Prospective student privacy notice

The University collects, holds and uses personal data about prospective students, parents/guardians of prospective students, recruitment agents and others assisting prospective students.

What we process

In particular we hold and process your:

• First name and last name
• Date of birth
• Email address
• Postal address
• Phone number
• Name and address of the education institution(s) you attend(ed)
• Gender
• Nationality
• Residential status
• IP address of the device you use to access the University of Surrey webpage.

Special category data

We may process data called “special category data” as we mark your record to indicate whether you have disclosed to us any of the following:

• Disability/accessibility requirements for open day booking
• Any data that indicates that you may fall into one of our Widening Participation categories. You can find more information about this from the In2Surrey scheme.

Sources we receive data from

We receive this data directly from you from a variety of different sources, depending on how and where you have met with us. This will be either from:

• Online requests for prospectus or the downloadable brochure, for the postgraduate prospectus this will be via We are SMILE Ltd (from September 2024)
• Event bookings; Veterinary School and Health Science open day bookings may use Eventbrite to manage the event but you will be prompted about this at the time of booking
• Participate in a University of Surrey competition and prize draw
• Registration details for events via Eventbrite where you have signed up to attend an event
• Registration of interest or sign-up forms (including from third party sources – currently: Unibuddy, Springpod and Keystone Education Group)
• The data collection app we use at recruitment fairs. The app is currently provided by Akkroo
• Scanners we use at certain events (currently UCAS and UK University Search, QS and FAUScan)
• The event organisers collect the data in these cases, but you will be prompted about this when you register at the event
• Email or phone enquiries or the Admissions enquiry web form; if you email or phone us with an enquiry or submit an enquiry though our web form we will record the information you give within our database. This may include special category data if you disclose this to us but you will be asked for your consent for us to store this information in our next email to you, or as part of the phone conversation
• Overseas agents or third parties who you enter a contract with to support you through the application process if you are applying from overseas
• Your IP address which is captured when you visit the University website. A tracking code (cookies) is used to create records based on your IP. The tracking code is created the moment you view the webpage. We capture consent from you to do this when you visit the University website.

The University collects only the data we need and we keep the data up to date and only for as long as it is needed.

We collect your personal data in order to:

• Provide you with information that you have requested about studying at Surrey
• Contact you via email with additional information about studying at Surrey and about the local area
• Manage event bookings.
• Participate in a University of Surrey competition and prize draw

Legal bases for processing your data

We take our obligations for data handling very seriously and it is therefore important for you to know that we process your personal data on the following legal bases:

• Data is processed in our legitimate interests where we communicate with you to fulfil a request for information e.g. to send a copy of our prospectus or event booking such as an open day and to follow up with you after the event for feedback.
• These purposes will never override your personal interests, fundamental rights and freedoms which require protection of your personal data.
• We process your data to carry out a task i.e. the provision of educational and research opportunities which is part of our obligation as a public authority where we communicate with you once you have applied to Surrey about your application.
• We process your data in order to comply with a legal obligation (such as equal opportunities monitoring) or regulatory obligation (when we report to governmental bodies but you will not be able to be identified as an individual in our reporting.
• We process your data only with your consent for other emails and similar communications where we tell you things we think you would like to know about Surrey (marketing and targeted communications). For example, where you have completed Facebook’s data capture form expressing your interest in learning more about Surrey. For more information on how Facebook manage your personal data, please see their privacy policy.
• We will also ask for your consent whenever you tell us about any special category data. We obtain this consent at the time you provided us with the data.

The University processes personal data and special category data in accordance with data protection legislation and Our Data Policy Statement (PDF).

Before you make an application

Data collected before you make an application to Surrey is handled by our Market Insight and Data team, Marketing and Communications Department and the Recruitment and Admissions Department who hold your information in an externally hosted database. This database is currently managed by Hobsons, view their privacy notice.

We also use the information you provide to compile statistics and conduct research in relation to enquirers, applicants and students for the purpose of planning, reviewing, managing and developing the University’s business, (but not to make any decisions about you).

We may also use your email address for the creation of lookalike audiences on Meta platforms (such as Facebook and Instagram). This involves securely uploading your email address to Meta, where it will be hashed to protect your privacy and matched with similar users to help us to deliver advertisements to more relevant audiences.

We keep your personal data in accordance with the University’s retention schedules. This means that your data is kept for a maximum of 5 years after your intended year of entry.

Your personal data will only be shared with those third parties with whom the University works with in order to provide you with relevant, personalised communications.

Third party service providers

These are organisations who provide the following services:

• Service providers who send out emails, SMS e.g. Meercat, or other communications on behalf of the University.
• Service providers who assist in the process of distributing open day programmes (currently Something Big and Impress Print).
• Survey providers who support the way we obtain feedback from open days (currently SurveyMonkey and SurveyGizmo).
• We use live chat software on our website. This is provided by Click4Assistance who are a UK-based software company, view their privacy policy
• Service providers who assist in the process of distributing prospectuses (currently Impress Print)
• Virtual and physical scanner recruitment fair data from third party event hosts. We currently use UCAS, QS, FindAUniversity's FAUScan and the Council of International Schools.
• Third-party advertising platforms who allow us to target lookalike audiences, currently Meta. Your email address would be hashed to protect your privacy.

No information will be passed to third party organisations for them to contact you directly themselves.

Data will be transferred from overseas only where you have given consent for an overseas agent or overseas university staff to enquire about studying at Surrey. The University works with overseas agents as data processors to assist you with managing the application process if you are an overseas applicant.

Data will only be transferred overseas to university staff to follow up on enquiries or applications from international students or applicants in that region. Information provided to overseas university staff and overseas agents acting on our behalf is subject to the same protection, processes and rights as data held in the UK. All transfers to overseas agents is bound by a data processor contract which sets out how they will handle your data in accordance with UK data protection legislation.

As an individual whose data we process (a data subject), you have certain rights in relation to the processing. Find detailed information about your rights as a data subject.

You have the right to:

• Withdraw your consent for us to process your personal data where we have relied on you giving us your consent to processing
• Ask us to confirm that your personal data is being processed and to access (i.e. have a copy) of that data as well as to be provided with supplemental information about the processing.
• Request that we rectify any inaccuracies where the data we hold on you is inaccurate or incomplete
• Have your data erased by us, although in certain circumstances we may not be able to do this. The circumstances where this applies can be found in the guide to data subject rights information.
• Restrict the processing of your personal data in certain ways
• Obtain your personal data for reuse
• Object to certain processing of your personal data.

If you would like to exercise any of your rights please visit our make a privacy request section.

Make a complaint

If you have any concerns about the way that we have handled your personal data please email the Data Protection team as we would like to have the opportunity to resolve your concerns.

If you’re still unhappy, you have the right to complain to the Information Commissioner’s Office (an independent body set up to advise on information rights for the UK) about the way in which we process your personal data.