Information about you
Why we collect your information
We use your personal details to provide you with information, products or services that you request from us.
This could be as part of a course application process, registering for an event or through contacting members of University staff.
How we use your information
Using your information allows us to provide you with a better and more tailored experience when using our website.
We use your information to:
- enable us to supply you with the goods, services and information you have requested
- ensure that content from the website is presented in the most effective manner for you and for your computer
- analyse the information we collect so that we can administer, support and improve and develop the website
- provide you with information, products or services that you request from us or which we feel may interest you, unless you have indicated otherwise
- maintain a contract we have with you, such as a course application form or any other service you wish to access
- notify you about changes to our service
We will ask you for your consent to use your information. This could be on submitting a form or through our cookie consent banner.
Storing your preferences
We will store certain preferences you have using the site if you agree to cookies being collected (within the banner that pops up at the bottom of the site).
Storing your information
In most cases, personal data is stored on University of Edinburgh servers within the UK.
However, the University does use third-party companies to enhance the quality, service and functionality of certain web services available to visitors.
Your information is securely transmitted via our website. Once we have received your information, we will also use strict procedures and security features to prevent unauthorised access.
How long we keep your data depends on the purpose for which the information was supplied. You will be informed of how long the data will be kept during the process of giving your personal details.
Automated processing and profiling
We do not use profiling or automated decision-making processes.
Disclosure of your information
We will not share, sell or distribute any of the information you provide to us without your consent, except where disclosure is:
- necessary to enforce our rights, including under our website Terms and Conditions of use
- necessary to enforce our rights under any other Terms and Conditions of use or Terms and Conditions of sale of the University or any of its schools, colleges or departments
- required or permitted by law
- Read more about our website Terms and Conditions of use
Ways we contact you
Depending on the circumstances we may contact you by post, telephone, email or text message. If you change your mind about being contacted in the future by any of these means then please let us know by getting in touch with us.
How to update your personal information
Help us keep our records updated by informing us of any changes to your email address and other contact details.
Legal bases and examples
Legal basis: consent
The University of Edinburgh principally uses your information under the legal basis of consent.
When you enter your information in a form, we specify the purpose and future use of this information. By submitting information to a form, you consent for your details to be used according to the purposes stated within each form.
An example of this would be an individual requesting to be added to a mailing list (which will be used to send you newsletters and information). The Business-to-Business (B2B) exemption for mailing lists means that consent is not required when the recipient of the emails is a professional contact.
As this information is provided on the basis of consent, you are free to withdraw your consent for such use of your information at any time.
Legal basis: contract
The University of Edinburgh may process your information under the legal basis of contract, whereby the processing is necessary for a contract you have with us, or because you have asked us to take specific steps before entering into a contract.
Application and booking forms typically fall into this category wherein you supply your information because you wish to access a particular service or enrol on a course.
Legal basis: legitimate interest
In the case of our legitimate interests to process your personal data we are required to ensure that our interests are balanced against yours. Generally speaking, legitimate interest is used where the use of data is part of the necessary day-to-day business and activities of Edinburgh College of Art. This must be weighed up against whether or not there is an alternative way to complete these processes, and ensuring it does not negatively affect the rights and freedoms of the people whose data we are processing. We must also consider the data subject’s reasonable expectation of what is likely to happen to their personal data.
In this case, where someone can prove that their own rights and freedoms outweigh the University’s, then their objection to processing must be taken into account and they must be opted out of the processing.
Where the maintenance of an email list is deemed to be a standard part of Edinburgh College of Art's day-to-day business and activities (e.g. disseminating research seminar series or announcements around estates matters), the legal basis of legitimate interest can also be used. In this case, explicit consent is not required from recipients of these emails, under the Business-to-Business (B2B) exemption.
For employees and students, some of these will be mandatory, especially if it is deemed to be essential information - these will be sent to your @ed.ac.ac.uk or @sms.ed.ac.uk email address. For some of these emails, and for those not being sent to an @ed.ac.ac.uk or @sms.ed.ac.uk email address, you may be able to opt-out by either using the "unsubscribe" link/button that may be available in these emails, or by contacting the list owner to request the removal of your data.
Legal basis: necessary for public task
This legal basis will apply only where the task carried out, or the authority of the controller, is laid down in Union law or UK. Thus, this is the legal basis to use for performing tasks with personal data that relate to the core functions (the reasons the University was established) of the University.
This legal basis covers data processing to perform tasks that are required to provide an education.
- lecturing and tutoring
- marking exams
- awarding degrees
- historic or scientific research
A cookie is a small file downloaded on to your device when you accesses certain websites. Cookies allow sites to recognise your device when you make a return visit.
When you leave our website or click on links that lead to external websites, we are unable to control what cookies are set in any way. You will need to set your cookie preferences for those sites as well.
There are broadly four reasons why a cookie might be stored on your device when visiting the University website.
- Cookies that make the website work properly for you and enable you to make use of the secure online services that we provide.
- Cookies that collect data about your use of the website which is then anonymised and used to help us improve our online services.
- Cookies that remember your preferences and make the site easier for you to use.
- Cookies that are placed by third party services we make use of to enhance the information we present online. We have no control over these third party cookies.
These cookies are placed on your device either by the University or by the third parties whose services we use as part of the website.
Some cookies are retained in your browser for only as long as you visit our website, while others persist for a longer specified or unspecified period.
How to block cookies
You can restrict or block cookies which are set during your use of the website by changing your browser’s settings. Some pages may not work if you completely disable cookies, but many third party cookies can be safely blocked.
Check information in your browser’s help section for specific instructions on how to manage cookies. Alternatively, websites such as “All About Cookies” provide comprehensive guidance.
The University uses Eventbrite to provide a booking service on the University’s behalf.
If you wish to attend one of our events but do not wish to use Eventbrite to book a place, please contact the event organiser. Contact details for each event are provided on the event booking page.
Information about you will be shared with Eventbrite, as our data processor.
We will not share your data with any other third party unless when there is a legal obligation to do so.
In general, we will hold the personal data you provided us up to the date of the event, after which it is deleted. In some cases, generally for our larger annual events where invites are sent out through Eventbrite, this data is kept for up to 5 years.
You can contact us at any time to request a copy of the information that we hold about you or ask us to remove your information.
General information for individuals
The University Records Management Section has additional information on how the University of Edinburgh collects, shares or processes personal information about you including:
- Data controller and contact details
- Data sharing
- Data transfers outside the European Economic Area
- Your rights
- And how to make a complaint
Additional information on the University's approach to data protection and your rights