UCAS' privacy policy

Who we are

UCAS stands for the ‘Universities and Colleges Admissions Service’ – we manage applications to higher and further education in the UK. We offer some of our services through our wholly owned trading subsidiary, UCAS Media Limited. From time to time your data may pass between UCAS and UCAS Media as the UCAS Group. The registered office for the UCAS Group is Rosehill, New Barn Lane, Cheltenham, Gloucestershire, GL52 3LZ. This policy refers to the UCAS Group as ‘UCAS’, UCAS’, ‘our’, ‘us’, or ‘we’.

All personal information provided by you through this website is under the control of UCAS, and we’re responsible for taking care of your personal information in line with the Data Protection Act 2018, and the UK General Data Protection Regulation (GDPR).

---

Terms used in this policy

When explaining how we use your personal information, we use quite a few terms to describe our services. If you don’t understand any of them, you can check what they mean on the 'UCAS terms explained' page.

We try to use language that is easy to understand and avoid legal terms. However, we’re required by law to include certain information in our privacy policy – here we explain what these terms mean:

• UK General Data Protection Regulation (GDPR) is a regulation on data protection and privacy, that applies within the United Kingdom (UK). The regulation provides individual control and rights in respect of personal information.
• Data Protection Act 2018 (DPA), along with the GDPR, sets the regime for handling personal data within the UK.   
• Personal data is information about individuals, like name and address, or educational or work achievements. Our policy may refer to personal data as ‘personal information’.
• ‘Special category’ personal data is personal information the GDPR considers to be sensitive, such as information about ethnicity, sexual orientation, religious beliefs, or mental and physical health. Use of this personal information is subject to stricter conditions under the GDPR.
• Criminal convictions personal data is personal information about someone’s criminal convictions. If you apply to some courses, such as ones that involve working with children, we will ask you if you have any criminal convictions.
• Lawful basis for processing – all uses of personal information must be supported by a ‘lawful basis for processing’. This means there must be provisions in the GDPR or DPA allowing the use of personal information for specific purposes.

Collecting your personal information

When you visit our website, or contact us through one of our service channels, we may collect your personal information, so we can contact you about your request or enquiry. This could include:

• your name, contact details, and interests, if you register to receive a newsletter, updates about our services, or information from third parties
• relevant details about you or your enquiry if you complete a form and/or use the live chat function on our website or provide a response to one of our onsite surveys
• your name and contact details, if you enter a competition. If you're one of the competition winners, we may publish your name on our website. If we need to collect more information from you, or share it with anyone, we’ll let you know when you enter the competition
• collecting your IP address when you visit our website, if you are the only person with access to your computer or device, and it can identify you. We may produce combined statistics about visitors to our website and website traffic patterns, answers to questions, content entered, and related website information. The information used for these purposes is aggregated (i.e. combined with other user data) and anonymised. It’s used to improve our website and will not be shared in a way which identifies you.

For further information about contacting us through social media and webchat, please see the ‘Social Media and Cookies’ section below.

---

Calling UCAS

When you call UCAS through our main contact numbers we will record the call. We do this to help us get better at what we do by using the recording for quality and training purposes. We keep call recordings for three months for training purpose, or to make sure that the information you provide is accurately recorded our systems. In exceptional circumstances, we may keep recordings for longer, for example, where information emerges to indicate that the content of the call may be significant, or if you have requested a copy of the call. During a call we may ask you some security questions or questions about your interaction with UCAS to help us to deal with your enquiry. To be able to improve our customer care and to help us provide our staff with the right information, we may anonymise your call recording to use as part of an analytical programme of work aimed at improving efficiency. This set of anonymised data may be kept for an extended period of retention. Call recordings will not be retained for a longer period than necessary.

---

Sharing your personal information

We may share your personal information with employees of UCAS or the wider UCAS Group, or our suppliers who provide services to us, if this is necessary to progress or address your request/enquiry.

If you raise a complaint about UCAS, a member of staff, or a third-party organisation which engages with a UCAS service, we will review your complaint to decide if we are able to investigate in accordance with our complaints policy. During a complaint investigation UCAS may need to share some of your personal information, together with the details of your complaint, with third parties if appropriate. Where this occurs UCAS will endeavour to provide the minimum information required to support the handling of the complaint; this activity is undertaken by UCAS in support of our legitimate interests to investigate your complaint.

Collecting your personal information

When you attend a UCAS event, including virtual events, we collect the following personal information:

• Your name, address, email address, date of birth, current school, and year. We also ask you to tell us when you want to start university, the areas of the country where you want to study, the subjects you want to study, and if you are considering a gap year, apprenticeship, going into employment, studying overseas, or studying at a conservatoire.
• You can also choose to give us your mobile phone number and tell us which subjects you’re currently studying.

---

Using your personal information

• We use this personal information to provide you with updates about event(s) you’re attending and ask your opinion about our services.
• We also use this personal information to make sure any information and advice we send you is relevant and useful – such as open days likely to be of interest to you, based on the subjects you want to study, and where you live.

We retain the personal information to produce research about such things as attendance at events, and their impact on access to higher education. Any statistical analysis reports we produce will not allow you to be identified.

---

Changing what we send you

If you change your mind about any information you have opted in to receive, you can do this at any time by selecting the ‘Update Preferences’ link in the emails you receive from us, or via your UCAS Hub account. 

---

‘Special category’ personal information

• We ask you to provide details of any special requirements you have, such as disabled access needs, or visual or hearing impairments, so appropriate support can be put in place at the event.
• You don’t have to give us this information, but by doing so, we hope to make sure you have a better experience at the event, as the information will be shared with UCAS Events employees and relevant employees at the venue (such as those with responsibility for security, and health and safety).

---

Sharing your personal information

• You can get your ticket scanned at an exhibitor’s stand. If you do, they’ll receive your name and contact details, including your mobile phone number (if provided), so they can contact you with opportunities that may be of interest. We’ll also share how you’d prefer to be contacted (e.g. email, post, SMS/text) based on what you told us when you signed up for the event.
• We’ll provide exhibitors with your date of birth, current school and year, when you want to start university, the areas of the country where you want to study, and the subjects you want to study. We’ll also let them know if you’re considering studying overseas or at a conservatoire, or are interested in a gap year, apprenticeship, or going straight into employment. If you gave the subjects you’re currently studying, we’ll also pass these on to the exhibitors.
• During a virtual event, if you access an exhibition space of one of our exhibitors, they will receive your contact details and the subjects you have noted that you are interested in. This will enable them to send you info about course details and open days which are relevant to you. The very nature of a virtual event is to find information and make connections with exhibitors. Any communications outside of the event will be based on the preferences you made in your registration. You will have the opportunity to opt out of exhibitor comms once they have made contact with you.
• Exhibitors may use this information to make sure any communications you receive are relevant and of interest to you.
• If you have booked your ticket as part of a school group, your school will be able to see whether you have attended or not.

---

Using your image at an event

When you attend an event, you might decide to have your photo taken. If you do, it will be stored in Flickr and shared on our website to help promote our events. This means, anyone who visits our website will be able to see and download your photo for two weeks after your visit. You must, therefore, be sure you’re happy for your photo to be shared.

If you want to have your photo removed, email datagovernance@ucas.ac.uk with:

• the details of the event you attended (date and venue)
• a copy of the picture you want to be removed

If you’re a parent, guardian, or carer attending a UCAS event, we’ll collect your name and contact details, so we can send you updates about the event, and information and advice to support your child with their post-18 options. We’ll also ask you to confirm what post-18 options your child is interested in, and will use this information to provide relevant information in the communications you receive from us. You can also scan your ticket at an exhibitor’s stand. If you do so, they will receive your name and contact details, so they can contact you with opportunities that may be of interest. During a virtual event, if you access an exhibition space or the content of one of our exhibitors, they will receive your contact details and details of the subjects that your child is interested in. This will enable them to send you info about course details and open days which may be of interest based on the preferences made in your registration.

If you are a delegate, speaker, provider, adviser or exhibitor attending a UCAS event, or virtual event, we’ll collect information that may include name, contact, school, and transport details, to support your attendance at the event, and so we can send you updates and information likely to be of interest. We’ll also send you useful information on behalf of third parties, if you choose to receive it.

We make the names, position, and organisation of people attending UCAS events available to everyone who attends. ​

Collecting and using your personal information

When you use the UCAS Hub we collect the following personal information:

• If you log in and create an account – to allow you to use the Hub’s research tools and add favourite course choices and content, we’ll ask for your name, location, chosen password, if you are at school, and your email address. We’ll also ask what type of courses you are interested in. You can also provide further confirmation of the type of information you are interested in receiving further details about.
•  If you wish to personalise the content – you can add information to assist in your exploration of your higher education choices including within the personal statement, notes or tariff calculator tools.
• If you use the CV Builder tool – you can enter information such as your goals, interests and motivations, skills, competencies and experience to populate your CV and download it. You can go back and edit your CV and re-download a new copy, for as long as you retain your Hub account.

​‘Special category’ personal information

• We do not request any special category information directly through the Hub. If you enter any such information into the tools available on the site, we consider that we hold your explicit consent to process (store) that information.

How we use your information

The information you provide will be used to present personalised content including through the tools available to you. Data will also be used to support the analysis of the system and improve future developments, wherever possible this analysis will use anonymised data.

Collecting and using your personal information

When you apply to higher education, we may collect the personal information below. 

• If you register on our website, we collect your username, chosen password, answers to security questions, your name, and email address.
• If you apply through our admissions schemes, we may ask you to provide your name, date of birth, contact details, communication preferences, gender, nationality, and permanent residence. We ask for details of your education, qualifications, work experience, course choices, student finance options, whether you have been in care, and your parent or guardian’s education and occupational background. You will be asked to complete a personal statement to support your application. When you pay the application fee, we’ll also collect your chosen payment details.

• Information you provide about whether you have been in receipt of free school meals (for those students applying for 2025 entry through their school or college) will be used to determine whether you are eligible for the fee waiver. This information will be reviewed by your school or college.

• If you apply directly to a provider instead of through UCAS, the provider shall inform you that they will send a shortened version of your application to UCAS (known as a Record of Prior Acceptance (RPA).

• To support your application, if you apply through UCAS Undergraduate or UCAS Conservatoires, we’ll receive results from the examination and awarding bodies.
• To support your application, we collect the personal information your referee(s) provides, and allow you to appoint a nominated contact who can speak to us, and receive information about your application. You must make sure you have the permission of your referee and nominated contact to provide us with their details.
• If you apply and live outside of the United Kingdom (UK), we ask for your visa and passport details, so the course providers you’re applying to can check your identity and confirm you can study in the UK.
• How you want to be contacted – if you opt to receive further information from UCAS or third parties.
• Undertaking research about the higher education sector – we’ll retain a copy of your application and use it, sometimes in combination with other information we hold, for producing statistical analysis and research in respect of UCAS’ admissions schemes. Any statistical analysis reports published will not allow any individual to be identified.

---

‘Special category’ personal information

To support your application, we may ask you to provide special category personal information as detailed below, which may be shared with the course providers (universities and colleges) you apply to.

• It’s up to you if you give details about your ethnicity, sexual orientation, gender identity, and religious belief – this will help providers check their compliance with the Equality Act 2010. This information is provided to your chosen providers after you’ve secured your place, or at the end of the application cycle.
• You can choose to give information about any disability you have, so the providers you’ve applied to can support you if you’re invited to an interview or offered a place.
• If you’re applying to courses that involve working with children and vulnerable adults, such as medicine, teaching, or social work, you’ll have to declare if you’ve got any criminal convictions, including spent convictions. This allows providers to consider any potential impact on your application.

Record of Prior Acceptance (RPA)

If you apply directly to a provider instead of through UCAS, the provider shall inform you that they will send a shortened version of your application to UCAS. This will include your application data but not your reference or personal statement.  This process is known as a record of prior acceptance.

This is to enable UCAS to maintain a complete dataset of acceptances for all full-time Higher Education applicants, when applicants have not used the UCAS Admissions service.  Personal data received by UCAS will be retained in line with our retention periods for admissions data and held securely.  Personal data may be used for research and analytical purposes, as detailed further on in this section under ‘Enabling research about higher education’. Data will not be used for any other purpose. 

Free School Meals and Contextual Admissions 

Free School Meals data is used by UCAS for analysis to help provide timely information to the sector on patterns of entry of different background groups. The data is also shared with providers as part of the admissions service to support contextual admissions and to inform their approach to widening access and participation. UCAS obtains free school meal data from various sources.  

For state schools in England, Wales, and Northern Ireland, UCAS receives school census FSM information from the Department for Education (from the National Pupil Database), Welsh Government (from the PLASC census) and Department of Education Northern Ireland (from the School Meals Uptake data collection). UCAS does not currently receive FSM data for pupils in state schools in Scotland. 

For independent schools, UCAS receives FSM information from Bursary Assessment Associates for individuals who have used their free school meal validation service and have met the FSM eligibility criteria. 

The information is shared by the Department for Education (DfE) under the lawful basis of Public Task and their commitment to ensuring fair treatment for all groups of students regardless of background. To see a copy of your data which is shared by the DfE or find out more details, or to request that DfE does not share this information, please email dataprotection.office@education.gov.uk.  

The information is shared by the Welsh Government (WG) under the lawful basis of Public Task. To see a copy of your data which is shared by WG or find out more details, or to request that WG does not share this information for operational purposes, please email school.stats@gov.wales.  

The information is shared by the Department of Education Northern Ireland under the lawful basis of Public Task. To see a copy of your data which is shared by the Department of Education or find out more details, or to request that the Department of Education Northern Ireland does not share this information, please email dataprotectionofficer@education-ni.gov.uk. 

FSM data also makes up part of the Multiple Equality Measure or ‘MEM’ score, you can find out more here.  

---

Sharing your personal information

We may share your personal information with organisations or individuals, for the purposes listed below.

Supporting your application to higher education

• We share the personal information in your application with the providers in the UCAS admissions scheme(s) you’re applying to, so they can consider your application.
• If you apply through our UCAS Undergraduate or UCAS Conservatoires schemes, we share any results provided by the examination and awarding bodies at any point during the application cycle with the course providers you applied to. We may also liaise with them about your results.
• If you take the United Kingdom Clinical Aptitude Test (UKCAT) or University Admissions Tests UK tests (ESAT and TMUA), we will share your Personal ID number and choice information with the test provider to enable them to share your test result with your university choices.
• If you apply to study at course providers in the Republic of Ireland, we’ll share your details with their higher education admissions body, the Central Applications Office Ltd., so we can process your examination results.
• If you apply through, or link your application to, your school, college, or UCAS registered centre, they can access the content of your application and keep up to date with your progress. They will be able to see and agree that the information you provide about whether you have been in receipt of free school meals is correct (for those students applying for 2025 entry through their school or college). They won’t be able to update or see any information you provide about your sexual orientation, gender identity, or religious belief.
• We provide personal information to your referee(s) so they can identify you and have sufficient information to write an informed reference.
• If you use an agent to submit your application, they can access your application and see its outcome.

Enabling research about higher education

If you apply through UCAS Undergraduate, we may share your personal data with the Office for National Statistics, or other statutory organisations, to support research in the public interest. We do this to help inform research about, and improve, higher education. We do not allow use for commercial purposes, such as marketing, and we take steps to minimise the personal information shared to support this research. Any data shared with researchers will not allow individuals to be identified.

Reporting to organisations with responsibilities for higher education

We may also share personal information with government or other bodies with responsibilities for the higher education sector, or others which develop and monitor the effectiveness of government policies for higher education such as:

• The Joint Information Systems Committee (JISC) – universities and colleges are required, by law, to provide personal information about their placed applicants and courses to JISC (previously HESA). This information is used to monitor the performance of universities and colleges, and to help make funding decisions. UCAS will share this data with the university or college, in a format which supports their reporting commitment. To assist with this process, with the agreement of the university or college and to support data validation activities, UCAS also share some of this data directly with JISC. 
• The Office for Students – when necessary to help it meet its statutory requirements for higher education funding and ensure fair access to higher education.

We only supply personal information that identifies you for these purposes:

• if the provision of statistical analysis is not suitable
• if we have a contract or agreement in place setting out agreed purposes for which it can be used

Prevention and detection of crime

We may share personal information with relevant statutory organisations, like the police, to support the prevention and detection of crime, and for child protection purposes.

Verification checks

We will make verification checks to ensure your application is accurate, and not fraudulently submitted. This process will include cross-referencing the information submitted on new applications with previously cancelled submissions, and checking personal statements do not include material copied from another source. If any adverse information is revealed about you, we will let you know so you have an opportunity to respond. We may also share details of these checks with the course providers to whom you've applied.

Information provided as part of your application may also be used by course providers to complete their own verification checks regarding the details you have provided. They may contact you directly if there are any concerns or queries regarding your application.

Sharing personal data outside the United Kingdom (UK)

We may transfer personal data outside the UK, if you apply or link your application through a school or college outside the UK.

We may use technology suppliers that provide services located in countries outside the UK. Where we do so, we ensure any personal information is protected by the same standards that apply in the UK.

If you apply through the UCAS Undergraduate scheme and find yourself unplaced, or you apply direct to Clearing, you can use Clearing Plus to review courses that we believe may be of relevance to you and where you meet criteria selected by course providers.

Collecting and using your personal information

We already hold the personal information necessary for you to use Clearing Plus, as you gave this in your application. We will keep a record of the course options you show an interest in and may use this information to review and improve Clearing Plus and to provide aggregated statistics, where you will not be individually identified.

Sharing your personal information

If you find a course in Clearing Plus that you want to be contacted about and select the ‘I’m interested’ option, we’ll share some key information from your application with the relevant universities or colleges. This includes your name and contact details. If the course provider wishes to see further information before contacting you, they will be able to access additional information, including your personal statement and qualifications,. If you no longer want to be considered for a course that you have selected, you will need to contact the provider to let them know. Find out more about Clearing Plus.

UniBuddy has been integrated into the UCAS journey to provide a fully personalised ‘chat to students’ experience.  You can access this service through your UCAS Hub account.

• If you use the UniBuddy service, you will be asked if you agree to the UniBuddy terms of service, Privacy Policy, and Acceptable Use Policy before you begin. If you accept, you will then be passed into the UniBuddy environment and UniBuddy will receive your Account ID, Country, Email, Entry Year, Favourite Subjects, First Name, Last Name, and Study Level from your UCAS Hub, which they will use to create you a UniBuddy account to provide their ‘chat to students’ service. If you make a change to the personal information within the UCAS Hub, your UniBuddy profile will be updated automatically when you next use the service.  
• Data matching between UCAS and UniBuddy is used to personalise your experience and to match and introduce you to student ambassadors studying at Higher Education universities and colleges, who are just like you. This information will be shown to you when you are logged into your UCAS Hub and it will adapt the more you tell us about yourself. This means the more subjects, locations or providers that are favourited, the service will become more personalised to you.    
• ‘Experiential’ data is captured by tracking user activity. This means that UCAS will be able to see user interactions in the UniBuddy service and will be able to use this for personalised messaging in the UCAS Hub to help you to continue your interactions with student ambassadors (for example to carry on the conversation with your chosen University) and show you handy links to relevant content and courses on UCAS.com and within the UCAS Hub.  
• If you change your mind and no longer want to use the Unibuddy ‘chat to students’ service, you can close your UniBuddy account by doing this whilst in your account in the UniBuddy environment.  
• If you already have a UniBuddy account when you access the service via UCAS, you will be asked if you would like to link your two accounts.  
• When you select an ambassador to initiate a chat, you will also be asked if you consent to your data being shared with the relevant university or college for marketing purposes and if you would like to be contacted by that university or college to help make your decision about where to study. 

In collaboration with UCAS, Springpod’s online learning platform has been integrated into the UCAS Discover journey to provide a personalised experience and access to higher education subject tasters, known as Subject Spotlights and access to Virtual Work Experiences. You can access this service through your UCAS Hub account: 

• If you use the Springpod service, you will be asked if you agree to the Springpod terms of service and privacy policy before you begin. If you accept, you will then be passed into the Springpod environment. Springpod will receive your full name, email address, address including postcode, country, date of birth and universities, subjects and careers of interest which will be shared from your UCAS Hub data, which they will use and retain (as a data controller) to create you a Springpod account to provide the service.  
• Springpod will share usage data, such as the number of experiences a user has completed or partially completed, back with UCAS for a personalised UCAS Hub user interface and for anonymous reporting purposes on the service.    
• You can make changes to your Springpod account at any time by doing this in your Springpod account. 
• If you change your mind and no longer want your data to be shared between UCAS and Springpod, you can manage this within the UCAS Hub settings.  If you would like your Springpod account data deleted, you can request this whilst in your Springpod account. 
• If you already have a Springpod account when you access the service via UCAS, you will be asked if you would like to link your two accounts.   
• When you complete a Springpod experience, you may also be asked if you consent to becoming a qualified lead for that provider, which means whether you would like to be contacted by that university, college or employer to help make your decision about where and what to study, and if you want to share your data with the relevant university, college or employer for marketing purposes. 
   

Apprenticeship Smart Alerts 

• Our Smart Alert service is designed to send you tailored opportunities based on the information you provide us and are filtered against criteria set by employers who use this service
• Within the UCAS Hub, you will be able to opt in to receive Smart Alerts
• We won't match you with every job on our Apprenticeship Search platform, just the ones where employers are looking for specific candidates and have chosen to pay for our matching service. To view all our apprenticeship vacancies, visit our Apprenticeship Search page
• With Smart Alerts you are fully in control of the personal data you provide; we will never share your details with employers or other third parties and you can choose whether to apply for the opportunity

Collecting and using your personal information 

• If you opt in, you will be asked to provide some information and personal data so that we can carry out our matching service   
• This includes information on your location, the distance you are willing to travel, whether you may consider relocation, the apprenticeship level and industry sectors you are interested in working in, the GCSEs you have been awarded and an estimated start date   
• Smart Alerts also use gender from your Hub data because some employers may wish to target opportunities to improve diversity in the recruitment pool.  
• Smart alerts uses your home postcode you provided in the Hub to calculate the Index of Multiple Deprivation quintile because some employers have specific ED&I targets, one of which is to increase the number of participants from deprived backgrounds    
•  For this service some of the data is enriched with publicly available information to calculate necessary information such as distance and drive time to apprenticeship opportunities, or postcode lookups to ascertain deprivation measures 
• You may then be sent details of apprenticeships where you have been matched to the employers' criteria when they become available 

How to opt out of receiving Smart Alerts 

• You can opt out of receiving alerts at any time, by clicking the ‘unsubscribe’ links in our communications. You can also update your preferences and opt out within the Hub. 

GDPR lawful basis for processing – Article 6 1 (f) where ‘processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child’ 

When you register to attend a UCAS event or set up a UCAS Hub account, we may send you further information considered ‘direct marketing’ under data protection law. 

• We will send you further information, unless you opt out, to help you find the right university or college course such as open days and other relevant information. We may also send you information about courses if you find yourself unplaced.
• UCAS Media, if you opt in, may send you information on behalf of third parties based on your preferences, interests and any favourites across UCAS.com. Opt in to receive information about commercial products such as student deals and offers, career information and apprenticeships, and to receive student experience surveys. 

Direct marketing is regarded as carried out for legitimate interests unless we have explicitly sought your consent. 

We will not share your personal information with third parties who send you direct marketing, unless you provide specific consent for us to do so, separate from any consent about receiving information.

Email communications

We may also use tracking technologies to measure your interaction with our emails, such as whether you have read or clicked on any of our emails so that we can understand how to improve our communications and make them more relevant to you. If you do not wish us to confirm whether you have opened or clicked on our communications, you will need to unsubscribe from our marketing emails as it is not possible for us to send these emails without tracking enabled. You can update your communication preferences at any time in your UCAS Hub account, or by using the unsubscribe link included at the bottom our emails. Please note you may still receive service emails with tracking technologies enabled after you have unsubscribed.

---

How to opt out of receiving further information

You can opt out of receiving this information at any time, by clicking the ‘Unsubscribe’ or ‘Update preferences’ links in our communications. You are also able to update your preferences within the Hub.

We may use a supplier to provide this information to you – such as an application that enables us to deliver information to you, sending you an email or SMS/text, or mailing companies, where the information is delivered to you by post.

---

Display marketing and how to switch it off

We use Google Tag Manager to support display advertising content on our website, according to the demographics (such as age, gender, or interests) of the visitors to particular pages. Find out how to opt out of personalised display advertising.

We may also use Google, Twitter, Facebook, LinkedIn, and Snapchat remarketing features which support promotion of our services you have shown an interest in, if you have subscribed to Google, Twitter, Facebook, LinkedIn, or Snapchat.

This may be based on a hashed (anonymous) email address, or other anonymous information collected by cookies when you visit our website, such as things like your mobile device location (if location features are turned on), browser cookie ID, mobile device identifier, and IP addresses. This helps us provide you with relevant adverts if you have a Google, Twitter, Facebook, LinkedIn, or Snapchat account.

You can choose to opt out of receiving these adverts by:

• changing your account settings for Twitter, Facebook, Google, LinkedIn, and Snapchat to opt out of receiving ‘audience advertising’, to ensure you do not receive tailored adverts
• enabling the 'Limit Ad Tracking' setting (on iOS devices), or the setting to 'Opt out of Interest-Based Ads' (on Android), so Google, Twitter, Facebook, LinkedIn, and Snapchat do not tailor our adverts for you by matching your device to information from partners

---

Confirming your status as a UCAS applicant

If you apply through UCAS Undergraduate, we’ll give you a code, which you can share with banks or other organisations, to access products and services only available to students, such as student bank accounts.

​

How we collect your personal information

If we engage with each other through social media, we may collect information contained in your posts or blogs, comments, likes, voting, web chat, video uploads, or private messaging functions, from any of the social media links available to you on this website.

---

How we share your personal information

Any personal information you choose to share could be accessed publicly, if you share any content on this site, or on any of our social media sites (Facebook, Twitter, YouTube, Pinterest, Instagram, Vine, LinkedIn, or Google+). This includes disclosing personal information if you engage with UCAS social media, such as posting comments on any of our UCAS social media pages or content, voting for your favourite blogger, sending us a private message, uploading a video, or tweeting us. If you share any personal information with us via web chat or private messaging functions on social media, whilst UCAS have strict privacy and data protection practices you must remember that you are also sharing your information with the platform you are engaging with, and they will have their own set of privacy policies that UCAS are not responsible for or have any control over.  

We cannot be held responsible for any damaging actions or behaviours which may result, following your use of this, or any other related social media activity.

---

Social media acceptable use

When you engage with UCAS on social media, such as our Facebook page or Twitter feed, comments you post are live as soon as you publish them. We do not check and approve them beforehand. We will remove inappropriate posts. So you know what that means to us, please read our acceptable usage guide (183.74 KB).

---

Cookies

We want to make sure we give you very clear information about the cookies we collect, how we use them, and how to disable them – read our cookies policy.

We use cookies to provide users with the functionality contained in our website, and produce anonymous information to help analyse website traffic, usage, and behaviour. This helps us improve the visitor experience on our website, and ensure you receive relevant adverts when you use our website, and others.

UCAS uses a cookie management tool which will allow you to identify and record your cookie preferences when you first visit our website.

Collecting and using your personal information

We may collect your personal information, including your name, role, and contact details, if you:

• provide support for a UCAS applicant, such as providing a reference, or validating their application
• sign up to receive a newsletter, and give us your name and contact information
• make an enquiry to become a UCAS registered centre, so we can contact you to progress your enquiry, or keep a record of those approved
• are a teacher or adviser supporting applicants after GSCEs or equivalent qualifications, so you can sign in to Apply for advisers and Adviser Track, and we can give you relevant information about our products and services
• are a teacher or adviser supporting students to make informed decisions about their future, so you can access the latest careers information and guidance
• act as a nominated representative (proxy), so we know an applicant is happy for us to speak to you about their application
• act as an agent on behalf of an applicant, so you can send and manage their application

We may also send you survey requests, so we can improve the services we offer.

---

Sharing your personal information

We may share the personal information we collect about you with:

• our service providers, who may need your personal information to progress your request or enquiry
• course providers, if you’ve provided a reference in support of an application 

​

If you are a legal member, you may be asked to provide your name, and provider details, and to vote on resolutions in accordance with the Companies Act 2006.

We hold this information to allow you to vote on resolutions and so we can contact you about your vote if we need to. We won’t share this information with third parties, unless required to by law.

We use a variety of measures to make sure we hold your personal information securely, and only share it with organisations who need to access it. This includes maintaining an Information Security Management System, in line with the international standard ISO 27001:2013.

We use third party suppliers who provide parts of our services for us. We have contracts with these suppliers, which require them to use personal data only to provide these services to us.

Where we use the services of a supplier which involves transferring personal data outside the United Kingdom (UK), these will be made to countries with a level of data protection law similar to the UK, or we will include approved model contract clauses, which provide safeguards for the personal data transferred. If you want to know more about international transfers of your personal data, please contact datagovernance@ucas.ac.uk. 

---

Passwords

To keep your application secure, we’ll provide you with a username and you’ll be asked to create a password. We also ask you to answer certain questions before we discuss your application with you. You can choose to nominate a representative to act on your behalf.

Do not give your Personal ID to anyone other than your nominated representative, if you choose to. Your password or security answers must not be given to anyone, even your nominated representative.

We retain your personal information in accordance with the GDPR, which obliges us to keep it only for as long as is necessary. If we do not have any requirement to retain personal information for business, regulatory, or legal reasons, we will delete it.

Article 89 (1) of the GDPR allows us to retain personal information for statistical and research purposes in the public interest. If you apply through one of our admissions schemes, we’ll retain and use this, in combination with other information we hold, to produce statistical analysis and research in respect of the higher education sector, for public benefit.

Some of the public benefit research we undertake means we must retain this information in a way that allows individuals to be identified. Examples of such research include:

• universities wanting to measure the success of their ‘widening participation’ schemes. This is government policy, and requires them to encourage and review participation in higher education across different social groups, and to measure the success of their interventions on admissions to higher education in respect of named individuals
• data from our admissions schemes over historic cycles, which we link to other datasets, such as the national pupil database. This contains details of pupils in England and Wales, over historic admissions cycle, to help produce reports on equality in higher education admissions

Where possible, we also deploy additional security measures encouraged by the GDPR. This includes using personal information held in a format that does not directly identify specific individuals, without the use of a separately stored code or key that allows identification. This is referred to in the GDPR as ‘pseudonymised data’.

The GDPR provides you with rights in respect of your personal information.

• The right to be informed about the way UCAS processes your information – we provide these details when you first use a UCAS service, and this includes the information available through this privacy policy.
• The right of access to information UCAS holds about you. There may be a requirement to provide identification details so we can be sure we are sharing information with the right person. We may also ask you for confirmation of the information you are hoping to obtain or your interactions with UCAS to support this handling of your request.
• The right of data portability – provides a right to a machine-readable copy of your information in certain circumstances.
• The right to object to ‘automated decision-making’ including profiling – you have a right under the GDPR to object to any decision that has legal effects on you made by solely automated means (e.g. no human intervention). UCAS’ uses of personal information don’t include automated decision-making as defined in the GDPR.
• The right to ‘rectification’ of your information – if you believe that the information UCAS holds about you is inaccurate, you have a right to ask us to amend or update that information.
• The right to request deletion of your personal information – UCAS retains personal information to support research into the higher education sector. However, you can request that we delete the personal information we hold about you and will provide a response.
• The right to object to uses of personal information, in particular where the lawful basis for processing relies on processing in the public interests, or UCAS’ legitimate interests. See the section ‘Lawful basis for processing’ for more information.
• The right to restrict processing, which is available in certain circumstances.

If you would like to apply these rights, or have questions about UCAS’ use of personal information, please email datagovernance@ucas.ac.uk, or write to: Data Protection Officer, UCAS, Rosehill, Cheltenham, Gloucestershire, GL52 3LZ. . Further details about these rights can be found on the Information Commissioner’s website. You also have the right to lodge a complaint with the Information Commissioner’s Office if you have concerns about how your data is being processed.

If you’d like to opt out of receiving direct marketing, you can click the ‘unsubscribe’ or ‘update preferences’ links in the communications we send, or you can update your preferences in the UCAS Hub.

The UK General Data Protection Regulation (GDPR) contains a variety of purposes for which personal information can be used, and our uses of personal information must meet one of these. They are listed at Article 6 of the GDPR.

There are also additional requirements in respect of ‘special category’ personal information listed at Article 9 (2) of the GDPR. The Data Protection Act 2018 contains provisions that allow personal information about criminal convictions to be used where certain circumstances apply.

This is known as the ‘lawful basis for processing’. UCAS’ lawful basis for using personal information varies, depending on the purpose for which we are using it. Our basis for processing is explained in more detail below.

---

Personal information

Purpose 1 – Managing your application to higher or further education, or attendance at a UCAS event

If you apply through UCAS, or register to attend a UCAS event, you’re accepting our terms and conditions, and entering into a contract with us. We’ll collect the personal information necessary to satisfy the purpose of this contract, such as personal information to allow course providers to make informed decisions on whether to offer a place on a course. This also covers personal information collected from other sources, such as referees, or examination and awarding bodies.

GDPR lawful basis for processing – Article 6 1 (b) ‘processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.

Purpose 2 – Sharing personal information with statutory bodies with responsibilities for the higher education sector, and to enable academic research into higher education

We share personal information with providers and other public authorities (e.g. government bodies such as the Department for Education) to help them with their statutory functions, including funding, regulation, and policymaking.

We share personal information with universities to help them meet, or demonstrate they are meeting, government aims or policies such as ‘widening participation’ initiatives, which require them to address discrepancies in the take up of higher education opportunities between different social groups. We also share personal information to enable academic research, in accordance with the aims of the Higher Education Research Act 2017. We also publish a wide range of reports about our higher education admissions schemes.

We always try to share information in a way that does not identify individuals, such as by providing statistical information. Where personal information is provided in a way that allows individuals to be identified, it is done so under contractual terms, and not used to support decisions being made about individuals.

GDPR lawful basis for processing – Article 6 1 (f) where ‘processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child’.

Purpose 3 – Commercial use of personal data through UCAS' commercial products and services including sending information to unplaced applicants about available courses, display advertising, providing services to universities to help their admissions strategies, and producing commercial research

If you apply through UCAS Undergraduate and do not get a place, we may send you course and opportunity information on behalf of providers, unless you opt out of receiving this. If you have subscribed to Google, Twitter, Facebook, LinkedIn, or Snapchat, we may also use their remarketing features to support promotion of our services that you have shown an interest in. You can stop receiving these adverts by following the advice in ‘Direct marketing, accessing student products, and how to opt out’ section of this privacy policy.

We give analysis to Universities and Colleges, to help them understand and measure the success of their admissions procedures, and improve them. We do not provide personal information that identifies individuals for this purpose. This may involve some individual level data matching activity to support the analysis; but any information we share will be anonymised to ensure individuals cannot be identified. We also may provide statistical analysis to people or organisations undertaking research into the higher education sector.

Your personal data may be used to support the development and provision of commercial products to third parties. Personally identifiable information will not be shared through such products or services without your consent.

GDPR lawful basis for processing – Article 6 1 (f) where ‘processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child’.

UCAS does not receive public funding. Our funding comes from:

• the UCAS application fee to apply to university or college
• application charges to universities and colleges for placing applicants
• commercial revenues raised through additional services we provide, such as marketing, paid for research and our commercial product development

These services help fund our charitable purposes for public benefit.

These activities do not involve sharing personal information in a manner that identifies you with third parties; personal level information will only be provided with your consent. We issue information about relevant course opportunities on behalf of universities. You can opt out of receiving such information when they apply, and at any point during the admissions cycle. We have controls built in to the technology systems that produce our research, to prevent it being shared in a way that can identify individuals.

We may use personal level data to support the development of new commercial products. Individual data will never be shared through these commercial products or services without your consent.

Purpose 4 – Enhancing customer experience

We offer services that enhance customer experience, which people can opt in to. These include:

• receipt of information about education, careers, accommodation, and products and services that students might be interested in
• providing you with a code, to give to banks or other organisations to access products and services only available to students, such as student bank accounts (this is only if you apply through the UCAS Undergraduate scheme)
• if you apply though a school, college, or UCAS registered centre, you can choose to let that centre see the progress of your application. This allows your centre to support you throughout the application process

GDPR lawful basis for processing – Article 6 1 (a) where an individual ‘has given consent to the processing of his or her personal data for one of more specific purposes’.

We will obtain a separate consent for these functions, in addition to the terms agreed to when applicants and others agree to the terms of service associated with the product.

We may send you surveys to help us to improve our products and services. For more information about this please see our surveys privacy notice.

---

Withdrawing consent

You can opt out of receiving further information and advice, by clicking the ‘Unsubscribe’ or ‘Update preferences’ links in the communications you receive from us. Or, if you have already applied, you can update your preferences in Track.

You can remove permission for your centre to be able to see your application by contacting us.

---

‘Special category’ personal information

Purpose 1 – Equality monitoring

When applying, applicants can choose to tell us their ethnicity, sexual orientation, and religious beliefs. Providers can use this information to review their performance in meeting their statutory duties in the Equality Act 2010. We may also use this information to produce similar analysis across the higher education sector. This personal information is shared with universities and colleges after an admissions decision has been made.

GDPR basis for processing – Article 9 2 (g) where the use of personal information ‘is in substantial public interest’, which the Data Protection Act 2018 clarifies can include keeping under review the existence or absence of equality of opportunity or treatment between different groups of people, including differences based on ethnicity, religious beliefs, and sexual orientation. This information is not used to influence decision-making and will not be shared with a course provider until a decision has been made on your application.

Purpose 2 – Assisting applicants who declare they have a disability

When applying, applicants can tell us if they have a disability or any special needs. It also allows providers to arrange additional support and make necessary arrangements for applicants with specific needs, at an early stage.

GDPR basis for processing – Article 9 2 (b) where the use of personal information is necessary for carrying out obligations in the field of social protection law.

---

Criminal convictions

When applying to courses leading to professions or occupations exempt from the Rehabilitation of Offenders Act (1974), applicants are required to declare whether they have any criminal convictions, including spent convictions. This enables universities and colleges to identify potential issues at an early stage and undertake ‘fitness to practice’ assessments to identify if an applicant is suitable for a course.

Data Protection Act 2018 – basis for processing:

• Schedule 1, part 2, paragraph 11 – protecting the public against dishonesty.
• Schedule 1, part 1, paragraph 1 – necessary for the purposes of performing obligations under the law relating to social protection.
• Schedule 1, part 1, paragraph 2 – necessary for health and social care purposes.

​

Collecting your personal information

In some circumstances UCAS collects images, including photographs and video footage with your consent for a specific purpose. In those situations, it will be made clear to you that in consenting you acknowledge and understand that you/your child’s participation in this activity is voluntary and that you freely consent to being recorded and that these recordings will be used by UCAS.

How we use your personal information

Images may be used for the following purposes:

1. Content for marketing materials
2. Content for commercial materials
3. Content for news media outlets
4. Content for distribution through social media, website, screenings and exhibitions
5. Uses required or permitted by law

How we share your information

Your/your child’s image may be published on any of the following channels, or other areas where appropriate:

1. in press and media (including newspapers, magazines, websites and social media)
2. on our websites
3. on our social media feeds including Twitter, Facebook, LinkedIn, YouTube and Instagram
4. in our printed publications
5. in printed publicity literature such as leaflets, posters or other display materials
6. at screenings, exhibitions and events.

Although your/your child’s image will initially be processed by UCAS within the UK, websites and other online media can be seen throughout the world, and not just in the United Kingdom, where UK law applies.

Your/your child’s image will be used in relevant campaigns and your consent form will be retrained for the period in which the image is in use. The duration of a campaign or use of your image may vary dependent on its content; however, it is likely that footage will be retained for no longer than 7 years, expect where it is retained for archival purposes.

 

Our website and privacy policy may contain links to other websites, operated by other organisations. Links which leave our website have an image next to them, of an arrow coming out of a box. We’re not responsible for the protection and privacy of any information you provide while visiting other websites. This privacy policy applies to this website only. Make sure you read the privacy policy of the website you’re visiting.