutions to confirm qualifications obtained, for example, or checking whether a Higher Education Statistics Agency record already exists for a student. Any such checks will be made in compliance with data protection law.
Published photos are available to anyone who has access to the website or printed materials in which the photo or video features.
The original photographs and videos will only be accessible to employees and agents of the University, or third parties that process data on behalf of the University (eg printing providers, digital asset management suppliers).
The University takes information security extremely seriously and has implemented appropriate technical and organisational measures to protect personal data and special category data. Access to information is restricted on a need-to-know basis and security arrangements are regularly reviewed to ensure their continued suitability. For further information please see our IT security information.
In certain circumstances, it is necessary to transfer your Personal Data (including Special Category Data) outside the UK. In respect of such transfers, the University will comply with our obligations under UK GDPR and ensure an adequate level of protection for all transferred data.
The University will retain your data in line with legal requirements or where there is a business need. Retention timeframes will be determined in line with the University’s Records Retention Schedule.
Under the UK GDPR, you have a right of access to your data, a right to rectification, erasure (in certain circumstances), restriction, objection or portability (in certain circumstances). You also have a right to withdraw consent. Depending on the course you are enrolled in, you can verify or correct information in your student record online at any time or by contacting the Short Courses Team at firstname.lastname@example.org. For all other requests, see what rights you have.
If you want to exercise your rights in particular to ask us to stop using photographs or videos which include you, then you can do so by contacting us at email@example.com. Please note that although we will stop using your image in any future publications, we will not be able to remove any copies which have already been published.
If you're taking part in a summer school or short course or are attending an event at which there may be photography or video recording taking place, you can let us know and we'll make best efforts not to capture or retain any images or footage of you.
If you can, let us know in advance by emailing firstname.lastname@example.org stating which course or event you will be attending and when.
If you've not been able to let us know in advance or have any questions or concerns during a course or at an event, please direct these to the photographer or videographer on site.
If you are unhappy with the way in which the University has handled your personal data, please contact the Short Courses Team at email@example.com or the University’s Data Protection Officer at firstname.lastname@example.org in the first instance. If you remain dissatisfied, you have a right to complain to the Information Commissioner’s Office.
We keep our privacy notice under regular review. This notice was last updated on 8 December 2022.