UCAS' privacy policy

Who we are

UCAS stands for the ‘Universities and Colleges Admissions Service’ – we manage applications to higher and further education in the UK.

All personal information provided by you through this website is under the control of UCAS, and we’re responsible for taking care of your personal information in line with the Data Protection Act 2018, and the UK General Data Protection Regulation (GDPR).

This policy may refer to the organisation as ‘UCAS’, ‘our’, ‘us’, or ‘we’, and our registered office is Rosehill, New Barn Lane, Cheltenham, Gloucestershire, GL52 3LZ.

Terms used in this policy

When explaining how we use your personal information, we use quite a few terms to describe our services. If you don’t understand any of them, you can check what they mean on the 'UCAS terms explained' page.

We try to use language that is easy to understand, and avoid legal terms. However, we’re required by law to include certain information in our privacy policy – here we explain what these terms mean:

• UK General Data Protection Regulation (GDPR) is a regulation on data protection and privacy, that applies within the United Kingdom (UK). The regulation provides individual control and rights in respect of personal information.
• Data Protection Act 2018 (DPA), along with the GDPR, sets the regime for handling personal data within the UK.   
• Personal data is information about individuals, like name and address, or educational or work achievements. Our policy may refer to personal data as ‘personal information’.
• ‘Special category’ personal data is personal information the GDPR considers to be sensitive, such as information about ethnicity, sexual orientation, religious beliefs, or mental and physical health. Use of this personal information is subject to stricter conditions under the GDPR.
• Criminal convictions personal data is personal information about someone’s criminal convictions. If you apply to some courses, such as ones that involve working with children, we will ask you if you have any criminal convictions.
• Lawful basis for processing – all uses of personal information must be supported by a ‘lawful basis for processing’. This means there must be provisions in the GDPR or DPA allowing the use of personal information for specific purposes.

​

Collecting your personal information

When you visit our website, we may collect your personal information, so we can contact you about your request or enquiry. This could include:

• your name, contact details, and interests, if you register to receive a newsletter, updates about our services, or information from third parties
• relevant details about you or your enquiry if you complete a form and/or use the live chat function on our website or provide a response to one of our onsite surveys
• your name and contact details, if you enter a competition. If you're one of the competition winners, we may publish your name on our website. If we need to collect more information from you, or share it with anyone, we’ll let you know when you enter the competition
• collecting your IP address when you visit our website, if you are the only person with access to your computer or device, and it can identify you. We may produce combined statistics about visitors to our website and website traffic patterns, answers to questions, content entered, and related website information. The information used for these purposes is aggregated (i.e. combined with other user data) and anonymised. It’s used to improve our website, and will not be shared in a way which identifies you

Calling UCAS

When you call UCAS through our main contact numbers we will record the call for quality and training purposes. Recordings are held for a maximum of three months. During a call we may ask you some security questions or questions about your interaction with UCAS to help us to deal with your enquiry.

Sharing your personal information

We may share your personal information with employees of UCAS or the wider UCAS Group, or our suppliers who provide services to us, if this is necessary to progress or address your request/enquiry.

If you raise a complaint about UCAS, a member of staff, or a third party organisation which engages with a UCAS service, we will review your complaint to decide if we are able to investigate in accordance with out complaints policy. During a complaint investigation UCAS may need to share some of your personal information, together with the details of your complaint, with third parties if appropriate. Where this occurs UCAS will endeavour to provide the minimum information required to support the handling of the complaint; this activity is undertaken by UCAS in support of our legitimate interests to investigate your complaint.
​

Collecting your personal information

When you attend a UCAS event, including virtual events, we collect the following personal information:

• Your name, address, email address, date of birth, gender, current school, and year. We also ask you to tell us when you want to start university, the areas of the country where you want to study, the subjects you want to study, and if you are considering a gap year, apprenticeship, going into employment, studying overseas, or studying at a conservatoire.
• You can also choose to give us your mobile phone number, and tell us which subjects you’re currently studying.

Using your personal information

• We use this personal information to provide you with updates about event(s) you’re attending, and ask your opinion about our services.
• We also use this personal information to make sure any information and advice we send you is relevant and useful – such as open days likely to be of interest to you, based on the subjects you want to study, and where you live.

We retain the personal information to produce research about such things as attendance at events, and their impact on access to higher education. Any statistical analysis reports we produce will not allow you to be identified.

Changing what we send you

• If you opt to receive information, advice, and offers from UCAS on behalf of third parties, you can change the types of communications you receive and how you receive them, at any time.
• The easiest way to do this is by selecting the ‘Update preferences’ link in the emails you receive from us.

‘Special category’ personal information

• We ask you to provide details of any special requirements you have, such as disabled access needs, or visual or hearing impairments, so appropriate support can be put in place at the event.
• You don’t have to give us this information, but by doing so, we hope to make sure you have a better experience at the event, as the information will be shared with UCAS Events employees and relevant employees at the venue (such as those with responsibility for security, and health and safety).

Sharing your personal information

• You can get your ticket scanned at an exhibitor’s stand. If you do, they’ll receive your name and contact details, including your mobile phone number (if provided), so they can contact you with opportunities that may be of interest. We’ll also share how you’d prefer to be contacted (e.g. email, post, SMS/text) based on what you told us when you signed up for the event.
• We’ll provide exhibitors with your date of birth, current school and year, when you want to start university, the areas of the country where you want to study, and the subjects you want to study. We’ll also let them know if you’re considering studying overseas or at a conservatoire, or are interested in a gap year, apprenticeship, or going straight into employment. If you gave the subjects you’re currently studying, we’ll also pass these on to the exhibitors.
• During a virtual event, if you access an exhibition space of one of our exhibitors they will receive your contact details and the subjects you have noted that you are interested in. This will enable them to send you info about course details and open days which are relevant to you. The very nature of a virtual event is to find information and make connections with exhibitors. Any communications outside of the event will be based on the preferences you made in your registration. You will have the opportunity to opt out of exhibitor comms once they have made contact with you.
• Exhibitors may use this information to make sure any communications you receive are relevant and of interest to you.
• If you have booked your ticket as part of a school group, your school will be able to see whether you have attended or not.

Using your image at an event

When you attend an event, you might decide to have your photo taken. If you do, it will be stored in Flickr and shared on our website to help promote our events. This means, anyone who visits our website will be able to see and download your photo for two weeks after your visit. You must, therefore, be sure you’re happy for your photo to be shared.

If you want to have your photo removed, email datagovernance@ucas.ac.uk with:

• the details of the event you attended (date and venue)
• a copy of the picture you want to be removed

If you’re a parent, guardian, or carer attending a UCAS event, we’ll collect your name and contact details, so we can send you updates about the event, and information and advice to support your child with their post-18 options. We’ll also ask you to confirm what post-18 options your child is interested in, and will use this information to provide relevant information in the communications you receive from us. You can also scan your ticket at an exhibitor’s stand. If you do so, they will receive your name and contact details, so they can contact you with opportunities that may be of interest. During a virtual event, if you access an exhibition space or the content of one of our exhibitors they will receive your contact details and details of the subjects that your child is interested in. This will enable them to send you info about course details and open days which may be of interest based on the preferences made in your registration.

If you are a delegate, speaker, provider, adviser or exhibitor attending a UCAS event, or virtual event, we’ll collect information that may include name, contact, school, and transport details, to support your attendance at the event, and so we can send you updates and information likely to be of interest. We’ll also send you useful information on behalf of third parties, if you choose to receive it.

We make the names, position, and organisation of people attending UCAS events available to everyone who attends. ​

Collecting and using your personal information

When you use the UCAS Hub we collect the following personal information:

• If you log in and create an account – to allow you to use the Hub’s research tools and add favourite course choices and content, we’ll ask for your name, location, chosen password, if you are at school, and your email address. We’ll also ask what type of courses you are interested in. You can also provide further confirmation of the type of information you are interested in receiving further details about.
•  If you wish to personalise the content – you can add information to assist in your exploration of your higher education choices including within the personal statement, notes or tariff calculator tools.

​‘Special category’ personal information

• We do not request any special category information directly through the Hub. If you enter any such information into the tools available on the site, we consider that we hold your explicit consent to process (store) that information.

How we use your information

The information you provide will be used to present personalised content including through the tools available to you. Data will also be used to support the analysis of the system and improve future developments; wherever possible this analysis will use anonymised data.

How your personal information is captured and shared

If you register to use the chat to students service, you will be providing information directly to Unibuddy — you can find further information in their Privacy Policy and Terms & Conditions. As part of accessing this service through ucas.com, your personal details will then be shared with UCAS to enable us to review the success of the service and allow us to send follow-up messaging from the university you chatted with. You will be able to unsubscribe from any such messaging using the unsubscribe links in the email you receive from UCAS, should you wish to do so.
​

Collecting and using your personal information

When you apply to higher education, we may collect the personal information below. 

• If you register on our website, we collect your username, chosen password, answers to security questions, your name, and email address.
• If you apply through our admissions schemes, we may ask you to provide your name, date of birth, contact details, communication preferences, gender, nationality, and permanent residence. We ask for details of your education, qualifications, work experience, course choices, student finance options, whether you have been in care, and your parent or guardian’s education and occupational background. You will be asked to complete a personal statement to support your application. When you pay the application fee, we’ll also collect your chosen payment details.
• To support your application, if you apply through UCAS Undergraduate or UCAS Conservatoires, we’ll receive results from the examination and awarding bodies.
• To support your application, we collect the personal information your referee(s) provides, and allow you to appoint a nominated contact who can speak to us, and receive information about your application. You must make sure you have the permission of your referee and nominated contact to provide us with their details.
• If you apply and live outside of the United Kingdom (UK), we ask for your visa and passport details, so the course providers you’re applying to can check your identity, and confirm you can study in the UK.
• How you want to be contacted – if you opt to receive further information from UCAS or third parties.
• Undertaking research about the higher education sector – we’ll retain a copy of your application and use it, sometimes in combination with other information we hold, for producing statistical analysis and research in respect of UCAS’ admissions schemes. Any statistical analysis reports published will not allow any individual to be identified.

‘Special category’ personal information

To support your application, we may ask you to provide special category personal information as detailed below, which may be shared with the course providers (universities and colleges) you apply to.

• It’s up to you if you give details about your ethnicity, sexual orientation, gender identity, and religious belief – this will help providers check their compliance with the Equality Act 2010. This information is provided to your chosen provider after you’ve secured your place, or at the end of the application cycle.
• You can choose to give information about any disability you have, so the providers you’ve applied to can support you if you’re invited to interview or offered a place.
• If you’re applying to courses that involve working with children and vulnerable adults, such as medicine, teaching, or social work, you’ll have to declare if you’ve got any criminal convictions, including spent convictions. This allows providers to consider any potential impact on your application.

The use of information provided by the Department for Education – Free School Meals and Pupil Premium markers for fair access to higher education.

For English 18 and 19 year old applicants, the Department for Education (DfE) provides information, which is shared with the providers in the UCAS admissions scheme(s) you’re applying to, relating to whether you have been recorded as eligible for Free School Meals. This relates to whether, at the end of Key Stage 4, you have been recorded as eligible for Free School Meals in the previous 6 years. This is referred to as FSM ever 6 and is used by the Department for Education as part of the allocation of Pupil Premium funding to schools.

This may be used by providers to inform their approach to widening access and participation.

The information is shared by the Department for Education under the lawful basis of Public Task and their commitment to ensuring fair treatment for all groups of students regardless of background.

You are afforded certain rights under UK data protection legislation. To see a copy of your data which is shared by the DfE or find out more details, or to request that DfE does not share this information, please email dataprotection.office@education.gov.uk. 

The use of information provided by Welsh Government – Free School Meals markers for fair access to higher education

For Welsh 17 and 18 year old applicants, Welsh Government (WG) provides information, which is shared with the providers in the UCAS admissions scheme(s) you’re applying to, relating to whether you have been recorded as eligible for Free School Meals. This relates to whether, at the end of Year 11, you have been recorded as eligible for Free School Meals in the previous 6 years.

This may be used by providers to inform their approach to widening access and participation.

The information is shared by the Welsh Government under the lawful basis of Public Task (Article 6(1)(e) GDPR) with UCAS named under the Education (Information About Individual Pupils) (Wales) Regulations 2007 as a prescribed person with which Welsh Ministers have the ability to legally share Pupil Level Annual School Census Data (PLASC). This enables Welsh Government to promote education to the people of Wales and action their commitment to ensure fair access for all groups of students regardless of background.

You are afforded certain rights under UK data protection legislation. To see a copy of your data which is shared by WG or find out more details, or to request that WG does not share this information for operational purposes, please email school.stats@gov.wales. It should be noted, that once the data has been shared with UCAS, it cannot be withdrawn from the universities and colleges that you have applied to.

Sharing your personal information

We may share your personal information with organisations or individuals, for the purposes listed below.

Supporting your application to higher education

• We share the personal information in your application with the providers in the UCAS admissions scheme(s) you’re applying to, so they can consider your application.
• If you apply through our UCAS Undergraduate or UCAS Conservatoires schemes, we share any results provided by the examination and awarding bodies at any point during the application cycle with the course providers you applied to. We may also liaise with them about your results.
• If you take the United Kingdom Clinical Aptitude Test (UKCAT) or Graduate Medical Schools Admissions Test (GAMSAT), we’ll share your results with the medical schools you’ve applied to, if they use these tests to consider your application.
• If you apply to study at course providers in the Republic of Ireland, we’ll share your details with their higher education admissions body, the Central Applications Office Ltd., so we can process your examination results.
• If you apply through, or link your application to, your school, college, or UCAS registered centre, they can access the content of your application and keep up-to-date with your progress. They won’t be able to update or see any information you provide about your sexual orientation, gender identity, or religious belief.
• We provide personal information to your referee(s) so they can identify you, and have sufficient information to write an informed reference.
• If you use an agent to submit your application, they can access your application, and see its outcome.

Enabling research about higher education

If you apply through UCAS Undergraduate, we may share your personal data with the Office for National Statistics, or other statutory organisations, to support research in the public interest. We do this to help inform research about, and improve, higher education. We do not allow use for commercial purposes, such as marketing, and we take steps to minimise the personal information shared to support this research. Any data shared with researchers will not allow individuals to be identified.

Reporting to organisations with responsibilities for higher education

We may also share personal information with government or other bodies with responsibilities for the higher education sector, or others which develop and monitor the effectiveness of government policies for higher education such as:

• The Joint Information Systems Committee (JISC) – universities and colleges are required, by law, to provide personal information about their applicants and offers to JISC (previously HESA) – UCAS will share these details with the university or college, to support their reporting commitment to JISC. This information is used to monitor the performance of universities and colleges, and to help make funding decisions.The Office for Students – when necessary to help it meet its statutory requirements for higher education funding, and ensure fair access to higher education.

We only supply personal information that identifies you for these purposes:

• if the provision of statistical analysis is not suitable
• if we have a contract or agreement in place setting out agreed purposes for which it can be used

Prevention and detection of crime

We may share personal information with relevant statutory organisations, like the police, to support the prevention and detection of crime, and for child protection purposes.

Verification checks

We will make verification checks to ensure your application is accurate, and not fraudulently submitted. This process will include cross-referencing the information submitted on new applications with previously cancelled submissions, and checking personal statements do not include material copied from another source. If any adverse information is revealed about you, we will let you know so you have an opportunity to respond. We may also share details of these checks with the course providers to whom you've applied.

Information provided as part of your application may also be used by course providers to complete their own verification checks regarding the details you have provided. They may contact you directly if there are any concerns or queries regarding your application.

Sharing personal data outside the United Kingdom (UK)

We may transfer personal data outside the UK, if you apply or link your application through a school or college outside the UK.

We may use technology suppliers that provide services located in countries outside the UK. Where we do so, we ensure any personal information is protected by the same standards that apply in the UK.

If you apply through the UCAS Undergraduate scheme and find yourself unplaced, or you apply direct to Clearing, you can use Clearing Plus to review courses that we believe may be of relevance to you and where you meet criteria selected by course providers.

Collecting and using your personal information

We already hold the personal information necessary for you to use Clearing Plus, as you gave this in your application. We will keep a record of the course options you show an interest in and may use this information to review and improve Clearing Plus and to provide aggregated statistics, where you will not be individually identified.

Sharing your personal information

If you find a course in Clearing Plus that you want to be contacted about and select the ‘I’m interested’ option, we’ll share some key information from your application with the relevant universities or colleges. This includes your name and contact details. If the course provider wishes to see further information before contacting you, they will be able to access additional information, including your personal statement and qualifications,. If you no longer want to be considered for a course that you have selected, you will need to contact the provider to let them know. Find out more about Clearing Plus.

Apprenticeship Smart Alerts 

• Our Smart Alert service is designed to send you tailored opportunities based on the information you provide us and are filtered against criteria set by employers who use this service
• Within the UCAS Hub, you will be able to opt in to receive Smart Alerts
• We won't match you with every job on our Apprenticeship Search platform, just the ones where employers are looking for specific candidates and have chosen to pay for our matching service. To view all our apprenticeship vacancies, visit our Apprenticeship Search page
• With Smart Alerts you are fully in control of the personal data you provide; we will never share your details with employers or other third parties and you can choose whether to apply for the opportunity

Collecting and using your personal information 

• If you opt in, you will be asked to provide some information and personal data so that we can carry out our matching service   
• This includes information on your location, the distance you are willing to travel, whether you may consider relocation, the apprenticeship level and industry sectors you are interested in working in, the GCSEs you have been awarded and an estimated start date   
• Smart Alerts also use gender from your Hub data because some employers may wish to target opportunities to improve diversity in the recruitment pool.  
• Smart alerts uses your home postcode you provided in the Hub  to calculate the Index of Multiple Deprivation quintile because some employers have specific ED&I targets, one of which is to increase the number of participants from deprived backgrounds    
•  For this service some of the data is enriched with publicly available information to calculate necessary information such as distance and drive time to apprenticeship opportunities, or postcode lookups to ascertain deprivation measures 
• You may then be sent details of apprenticeships where you have been matched to the employers criteria when they become available 

How to opt out of receiving Smart Alerts 

• You can opt out of receiving alerts at any time, by clicking the ‘unsubscribe’ links in our communications. You can also update your preferences and opt out within the Hub. 

GDPR lawful basis for processing – Article 6 1 (f) where ‘processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child’ 

When you register to attend a UCAS event or apply to higher education, we may send you further information considered ‘direct marketing’ under data protection law.

• If you register to attend a UCAS event or apply through UCAS, we will send you further information about our services, including our newsletters and information relevant to your application. We may send you information about courses if you find yourself unplaced, unless you opt out, in your application or subsequently. We may invite you to enter competitions or respond to surveys.
• If you apply through any of our admissions schemes, use the UCAS Hub, or attend a UCAS event, you’ll be asked to opt in to receive information from selected third parties about education, careers, and/or sponsorship opportunities, as well as information about commercial products, and services relevant to students, such as discounts related to travel, banking, magazines, insurance, health, and fitness.

We will not share your personal information with third parties who send you direct marketing, unless you provide specific consent for us to do so, separate from any consent about receiving information.

Email communications

We may also use tracking technologies to measure your interaction with our emails, such as whether you have read or clicked on any of our emails so that we can understand how to improve our communications and make them more relevant to you. If you do not wish us to confirm whether you have opened or clicked on our communications, you will need to unsubscribe from our marketing emails as it is not possible for us to send these emails without tracking enabled. You can update your communication preferences at any time in your UCAS Hub account, or by using the unsubscribe link included at the bottom our emails. Please note you may still receive service emails with tracking technologies enabled after you have unsubscribed.

How to opt out of receiving further information

You can opt out of receiving this information at any time, by clicking the ‘Unsubscribe’ or ‘Update preferences’ links in our communications. You are also able to update your preferences within the Hub.

We may use a supplier to provide this information to you – such as an application that enables us to deliver information to you, sending you an email or SMS/text, or mailing companies, where the information is delivered to you by post.

Display marketing and how to switch it off

We use Google DFP to support display advertising content on our website, according to the demographics (such as age, gender, or interests) of the visitors to particular pages. Find out how to opt out of personalised display advertising.

We may also use Google, Twitter, Facebook, LinkedIn, and Snapchat remarketing features which support promotion of our services you have shown an interest in, if you have subscribed to Google, Twitter, Facebook, LinkedIn, or Snapchat.

This may be based on a hashed (anonymous) email address, or other anonymous information collected by cookies when you visit our website, such as things like your mobile device location (if location features are turned on), browser cookie ID, mobile device identifier, and IP addresses. This helps us provide you with relevant adverts if you have a Google, Twitter, Facebook, LinkedIn, or Snapchat account.

You can choose to opt out of receiving these adverts by:

• changing your account settings for Twitter, Facebook, Google, LinkedIn, and Snapchat to opt out of receiving ‘audience advertising’, to ensure you do not receive tailored adverts
• enabling the 'Limit Ad Tracking' setting (on iOS devices), or the setting to 'Opt out of Interest-Based Ads' (on Android), so Google, Twitter, Facebook, LinkedIn, and Snapchat do not tailor our adverts for you by matching your device to information from partners

Confirming your status as a UCAS applicant

If you apply through UCAS Undergraduate, we’ll give you a code, which you can share with banks or other organisations, to access products and services only available to students, such as student bank accounts.
​

How we collect your personal information

If we engage with each other through social media, we may collect information contained in your posts or blogs, comments, likes, voting, web chat, video uploads, or private messaging functions, from any of the social media links available to you on this website.

How we share your personal information

Any personal information you choose to share could be accessed publicly, if you to share any content on this site, or on any of our social media sites (Facebook, Twitter, YouTube, Pinterest, Instagram, Vine, LinkedIn, or Google+). This includes disclosing personal information if you engage with UCAS social media, such as posting comments on our UCAS Facebook page, voting for your favourite blogger, sending us a private message, uploading a video, or tweeting us.

We cannot be held responsible for any damaging actions or behaviours which may result, following your use of this, or any other related social media activity.

Social media acceptable use

When you engage with UCAS on social media, such as our Facebook page or Twitter feed, comments you post are live as soon as you publish them. We do not check and approve them beforehand. We will remove inappropriate posts. So you know what that means to us, please read our  acceptable use guide (373.73 KB).

Cookies

We want to make sure we give you very clear information about the cookies we collect, how we use them, and how to disable them – read our cookies policy.

We use cookies to provide users with the functionality contained in our website, and produce anonymous information to help analyse website traffic, usage, and behaviour. This helps us improve the visitor experience on our website, and ensure you receive relevant adverts when you use our website, and others.

UCAS uses a cookie management tool which will allow you to identify and record your cookie preferences when you first visit our website.

Collecting and using your personal information

We may collect your personal information, including your name, role, and contact details, if you:

• provide support for a UCAS applicant, such as providing a reference, or validating their application
• sign up to receive a newsletter, and give us your name and contact information
• make an enquiry to become a UCAS registered centre, so we can contact you to progress your enquiry, or keep a record of those approved
• are a teacher or adviser supporting applicants after GSCEs or equivalent qualifications, so you can sign in to Apply for advisers and Adviser Track, and we can give you relevant information about our products and services
• are a teacher or adviser supporting students to make informed decisions about their future, so you can access the latest careers information and guidance
• act as a nominated representative (proxy), so we know an applicant is happy for us to speak to you about their application
• act as an agent on behalf of an applicant, so you can send and manage their application

We may also send you survey requests, so we can improve the services we offer.

Sharing your personal information

We may share the personal information we collect about you with:

• our service providers, who may need your personal information to progress your request or enquiry
• course providers, if you’ve provided a reference in support of an application 

​

If you are a legal member, you may be asked to provide your name, and provider details, and to vote on resolutions in accordance with the Companies Act 2006.

We hold this information to allow you to vote on resolutions and so we can contact you about your vote if we need to. We won’t share this information with third parties, unless required to by law.

We use a variety of measures to make sure we hold your personal information securely, and only share it with organisations who need to access it. This includes maintaining an Information Security Management System, in line with the international standard ISO 27001:2013.

We use third party suppliers who provide parts of our services for us. We have contracts with these suppliers, which require them to use personal data only to provide these services to us.

Where we use the services of a supplier which involves transferring personal data outside the United Kingdom (UK), these will be made to countries with a level of data protection law similar to the UK, or we will include approved model contract clauses, which provide safeguards for the personal data transferred. If you want to know more about international transfers of your personal data, please contact datagovernance@ucas.ac.uk. 

Passwords

To keep your application secure, we’ll provide you with a username and you’ll be asked to create a password. We also ask you to answer certain questions before we discuss your application with you. You can choose to nominate a representative to act on your behalf.
Do not give your Personal ID to anyone other than your nominated representative, if you choose to. Your password or security answers must not be given to anyone, even your nominated representative.

We retain your personal information in accordance with the GDPR, which obliges us to keep it only for as long as is necessary. If we do not have any requirement to retain personal information for business, regulatory, or legal reasons, we will delete it.

Article 89 (1) of the GDPR allows us to retain personal information for statistical and research purposes in the public interest. If you apply through one of our admissions schemes, we’ll retain and use this, in combination with other information we hold, to produce statistical analysis and research in respect of the higher education sector, for public benefit.

Some of the public benefit research we undertake means we must retain this information in a way that allows individuals to be identified. Examples of such research include:

• universities wanting to measure the success of their ‘widening participation’ schemes. This is government policy, and requires them to encourage and review participation in higher education across different social groups, and to measure the success of their interventions on admissions to higher education in respect of named individuals
• data from our admissions schemes over historic cycles, which we link to other datasets, such as the national pupil database. This contains details of pupils in England and Wales, over historic admissions cycle, to help produce reports on equality in higher education admissions

Where possible, we also deploy additional security measures encouraged by the GDPR. This includes using personal information held in a format that does not directly identify specific individuals, without the use of a separately stored code or key that allows identification. This is referred to in the GDPR as ‘pseudonymised data’.

The GDPR provides you with rights in respect of your personal information.

• The right to be informed about the way UCAS processes your information – we provide these details when you first use a UCAS service and this includes the information available through this privacy policy.
• The right of access to information UCAS holds about you. There may be a requirement to provide identification details so we can be sure we are sharing information with the right person. We may also ask you for confirmation of the information you are hoping to obtain or your interactions with UCAS to support this handling of your request.
• The right of data portability – provides a right to a machine readable copy of your information in certain circumstances.
• The right to object to ‘automated decision-making’ including profiling – you have a right under the GDPR to object to any decision that has legal effects on you made by solely automated means (e.g. no human intervention). UCAS’ uses of personal information doesn’t include automated decision-making as defined in the GDPR.
• The right to ‘rectification’ of your information – if you believe that the information UCAS holds about you is inaccurate, you have a right to ask us to amend or update that information.
• The right to request deletion of your personal information – UCAS retains personal information to support research into the higher education sector. However, you can request that we delete the personal information we hold about you and will provide a response.
• The right to object to uses of personal information, in particular where the lawful basis for processing relies on processing in the public interests, or UCAS’ legitimate interests. See the section ‘Lawful basis for processing’ for more information.
• The right to restrict processing, which is available in certain circumstances.

If you would like to apply these rights, or have questions about UCAS’ use of personal information, please email datagovernance@ucas.ac.uk, or write to: Data Protection Officer, UCAS, Rosehill, Cheltenham, Gloucestershire, GL52 3LZ. . Further details about these rights can be found on the Information Commissioner’s website. You also have the right to lodge a complaint with the Information Commissioner’s Office if you have concerns about how your data is being processed.

If you’d like to opt out of receiving direct marketing, you can click the ‘Unsubscribe’ or ‘Update preferences’ links in the communications we send, or, if you have applied through UCAS, you can update your preferences in the UCAS Hub.

The UK General Data Protection Regulation (GDPR) contains a variety of purposes for which personal information can be used, and our uses of personal information must meet one of these. They are listed at Article 6 of the GDPR.

There are also additional requirements in respect of ‘special category’ personal information listed at Article 9 (2) of the GDPR. The Data Protection Act 2018 contains provisions that allow personal information about criminal convictions to be used where certain circumstances apply.

This is known as the ‘lawful basis for processing’. UCAS’ lawful basis for using personal information varies, depending on the purpose for which we are using it. Our basis for processing is explained in more detail below.

Personal information

Purpose 1 – Managing your application to higher or further education, or attendance at a UCAS event

If you apply through UCAS, or register to attend a UCAS event, you’re accepting our terms and conditions, and entering into a contract with us. We’ll collect the personal information necessary to satisfy the purpose of this contract, such as personal information to allow course providers to make informed decisions on whether to offer a place on a course. This also covers personal information collected from other sources, such as referees, or examination and awarding bodies.

GDPR lawful basis for processing – Article 6 1 (b) ‘processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.

Purpose 2 – Sharing personal information with statutory bodies with responsibilities for the higher education sector, and to enable academic research into higher education

We share personal information with providers and other public authorities (e.g. government bodies such as the Department for Education) to help them with their statutory functions, including funding, regulation, and policy-making.

We share personal information with universities to help them meet, or demonstrate they are meeting, government aims or policies such as ‘widening participation’ initiatives, which require them to address discrepancies in the take up of higher education opportunities between different social groups. We also share personal information to enable academic research, in accordance with the aims of the Higher Education Research Act 2017. We also publish a wide range of reports about our higher education admissions schemes.

We always try to share information in a way that does not identify individuals, such as by providing statistical information. Where personal information is provided in a way that allows individuals to be identified, it is done so under contractual terms, and not used to support decisions being made about individuals.

GDPR lawful basis for processing – Article 6 1 (f) where ‘processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child’.

Purpose 3 – Commercial use of personal data through UCAS' commercial products and services including sending information to unplaced applicants about available courses, display advertising, providing services to universities to help their admissions strategies, and producing commercial research

If you apply through UCAS Undergraduate and do not get a place, we may send you course and opportunity information on behalf of providers, unless you opt out of receiving this. If you have subscribed to Google, Twitter, Facebook, LinkedIn, or Snapchat, we may also use their remarketing features to support promotion of our services that you have shown an interest in. You can stop receiving these adverts by following the advice in ‘Direct marketing, accessing student products, and how to opt out’ section of this privacy policy.

We give analysis to Universities and Colleges, to help them understand and measure the success of their admissions procedures, and improve them. We do not provide personal information that identifies individuals for this purpose. This may involve some individual level data matching activity to support the analysis; but, any information we share will be anonymised to ensure individuals cannot be identified. We also may provide statistical analysis to people or organisations undertaking research into the higher education sector.

Your personal data may be used to support the development and provision of commercial products to third parties. Personally identifiable information will not be shared through such products or services without your consent.

GDPR lawful basis for processing – Article 6 1 (f) where ‘processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child’.

UCAS does not receive public funding. Our funding comes from:

• the UCAS application fee to apply to university or college
• application charges to universities and colleges for placing applicants
• commercial revenues raised through additional services we provide, such as marketing, paid for research and our commercial product development

These services help fund our charitable purposes for public benefit.

These activities do not involve sharing personal information in a manner that identifies you with third parties; personal level information will only be provided with your consent. We issue information about relevant course opportunities on behalf of universities. You can opt out of receiving such information when they apply, and at any point during the admissions cycle. We have controls built in to the technology systems that produce our research, to prevent it being shared in a way that can identify individuals.

We may use personal level data to support the development of new commercial products. Individual data will never be shared through these commercial products or services without your consent.

Purpose 4 – Enhancing customer experience

We offer services that enhance customer experience, which people can opt in to. These include:

• receipt of information about education, careers, accommodation, and products and services that students might be interested in
• providing you with a code, to give to banks or other organisations to access products and services only available to students, such as student bank accounts (this is only if you apply through the UCAS Undergraduate scheme)
• if you apply though a school, college, or UCAS registered centre, you can choose to let that centre see the progress of your application. This allows your centre to support you throughout the application process

GDPR lawful basis for processing – Article 6 1 (a) where an individual ‘has given consent to the processing of his or her personal data for one of more specific purposes’.

We will obtain a separate consent for these functions, in addition to the terms agreed to when applicants and others agree to the terms of service associated with the product.

We may send you details of opportunities to support our market research or user research activity. If you decide to engage with these activities, your responses will be used to inform and improve UCAS products and services offered to our range of customers. We may share results from surveys with third parties to provide insight and analysis of services available to students. This may involve some individual level data matching activity to support the analysis; but any information we share will be anonymised to ensure individuals cannot be identified. Please review the terms and conditions for each survey individually for further data processing information.

GDPR lawful basis for processing – Article 6 1 (f) where ‘processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child’.

Contacting select groups of customers or partners to support engagement in improving our products through user testing research or market research is a legitimate activity which helps to improve the support and products we provide. Market research may be delivered by third parties under contract which will assure your information and responses are appropriately secured and managed in accordance with data protection legislation. Wherever possible, feedback and responses to this form of activity will be anonymised in any final reports.

Withdrawing consent

You can opt out of receiving further information and advice, by clicking the ‘Unsubscribe’ or ‘Update preferences’ links in the communications you receive from us. Or, if you have already applied, you can update your preferences in Track.

You can remove permission for your centre to be able to see your application by contacting us.

‘Special category’ personal information

Purpose 1 – Equality monitoring

When applying, applicants can choose to tell us their ethnicity, sexual orientation, and religious beliefs. Providers can use this information to review their performance in meeting their statutory duties in the Equality Act 2010. We may also use this information to produce similar analysis across the higher education sector. This personal information is shared with universities and colleges after an admissions decision has been made.

GDPR basis for processing – Article 9 2 (g) where the use of personal information ‘is in substantial public interest’, which the Data Protection Act 2018 clarifies can include keeping under review the existence or absence of equality of opportunity or treatment between different groups of people, including differences based on ethnicity, religious beliefs, and sexual orientation. This information is not used to influence decision-making, and will not be shared with a course provider until a decision has been made on your application.

Purpose 2 – Assisting applicants who declare they have a disability

When applying, applicants can tell us if they have a disability or any special needs. It also allows providers to arrange additional support and make necessary arrangements for applicants with specific needs, at an early stage.

GDPR basis for processing – Article 9 2 (b) where the use of personal information is necessary for carrying out obligations in the field of social protection law.

Criminal convictions

When applying to courses leading to professions or occupations exempt from the Rehabilitation of Offenders Act (1974), applicants are required to declare whether they have any criminal convictions, including spent convictions. This enables universities and colleges to identify potential issues at an early stage, and undertake ‘fitness to practice’ assessments to identify if an applicant is suitable for a course.

Data Protection Act 2018 – basis for processing:

• Schedule 1, part 2, paragraph 11 – protecting the public against dishonesty.
• Schedule 1, part 1, paragraph 1 – necessary for the purposes of performing obligations under the law relating to social protection.
• Schedule 1, part 1, paragraph 2 – necessary for health and social care purposes.

​

Collecting your personal information

In some circumstances UCAS collects images, including photographs and video footage with your consent for a specific purpose. In those situations, it will be made clear to you that in consenting you acknowledge and understand that you/your child’s participation in this activity is voluntary and that you freely consent to being recorded and that these recordings will be used by UCAS.

How we use your personal information

Images may be used for the following purposes:

1. Content for marketing materials
2. Content for commercial materials
3. Content for news media outlets
4. Content for distribution through social media, website, screenings and exhibitions
5. Uses required or permitted by law

How we share your information

Your/your child’s image may be published on any of the following channels, or other areas where appropriate:

1. in press and media (including newspapers, magazines, websites and social media)
2. on our websites
3. on our social media feeds including Twitter, Facebook, LinkedIn, YouTube and Instagram
4. in our printed publications
5. in printed publicity literature such as leaflets, posters or other display materials
6. at screenings, exhibitions and events.

Although your/your child’s image will initially be processed by UCAS within the UK, websites and other online media can be seen throughout the world, and not just in the United Kingdom, where UK law applies.

Your/your child’s image will be used in relevant campaigns and your consent form will be retrained for the period in which the image is in use. The duration of a campaign or use of your image may vary dependent on its content; however, it is likely that footage will be retained for no longer than 7 years, expect where it is retained for archival purposes.

Our website and privacy policy may contain links to other websites, operated by other organisations. Links which leave our website have an image next to them, of an arrow coming out of a box. We’re not responsible for the protection and privacy of any information you provide while visiting other websites. This privacy policy applies to this website only. Make sure you read the privacy policy of the website you’re visiting.