Student privacy notice

Information you need to know

Liverpool John Moores University (LJMU) needs to obtain and process a range of information about its students in order to exercise its responsibilities, fulfil its education, training and support obligations to you, and carry out other essential university activities. See further information on the institution.

Liverpool John Moores University is the Data Controller.

Our Data Protection Officer can be contacted at DPO@ljmu.ac.uk.

This privacy notice explains how we use your personal information and your rights regarding that information.

For information about how the wider university uses personal data please see the Privacy notice section of our website.

Information we are collecting

We collect a range of personal data about you throughout your relationship with the university, including during recruitment, application, enrolment and throughout your studies.

This may include:

  • your:
    • application details
    • funding arrangements
    • programme of study
    • academic achievements
  • information relating to your:
    • attendance
    • progress
    • assessments
    • graduation
  • information you provide when engaging with university services, such as academic, pastoral, wellbeing or support services
  • information required to meet the university’s legal, regulatory and health and safety obligations
  • data used for research, statistical and archival purposes

We also process core personal data about you, including:

  • your name
  • contact details
  • date of birth
  • nationality and immigration status
  • emergency contact details

At registration, you will be asked to upload a photograph of yourself via MyPhoto to create your student ID card. This photograph will also be used as your profile picture associated with your student account to help staff identify you. You can change or remove your photograph at any time.

Your student email account is the primary method we use to communicate with you. We will use this account to send you important information relating to your studies, as well as information and guidance to support your student experience.

At registration, you will also be asked to provide your contact preferences for receiving information about student recruitment activities, offers and opportunities. These communications will only be sent to you where you have provided your consent.

This list is not exhaustive. Where you access specific services, you will be provided with additional information about how your data is used. Further details can be found in the relevant privacy notices for those services.

In some circumstances, your personal data may be processed as part of university procedures, such as student complaints or Fitness to Practice processes. This will only take place where it is necessary and appropriate, and access to the information will be limited to authorised staff.

Source of the personal data

Depending on your route of entry to LJMU, we obtain personal data about you from a range of sources.

This may include:

  • UCAS (Universities and Colleges Admissions Service), where you have applied through UCAS
  • information you provide directly to the university as part of your application
  • information provided by an international study agency acting on your behalf, where you have given permission
  • information provided by your employer or a partner institution where your course is delivered in collaboration with LJMU

Most of the information we collect from you directly. All students provide personal data directly to LJMU at registration. You will be asked to verify and confirm this information at the beginning of each academic year, and you can update your details at any time via My LJMU, by contacting Academic Registry, or by telephoning 0151 231 3289.

We also collect information about you through your interaction with university systems and services during your studies.

The university operates a CCTV system to maintain a safe environment and to investigate complaints or concerns regarding safety or security. The CCTV system covers university buildings (inside and outside) and public areas across our campuses, and your image may be captured when you are on or near university premises.

Why we are collecting your data and the legal basis for this

We process personal data in accordance with the principles of the GDPR and only where there is a valid lawful basis to do so.

We collect and use your personal data so that we can function effectively as a university, to manage your relationship with the university, and to support you throughout your studies.

This includes:

  • delivering and administering your programme of study
  • monitoring and supporting your:
    • attendance
    • engagement
    • academic progress
  • providing academic, pastoral and wellbeing support
  • managing:
    • fees
    • funding
    • financial arrangements
  • fulfilling our legal, regulatory and safeguarding obligations
  • supporting the operation and development of the university’s activities, including research, statistical and reporting purposes
  • conducting analysis with the aim of improving our services
  • maintaining ongoing contact with you after graduation for alumni relations

In most cases, the lawful basis for processing your personal data will be:

  • Article 6(1)(b) - processing is necessary for the performance of a contract with you
  • Article 6(1)(c) - processing is necessary for compliance with a legal obligation
  • Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest

In some circumstances, we may rely on:

  • Article 6(1)(f) - legitimate interests, where processing is necessary for the purposes of the University or a third party and these interests are not overridden by your rights and freedoms
  • Article 6(1)(a) - consent, where you have been given a clear choice and control over how your data is used

In emergency situations, we may rely on Article 6(1)(d) - vital interests, where processing is necessary to protect you or another person.

Where we process special category data (such as information about your health or ethnicity), we will do so in accordance with Article 9 of UK GDPR and the Data Protection Act 2018, for example where it is necessary to provide appropriate support or meet our legal obligations.

CCTV footage will be processed to maintain the security of the university community, enhance public safety, prevent and detect crime, and apprehend and prosecute offenders. It will also be used in the investigation of complaints and allegations made under the university’s rules, regulations, procedures and codes of practice. Further information is available in our CCTV privacy notice.

Who has access to this data

Your personal data will be accessed only by relevant LJMU staff where the data is necessary for them to undertake their designated role.

This may include:

  • academic tutors
  • Academic Registry staff and administrators in your faculty
  • Student Life and Wellbeing
  • Student Governance
  • Alumni Services and other teams that you engage with during your time at LJMU
  • IT Services
  • Security and Data Protection teams
  • management teams to identify and evaluate gaps and trends in order to improve our services

We may also be required to share your information with some external parties such as:

  • local authorities (for example, for council tax or benefit purposes, including the prevention and detection of fraud)
  • government departments and public bodies where the university has a legal or statutory obligation to share information, such as:
    • the Student Loans Company
    • The Higher Education Funding Council for England (HEFCE)
    • the Quality Assurance Agency (QAA)
    • the Education and Skills Funding Agency (ESFA)
    • equivalent bodies in other countries
  • the Higher Education Statistics Agency (HESA), which collects and analyses information about students (further details are available in the HESA Student Data Collection Notice)
  • police and law enforcement agencies, where necessary for:
    • the prevention or detection of crime
    • the apprehension and prosecution of offenders
    • where there are safeguarding concerns relating to you or other members of the LJMU community
  • external service providers and system suppliers who process data on behalf of the university, for example:
    • software providers
    • managed print services
    • event organisers
  • UK Visas and Immigration Agency (UKVI), where required as part of the university’s responsibilities under immigration legislation
  • external examiners and assessors
  • your employer, where your programme is delivered in partnership with them
  • safeguarding partners such as The Liverpool and Wirral Multi-Agency Risk Assessment Conference, where it is necessary for safeguarding purposes
  • accommodation providers, where it is necessary to protect the welfare of:
    • yourself
    • another student
    • any other person or our wider LJMU community
  • providers of the SafeZone app to support campus safety and emergency responses

We will normally communicate directly with you as the student. Your personal data will not be routinely shared with parents or family members unless you have given your consent, except in exceptional circumstances where it is necessary to protect your vital interests or those of others.

In some cases, you may choose to give consent for the university to share information with a sponsor or third party if you are using an agent.

Student email addresses are published in the university’s Outlook address book. This directory is for internal use only, and individuals should not share contact details externally without permission.

John Moores Student Union

The university works closely with Liverpool John Moores Students’ Union (JMSU) to ensure a greater level of service to our students and to support your student journey. We share personal data with JMSU to enable your membership of the students’ union and participation in associated clubs and societies. If you do not wish to be a member of JMSU, you can opt out at any time during your registration or via your account in My LJMU.

We may also share personal data with JMSU in the event of safeguarding concerns, complaints, disciplinary matters, or major incidents, where the sharing is necessary and there is a clear lawful basis to do so. A formal data sharing agreement is in place between the university and JMSU.

JMSU is an independent data controller. For more information on how JMSU uses your data, please see the JMSU website.

How the university protects your data

We are committed to keeping your personal data safe in line with data protection legislation and the university’s information security and data protection policies.

Access to your personal data is restricted to authorised staff who require it to carry out their roles. Appropriate access controls are in place to ensure that staff can only access the information necessary for their responsibilities.

How long the university keeps your data

Your personal data will only be kept as long as it is necessary and in accordance with the university’s Records Retention Schedule.

The Records Retention Schedule sets out how long different types of student records are retained, which will vary depending on the nature and purpose of the information. For example, some records relating to your studies, academic progress and student record may be retained for a period after you leave the university, while other information may be kept for longer where there is a legal, regulatory or academic requirement to do so.

When your personal data is no longer required, it will be securely deleted or anonymised in line with university policy.

Your rights

As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request
  • ask the university to correct inaccurate or incomplete data
  • ask the university to delete or stop processing your data, for example, where the data is no longer necessary or legally required for the purposes of processing
  • object to processing where we are relying on a legitimate interest
  • request transfer of your data to another party

If your personal data has been provided by consent, you have a right to withdraw that consent at any time.

If you would like to exercise any of these rights, please contact the Data Protection Officer at DPO@ljmu.ac.uk.

If you do not provide data

Certain personal data is required to enable the university to provide you with your education and manage your relationship with us. If you do not provide this information, we may not be able to enrol you, deliver your programme of study, or provide key services and support.

Some services are optional, such as Student Life and Wellbeing or Alumni Services. Where you choose to engage with these services, they will only be able to support you or keep you informed if you provide the relevant information.

Transfers of data outside the UK

We normally keep your personal data within the UK. In some cases, however, we may need to transfer it to another country - for example, to deliver a contract with you or to work with a partner organisation such as a university based overseas.

Whenever this happens, we make sure your information stays protected. This could be through a UK “adequacy regulation” (which confirms that the other country’s data protection laws are up to UK standards) or by putting strong safeguards in place.

These safeguards might include:

  • model contractual clauses
  • formal data sharing or processing agreements
  • binding corporate rules

In short, even if your data travels abroad, it will continue to be treated with the same care and respect as it would under UK law.

Automated decision-making

We do not use computers to make decisions about you based solely on your personal data. Any decisions that affect you will always be made by a human, ensuring that you are treated fairly.

How to complain to the university

You have a right to complain to the university if you think it has not properly responded to your request for personal information or feel it has not handled your personal data responsibly.

If you are not satisfied with how your request for information or how your personal data has been handled, you should set out your complaint in writing to:

Maria Burquest
University Secretary and General Counsel
Legal and Governance Services
2nd Floor Exchange Station
Tithebarn Street
Liverpool
L2 2QP

or by email via DPO@ljmu.ac.uk.

How to complain to the Information Commissioner’s Office

You have the right to complain to The Information Commissioner if you believe that our processing of your personal data does not meet our data protection obligations. The Information Commissioner can be contacted using the following details:

  • Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF.
  • Telephone: 0303 123 1113.
  • Email: contact can be made by accessing the ICO website.