Personal data means any information relating to a person who could be directly or indirectly identified by that information. This definition provides for a wide range of ways that a person may be identified by their data. This includes their name, identification number, location data or an online identifier. Some information is considered to be ‘Special Category’ information and needs more protection because of its sensitivity.
The University of Westminster is the Data Controller for the personal information held in relation to prospective students. This Privacy Notice is in addition to the University’s privacy notice.
How we collect information
We collect information about you when you:
- Make a course enquiry or order a prospectus.
- Register for an event or visit the university for an open day or campus tour.
- Participate in online events or live chats.
- Attend higher education fairs at home or abroad.
- Request information about the University via the Unicompare website.
- Sign up to hear more about the University or our services.
- Make an application to study at University of Westminster.
Confidentiality
The information you provide will only be shared with colleagues from the service who are directly involved in handling your enquiry, request or application.
What information we collect and hold
Personal information collected includes:
- Name
- Contact details (telephone, email, address)
- Country
- Gender
- Application details
- Qualifications
- Next of kin details
- Letters and documents
- Test scores and interview notes
- Financial information
Special category information collected includes:
- Any disability information you disclose
- Accessibility or dietary requirements
- For applicants, any criminal convictions declarations, immigration status, nationality and equality, diversity and inclusion (EDI) records.
Before application the University will not gather or require you to give us any sensitive personal data to fulfil your enquiries. If a situation should arise where we feel it would be in your interest to have the opportunity to tell us some sensitive personal details, relating perhaps to your health or disability, this information will only be gathered and used with your explicit consent. Any sensitive personal information we hold will only be shared where it is essential for the delivery of any agreed service, such as a campus tour.
To withdraw consent for the University to hold and share your sensitive personal data relating to an enquiry you have made, please contact: [email protected].
To withdraw consent for the University to hold and share your sensitive personal data relating to an event registration you have made, please contact our Events Manager: [email protected].
How the personal information we hold is used
Your personal information will be used to:
- Respond to your enquiry or to send you information.
- Register you for an event, open day or campus tour.
- Provide you with answers to questions about our courses and teaching.
- Send you information about our services.
- Send you advertising information, please see further details below.
- Provide support to prospective students.
- Enable communications with existing student ambassadors.
- Process your application to study at the University of Westminster.
- Verify your qualifications.
- Run sponsorship and immigration checks.
- Run interviews and tests as required.
- Provide you with an offer letter.
- Create a student record.
- To send you messages during clearing to guide you.
- For reporting, service management and service improvement activities.
- For other administrative purposes, for example; to undertake statistical analysis, conduct market research and internal filtering in order to ensure the information we send is relevant to you.
- Retargeting activity on Meta.
Emails sent from our customer relationship system may include tracking pixels that help us establish which of our emails are more interesting to prospective students to ensure emails are optimised and tailored.
We might send you information advertising our courses and services. Where you have agreed, we will try to ensure that any online advertising you see from the University of Westminster is relevant to you. We use a Google tool that allows us to match your data with your online profile, and either enables or prevents certain adverts from appearing during your online sessions. In our use of this service, Google will not use your data files to build or enhance profiles of you, they will not share your data files with any third party and your data will be promptly deleted once our ad campaigns have finished.
Our reason for processing your personal data
We process your personal data for the following reason:
- You have given your consent.
- Processing is necessary for the performance of a contract (or to enter into a contract).
- Processing is necessary for a task in the public interest.
- Processing is necessary for a legitimate interest of the University.
Special category data is processed for the following reason:
- You have given your consent.
- Employment, social security and social protection.
Organisations we may share your information with in relation to this processing
We may share your information with the following organisations:
- UCAS
- UKVI
How we protect your information
The personal information we hold will be processed with appropriate security and used in accordance with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). Your information may be held outside of the UK. Where this is the case, we ensure that appropriate measures are in place to protect your data.
Our data retention policy
We will retain this information only for as long as necessary. We may aggregate and anonymise data for wider internal management reporting or research purposes. Personal data will be kept in line with the university’s retention schedule.
The University will only process and retain your personal information in our CRM and other systems as follows:
- One year after your stated preferred year of entry your data will be anonymised. For example, if your stated year of entry is 2023/24 your data will be anonymised by November 2024.
or - If you have not stated a year of entry then your data will be anonymised one year after the academic year that your data was collected. For example, data collected during academic year 2023/24 will be anonymised by November 2024.
After which time, your personal data will be archived, anonymised and then only used for aggregate statistical purposes.
Your anonymised data will then be hard deleted five years after your data was collected, or five years after your stated year of entry, if you gave one.
If you provided your details via an event platform, your details will be deleted from the platform within twelve months, but your data may be retained in our CRM as described above.
Disclosure of information to third parties
Personal information will not be disclosed to external organisations other than those acting on the instructions of the University. Where this is the case, a written contract will be put in place between the University and the third party setting out appropriate data protection obligations.
We use several commercial companies and partners to either store personal information or to manage it on our behalf. Where we have these arrangements, we ensure that there is a contract or data sharing agreement in place to ensure that the requirements of data protection legislation are met.
Sometimes we have a legal duty to disclose personal information. We may share your information:
• for the detection and prevention of crime and fraudulent activity
• if there are serious risks to the public, our staff or to other professionals
• to protect a child
• to protect adults who are thought to be at risk
Your rights
The law gives you several rights to control which personal information is used by us and how it is used by us.
How can you access the information we hold about you?
You are legally entitled to ask to see any records we hold about you. If you wish to request access to the personal information we hold about you, please contact the Information Compliance Team through the University’s subject access procedure.
How can you request correction of inaccurate information?
Whilst we try to ensure that any personal data we hold about you is correct, there may be situations where the information we hold is no longer accurate. If this is the case, please contact the department holding the information so that any errors can be investigated and corrected. If you don’t know which department to contact please contact the Information Compliance Team.
You can ask to delete information (right to be forgotten)
In some circumstances you can ask for your personal information to be deleted, for example, in instances where:
• Your personal information is no longer needed for the reason why it was collected in the first place.
• You have removed your consent for us to use your information (where there is no other legal reason for us to use it).
• Deleting the information is a legal requirement
Please note that there are situations where the right to be forgotten does not apply. Please contact the Information Compliance Team to make a request.
You can ask to limit what we use your data for
In some circumstances, you have the right to restrict what processing an organisation carries out or ask that they stop processing your personal data. When processing is restricted, the organisation may continue to store your data but not process it further. Please contact the Information Compliance Team to make a request.
You can ask to have your information moved to another provider (data portability)
You have the right to ask for your personal information to be given back to you or another service provider of your choice in a commonly used format. Please contact the Information Compliance Team to make a request.
You can object
You have the right to object to processing of your personal data at any time. This means that you can stop or prevent an organisation from using your data. However, it only applies in certain circumstances. Please contact the Information Compliance Team to make a request.
Automated decision making and profiling
You have a right to request that decisions based solely on automated processing, including profiling, which may produce a legal effect or affect them significantly, to have some form of human input so they are not automatically generated by a computer. Please contact the Information Compliance Team to make a request.
Right to complain
You have the right to complain about how we use your personal data. In the first instance, please contact the Information Compliance Team.
How to contact us
If you would like further information or if you have any concerns about how we handle your data, these can be raised with our Information Compliance Team by emailing [email protected] or writing to:
Information Compliance Team
University of Westminster
32-38 Wells Street
London
W1T 3UW
Independent advice
Independent advice can be sought from the UK regulator for data protection, the Information Commissioner’s Office (ICO).
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
T: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.
Alternatively, visit the ICO website or email [email protected].
This privacy notice and updates
If you have any queries about this privacy notice, or about how we hold and use your data, please contact the Information Compliance Team.
We will review and update this privacy notice to reflect changes in our processes and procedures. When such changes occur, we will revise the 'last updated' date on this notice. We encourage you to periodically review this notice to remain informed.
Last reviewed and updated November 2025