Data privacy notice

We will comply with data protection law. This says that the personal information we hold about you must be:

1. Used lawfully, fairly and in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.

We collect most of the personal information about you via our online application system (Aspire) and via our online forms. For example, while providing services to you or after we have provided services to you (e.g. feedback responses). 

We may sometimes collect personal information from third parties where you have provided consent for them to do so or where it is within the legitimate interests stated in their privacy notice.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

There are "special categories" of more sensitive personal data which require a higher level of protection.

Information you give to us

We may collect and process the following data about you. This may include personal details such as:

• First name and title
• Last name
• Gender
• Date of birth
• Home address and contact details
• Nationality and country of residence
• School/institution or organisation and year group
• Information relating to your past and future academic progress, educational or professional background
• Communication preferences details of emergency contacts
• Your eligibility for Free School Meals and pupil premium
• Your family household income
• Whether you have been or are in care
• Whether you are a young carer with caring responsibilities
• CCTV footage and other information obtained through electronic means such as swipe card records

For programmes and activities, we may also collect special categories of data including:

• Information about your health, including any medical conditions, disabilities and dietary requirements
• Race or ethnicity
• Religious beliefs
• Sexual orientation

For paid casual workers this may also include bank account details, payroll records and tax status information 

*Please note the lists above are not exhaustive. For details of the information we collect for a specific activity, programme or event please contact the Outreach Team at outreachdata@imperial.ac.uk

Information we collect about you

Individuals who apply to Outreach programmes and activities may be asked to provide us with information about their parents/guardians, carers or teachers prior to participating on a programme or activity.

For parents / guardians, this may include:

• Name and title
• Address
• Nationality
• Email address
• Telephone numbers(s)
• Relationship to applicant
• Occupation
• Educational background and level of education achieved

For teachers and referees, this may include:

• Name and title
• Work email address
• Work telephone number
• School/organisation name and location
• Position/job role
• Relationship to applicant

Parents/guardians, carers and teachers may also be asked to confirm information about applicants to our programmes and activities, including information about special categories of data outlined above. 

If you are applying to one of our programmes, we may also collect information regarding your school or institution including its academic and socio-economic profile.

If you go on to apply to undergraduate or postgraduate programmes at the University, we may collect information relating to your higher education applications from third parties such as:

• UCAS
• HEFCE
• HEAT

If you attend an event organised by a third party or use a third party service that has a relationship with Imperial (for instance Capex, EdX), and indicate to the organiser that you wish to be contacted by Imperial, the personal details you provide to the event organiser may be shared with us where the organiser has notified you they will do this.

If you receive our email communications, we may collect information regarding which of our emails you have opened, and links that you have clicked within these.

If you attend an Outreach activity or programme we may take photographs, audio recordings, and video recordings of you if you have not objected to us doing so.

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

1. Where we need to perform the contract we have entered into with you or in order to take steps at your request prior to the entry into a contract.
2. Where we need to comply with a legal obligation.
3. Where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
4. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. 
5. Where it is necessary in order to protect your vital interests or someone else’s vital interests.
6. Where you have consented to the processing. 

Situations in which we will use your personal information

Most commonly, we will use your personal information in the following circumstances:

Where you have consented to us processing your data in order to provide you with specific information, print or digital materials, or other services you have requested

Where we need to perform services relating to a contract, we have entered into with you

• For application, participation and registration purposes prior to participating on a programme or activity
• To deliver and administer our programmes and activities 
• To ensure your safety and wellbeing during our programmes and activities
• To contact you for a reference for an applicant to one of our programmes
• For the administration of volunteering or paid work opportunities
• For the administration of Outreach’s activities

Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Usually this will include:

• For internal record keeping
• To monitor and evaluate the effectiveness of our programmes, activities, and marketing materials through research, statistical analysis and surveys
• To monitor and evaluate trends in applications to the University through statistical analysis
• To monitor and evaluate the effectiveness of our electronic communications through statistical analysis
• To contact you with information about the University, or our programmes and activities that may be relevant to you where you have not objected to us doing so (please see section 4 below for more details)
• To take photographs, audio and video footage at our events, activities, and programmes for use in the University’s digital and printed promotional materials, communications, publications and social media sites.

To provide you with information about the University and our activities that we feel may be relevant to you. We will only send you electronic marketing messages in the following situations:

• you consent to this by completing the relevant field on our web forms, activity registration forms or programme application forms
• you are a higher education professional with whom we have an existing relationship and have not objected to us doing so

If you do not want us to use your data in this way (electronic marketing) you can opt out of these at the point which we collect your data or use the unsubscribe link in our email communications at any time after our initial contact.

Please note that in order to ensure that the content of our electronic communications is relevant to you, we may send some of these based on specific information you have provided. This includes information such as your country or region of domicile, gender, age, subject area(s) of interest, and level of studies.

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to comply with a legal obligation.
• Where we need to protect your interests (or someone else's interests).
• Where it is needed in the public interest or for official purposes.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason which is compatible with the original purpose. However, if we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

If you are under 13 years old we will only process your personal information if we have parent/guardian consent to do so.

If you fail to provide personal information

If you fail to provide certain information when requested:

• We may not be able to consider your application to one of our programmes
• You may not be able to attend our activities
• You may not receive relevant communications
• We may be prevented from complying with our legal obligations 

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. 

If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. 

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

"Special categories" of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal information in the following circumstances:

1. In limited circumstances, with your explicit written consent.
2. Where it is necessary in the context of employment law, or laws relating to social security and social protection.
3. Where the processing is necessary to protect your vital interests (or those of another person) where you are incapable of giving consent.
4. Where the processing is carried out in the course of our legitimate activities as a charity, with respect to our own members, former members, or persons with whom we have regular contact in connection with our purposes.
5. Where the processing relates to personal data which have been manifestly made public by you.
6. Where the processing is necessary for the establishment, exercise or defence of legal claims, or for courts acting in their judicial capacity.
7. Where the processing is necessary for reasons of substantial public interest, and occurs on the basis of a law that is, proportionate to the aim pursued and protects your rights as a data subject.
8. Where the processing is required for the purpose of medical treatment undertaken by health professionals, including assessing the working capacity of employees and the management of health or social care systems and services.
9. Where the processing is necessary for reasons of public interest in the area of public health (e.g. ensuring the safety of medicinal products).
10. Where the processing is necessary for archiving purposes in the public interest, for historical, scientific, research or statistical purposes, subject to appropriate safeguards. 

In some cases, we may need to process sensitive personal information that you have provided, or we have collected about you.

We will only collect sensitive personal information outlined earlier in this privacy notice and for the reasons below:

You consent to us processing this data to for application, participation and registration purposes prior to participating on a programme, event or activity (GDPR Art. 9.2(a))

To carry out employment rights and obligations if you undertake voluntary or paid work with the department (GDPR Art. 9.2(b))

You consent to us processing this data to ensure your safety and wellbeing during our programmes and activities (GDPR Art. 9.2(c))

For reporting and evaluation purposes where there is substantial public interest based on our agenda to widen participation in higher education (GDPR Art. 9.2(g))

For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (GDPR Art.9.2(j))

We will use information about your physical or mental health, or disability status, to ensure your health and safety and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence
We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.

Do we need your consent?

We do not need your consent to process sensitive personal information if we comply with the above reasons.

In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

We may have to share your data with third parties, including third-party service providers and other entities in the university group.

We require third parties to respect the security of your data and to treat it in accordance with the law.

We may transfer your personal information outside the EU.

If we do, you can expect a similar degree of protection in respect of your personal information.

"Third parties" includes third-party service providers (including contractors and designated agents) and other entities within the university group.

We may share your personal information with third parties where required by law, where it is necessary to administer the relationship with you or where we have another legitimate interest in doing so.

• Any data shared with third parties will be used by the third party organisation for the purpose of 
• Providing a service you have requested
• Provide a service as part of a programme or activity
• Monitoring and evaluation of our programmes or activities 
• Evaluate the effectiveness of our outreach activities, and programmes as part of government policy to widen participation in higher education, and to develop future policy.

The following third-party service providers may process your personal information for the reasons stated in the above:

• Staff from Imperial’s academic and support services departments
• The University and Colleges Admissions Service (UCAS)
• The Higher Education Access Tracker (HEAT) service and its member institutions
• The Centre for Evaluation and Monitoring (CEM)
• External funders of specific programmes such as JP Morgan, The Sutton Trust or the Elsevier Foundation and Berkeley Foundation
• Evaluation partners of external funders of specific programmes such as NFER, Cosmos Engagement Ltd and the Bridge Group. Other partners may be engaged in the future
• FFT Education Limited
• Royal Institution (Ri)

We may also share your personal data with our contractors and service providers who process personal data on behalf of Outreach to perform certain business-related functions. These include:

• Data Harvesting Student CRM — event management and CRM database services
• Microsoft Dynamics — event management and CRM database services
• GoToWebinar (Log me in inc) — online webinar services
• Mailbird — delivery of printed prospectuses and materials
• Qualtrics — applications, surveys and email suppression services
• Eventbrite — event management services
• Mailchimp (The Rocket Science Group LLC) — email services

   

How secure is my information with third-party service providers and other entities in our group?

Data will only be shared using secure data transfer methods and stored by us and our partners on secure systems. We and our partners will not use your personal data in any way that would affect you individually.

Any data released by the University or third parties into the public domain will only be released in aggregate form, and fully anonymised to prevent identification of individuals.

For programmes that are run in collaboration with an external organisation, information that you provide on your application may be stored and shared securely in line with this notice. These external organisations include but are not limited too;

• Shrewsbury School
• Oundle School
• With Insight Education
• Mathematics in Education and Industry (MEI)
• Brightside Mentoring
• Medical Schools Council

Data security

We have put in place measures to protect the security of your information. Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. 

In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

We are required to only keep your information for as long as is necessary.

When you apply to or participate in one of our programmes, activities, or webinars, complete one of our web forms to register your interest in these, or complete one of our web forms to request other services we provide we will retain your personal data based on the criteria below.

Where more than one applies, we may retain your data based on whichever of these occurs at the latest date.

• The August after you have reached the age of 25 years old
• If you apply to undergraduate or postgraduate courses at Imperial, Outreach will keep your personal data until the August +6 years following the year of entry for the course to which you apply
• Not withdrawn your consent to be included in evaluation of the activity you attended or research into equality of opportunity

For security purposes data may exist on backup servers with our database and CRM suppliers for an additional 3 months after deletion. Data will exist for backup purposes only and will not be accessed or processed during this time.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Any personal data processed for medical purposes or as emergency contact details will be retained until the conclusion of the programme, unless we are required to keep the data for longer to comply with any necessary referral or follow up queries.

Personal data relating to casual workers or volunteers will be retained for the duration of their work with us, however non-personal data may be held for monitoring purposes.

If you are a Higher Education professional with whom we have an ongoing relationship, your professional contact details will be held on our database until we are notified of any changes to these, or you request for these to be removed.

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us. 

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

• Request access (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you.
• Request correction This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing.
• Object to processing where we are relying on a legitimate interest (or those of a third party). You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the university’s Data Protection Officer in writing.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.

To withdraw your consent, please contact the Outreach Team outreachdata@imperial.ac.uk in the first instance. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Access to the information we hold about you

You have a right to request a copy of the data that we hold about you, to ask us to amend your details or ask us to stop processing or delete your personal data in certain circumstances.

If you would like a copy of the data supplied to us, or have any questions or concerns about the use of data for the purposes described, or would like your data to be deleted from our system, please contact us by writing to:

Outreach Team — Data Protection Enquiry
Imperial College London
Level 3 Sherfield Building
London
SW7 2AZ

Alternatively, please email us at: outreachdata@imperial.ac.uk with the subject title: Data Protection Enquiry.

Your right to complain

You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. For further information see the Information Commissioner’s Office  (https://ico.org.uk/)

The University is currently required to register its notice of being a data controller with the UK’s regulatory body – the Information Commissioner’s Officer. The University’s registration number is Z5940050.

You can contact the University’s Data Protection Officer at:

Level 4 Faculty Building
Imperial College London
South Kensington
London
SW7 2AZ

dpo@imperial.ac.uk

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates.

We may also notify you in other ways from time to time about the processing of your personal information.

Last updated: 5 February 2025