SurreyLearn privacy notice

If you are a student (or a staff member who is enrolled as a student):

SurreyLearn collects information about which courses you are enrolled into, your assignment submissions, assignment feedback, video feedback, discussions, and grades information.  

SurreyLearn also collects your computer’s IP address and data relating to your visits to SurreyLearn that record your use of your modules and module content, including, for example, details of course materials and tools you have accessed.  

To enrol you into your courses and create your profile, SurreyLearn also stores your full name, email address, gender which you provided at registration.

It also stores your profile picture, if you have uploaded one. 

If you are a staff member:

SurreyLearn collects information about which courses you are enrolled into (that is, if you are teaching, access for another purpose such as viewing content etc.). It also collects visits to modules, feedback, discussion posts you have contributed to and assignments that you set.

SurreyLearn also collects your computer’s IP address and data relating to your visits to SurreyLearn that record your use of your modules and module content, including, for example, details of course materials and tools you have accessed.  

To enrol you into your courses and create your profile, SurreyLearn also stores your full name, email address, gender which you provided at registration.

It also stores your profile picture, if you have uploaded one. 

We receive this data from you when:

• If you are a student - enrol as a student at the University and during the period of your study via the University’s SITS platform
• If you are a staff member - commence employment and during the period of your employment at the University via the University’s Peoplesoft platform
• Upload any information directly, for example profile pictures.

We collect this information to:

• Provide, facilitate, and administer courses and improve their quality
• Comply with regulatory requirements such as providing information in support of an appeal
• Provide students with support in using SurreyLearn
• Provide third-party services available through SurreyLearn
• Enable us to identify where students may be at risk of disengaging with their studies
• Provide support to students with their studies via engagement monitoring
• Improve the student experience, for example course design
• Enable us to prepare reports for learning analytics to benefit students and inform course design.

The University collects only the information needed and the data is kept up to date and only for as long as it is required.

It is important for you to know the lawful basis for us processing your information:

We process data to meet our statutory and legal requirements, specifically to meet statutory obligations for Tier 4 students (and ad hoc reporting not rolled out to everyone but on specific request).

We also process data in our legitimate interests to report on student progress and engagement.  

These legitimate interests are determined through an assessment made by weighing our requirements against the impact of the processing on you. Our legitimate interests will never override your right to privacy and the freedoms that require the protection of your personal data. If you are interested in learning more about this legitimate interest assessment, please contact dataprotection@surrey.ac.uk.

We process personal data in accordance with data protection legislation and our own Data Protection Policy. 

We use the data to support you in your studies and to enable module leaders and teaching staff on your module to review engagement and to inform and improve course design.

We analyse the effectiveness of Surreylearn at a personal and an aggregate level by using your data to monitor engagement and to inform and improve course design.

We keep your personal data in accordance with the University’s retention schedules, which is 7 years.

We take the security of the personal data we hold seriously. Details on university wide measures surrounding IT security can be found in Our Data Policy Statement (PDF) (incorporating Information Security Policy).

We have internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties.

Where we engage third parties to process personal data on our behalf, they do so on the basis of written instructions contained within a contract, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

Supporting your studies

We share your data internally via reports with your module leader and teaching staff on your module to enable them to support you through your studies and to inform future course design.

Your activities on your course may also be shared internally for academic research purposes. This includes the comments you make where you may disclose certain personal information about yourself. 

We may also share information securely with third party services, such as DOMO and Panopto available through SurreyLearn. 

Academic research

In the information we share for academic purposes, your personal information, discussion comments or other course activity is never linked with your user profile information (such as name or profile picture). However, it may still be possible to identify you by finding your comments on SurreyLearn and seeing the anonymised user linked to them, or by the content of your comments. Institutions who conduct research will never connect your comment or your activity with you as an individual and will always treat any personal data in strict accordance with research ethics guidelines and data protection laws. 

We may also share data externally to enable ourselves and other partner universities to carry out academic research on your access of course materials and tools in SurreyLearn. In this case your information will be anonymised and transferred securely.

Research will always be conducted in accordance with our Research Ethics guidelines. 

As an individual whose data we process (a data subject), you have certain rights in relation to the processing.  You can find detailed information about your rights as a data subject on the University’s webpage. 

You have the right to:

• Withdraw your consent in circumstances where we are processing your personal data on that basis
• Ask us to confirm that your personal data is being processed and to access (i.e. have a copy) of that data as well as to be provided with supplemental information about the processing
• Request that we rectify any inaccuracies where the data we hold on you is inaccurate or incomplete
• Have your data erased by us, although in certain circumstances we may not be able to do this, for example, where we must comply with a legal obligation or in managing your health and social care. The circumstances where this applies can be found in the data subject rights information on the University’s webpage
• Restrict the processing of your personal data in certain ways
• Obtain your personal data for reuse
• Object to certain processing of your personal data.

To exercise any of these rights, please contact dataprotection@surrey.ac.uk. 

If you have any concerns about the way that we have handled your personal data please contact us at: digital.learning@surrey.ac.uk as we would like to have the opportunity to resolve your concerns.  If you’re still unhappy, you have the right to lodge a complaint with the Information Commissioner’s Office. Please see their website at: https://ico.org.uk/make-a-complaint/.