What is this page?

This is King’s College London’s core privacy notice. It explains the university’s approach to collecting and using personal information (any information which relates to or identifies an individual) about people we interact with. It also supplements more specific information you may have been given (a privacy notice or statement) when engaging with a service, facility, event or initiative run by the university. For example, you may have followed a link here because you signed up to attend an event aimed at prospective students or members of the public. The information below is the same for all the university’s activities where personal information is collected, so we thought it would be helpful to have it in one place that you can refer to and revisit whenever you need.

Individual university services may have their own privacy notices with further information about how they use your personal information. For more detailed information about our main processing activities, see the following notices.

• Students: Student Data Collection Notice
• Applicants: Applicant Data Collection Notice
• Prospective students: Prospective Student Data Collection Notice
• Alumni and supporters: Alumni and Supporters Privacy Notice
• Staff: HR Privacy Notice
• Recruitment: Recruitment Activities Privacy Notice
• Research: Statement on Use of Personal Data in Research

Who are we?

We are King’s College London, one of the top 25 universities in the world and the fourth oldest university in England. We provide world-class teaching and cutting-edge research. Further information can be found in the About King’s section of our website.

Our Student’s Union ( KCLSU) is a separate legal entity so they have their own responsibility when it comes to collecting and using personal information.

Why are we processing your personal information?

You may have already been told about the specific purposes for which we are processing your personal information, as well as the ‘legal’ or ‘lawful’ basis for that processing (the justification under current data protection legislation).

More about ‘legal’/’lawful’ basis:

We can only process (collect, use, store etc) your personal information if one of the following applies:

• We need your personal information to provide a service as part of a contract (for example, to enable you/us to fulfil your/our obligations under a student contract or employment contract). Note that in English law ‘contracts’ are not limited to those in writing, so this justification may also cover less formal agreements between you and the university.
• We need your personal information to perform our official functions as a teaching and research institution, and those functions are in the public interest. Our official functions may derive from legislation or our Charter. This justification also covers situations where we need to share information with other organisations in order for them to carry out their official functions (for example, taxation, reporting crimes, preventive and occupational medicine).
• We need your personal information to comply with a legal obligation to which we are subject (for example, providing data about our staff and students to the Higher Education Statistics Agency (HESA) is a legal requirement for universities under the Further and Higher Education Act 1992).
• We need your personal information for a legitimate interest of the university or a third party, provided that interest is not overridden by your interests and rights (for example, we may need to process your information to protect our network and information security and system maintenance). Note this justification cannot be used when we are carrying out our official functions.
• We need your personal information to protect somebody’s life (a vital interest).
• You provide consent for us to process your personal information, based on clear and specific information, with a genuine choice (without any pressure), and the ability to change your mind at any time.

How do we use your personal information?

We will generally use your personal information to provide you with the services, products or information you have requested from us. We may need to share your information with our service providers for these purposes, but we will ensure that appropriate contracts with these parties are in place and they only process your information in accordance with our instructions and data protection legislation. If we need to transfer any information to a country not recognised as providing equivalent protection, we will use additional safeguards approved by UK or EU regulators.

What are your rights?

By law, you have certain rights over your personal information:

• To receive a copy of your information
• To ask us to correct any errors
• To delete it once we no longer need it
• To ask us to stop using your information in a certain way
• To ask for certain information in a portable, electronic format
• To object to certain uses of your information (for example, marketing and automatic profiling or decision making)

To make a request for any of the above, please see our Data Subject Rights page.

Do we carry out marketing?

If you make contact directly with the university or through one of our service providers, you may be asked to opt-in to receive marketing communications. This is done at the point where your personal information is first collected.

Where the University meets the requirements, we may send you information about our commercial activities including events, products, and services relevant to you under the 'soft opt-in' exception. 

We send business to business marketing emails or texts to companies (“corporate subscribers”) under the lawful basis of ‘legitimate interest’. 

Within any marketing communications, you will be provided with a simple and transparent way to unsubscribe. Any changes you request to how your personal information is processed for the purposes of marketing and/or the provision of service updates will be acted on promptly.

If you proceed to enrol as a student at King's College London, the email address that you registered an interest with will be overwritten by your new King's email address for the duration of your study. This means that all internal communications from King's will be sent to that email address and enables you to utilise King's self-service student enquiry centre. If you do not wish for this to happen, please contact us to opt out.

Do we use 'cookies'?

Cookies are text files, which identify a user's computer to our servers. Cookies in themselves do not identify the individual user, just the computer used.

Our website uses cookies for collecting user information which may include IP address, operating system and browser information. We use persistent cookies to track returning visitors. They expire after 12 months and enable us to compare website traffic from month to month. To see more about our cookies, see the cookie use page.

Information on controlling or rejecting cookies is available from several websites, such as http://www.aboutcookies.org. Most browsers allow you to refuse cookies – see the help section of your browser’s toolbar for further information.

How long do we keep your information for?

Unless stated otherwise in a privacy notice, we will keep your information based on the periods or criteria specified in the university’s Records and Data Retention Schedule.

Will changes be made to this privacy notice?

We keep our privacy notice under regular review and we will place any updates on this web page. This privacy notice was last updated on 14 July 2023.

How can you contact us or make a complaint to the regulator?

To contact us about our privacy notice or information we hold about you, please write to the university’s Data Protection Officer, Olenka Cogias:

• by email – info-compliance@kcl.ac.uk
• or by post – Information Compliance team, King’s College London, Room SW1.09 Somerset House, Strand Campus, WC2R 2LS

If you do not feel we have dealt with your request appropriately, you can complain to the Information Commissioner’s Office.