Search

This is our privacy notice for past, present and prospective students of City St George's, University of London.

This privacy notice explains how City St George's, University of London (City St George's) collects, uses and shares your personal data, and your rights in relation to any of your personal data that City St George's holds. This privacy notice concerns City St George's processing of personal data of past, present and prospective students of City St George's.

City St George's is a data controller in terms of the Data Protection Act 1998 and the General Data Protection Regulations (GDPR) which came into effect on the 25 May 2018. City St George's is registered with the Information Commissioner’s Office (ICO) with the registration number Z8947127.

How City St George's collects your information

Information about you will be collected by City St George's in a number of ways:

  • When you apply or register to study at City St George's we will collect data to allow us to administer your studies. If you have applied via the Universities and Colleges Admissions Service (UCAS) they will share your information with us.
  • If you express an interest in City St George's we will ask you to provide us with some information so we can communicate with you effectively.
  • In various other ways during the course of your studies, for example, when you interact with City St George's services.
  • City St George's may, at times, ask third parties for information about you such as your sixth form college, funder or employer.

Information City St George's collects

City St George's may collect the following types of personal data about you:

  • Your name and contact information such as address, email address and telephone number, as well as your date of birth and your passport number, country of domicile and your nationality. Contact details for your family and trusted contacts. City St George's also processes and stores CCTV footage for security and safety. For further information, please read our CCTV Policy.
  • Information relating to your education and employment history including where you have worked, dates of study and examination results.
  • Records relating to assessments of your work, details of examinations taken, your examination grades, personal tutor meetings, attendance records and other information in your student record.
  • Information relating to your disciplinary record, any Fitness to Practice/Study of complaints processes you have been concerned in.
  • Sensitive personal data or special category data:
    • health and medical conditions
    • certain criminal convictions
    • racial or ethnic origin
    • religion or similar beliefs
    • sexual orientation.

Why do we process this information?

City St George’s uses the information provided by or collected from applicants and/or students (including information from application forms) to administer applications and to compile statistics about applicants and/or students that may be published or passed to government bodies or the Higher Education Statistics Agency (HESA). As of 4 October 2022, HESA merged with JISC, meaning that JISC is now the data controller of personal data previously controlled by HESA. For further information please see the HESA Student Data Protection Notice.

If your application is successful, City St George’s will also use the information provided by or collected from you:

  1. to facilitate and deliver your programme of study and to provide you with teaching, research and educational services and support;
  2. to administer your studies, including admissions procedures and maintenance of your academic records after admission;
  3. to provide you with, and manage your use of, City St George’s facilities and services and your participation at events;
  4. to monitor and maintain records of your performance, engagement and attendance;
  5. to operate security, disciplinary, fitness to practice or study, complaint and quality assurance processes and arrangements and to provide you with support;
  6. to conduct research and to identify ways to enhance learning, teaching, assessment and the broader student experience;
  7. to enable effective communication with you;
  8. to administer the financial aspects of our relationship with you and any funders, including processing any payments made by you to City St George’s;
  9. for credit scoring, credit assessment, debt tracing or fraud and money laundering prevention. City St George’s may disclose this information or data about you to credit reference agencies or other credit assessment, debt tracing and collectors, fraud prevention organisations or solicitors as appropriate;
  10. for legal, personnel, administrative and management purposes including the processing of any sensitive personal data relating to you, which may include, as appropriate: information about your physical or mental health or condition in order to monitor leave from study or extenuating circumstances and take decisions as to your fitness for study or for other uses as may be required by law;
  11. conduct equal opportunities monitoring and equality impact assessments using your ‘protected characteristic data’;
  12. for other activities that fall within the pursuit of the City St George’s ‘legitimate interests’ (including the development and maintenance of an alumni programme, or in the event that City St George’s is required to terminate our contract with you and withdraw you from City St George’s in accordance our Terms and Conditions of Study); and
  13. to carry out legal and regulatory duties, which may require that information be provided to others e.g. local councils, Transport for London, HESA
  14. Personal data is shared with the Higher Education Statistics Agency (HESA), part of Jisc, for the purposes of conducting the Graduate Outcomes survey. More information about how Jisc processes your data can be found in the Graduate Outcomes Privacy Information.

City St George’s may share your personal data with third parties to support us in fulfilling our obligations and responsibilities to, and in managing our relationship with, you under our Terms and Conditions of Study. The third parties may include sponsors or funding organisations, professional bodies, work placement partners and foundation course providers, potential employers, local government departments, the University of London and third-party suppliers providing services to City St George’s.

In addition, in certain circumstances, City St George’s may be under a duty to disclose or share your personal data (including sensitive personal data) in order to comply with any legal or regulatory obligations, and to protect City St George’s rights, property, or safety of our employees, students or others. The third parties may include health professionals, Student Loans Company, UK Visas and Immigration (UKVI) and/or the Police.

You may be given further information about the processing of your personal data when you use specific services and facilities offered by City St George’s, such as our Student Health and Wellbeing Service and CitySport.

When you leave City St George’s, whether because you complete your programme of study or otherwise, your information will be retained by us for the purposes of maintaining your student record and/or where there is a legitimate business need to do so.

The legal basis for processing your information

City St George’s relies on several different legal basis depending on the processing being performed:

(Article 6(1)(a)), Consent – on specific occasions City St George’s will only process certain data if you consent e.g. on registration, you only need to provide certain “special categories” of data if you agree to that.

(Article 6 (1)(b)), necessary for the performance of your student contract – on many occasions City St George’s will process your data to enable it to meet its commitments to you e.g. those relating to education and assessment.

(Article 6 (1)(c)), necessary to comply with a legal obligation – City St George’s may have legal obligations to provide your personal data to others e.g. HESA.

(Article 6 (1)(d)), for the purpose of protecting the vital interest of yourself or another – sometimes in extreme circumstances City St George’s will have to release information to protect your interests or the interests of others e.g. in medical emergencies.

(Article 6 (1)(e)), processing necessary for the performance of a task carried in the public interest – City St George’s is an educational and research establishment and in particular its educational and research activity is conducted in a public interest (including your interest and the interest of others).

(Article 6 (1)(f)), processing is necessary for the purposes of the legitimate interest of City St George’s or a third party subject to overridden interests of the data subject – the University (and sometimes third parties) has a broad legitimate interest in activities that connect to the activities and education of students. Subject to those interests not being overridden by the interests of fundamental rights and freedoms of students, it will pursue those interests. A good example of this legitimate interest would be Alumni activities.

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which it is collected.

Others City St George’s shares your information with

Where necessary City St George’s will disclose, outside the institution, relevant items of your personal data as set out below.

  • Sponsors or funding organisations (including the Student Loans Company) where a contract exists, in accordance with the terms of the contract (which usually relate to attendance and progress reports).This does not include third parties (such as parents) who may be paying for your studies but with whom no formal contract exists.
  • Professional bodies (e.g. Law Society, Nursing and Midwifery Council, General Medical Council, Health and Care Professional Council).
  • For the purposes of confirming your qualifications e.g. for registration with your professional body and the continuation of your training, and the accreditation of your course.
  • NHS Trusts in England and Wales where this is necessary for the purposes of your study.
  • For medical students year on year performance data is provided to UKCAT (UK Clinical Aptitude Test) to validate and improve the test.
  • Work Placement sites or other educational partners involved in joint course provision where this is necessary for the purposes of your study.
  • The Office for Students (OfS) and its agents, such as the Higher Education Statistics Agency (HESA) and the Quality Assurance Agency. You are also advised to refer to the collection notices on the HESA website for further details.
  • Potential employers or providers of education whom you have approached for the purposes of confirming your qualifications.
  • Local Government Departments, including Council Tax, Electoral Services and Transport for London for the purpose of assessing and collecting Council Tax and or supporting your registration to vote in elections.
  • UK Agencies with duties relating to the prevention and detection of crime, apprehension and prosecution of offenders, collection of a tax or duty, or safeguarding national security.
    For example: Benefit or Tax Inspectors, the Police, the UK Border Agency (UKBA) or the Foreign and Commonwealth Office, as necessary, and with consideration of your rights and freedoms.
  • The University of London for the purposes of allowing you access to shared facilities.
  • City St George’s Students’ Union, in order to facilitate your membership of this and its services including associated clubs and societies. You have the opportunity to opt-out of membership of the Students’ Union by following the procedure outlined here. To opt out of membership of City St George's Students’ Union at any time, you need to visit your student account on the University’s systems.
  • Foundation course partners for the administration of those courses.
  • Providers supplying learning analytics services (Jisc) to support students in their studies.

In addition, City St George's employs the services of various suppliers and agents as data processors. In each case your information will only be shared with these third parties in accordance with the data protection principles.

We will use your special category personal information in the following ways

Your race, disability status, national or ethnic origin, religious, philosophical or moral beliefs or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting. This is required by a number of organisations that we work with, notably for monitoring purposes. Including by the Higher Education Statistics Agency (HESA), professional bodies that we work with/that accredit our programmes, governmental funders/sponsors (such as the UK Research Councils) and City St George’s Students’ Union.

Data retention

City St George’s retains personal information it collects from you where there is an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

When there is no ongoing legitimate business need to process your personal information, City St George’s will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then City St George’s will securely store your personal information and isolate it from any further processing until deletion is possible.

Your rights

You have rights to your personal data held by City St George’s as set out in the GDPR. These include:

  • Rights to access your personal data to be provided by City St George’s within one calendar month – known as a Subject Access Requests (Article 15). This includes information on:
    • A description of your data
    • The Recipients of your data
    • A copy of your data.
  • Rights to rectification and erasure. You have the right to correct any inaccurate personal data held by City St George’s. Once information City St George’s has collected is no longer necessary for the purpose for which it was collected and processed, you sometimes have the right to have your data erased.
  • Rights to restriction of processing.
    • You sometimes have the right to restrict the processing of your personal data or object to the processing of your data.
    • If you wish to withdraw consent for the processing of your personal data or otherwise restrict or object to the processing of your personal data, please contact the Information Compliance Team.
  • Rights to data portability. You have the right to receive your personal data City St George’s holds in a structured, commonly used and machine-readable format and have the right to transmit that data to another controller without hindrance from City St George’s.

Changes to this notice

City St George’s may amend this privacy notice and will occasionally update to reflect customer feedback and enhance its accessibility.

In that case, City St George’s will post notice of the change on its website, and you will be deemed to have accepted such changes.

City St George’s encourages you to periodically review this notice to be informed of how the institution is protecting your privacy.

Contact details

As a public body, City St George’s has appointed Geoff Gray as the Data Protection Officer (DPO). Should you have any concerns about your personal data at City St George's please contact the DPO by email.

Additional guidance can be sought from the Information Governance team by telephone +44 0)20 70 40 4000 or email dataprotection@city.ac.uk.

Please note that following our merger, all policies are subject to review and re-development as part of the integration within City St George’s, University of London. This policy was last updated on 5 August 2025.