This Notice explains how Leeds Arts University will collect and use your personal data. This policy outlines what categories of information we retain and how we use it. Leeds Arts University is committed to looking after any personal data that it processes, in accordance with Data Protection Legislation, including the UK GDPR, the EU GDPR and the Data Protection Act as amended. Leeds Arts University is a Controller for the purposes of Data Protection Legislation. This means that we are responsible for deciding how we hold and use personal information about you. We are required under Data Protection Legislation to notify you of the information contained in this privacy notice.
Throughout this Notice, âUniversityâ "we", "our" and "us" refers to Leeds Arts University and "you" and âyourâ refers to those engaging with or wishing to receive infomraiton on events, shows and exhibitions at Leeds Arts University.
It is important that you read and retain this notice, together with any other information we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using that information and what your rights are under Data Protection Legislation.
Where do we get your personal data from?
We obtain your personal data when you complete a form on our website or at an event and opt-in to receiving promotional emails about Leeds Arts University activities such as events and exhibitions; Creative Networks; and End of Year Shows.
What personal data do we hold?
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include instances where it is not possible to identify individuals from the data (e.g. anonymous data). The personal information that we collect and process about you will include data such as:
Your name
Your email address
Your selection of the information you would like to receive e.g. End of Year Shows
A record of our communication with you
Will we send your data to third party organisations?
We do not sell or otherwise transfer personal data to any third parties unless you have consented to this or this is permitted or required by law.
Instances where we may share your personal data with a third party include:
Third party service providers, such as for email services and CRM services within the Universityâs standard administrative environment;
On occasion, and where necessary, with University auditors;
On occasion, and where considered necessary, information may be shared with the police and/or other law enforcement agencies.
When we use third party service providers, we only disclose to them any personal information that is necessary for them to provide their service. All of our third-party service providers are required to take appropriate security measures to protect your personal information. We only permit third-party service providers to process your personal data for specified purposes and in accordance with our instructions.
Data Security
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Additionally, we limit access to your personal information based on business need.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Automated decision-making
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
We do not envisage that any decisions will be taken about you using automated means. However, we will notify you in writing if this position changes.
How and why will we communicate with you?
We will email you with information regarding the topic you have opted-in to receive.
You can opt-out at any point in time via the âContact Preferencesâ link at the bottom of emails or via emailing marketing@leeds-art.ac.uk.
Your rights as a data subject
Data Protection Legislation gives you a number of rights to protect your personal data and its use. You have the right, subject to any exemptions, to:
Withdraw consent where that is the legal basis of our processing
Access your personal data that we process
Rectify inaccuracies in personal data that we hold about you
Be forgotten. This means that in certain circumstances you can request that your details be removed from systems that we use to process your personal data
Restrict the processing of your personal data in certain circumstances
Obtain a copy of your data in a commonly used electronic form
Object to certain processing of your personal data by us
If you would like to express any of these rights you can contact us at dpo@leeds-art.ac.uk. Please note that we may need to request specific information from you, such as photographic ID, to help us confirm your identity and ensure your right to access the information (or to exercise your other rights). This is another security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Please see ico.org.uk for further information on the above rights.
How can I complain?
You can contact the Data Protection Officer for any complaints at dpo@leeds-art.ac.uk.
You can also lodge a complaint with the Information Commissionerâs Office. They can be contacted via their website, or at:
Information Commissionerâs Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Legal bases for processing your data under Data Protection Legislation
We will only keep your information for as long as is necessary for us to fulfil the purposes we collected it for, including satisfying any legal, accounting or reporting requirements. Sometimes we may anonymise personal information so that you are no longer identifiable by the data. In these cases, we may use this information without further notice to you.
We only process your personal data where we have established a legal basis for processing. There are 6 bases for processing that are laid out in data protection legislation. Of these 6, the following are used to support our processing of your personal information:
Consent
You have provided us with consent to hold your data and communicate with you via a specific method.
Public Interest
This is when processing is necessary for the performance of a task carried in the public interest. Much of the processing we undertake is under this basis, within our capacity as an educational establishment.
Changes to this Information
We may update this information and we will notify you when we do this where necessary. This document was last updated on 25 July 2025.
Cookies
This site uses cookies to improve your experience, track the performance of the site and serve targeted advertising. To find out more and how to change your cookies settings visit our Cookie Policy.