Privacy Notice for Enquirers and Prospective Students

About this notice

This privacy notice explains who we are, how and why we collect and use personal information which you submit into the Student Relation Management (SRM) System, and your enquiries and cases raised with staff within our Student Hubs, our purposes and lawful bases for processing, who we share your personal data with, relevant retention periods, and how you can exercise your privacy rights.

This notice provides information that is in addition to information contained in the University’s Student Privacy Notice. Please do read this notice to understand how we use your personal information and if you have any questions please contact us using the contact details provided below.

Who we are

Throughout this notice, “University”, “we”, “our” and “us” refer to the Manchester Metropolitan University, an exempt charity under Schedule 2 to the Charities Act 1993 (amended by the Charities Act 2011). The University is the Controller in respect of the personal data you provide as part your enquiry or case.

The University is registered as a Controller with the Information Commissioner’s Office (ICO). We manage personal data in accordance with the General Data Protection Regulation (GDPR) and the University’s Data Protection Policy.

The personal data we process

Your personal data is collected direct from you via your student portal submissions, your enquiry to the student hub e-mail address or in person within our Student Hubs. The personal data we hold is dependent upon your enquiry, but typically includes:

  • Your name, contact and course information.
  • Details of your enquiry: date, enquiry information, referral information, resolution and closure information.
  • A log of your interactions (phone, appointments, notes, communications) with our Student Hubs.
  • Details of your exceptional Factors claim, including evidence.
  • Details of your disability and support information, including medical evidence.

Students are reminded that more sensitive information should not be submitted as part of general enquiries.

The purposes of the processing

Our Student Hubs are the first point of contact for the majority of students, dealing with up to 250,000 enquiries and 1200 different query types a year. Our SRM student enquiry management system supports us to resolve these enquiries, meet your expectations and offer improved services. We rely on the following lawful bases to process your personal data for the following purposes:

  • Legitimate interests – effective enquiry case management and resolution. The resolution of the majority of student enquiries falls within the legitimate interests lawful basis. We administer and manage your case at your request. It is therefore within your reasonable expectations that we would record your enquiry, investigate and respond accordingly.

Depending on your enquiry, we may process your personal data as follows:

  • Contract – if your enquiry relates to a student service which we provide as part of our student contract - the processing is necessary for the performance of the University’s contractual obligations to you prior to, during and for a period after a programme of study. The University may additionally enter into a contract with you regarding residence within student accommodation.
  • Public Task – if the resolution of your enquiry involves providing support to you in a manner which supports your study or learning, then the processing is necessary for the provision of higher education services to students, this is a specific task in the public interest that has a clear basis in law under the Education Reform Act 1988 and the Education (High Education Corporations) Order 1988, which confirm the University as a higher education corporation.
  • Legal obligation – if your enquiry relates to statutory obligations then the University processes your data to ensure that it is complying with our legal obligations, for example in respect of Council Tax or Home Office requirements regarding visas.
  • Legitimate interest – to conduct service improvement activities in a manner, which do not target or make recommendations in respect of particular students. E.g. to evaluate the types of enquiries and to enable us to improve our level of service.

Special category data

We may collect and process personal data defined as special category in order to: consider and administer your exceptional factors request, and to make ‘reasonable adjustments’ for individuals with a disability to avoid them being put at a disadvantage under the Equality Act 2010. We do this with your consent and as per our legal obligations.

The recipients or categories of recipients of the personal data

Most student enquiries will be resolved within the Student Hubs, others will require referral to 50 specialist teams across the University who provide a variety of additional services to students. Relevant specialist services are able to pick up the enquiry digitally and respond directly to the student within the SRM.

Referrals are dependent upon your enquiry. Examples may include: to our student and programme management teams, exceptional factors teams, counselling, mental health and wellbeing services, disability services, careers and employability services, and other specialist areas of Student Services.

We do use the services of Unit4 and Microsoft as processors to host and support our SRM system, this is subject to data protection compliant contracts which contain all necessary confidentiality and information security provisions. Unless you provide us with your consent, i.e. engagement with council tax teams, Home Office visas etc, or there are exceptional circumstances, we will not make any disclosures to third-party recipients.

Data retention

Your personal data will only be retained for as long as it is necessary in accordance with the University’s Retention and Disposal Schedule. Specifically, enquiry and case information will be retained from the date of the last action on the case for a period of six years.

Your rights in respect of the processing

The GDPR provides data subjects with the following data subject rights:

  • The right to be informed – the original privacy notice used at the point of data collection, combined with this additional privacy notice information assists with fulfilling these obligations.
  • The right of access - You have the right to be told whether we are processing your personal data and, if so, to be given a copy of it. This is known as the right of subject access. The right of access to personal data held about you exists in order to be aware of, and verify, the lawfulness of the processing. You can find out more about this right on the University’s Subject Access Page.
  • The right to rectification - If you believe that personal data we hold about you is inaccurate, please contact us and we will investigate. You can also request that we complete any incomplete data. Once we have determined what we are going to do, we will contact you to let you know.
  • The right to erasure and right to object - You can ask us to erase your personal data in any of the following circumstances: we no longer need the personal data for the purpose it was originally collected; you withdraw your consent and there is no other legal basis for the processing; you object to the processing and there are no overriding legitimate grounds for the processing etc. Once we have determined whether we will erase the personal data, we will contact you to let you know.
  • The right to restrict processing - You can ask us to restrict the processing of your personal data in the following circumstances: you believe that the data is inaccurate and you want us to restrict processing until we determine whether it is indeed inaccurate, the processing is unlawful and you want us to restrict processing rather than erase it, we no longer need the data for the purpose we originally collected it but you need it in order to establish, exercise or defend a legal claim and you have objected to the processing and you want us to restrict processing until we determine whether our legitimate interests in processing the data override your objection. Once we have determined how we propose to restrict processing of the data, we will contact you to discuss and, where possible, agree this with you.

Please use the contact information below to exercise these rights.

Contacting us

For questions or concerns about this Privacy Notice, or our use of your personal information, you can contact us using the contact information seen here: https://www2.mmu.ac.uk/student-life/contact-us/ in the first instance.

Our Data Protection Officer can also be contacted using [email protected], by calling 0161 247 3884 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority in respect of the processing of your personal data. We would encourage you to expend our internal complaints procedure through our initial contact and the University Data Protection Officer, prior to contacting the ICO. Please contact: [email protected] or telephone: 0303 123 1113. For any further contact information please see: https://ico.org.uk/global/contact-us/.

Updates to this privacy notice

We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.