Royal College of Art
Privacy Policy
Summary of this Privacy Notice
This privacy notice explains how the Royal College of Art (RCA) collects and uses personal data, why we collect it, how it is used, and what processes are in place in respect of personal information.
It provides specific information in relation to these different stakeholder groups:
1. visitors to our websites
2. subscribers – people who use our services, e.g. those who subscribe to newsletters, or register for events
3. applicants – people who apply online for our programmes of study
4. students
5. donors & alumni supporters
6. staff.
Introduction
The Royal College of Art will protect the privacy of users of our services, and enquirers and visitors to our website, in accordance with the General Data Protection Regulation (GDPR) 2018, Privacy and Electronic Communication Regulations (2003) and the new Data Protection Act (2018/19), once the latter is in place.
Whenever personal information is given to the RCA by anyone, they are asked to consent to its collection and use by the RCA in accordance with this Privacy Notice. Personal data submitted online to the RCA will only be passed on to third parties who are directly involved in providing services to the RCA for the purpose required. The RCA will not disclose any personal data for any other use, to any other party, unless we are obliged to do so by law.
The RCA is committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place physical, electronic and managerial procedures to safeguard and secure the information we collect online.
Your Rights and Preferences
The legal basis for processing your personal data is your consent, where you have provided this, and otherwise our legitimate interests. In the case of our legitimate interests to process your personal data we are required to ensure that our interests are balanced against any detriment you may face from our processing.
You have a right to know what information the RCA holds about you, and to ask us to stop processing your data, provided that the College has no legitimate or legal reason to continue using it.
Under GDPR, you have the right to:
- opt out of specified or all communication with the RCA
- ask for access to, or correction/deletion, of your data
- have data processing restricted to a particular use e.g. event registration only.
Requests to obtain confirmation that your data is being processed in accordance with the regulations, or to request access to your personal data, must be made in writing (via email, letter or fax) and should include:
- your full name, address and contact telephone number
- your student or staff ID number to help us distinguish your records from other people of the same name
- details of the specific information you require and any relevant dates.
If you are a student or member of staff, writing to us from an email address that we have on record will help us verify your identity.
The RCA will respond within 30 calendar days of receipt of the request. You can submit requests via email to foi@rca.ac.uk or by writing to:
The Freedom of Information (FOI) Team
IT, Library & Technical Services
Royal College of Art
Kensington Gore
London SW7 2EU
+44 (0)20 7590 4427
1. Visitors to our websites
The RCA website collects data from website visitors for specific purposes that relate to legitimate interests concerning the College’s core activity, as a world-leading university with academic schools and centres in research, knowledge exchange, executive education and innovation.
The RCA may also use ‘cookies’ and ‘tracking pixels’ on any of its web sites. A cookie is a small text file that is sent from a web server to your browser and may be stored on your computer, designed to collect data for statistical purposes. A tracking pixel is a marker inserted into a website page that connects your data to other information you have made available on other platforms.
RCA website cookies and tracking pixels do not collect any identifiable personal information, but can automatically collect data based on visitor browser settings and context (e.g. location, device, browser, preferences) and the use of our websites. You can configure your own browser or social media platforms to control how much of your data is available through cookies and tracking pixels.
How will we use the data?
- for analytics purposes – to count the number of unique visits to a page or click patterns, and understand the context in which visitors navigate through the website, so that we can improve the content and navigation
- to provide visitors with a tailored and appropriate experience, when they return to a website
- to match profiling data from third parties, to improve our services to users
- to report statistics internally and to regulatory authorities on request
- to measure website performance
- where such storage or access is strictly necessary for the provision of a service requested by the subscriber, visitor or user.
Links to other websites
The RCA website contains links to other websites. We are not responsible for the privacy practices of other sites. We encourage our visitors to be aware when they leave our website, and to read the privacy arrangements of other sites that collect or use personal data.
2. Mailing-list subscribers
Subscribers to newsletters or email lists may be contacted when we promote programmes of study or events that may be of interest. Anyone may at any time request us to stop using their personal data for direct marketing purposes via the opt out included in all emails or by contacting: media@rca.ac.uk
3. Applicants
By submitting an enquiry or application, you are consenting to your data being held by QS Enrolment plc, on behalf of the Royal College of Art. Your data will be used for the purposes of dealing with your enquiry, and to send you relevant information about the College.
Neither QS Enrolment plc nor the Royal College of Art will pass your details on to any third party. If you wish to remove yourself from the Royal College of Art database please contact QS Enrolment plc, IDT House, 44 Featherstone Street, London EC1Y 8RN or email admissions@rca.ac.uk.
What personal information do we hold?
We ask applicants to provide us with the following data during the application process:
- name
- date of birth
- gender
- address
- telephone number
- email
- present nationality
- country of birth
- country of permanent residence
- UK Visa status and details
- passport details (Tier 4 visa students only)
English language qualifications (for applicants whose first language is not English), including certificates of award
- institution name, dates of attendance, programme title, result and thesis title for all higher education qualifications, including certificates of award
- institution name, subject, qualification, result and year of award for all further education qualifications
- details and dates of work experience relevant to the application
- details of previous applications to the RCA
- ethnicity
- disability and learning differences
- financial support plans
- criminal convictions
- programme applied for
- personal statement in support of the application
- referee name, position and contact details
- a portfolio of work relevant to the application.
This information is retained in perpetuity on the College’s secure Student Information System.
What do we use this information for?
The information is used predominantly to support us in considering your application. Specifically, the information is used to:
- consider whether you are likely to have the capacity to successfully complete the programme you have applied to, in accordance with our Admissions Policy
- enable us to organise interviews and communicate with you about your application to the College;
- assess your likely fee and visa status, so that we can advise you on how to proceed if you are made an offer to a programme of the College
- assist with the issue of Confirmations of Acceptance for Study (CAS) documents to students requiring a Tier 4 student visa to enter the UK.
We also use the information to monitor and assess our application and student recruitment processes, ensuring that we can reassure applicants and stakeholders that our processes are entirely merit based, and that there are no barriers that discriminate on the basis of protected or other non-academic characteristics. We also use information to inform and improve activities that enable greater access to the Royal College of Art for all potential students.
Finally, we use this information to prepare your student record should you accept your offer, so that we are able to register and induct you speedily to the Royal College of Art at the start of your programme of study.
Who do we share this information with?
The College has engaged QS Enrolment Solutions to support us in the recruitment of students. Non-sensitive personal data is shared with QS Enrolment Solutions, who manage communications with international applicants up to the point at which the student is registered.
What happens if I do not provide this information?
If we do not receive the information that we request during the application process then we reserve the right not to consider your application.
4. Students
What personal information do we hold?
We hold the following personal information about our students:
- name
- date of birth
- gender
- address
- telephone number
- email
- programme of study
- present nationality
- country of birth
- country of permanent residence
- UK Visa status and details
- passport details (Tier 4 visa students only)
- English language qualifications (for applicants whose first language is not English), including certificates of award
- institution name, programme title and result for all higher education qualifications, including certificates of award
- institution name, subject, qualification, result and year of award for all further education qualifications
- ethnicity
- disability and learning differences
- criminal convictions
What do we use this information for?
The information is used predominantly to support us in managing your registration and eventual award from the College. Specifically it is used for:
- ensuring that all registered and enrolled students have access to their programmes and learning resources
- ensuring that you are advised of any conditions of continuing enrolment, and ensuring compliance with those conditions
- enabling us to assess and advise you of the fees that you must pay to retain your registration
enabling us to make awards and issue certificates and transcripts to successful students
- enabling us to supply other institutions and employers with confirmation of any award of the College, subject to your consent
- enabling us to advise Tier 4 student visa holders of any actions they will need to take to ensure compliance with visa regulations
- enabling us to produce standard student letters, such as letters enabling exemption from council tax or to open bank accounts.
We also use the information to monitor our processes, ensuring that we can reassure applicants and stakeholders that our processes do not facilitate treatment of students with protected characteristics that places them at an unfair disadvantage to students who do not have these protected characteristics.
Some personal data about students is sent once a year to Higher Education Statistics Agency (HESA). The data is sent in an anonymised form (so you cannot be identified from it). Please visit the HESA website for more information.
Who do we share this information with?
The Royal College of Art is required to share this information with regulatory bodies, including the Office for Students and the Higher Education Statistics Agency, for the purpose of assessing Government funding arrangements and for the Graduate Outcomes survey of graduates of our programmes. We may also share information with outside organisations for the production of certificates or the convocation ceremony. In such cases only the data required by the organisation for the effective discharge of its duties will be provided.
What happens if I do not provide this information
If we do not receive the information that we request during the application process then we may not be able to facilitate your access to the College for specific sessions or facilities, and may be required to suspend or cancel your registration.
How long do we hold your data?
This information is retained in perpetuity on the College’s secure Student Information System. In accordance with GDPR, sensitive elements of the information is deleted when no longer needed.
5. Donors & Alumni Supporters
What personal information do we hold?
The personal information the RCA holds about you includes:
- personal data that allows us to identify you, e.g. contact details, date of birth
- details of your education
- details of your interactions with the RCA – e.g. attendance at events; any donations you have made; meetings, emails and phone calls with RCA staff
- details of relationships between you and other supporters, alumni, staff and other RCA contacts
- information gathered from in-house or third-party research that helps us understand more about your background and interests in order to communicate with you as effectively as possible.
Why we collect your data
We collect and analyse your data to ensure that we are working as effectively as possible, and that your generous support goes towards furthering the work of the RCA. By gathering your data we can build strong, mutually beneficial relationships and ensure we are contacting you appropriately, in a timely fashion, and in ways which will be of interest to you.
We collect data to carry out specific tasks, which allow us to respond to requests you may make; provide a better service to you; and identify further avenues of support for the RCA. We review the data we hold to ensure it remains accurate and current.
As per the College’s Gift Acceptance Policy, we are required to undertake due diligence reviews before seeking or accepting donations in excess of £100,000 or those which are associated with a naming opportunity. To do this we access publicly available personal data relating to the potential supporter including reviewing their known associations, criminal convictions and offences. If you would like further information on the Gift Policy and due diligence process please contact the Development & Alumni Relations team via the contact details below.
On occasion, someone you know – for example friends, family or a business associate – may give us your name and contact details as someone who is likely to be interested in the work of the RCA. Similarly we may seek to make contact with you on the recommendation of RCA staff or from relevant news reports. We will contact you as soon as is practicable to let you know we are processing your data in this way. If you do not want us to contact you further please let us know via the contact details at the end of this policy and we will respect your wishes.
What do we use this information for?
Your personal data may be used to:
- keep in touch with our alumni and supporters – including sending publications and invitations that may be of interest
- inform you of promotions and offers that may be available to you through the College’s alumni clubs and partners
- provide access to services, for example use of College facilities
- send updates on the progress we are making and to ask for gifts or other support
- administer, acknowledge and steward gifts and other payments, for example event tickets (including tax administration for gift aid)
- maintain internal records – to keep an accurate overview of your interactions with the RCA
- conduct due diligence, as per the RCA’s Gift Acceptance Policy, to reduce the risk of fraud, credit risk or reputational damage to the College
- create Research Profiles highlighting your preferences and philanthropic interests as well as conduct wealth screening in order to make sure that we are contacting you in the most appropriate way with the most relevant information
- where appropriate, create briefings which will be shared with senior staff, Council members and other affiliated volunteers in advance of events/meetings that you may attend
- conduct research and audits in order to gain a better understanding of our alumni and supporters, to enable us to improve our work.
In accordance with Data Protection Law, you can choose the information you receive from us and via which method (e.g. post, email, phone). We will contact you primarily using your preferred contact method and limit the frequency of non-personalised communications wherever possible. You may opt out from receiving correspondence from the Development & Alumni Relations team at any time via the contact details below.
How do we keep your personal information safe?
The RCA does not sell personal data to any third parties.
Any data we gather is kept strictly confidential and we ensure that there are appropriate technical controls in place to protect your personal details:
- data is stored on a secure drive and in a password-protected CRM database that only designated members of RCA staff have access to
- our online forms are always encrypted and our network is protected and routinely monitored
- we undertake regular reviews of who has access to information that we hold, to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors.
We will only share your personal data with external organisations if we are required to do so by law. If we share data with a third party, we ensure that appropriate data sharing agreements are in place before doing so and that partners have a legal responsibility to only use the information for the purposes for which we supply it. Examples of where we may do this include:
- mailing houses which send out alumni magazines on behalf of the RCA
- specialist third-party agencies who screen alumni names and addresses against data bureau to keep our mailing lists up-to-date
- consultants and third-party agencies that advise us on individual's’ capacity to donate or potential interest in the RCA, for example through wealth screening.
If you have joined a specific alumni club, such as the AlumniRCA East Coast Club, then we may share limited data with the organisers of that group, so they can manage events. The organisers sign an agreement to handle your data securely and only for this agreed purpose. We do not give out your data to organisers of groups that you have not opted into, but we may contact you on their behalf.
We are happy to help you to get in contact with individual alumni, but will not release their personal contact details without permission and therefore will normally send a message to them on your behalf.
How long do we hold your data?
We will retain your data indefinitely in support of your lifelong relationship with the RCA, or until you request us to do otherwise.
Where you exercise your right to deletion of data, we will retain a core set of personal data (name, education details (if related to the RCA), unique identification number and date of birth) to ensure we do not contact you inadvertently in future. We may also need to retain some financial records about you for statutory purposes (e.g. Gift Aid, anti-fraud and accounting matters).
6. Staff
As a data controller, the RCA maintains information about you in paper and electronic form, which is kept in the Human Resources Directorate. Examples of the types of data we collect, with the reasons why we process it, are listed below. If in the future we intend to process your personal data for a purpose other than that which it was collected, we will provide you with information on that purpose and any other relevant information.
What personal information do we hold?
To fulfil our contractual obligations to RCA employees, we need to collect and process staff data. We use this data to manage the relationship between the College and employees effectively, lawfully and appropriately. This applies during the recruitment process up to when your employment ends and after you have left. Much of the information we hold will have been provided by you, but some may come from other internal sources, such as your manager, or in some cases, external sources, such as referees. Types of information collected for this purpose may be in relation to an individual’s:
- employment application form and references
- contract of employment
- home address
- national insurance number
- proof of right to work in the UK
- bank details
- records of holiday, sickness, other absence, along with any evidence supplied
- emergency contact details
- academic qualifications and membership of relevant bodies (e.g. RIBA, ACCA, HEA etc).
- training and appraisal records
- where appropriate, disciplinary and grievance records.
We also collect special category data to monitor equal opportunities. This would be information in relation to an individual’s:
- gender
- marital status
- sexual orientation
- religion or belief
- ethnic origin
- disability
- health
Privacy Policy
What do we use this information for?
We use this information to administer payroll, pensions, training, appraisal and monitor equal opportunities. We share information with RCA IT and Buildings & Estates staff, to manage your access to relevant services. Information on academic contracts is shared periodically with the Research, Knowledge Exchange & Innovation office, to administer the Research Excellence Framework (REF).
We are legally obliged to collect, retain and disclose certain information about you, as follows:
- to pass information with HM Revenue and Customs, the UK’s tax, payments and customs authority (the HMRC’s privacy policy can be found here)
- to send some personal data about you once a year to Higher Education Statistics Agency (HESA). The data is sent in an anonymised form (so you cannot be identified from it). Please visit the HESA site for more information.
- to pass information about you to third parties, where the law allows it. For example, we'd confirm the dates and nature of your employment here to a prospective employer.
- To regularly share information with the Superannuation Arrangements of the Universities of London (SAUL), to administer the RCA’s workplace pension scheme, and with the Imperial College Occupational Health Department, who supply Occupational Health Services to the RCA.
- to transfer information about you to other group companies for purposes connected with your employment or the management of the company’s business. An example of this would be if an RCA service transfers to a new employer, under the Transfer of Undertakings (TUPE) legislation.
How long do we hold your data?
Information is retained throughout your time employed by RCA. If you decide to leave RCA employment, your personnel file is retained for six years from the date you leave. If you were a member of a pension scheme, some information will be kept longer to allow payment of a pension.
Further information
This is the website of the Royal College of Art, an exempt charity which operates under the Terms of a Royal Charter. Our registered office is at Kensington Gore, London SW7 2EU.
Individuals have certain rights of access to their personal data. If you want to request any information about your personal data, please contact: publications@rca.ac.uk.
If you are not satisfied with how we have dealt with your request, you may contact the Information Commissioner's Office.