Data protection, privacy & cookies

The Royal College of Art (the College) uses personal data of people who come into contact with the College. We use this information to enable us to provide education and associated services.

You can find our Privacy notices below which explain how we use personal data. We write each Privacy notice dependent on the individual’s relationship with the College. Please find the relevant one for you.

The College is registered as a Data Controller, with the Information Commissioner’s Office (ICO).

Registration number: Z5688595

Your rights and how to contact us

When the College processes your persona data, you have the following qualified rights:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making

To make a request under any of these rights, or to contact us about your personal data please email dpo@rca.ac.uk. Or by writing to:

Governance team
Royal College of Art
Kensington Gore
London SW7 2EU

If you would like to make a request by phone please call us at +44 (0) 207 590 4444 and leave a message. 

You also have the right to make a complaint to the Information Commissioner’s Office at www.ico.org.uk. Or by writing to:

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Last updated: November 2023

Types of personal information we process

The RCA collects data from website visitors including the use of cookies and tracking pixels. A cookie is a small text file that is sent from a web server to your browser and may be stored on your computer, designed to collect data for statistical purposes. A tracking pixel is a marker inserted into a website page that connects your data to other information you have made available on other platforms. The information is stored and some are shared with our advertising services.

Types of cookies and why we process your personal information

Cookies collect data based on visitor usage of our website alongside setting and context such as the location, device, browser and preferences. The cookies RCA uses are:

• Strictly necessary cookies: these are necessary for the website to function.
• Functional cookies: these help enhance our website functionality with features such as chat services and language settings.
• Performance cookies: these allow the College to count visitors and website traffic helping us to understand how visitors use the website.
• Targeted cookies: these are set by our advertising partners and may be used to build a profile of your interests to show you relevant adverts on other sites.
• Social media cookies: these enable you to share content via social media and track your interests across other sites impacting the content and messages you see on other websites you visit.

Our lawful basis

Strictly necessary cookies are collected under the College’s legitimate interest. All other cookies are collected with your consent.

How we may share your personal information

Information is collected via Google Analytics and by other marketing agencies on behalf of the College. Our website contains links to other websites. We are not responsible for the privacy practices of other sites. We encourage visitors to be aware when they leave our website, and to read the privacy arrangements of other sites that collect or use personal data.

Your rights

You can update your RCA cookie settings using the Cookie Settings button below.

Subscribers to newsletters or email lists may be contacted when we promote programmes of study or events that may be of interest. Anyone may at any time request us to stop using their personal data for direct marketing purposes via the opt out included in all emails or by contacting: media@rca.ac.uk

What personal information we collect for your application

All information is either collected directly from you, or your chosen referee.

Biographical information

Name, date of birth, previous schooling, qualifications, relevant work experience and academic goals. Passport information (Tier 4 visa students only).

Why we collect it:

• To process your application.
• To assess your eligibility for scholarships and bursaries.

Lawful basis:

• Article 6.1.e - necessary for the performance of the College’s public task as a Higher Education institution.

Contact information

Address, phone number, email

Why we collect it:

To process and contact you about your application.

Lawful basis:

• Article 6.1.e - necessary for the performance of the College’s public task as a Higher Education institution.

Any previous applications or courses with RCA

Why we collect it:

• Used to analyse the College’s performance and make improvements.

Lawful basis:

• Article 6.1f - Legitimate Interests in improving our educational offer.

Demographic information

Nationality, country of birth, ethnicity, religion, sexual orientation.

Why we collect it:

• To statistically monitor trends and support the College’s Access and Participation Plan.
• To improve our services and student access.
• To meet Office for Students (OFS) and Jisc (Joint Information Systems Committee) requirements.

Lawful basis:

• Article 6.1.e - necessary for the performance of the College’s public task as a Higher Education institution.
• Article 9.2g - substantial public interest that has a basis in law.

UK Visa status

Why we collect it:

• To maintain and monitor visas and immigration status as required by UK Visa and Immigration.

Lawful basis:

• Article 6.1.e - necessary for the performance of the College’s public task as a Higher Education institution.
• Article 6.1.c - Legal obligation
• Article 9.2g - substantial public interest that has a basis in law.

Criminal conviction data

Why we collect it:

To manage safeguarding of vulnerable adults.

Lawful basis:

• Article 6.1.e - necessary for the performance of the College’s public task as a Higher Education institution.
• Article 9.2g - substantial public interest that has a basis in law.

Language/Languages

English language qualifications, certificates of award

Why we collect it:

• To assess your application.
• To meet Office for Students (OFS) and Jisc (Joint Information Systems Committee) requirements.

Lawful basis:

• Article 6.1.e - necessary for the performance of the College’s public task as a Higher Education institution.
• Article 6.1.c - Legal obligation

Your portfolio and personal statement

Why we collect it:

• Used to assess your application.

Lawful basis:

• Article 6.1.e - necessary for the performance of the College’s public task as a Higher Education institution.

Accessibility needs

Disability and learning differences

Why we collect it:

• Used to prepare your student record on acceptance and provide necessary accessibility services.
• To meet Office for Students (OFS) and Jisc (Joint Information Systems Committee) requirements.

Lawful basis:

• Article 6.1.e - necessary for the performance of the College’s public task as a Higher Education institution.
• Article 6.1.c - Legal obligation
• Article 9.1a - explicit consent
• Article 9.2g - substantial public interest that has a basis in law.

Referee information

Name, position and contact details

Why we collect it:

• Used to assess your application. Your references will be provided to us by your referees using PebblePad.

Lawful basis:

• Article 6.1.e - necessary for the performance of the College’s public task as a Higher Education institution.

Access and Participation

(only applicable to British Nationals applying for MA Architecture)

Family socio-economic background, employment history and university education.

Information relating to previous education; school, primary postcode, access to free school meals

Local Authority care status

Refugee status

Student Loan information

Why we collect it:

• To meet Office for Students (OFS) and Jisc (Joint Information Systems Committee) requirements.

Lawful basis:

• Article 6.1.e - necessary for the performance of the College’s public task as a Higher Education institution.
• Article 9.2g - substantial public interest that has a basis in law.

How we store your information

We operate secure electronic and physical storage with controls for personal data. We employ robust technical measures such as encryption when storing and transmitting your personal data. RCA staff are subject to mandatory data protection and information security training.

Your information will be stored for no longer than necessary. Information will be transferred to your student record if you are successful. You can read our student privacy notice here.

How we share your information

Your personal information is shared with QS enrolments under the College’s Legitimate Interests (Article 6(1)(f)) to contact you about your application and to provide information about the RCA.

Under our necessary duties as a Higher Education, institute data will be shared with JISC (Joint Information Systems Committee) and UK Visa and Immigration services. It may also be shared with authorities as requested under our legal obligations.

As an enquirer to study and prospective student, the College will collect and use data relating to personal details. The principle purpose for processing your personal data is for us to respond to your enquiry and provide you with relevant information about applying to study at the College.

For more information, download our Data Protection and Student Data – Fair Processing Notice (PDF).

Types of information we collect, and why we collect it

• Information provided on your application is moved to your student record. This includes profile and contact information to administer your enrollment and education.
• Statistical student data is used from programmes to produce management information for the purpose of decision making.
• Demographic information to support, monitor and report on access, participation and equal opportunities.
• Provision and maintenance of computing facilities including email account and internet access and connected devices. For the prevention and detection of crime, fraud or misuse the College will monitor the use of IT systems technology or spaces. Monitoring complies with RIPA 2000, HRA 1998 and DPA 2018 and will be justifiable, fair and proportionate and in line with institutional policies.
• Contact details of next kin to be used in an emergency including in cases of serious concern for your safety.
• Passport and visa information and other documentation required in relation to lawfully enrol international students onto UK courses.
• Education information including: academic performance/assessments and academic organisation of courses, modules, timetables and room bookings to deliver your education and meet our contractual services.
• Financial information to administer fees, charges, loans, grants, scholarships, hardship funds.
• Records of use of services in the provision of those services including the library and Student Support.
• Medical, health and disability information to provide inclusion plans, put reasonable adjustment in place and support student health and safety.
• Information provided by you to support extenuating circumstance procedures.
• Information relating to proceedings of academic or professional conduct to support and resolve investigations.
• Health and Safety incident reports for the purpose of investigation and provision of support.
• Any survey or feedback data provided by you to the College or information you have provided as a participant as part of College research.
• Audio/video recordings of academic lectures, tutor groups or assessments for the purpose of College record keeping and education provision.
• CCTV recordings for the purpose of the prevention and detection of crime and in supporting the safety and security of our students, staff, visitors as well as College property.
• Records of non-course related training or events that are run by the College.

On graduation, your data is processed by the RCA Alumni Network. A separate Privacy Notice for RCA Alumni can be found on this page.

This is primarily collected where it is necessary for the performance of the College’s public task as a Higher Education Institution (Article 6.1.e). This includes the administration and provision of your education.

For more information and details on how we store an share your information, download the Student Privacy Notice (PDF).

Digital Content Submissions

At times, the College may invite current students to submit content for publishing on our digital media channels, including the College website and social media platforms such as instagram.

For digital content submissions the RCA collects information directly from you, so we (the RCA) can share and promote your work and practice on RCA digital platforms. This is only done with your consent (Article 6a) and your explicit consent (Article 9a) if special category data is given. We will only use information provided to us on this form as part of the online post.

For more information, download our Privacy Notice: Digital Content Submissions (PDF)

Last updated: November 2023

Types of personal information we process

• Your contact details and biographical information submitted by you during the application and enrolment process;
• Details of your courses, modules, timetables and room bookings, assessment marks and examinations related to your study;
• Financial data;
• Photographs and video recordings;
• Contact details for next of kin;
• Information related to the prevention and detection of crime and the safety and security of our premises, products, staff and students. Including, but not limited to, CCTV recordings and IT network security monitoring;
• Any information provided by you for the College to provide access, advice, support or welfare.

Why we process your personal information

• To process your application and enrol you onto our Short Courses;
• To administer your Short Course and provision your education and assessment;
• To provide you with information about similar services and events;
• For financial purposes in the administration of fees, charges and in the provision of loans, grants, scholarships and funding;
• To capture lectures and assessments for the purpose of educational provision and college promotion that is in our legitimate interests but still fair to you;
• In the case of an emergency;
• For the purpose of prevention and detection of crime and for the safety and security of our students, staff and premises;
• In the provision of advice and support for your welfare needs.

Our lawful basis

We process data for a variety of purposes under the following conditions:

• We mainly process your data for the performance of a contract (Article 6 1 b) to meet your short courses contract;
• We may process your data under condition of your consent or your explicit consent (Article 6.1.a and Article 9.2.a);
• We process information for our legitimate interests (Article 6.1 f) where it is proportionate to your rights and freedoms, including where there is serious concern for your safety, or in respect of your interests at the College;
• We may process information for your vital interests (Article 6.1.d) where not to do so would risk your life;
• Where we have a legal obligation to process your data (Article 6.1.f) such as if we are required to share your data with law enforcement bodies.

How we may share your personal information

In some instances RCA Short Courses may share your personal data with our partners, service providers or under our legal or regulatory duties. We may share your data under the following circumstances:

• To provide educational or employment references;
• To education providers in joint course provision;
• To emergency services for your health and safety;
• To law enforcement and government agencies where we have a legal obligation to disclose, or where is it required for Safeguarding;
• Your data is securely hosted on contracted third -party platform services providers such as GCloud and eLearning platforms.

How your personal information is stored

We operate secure electronic and physical storage with controls for personal data. We employ robust technical measures such as encryption when storing and transmitting your personal data. RCA staff are subject to mandatory data protection and information security training. We will keep your data for as long as necessary for the purpose or purposes it was collected.

Your rights

See top of this webpage to read about your rights and how to contact us.

As an enrolled student, you are automatically part of the Alumni Network when you graduate. The Development & Alumni Relations Office collect and use data relating to personal details, family and social circumstances, education and training records, along with employment information, if you choose to share this with us.

The principle purpose for processing your personal data is for us to deliver alumni services to you. To do this, we process your personal data based on our legitimate interests. We also offer some features including events and promotions based on your consent.

For more information, download our Data Protection and Alumni Data – Fair Processing Notice Summary (PDF)

Last updated: November 2023

For the purposes of this Notice, ‘staff’ includes applicants, employees (academic, support and management, workers (including agency, casual, hourly paid and contracted staff), apprentices, volunteers, trainees and those carrying out work experience.

Types of personal information we process

We require you to provide:

• Personal and contact information
• Role information (role, salary, start date)
• Employment records and training history
• Educational qualifications and evidence
• Financial information (bank account and pension details)
• Income tax codes and tax details
• Evidence of nationality (passport, visa, NI number)
• Sickness and absence information
• Emergency contact/next of kin

In addition, we may ask you to provide:

• Photograph
• Ethnicity or race data
• Religion
• Sexual orientation
• Sex identifier
• Gender reassignment
• Disability and accessibility needs
• Medical condition/history
• Exit interview

As part of your time at RCA we may create the following data about you:

• Payslips. P60, holiday and absence records
• Development and training records
• Appraisal and employee review
• Investigation or incident information
• Grievance or disciplinary information
• Technological monitoring logs for the prevention or detection of crime, fraud or deliberate misuse.
• CCTV footage (for prevention and detection of crime)
• Additions or deductions to payroll including overtime, unpaid leave and strike days to reproduce accurate payroll

Why we process your personal information

• For the administration of prospective, current and past staff in relation to recruitment, payment, pensions and other contractual obligations.
• Vetting checks and to meet national employment law where required
• Planning and management of the College's workload or business activity.
• For occupational health and safety.
• To investigate and manage incidents in relation to our obligations to our people; disciplinary investigations, disputes and employment tribunals.
• To improve our services for you and other staff and ensuring staff are appropriately supported in their roles.
• To produce monitoring and reporting statistics for better decision making and sector comparisons and legal requirements.
• Staff training and development.
• Where we have a legal duty to disclose to external parties under statutory powers.
• For the purpose of prevention and detection of crime for the safety and security of staff, students and our premises.

Our lawful basis

Our main reason to collect your data is to fulfil our contract with you as a member of staff (Article 6.1b).

We also process your data under:

• Your consent (Article 6.1a).
• Your vital interests, where not to do so would risk your life (Article 6.1d)
• Our legal obligations (Article 6.1c)
• Our legitimate interests, where it is proportionate to your rights and freedoms (Article 6.1f)
• Under our public task (Article 6.1e)

And your sensitive personal data for under:

• Your explicit consent (Article 9.2a)
• Reasons of substantial public interest (Article 9.2g)
• In the interests of public or occupational health (Article 9.2h)

How we may share your personal information

We share your information with third party providers who are contracted to work on the College’s behalf such as our pension providers, insurers and legal consultants. We may also share you information with:

• Joint Information Systems Committee (JISC)
• The Department for Work and Pensions
• UK Visas and Immigration Office
• HM Revenue and Customs (HMRC)
• Pension schemes – including UBPAS, USS and others (as set out in the scheme rules)
• Research sponsors/funders
• Trade unions
• Potential employers (where a reference is requested)
• Benefits Agency as required by the Social Security Administration Act 1992
• Emergency services
• Government authorities (such as through police or court procedure)

How your personal information is stored

We operate secure electronic and physical storage (this data is stored electronically for those that joined since April 2021), with controls for personal data. We employ robust technical measures such as encryption when storing and transmitting your personal data. RCA staff are subject to mandatory data protection and information security training.

Your rights

See top of this webpage to read about your rights and how to contact us.

If you are a staff or student Council member you should also refer to the staff or student privacy notices.

Your declarations of interest, expenses and other information may be made available to the public if subject to a Freedom of Information request. An assessment would be made of the extent to which data should be anonymised and whether an exemption can be applied before release.

For more information, download our Governor Privacy Notice (PDF).

We record the name and contact details for everyone who visits the College, to safeguard students, staff and visitors and to support Public Health England and the NHS respond to the pandemic. We are also urging staff and students to let us know if they have tested positive for Covid-19. 

What do we use this information for?

We will process your personal information only when necessary to:

• provide you with essential support;
• notify relevant organisations (see below);
• support efforts to limit exposure, contain outbreaks and ensure the College remains Covid secure.

Who do we share this information with?

If a student, member of staff or visitor tests positive for Covid-19, we will share only applicable personal information with the following organisations for contact tracing purposes:

• Public Health England;
• NHS Test and Trace.