Enquirer, applicant and offer-holder privacy notice

SOAS University of London is the higher education institution about which you have enquired, or to which you have applied for a place on one of our courses. We are a Data Controller in respect of your personal data, which means we decide how and why we use your data. We have appointed a Data Protection Officer whose role is to inform and advise us about, and to ensure that we remain compliant with, data protection legislation. The Data Protection Officer should be your first point of contact if you have specific queries or concerns about your personal data. For general admission queries, please contact the relevant Admissions team. Contact details for undergraduate, postgraduate, distance learning and foundation/short course queries can be found in the Study at SOAS section of the website.

Our current Data Protection Officer is the Information Compliance Manager who can be contacted via email dataprotection@soas.ac.uk or call 0207 898 4817.

If the Data Protection Officer is unavailable, you can contact the Records Manager by email (dataprotection@soas.ac.uk) or by post at this address: Information Compliance Office, SOAS University of London, 10 Thornhaugh Street, Russell Square, LondonWC1A 0XG.

This notice explains how and why SOAS processes personal data about its course applicants. This notice covers any individual who registers interest in any of SOAS’s degree programmes or short courses, including individuals who provide information to the Student Recruitment Officers or any contracted agent of SOAS, individuals who enquire about studying at SOAS by email or through our online forms or by any other means, as well as individuals who apply for degree programmes and short courses.

You should read this notice, so that you know what we are doing with your personal data. Please also read any other privacy notices that we give you, that might apply to our use of your personal data in specific circumstances in the future. For instance, if you accept a place to study at SOAS we will provide you with a notice explaining how we use registered students’ data.

SOAS is a Data Controller in respect of your personal data. We have responsibilities to process your data lawfully, to tell you about how we are processing your data, and to safeguard your data.

We process your personal data to enable us to provide you with information about the various programmes of study available at SOAS, and to effectively administer the admissions process, particularly to ensure that admissions tutors have all the right information needed to make evidence based decisions about who to accept to courses.

The activities in which your personal data will be processed are:

• Sending you information about degree programmes and courses, other study related information and tracking your application
• Sending you other relevant information in response to an enquiry about studying at SOAS and/or making a choice to study at the School including sending you information about a recruitment event you have registered to attend either on or off-campus
• Sending marketing and other promotional information
• Processing your application to a course at SOAS
• To record and monitor your right to study and SOAS’s compliance with Immigration Rules
• Deciding whether to offer you a place at SOAS and communication with you about the outcome
• Conducting a tuition fee assessment to ascertain applicant fee status

If you are attending an Open Day, we will record your attendance and may ask you for further information during or after the event. When we collect the information, we will tell you why we are doing it, how long we will keep the data, and whether it will be shared with any third parties. You will also be told how to pursue your rights under data protection law.

The School is required by law to always have a “lawful basis” for processing your personal data. This is a condition which allows us to do the processing, and it must (a) fit the purpose of processing, and (b) protect your rights and freedoms. As a prospective applicant, candidate or offer-holder you can identify the basis which SOAS has identified as most relevant for each purpose by looking at the table below:

As seen in the table above, some of the data processing we do is on the condition that it is in the interests of the individual and the School. For example, when you make an enquiry about our courses or express an interest in studying at SOAS by giving your details to our recruitment officers or agents, we will use your contact details to provide you with information about the course you are interested in and other relevant study-related information to help you make an informed decision.

If you decide to move forward with an application to study at the School, we will use the data you provide to process your application. If you are an undergraduate, we will receive your data from UCAS and will transfer the data from their system to our student records system. If you are a postgraduate, you will submit your application directly to us through our postgraduate application system. Whilst the School is deciding whether to make you an offer to study, we are processing your data in the School’s and your legitimate interests. This means that you have the right to ask us to stop processing your data at any point i.e. by telling us you would like to withdraw your application.

Once the School makes you an offer which you then accept, we consider that SOAS is taking steps to enter into a contractual arrangement with you at your request, and will need to assess your fee status based on the information you provided in your application. At this stage you can no longer ask us to stop the processing, although you do have the right to ask for access to your data, and to correct any inaccuracies.

SOAS needs to collect, maintain and use your personal data to respond to enquiries about degree programmes and other courses, to manage and track your application, and to manage the provision of offers the preparations for your arrival at the School.

If you have made an enquiry about studying at SOAS, we will collect the following types of data:

• Your name (including title)
• Your contact details (such as address(es), phone number(s), email address(es)
• Your date of birth
• Your gender
• Your nationality
• The country in which you live
• Courses in which you expressed an interest
• Education and employment history, including any qualifications achieved or predicted grades

If you have made an application to one of SOAS’s courses, or hold an offer from SOAS to study, we will collect all the above information plus the following types:

• Passport number (eg. for IFCELS courses)
• Contact details of emergency contacts
• Copy of passport, visa and right to study documentation where relevant.
• For the purposes of assessing eligibility for bursaries, or applications for hardship funds programmes linked to these, a record of household income will be collected and maintained
• Your application form. We will use the details you provide on your UCAS application or in the case of direct entry (including pre-sessional courses, Academic Summer School, courses run by the Language Centre, or Asian Art short courses) your SOAS application plus any supporting documents requested as part of your application and additional details provided by any referees and recorded following any interview or selection process.

When you apply for undergraduate or postgraduate taught and research degrees, you will be asked to provide some information which is considered ‘Special Category Data’ under data protection law. If SOAS wants to process Special Category Data, we must take extra measures to protect it i.e. by proving we have a valid condition under Article 9 of the GDPR in addition to our lawful basis for processing the data. The types of data which the law defines as Special Category are: ethnic and racial background, health, religious and philosophical belief, trade union membership, political opinion, sexual life and sexual orientation, genetic data, and biometric data to the extent that this can identify an individual. SOAS also needs to take the same measures to protect criminal convictions data.

The types of Special Category Data which you will be asked for when you apply for undergraduate or postgraduate degrees are:

• Ethnic and racial background
• Health (including declaring a disability)
• Religious belief
• Sexual life or sexual orientation

SOAS collects information on your ethnic/racial background, religious or philosophical beliefs, and sexual orientation, for equal opportunities monitoring purposes, including where conducted for the Higher Education Statistics Agency.

When you sign up for an open day or apply to one of our courses, you will have the opportunity to provide us with information about any disabilities or other medical conditions you have so that we can facilitate your access to the buildings, and we can respond appropriately in the event of a medical emergency whilst you are on campus.

We will process your Special Category Data because:

• You have provided us with explicit consent
• Because it is in the public interest
• Because we are authorised by law to process it
• It is in your vital interest.

SOAS will share your personal data with relevant staff at the School for the purposes of assessing your application to study here, but we will also share your information externally with the third parties listed below. Some of these third parties will receive your data as a processor, which means SOAS has a contract which tells them what data to process, why they are doing it, and how to do it. Other third parties will receive it as a controller, which means they have their own interest in the personal data, and need to process it for their own purposes. Where necessary we will have a data sharing agreement with those parties.

• Your referees
• Where relevant and as required and/or notified to you, your school/college or training organisation
• Your examination boards or awarding bodies
• Your student support assessment body
• Your funders and/or potential funders, including in the case of international applicants, the British Council or appropriate agencies
• Where relevant and as required, UK Visas and Immigration in order to act as your sponsor for visa purposes
• Where relevant and as required, governmental bodies including local authorities, the Home Office, and the Department for Work and Pensions and its agencies
  UCAS for the purpose of investigation in cases where we need to verify aspects of the application
• Where necessary and as required, law enforcement agencies
• Our data processors, such as suppliers of our Marketing Customer Relationship Management (CRM) system and postgraduate application system
• Any other relevant professional or statutory regulatory bodies
• Third party student accommodation providers with whom the School has nomination agreements, or the University of London who provide intercollegiate accommodation
• To banks (and other payment agencies you may use), family members who are paying a deposit, application fees, or early tuition fee payments before student registration. where appropriate and this includes the disclosure of relevant information to our supplier of banking services for the purposes of complying with anti-money laundering regulations
• Where you have applied with the support of an educational agent we will share the details of your application with them with your consent.

There are certain circumstances in which SOAS will need to transfer your personal data to countries outside the European Economic Area (EEA). This includes data shared with funders or potential funders who may provide financial support for your studies, your academic referees, or educational agents who supported your application. In each of these cases we will not share your personal data without your consent.

If you enquire about or apply for courses and materials from the list below, you will provide your details on a form hosted by Jotform. Jotform will receive your data as a processor, which means that they will only use the information in accordance with our instructions. Jotform is a company registered in the United States, and is certified by Privacy Shield, a contract between the EU and the United States which provides a framework for the safe transfer of personal data between the jurisdictions.

List of enquiry and application forms hosted by Jotform:

• Academic Summer School application form
• Academic Summer School enquiry form
• International Foundation Centre for English Language Studies application forms
  Centre for International Studies and Diplomacy enquiry form
• Undergraduate and Postgraduate prospectus request forms
• Yoga Summer School application form

If you are a postgraduate applicant your application will be processed on our third-party system. The suppliers of the system use cloud storage based in the United States., and data may be subject to onward transfers outside the EEA. The transfer of your application data to the United States is covered by the Privacy Shield framework. Onward transfers of data to other territories outside the EEA and the European Commission’s Standard Contractual Clauses.

The length of time we keep your information depends on whether you are an enquirer, unsuccessful applicant or a successful applicant who goes on to enrol at SOAS.

If you enquire about one of our courses, we will retain your personal data for three years from the end of the academic year in which you enquired.

If you applied unsuccessfully to one of our courses, we will retain your personal data for one year from the date the admission process ended in the year you applied.

If you make a successful application to our undergraduate or postgraduate programmes, or any of the short courses and foundation courses run by SOAS, we will retain your information in accordance with your student file (six years from the end of the academic year in which you left SOAS). If you make a successful application to our Distance Learning programmes, we will retain your information for two years from the date the offer was made. If you enrol, we will then retain your information as part of your student file (six years from the end of the academic year in which you left SOAS).

There are separate retention periods for information received from you and other parties in relation to any complaint or formal appeal you make against your non-acceptance to a course at SOAS. For further information please go to section 14.2 of the SOAS Retention Schedule:

You have certain legal rights in relation to your personal data. If you exercise your rights by asking for access to your data, for data to be corrected, or if you object to our processing or want to restrict processing, we have one month to respond to your request by satisfying the terms of the request, or explaining why we are unable to do so (e.g. because an exemption applies, or we feel that our legitimate interest in processing outweighs your objection). Some legal rights may not be available depending on the lawful basis under which we are processing your data, as shown in the table below.

As someone who has enquired about study at SOAS, applied for one of our courses, or has received an offer to study at SOAS, we may process your personal data under the following lawful bases:

• Consent
• Contract
• Legal obligation
• Vital interests
• Legitimate interests

The table below shows which rights are available to you under each lawful basis:

Right of Access : You have the right to the information which the School holds about you. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, the School may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. For a guide on how to make a ‘Subject Access Request’, including requirements for proving your identity, please see:requesting access to personal data.

Right to correct your data : If you believe data we hold about you is incorrect as to a matter of fact, or if your information changes, please write to us as soon as possible. If you have given information to an agent or applied for an open day or about a course, then you should get in touch with SOAS’s Marketing team at study@soas.ac.uk. If you have applied to one of our courses, please contact the following teams:

• IFCELS applicants: contact IFCELS
• Language Centre applicants: email the relevant section depending on the language course you applied for. For email addresses, see our Language Centre contact page.
• Undergraduate applicants: contact undergradadmissions@soas.ac.uk
• Postgraduate taught applicants contact: mastersadmissions@soas.ac.uk
• Postgraduate research applicants contact: dsadmissions@soas.ac.uk

Distance learning applicants should contact the following programme specific addresses:

• Centre for Development, Environment and Policy (CeDEP): DLAdmissionsTeam3@soas.ac.uk
• Centre for Finance and Management Studies (CeFims): DLAdmissionsTeam1@soas.ac.uk
• Centre for International Studies and Diplomacy (CISD): glodipadmin@soas.ac.uk

Right to restrict processing

If you believe SOAS is processing your data unlawfully, you can ask us to restrict the processing of your data whilst we investigate your complaint. When we restrict your data we will not do anything with it other than store it securely, in order to mark it as restricted.

Right to erasure

If we process data with your consent or in our legitimate interests then you can ask for your data to be expunged (completely deleted) at any time.

Right to data portability

If you provide us with electronic data which we have your consent or a contractual reason to process, you can ask for a copy of the data in a machine-readable format, or you can ask us to transfer it to another IT environment on your behalf.

Right to objection

If we process your data with your consent or in our legitimate interests, you may object to the processing. For example, you might opt-out of receiving marketing communications.

If SOAS corrects, restricts, or deletes your personal data at your request and that data has been passed to a third party or third parties for the same purpose, SOAS is responsible for ensuring that those bodies also fulfil the terms of your request.

If you wish to exercise any of these rights, please contact our Data Protection Officer (dataprotection@soas.ac.uk) in the first instance.

If you think SOAS is processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner’s Office, which is the UK data protection regulator. More information can be found on the Information Commissioner’s Office website.

We will review this notice on an annual basis, and will make updates as necessary to reflect any changes to the type of personal data that we process and/or the way in which it is processed. The most recent version of this notice can always be found on this page.