Privacy Notice

Coronavirus (COVID-19) Collection of Personal Data - Privacy Notice

This Privacy Notice relates to personal data being collected from visitors, staff and students providing their contact details as part of the COVID-19 NHS Test and Trace programme. It should be read in conjunction with the University of Hertfordshire’s overall Data Protection and Privacy Statement.

For the health and safety of visitors, staff and students at these premises, we are recording the name and contact details of those who visit the University Campus to support efforts in tackling COVID-19. This information will be used to enable the NHS Test and Trace Service to contact you if you have been on the premises at around the same time as someone who has tested positive for coronavirus.

1. Why do we need to collect this data?

The purpose for which we are processing your personal data is to assist with NHS efforts in tackling the coronavirus public health epidemic. This will involve the gathering and, when necessary, the sharing of information with the NHS and statutory partners. Your data will not be used for any other purpose.

We will only share your data when it is necessary to do so with the NHS Test and Trace Service and/or any other statutory partners assisting with test and trace operations. This will only be in the event there are coronavirus cases linked to the premises.

For further information on the NHS Test and Trace Service please visit the Gov.UK website here

2. What data will we collect?

Along with the date and time of your arrival and departure, we will collect the following personal data if applicable:

  • your name; and
  • contact telephone number.

If you do not have a telephone number, you have the option to provide:

  • a postal address; or
  • an email address.

We may also collect details of the specific location you visited on campus and the name of the person, people or department (s) you visited and/or had contact with.

3. What is our lawful basis for collecting this data?

Under data protection law there must be a lawful basis to allow us to collect and process personal information. In this case, the lawful bases for processing your data are:

Legitimate interests – we have a legitimate interest to ensure the wellbeing and minimise risk to the public, as well as the delivery and continuation of operations.

Public Interest - it is necessary for the performance of a task carried out in the public interest, i.e. to support the efforts to stop the spread of Covid-19.

4. How long will we retain the data?

Your personal data will be retained only for the purposes stated in this privacy notice and will be held by us for no more than 3 weeks (21 days).

All personal data will be held and disposed of in a safe and secure manner.

5. Your rights

As defined in data protection law, you have the following rights:

The right to be informed about the collection and use of your personal data - This is outlined above.

  • The right to erasure – you can request for your personal data to be erased if there is no longer a justification for it to be processed.
  • The right to object to us processing your personal data – if you no longer wish us to process your data for this purpose, please let us know.
  • The right to rectification - If the information held is in any way incorrect, you can contact us and request that the information be rectified.

In certain circumstances, exemptions to these rights may apply. Further information is available on the Information Commissioner’s Office website here.

6. Do you have a complaint?

If you have any further questions, these should be directed (in the first instance) to a manager in the area of the University that collected your data.

If you have any issues about this statement or the way the University has handled your personal data, please contact