)
Who we are
The UEA Law Clinic is part of the University of East Anglia (UEA).
UEA is a public research university based in Norwich, England. UEA is a registered data controller of your information, which means we collect, use and store personal information about you in your capacity as an enquirer to, or user of, the Justice Project. We also process the personal data of third-party individuals captured with Justice Project records.
We do our utmost to protect your privacy. We have security systems and procedures to protect information from unauthorised disclosure, misuse, or destruction.
What information we collect about you
During your involvement with the Law Clinic, the following personal information is collected, used, and stored securely by us:
Identifying Data – information that identifies you including your name, DOB,
Contact Data – information used to contact you or your named emergency contact including address, phone numbers, email address
Life data – information about your education, career or employment, your public life, and social connections
Sensitive Information – information that is more sensitive and may include details about your race and ethnicity, political opinions or trade union membership, sex life or sexual orientation, genetic or biometric data, religious or philosophical beliefs, health or criminal offence data.
How and when we collect this information
We collect information both from you and from other sources. Much of this information is provided by those applying to the Justice Project through their application.
Why we collect and how we use this information
We will only use your personal data for the purposes for which we collected it, unless we consider that we need to use it for another related reason and that reason is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will ensure there is a lawful basis to do so.
The Law Clinic processes personal data, under Public Interest to:
receive and review applicants to the Justice Project.
administration and manage accepted applicants to the Justice Project
The Law Clinic processes personal data, under Legal Obligation to:
To fulfil our duties under safeguarding and Prevent laws or where a potential public health risk is identified
For equal opportunities monitoring or when we record/report on incidents and accidents in compliance with health and safety laws
To ensure the health, safety, welfare and security of University staff, students, visitors, systems and facilities eg recording visitors to campus
For business and management purposes eg accounting, auditing, insurance, or to prevent fraud.
Sensitive Information
Access to and the sharing of this kind of ‘special category’ personal information has extra protection. Where we do use your sensitive personal information, we will either have obtained your explicit consent or there will be a substantial public interest reason with a basis in law.
The reasons for using this information include to prevent or detect unlawful acts, to protect the public, or to address safeguarding issues. It may also include the monitoring of disability data to facilitate access to buildings; information about race and ethnicity for monitoring our responsibilities under the Equality Act 2010.
Who we may share your information with
UEA may share your information with other UEA departments or external organisations either where there is a legitimate or legal reason to do so or because you asked us to.
The external organisations including third party providers of good or services including software and service providers, insurers, and auditors.
Where UEA shares your information with any organisation based outside the UK, appropriate safeguards will be in place to protect your personal information.
How long we keep your information
We will keep your personal information only as long as it is necessary for the purpose it was collected and in accordance with our University Retention Schedule.
UEA will always store your personal information safely and will never disclose it to any other person unlawfully.
Your rights
Under data protection law, you have rights including:
Right of access – you can ask us for copies of your personal information (this is known as a Data Subject Access Request or SAR)
Right to rectification – you can ask us to rectify personal information you think is inaccurate
Right to erasure - you can ask us to erase your personal information
Right to restrict processing – you can ask us to restrict how we use your personal information
Right to object to processing – you can object to us using your personal information
Right to data portability – you can ask that we transfer the personal information you gave us to another organisation, or to you.
Please note, these rights are not absolute and the requirement for UEA to comply with your request depends on the purpose for our processing. You don’t need to pay any charge for exercising these rights. If you make a request, we have one month to respond to you.
How to contact us
Please contact UEA’s Data Protection Officer at dataprotection@uea.ac.uk if you would like any further information; if you wish to exercise any of your data rights; if you believe your personal information has been breached; or if you have any other concerns about how your personal information is being used by UEA.
If you are still not happy after you have spoken to us, you can contact the ICO:
Online - Contact us - public | ICO or by phone - ICO Helpline number: 0303 123 1113
Changes to this privacy notice
We keep our privacy notices under regular review.
This privacy notice was updated on 27 March 2026.