Privacy Notice:
General Enquiries

University for the Creative Arts
Marketing, Student Recruitment & Engagement Department

Privacy Notice: General Enquiries

Note: For the purposes of this Privacy Notice, “you” or “your” means an individual who is interested in courses and/or events at the University for the Creative Arts. “we”, “us”, “our” or “University“ means the University for the Creative Arts. “Personal Data” or “data” means your personal identification information that you have given us or we have collected. “Special Category Data” means specific sensitive data which we give more protection.

This Privacy Notice applies to enquirers of the University who have not yet applied to become a student but have expressed an interest in the University and/or its events. It explains how we will process your Personal Data, including what Personal Data we collect about you, how we use your Personal Data, the legal justification for using it and who might see it.

The University for the Creative Arts, Falkner Road, Farnham, GU9 7DS is the data controller of your Personal Data.

When we collect your Personal Data:

We may collect your Personal Data through our enquiry systems which include the following:

  • Data collection forms, either in person via a tablet or on our website;
  • Surveys;
  • Telephone enquiries;
  • Email enquiries;
  • Enquiries through our online chat function;
  • Your registration at a University event/stand;
  • From your business card when handed to University staff;
  • When passed from our representatives overseas;
  • When passed on from your current school or college.

What Personal Data are we collecting:

Examples of the Personal Data we may collect from you and store following your enquiry are as follows:

  • Your name;
  • Your contact information (such as your address, telephone number, email address, your social media handle);
  • Your date of birth;
  • Your nationality and/or country of residence;
  • Your activities in preparation for Higher Education, e.g. attendance at events and workshops;
  • Your communication preferences;
  • Your study preferences, including subject and level of interest;
  • Your results and feedback to any of our surveys;- Any questions you have asked or other personal details you have shared with us.

How and why we use your Personal Data: 
 
We only process data for specified purposes and where it is justified in accordance with data protection law.

In order for us to provide a service to you, such as answering your enquiry, sending you an ordered publication and registering your attendance at an event, we will process your Personal Data in order to:

  • Contact you about your enquiry;
  • Send you any requested materials, such as a prospectus;
  • Register you for an event and manage your booking;
  • Produce analytical reports and produce statistics. You will not be identifiable through these statistics, and no decisions will be made about you as an outcome of such reports and statistics;
  • Organise events and workshops, including registration, to ensure that we can meet your needs at the event, and including communications about the event;
  • Process your entry into any competitions that you enter;
  • Provide you with future promotional information about the University, our courses, our facilities, activities, news, views, general updates and any other information that may be of interest to you;
  • In some circumstances we may use individuals data to enable the creation of lookalike audiences and for retargeting purposes, enabling us to reach new individuals more effectively with similar interests and to deliver relevant content to you based on your previous interactions. Your personal data throughout this specific processing activity will remain fully secure and protected at all times.

Where you have registered for an event or workshop, our lawful basis for processing your Personal Data is contractual necessity.

Where you have submitted an enquiry or request for further information, our lawful basis for processing your Personal Data is consent.

Where your personal data is processed for statistical reports or analytical purposes, our lawful basis for processing your Personal Data is legal obligation or public task.

For marketing and promotional activity we are relying on your consent gained via online forms and direct email in order to carry out the processing of your Personal Data. Where you have made enquiries about courses or other services, we may contact you about similar courses or services in future, but you will have the opportunity to opt-out of future marketing when your contact details are first collected and you will have the option to ‘opt-out’ of marketing on all promotional emails sent to you.

If you fail to provide Personal Data:

Where we need to collect Personal Data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel the service you have with us but we will notify you if this is the case at the time.

Special Category Data:

In some instances, such as registering you for an event or activity, we will need to collect information about any accessibility requirements you have. This information will only be used to ensure we can accommodate any specific requirements you may have.

We are relying on your explicit consent, gained via email or by your signing our data collection form (or as otherwise given, as applicable), in order to carry out the processing of your Special Category Data.

Who your Personal Data may be shared with:

We have a list of approved suppliers with whom we will share your data, when necessary. This list includes:

Recipients Personal Data we may share with them
Fulfilment Houses – e.g. when we send you a prospectus Contact details, course of interest.
Our Customer Relationship Management Software and administrative / IT staff associated with student enquiries. Contact details, course of interest.
Survey Software Company Survey input details, contact information and account credentials where required for single sign-in

When do we transfer Personal Data outside of the United Kingdom?

We work with suppliers and partners who may make use of Cloud and/or hosted technologies so their processing may involve a transfer of data outside of the UK. We undertake data security due diligence on our partners, ensure that suitable contracts are in place and that these partners conform to appropriate accreditations.

Wherever these transfers take place, the University will have an appropriate contract in place and there are strict rules regarding the confidentiality and security of your information in place to safeguard it.

How long we will keep your data:

We will keep your data for a period of five years after your last engagement with us, after which it will be anonymised. One year later we will delete your data. If you become an applicant or student within this timeframe, the University’s privacy notices in relation to applicants and students (as appropriate) will apply.

Your rights:

You have rights under data protection laws in relation to your Personal Data. These rights include:

The right to access – You can request access to, or copies of, the Personal Data that we hold about you. If you would like to exercise this right, please contact us by emailing our Data Protection Officer using the contact details given below.

The right to rectification – You can ask us to put right any information that you believe is incorrect or where appropriate, given the purposes for which your data is processed, the right to have incomplete data completed. If you believe that any information we have about you is incorrect or incomplete, please contact us using any of the contact details given below as soon as possible. We will take steps to seek to correct or update any information if we are satisfied that the information we hold is inaccurate.

The right to erasure – You can request that your Personal Data be deleted, where it is no longer necessary for the purposes for which it is being processed and provided there is no other lawful basis for which we may continue to process such information; 
The right to withdraw consent – You can withdraw any consent given to processing (this will not affect the lawfulness of processing based on consent before its withdrawal).

The right to restrict processing – You can ask us to suspend the processing of your data in the following scenarios:

  • If you want us to establish the data’s accuracy;
  • Where our use of the data is unlawful but you do not want us to erase it;
  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims;
  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to process it.

The right to object to processing – You can object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. We may continue to process your personal data where we can demonstrate that we have compelling legitimate grounds to do so which override your rights and freedoms.

The right to data portability – You have the right to obtain and reuse your personal data for your own purposes across different services. The right to data portability gives you the right to receive personal data you have provided to us in a structured, commonly used and machine readable format. It also gives you the right to request that we transmits this data directly to another data controller.

The right to lodge a complaint – If you have any concerns on the way we are handling your Personal Data, you can lodge a complaint with us by contacting the Data Protection Officer on the details below and we will try to resolve any concerns you may have. However, if you consider that we are in breach of our obligations under data protection laws, you have the right to lodge a complaint with the Information Commissioner's Office.

The University has an appointed Data Protection Officer (DPO). Their postal address is:

Data Protection Officer, UCA Farnham, Falkner Road, Farnham, GU9 7DS

They can be emailed at dpo@uca.ac.uk

If you would like to exercise any of your rights as described above (or if you have any questions about this Privacy Notice or concerns about our dealings with your Personal Data), please contact the Data Protection Officer.

Updates to this Privacy Notice:

The University may change this Privacy Notice from time to time in order to reflect changes in the law and/or its privacy practices. When this happens and where the University is required to do so by law, it will provide you with a new and/or updated Privacy Notice detailing how the use of your Personal Data is changing and, if necessary, obtaining your consent for the further Processing, as may be applicable.

Last reviewed on Thursday 27th February 2025.