)
About this notice
The University of East Anglia (UEA) is a dual intensive teaching and research university based in Norwich, England. UEA and is a registered data controller of your information, which means we collect, use and store personal information about you when you register with or purchase from the UEA Shop. UEA will also process the personal data of third-parties that shop users send products to.
What information we collect about you
During your involvement with UEA, the following personal information is collected, used, and stored securely by us:
Identifying Data – information that identifies you including your name, contact details and address(es)
Your Preferences – information about how you like to be contacted
Contact Data – information used to contact you including phone numbers and email address
Payment data - payment card details
Location Data - including IP addresses and delivery address(es)
How and when we collect this information
UEA will collect information to provision you with an account or to provide the products / services that are purchased.
Why we collect and how we use this information
We will only use your personal data for the purposes for which we collected it, unless we consider that we need to use it for another related reason and that reason is compatible with the original purpose.
Lawful basis for using your data
UEA processes your personal data for the following lawful purposes:
consent: when an account is created but no purchases are made
contract: to fulfil a purchased service or product
Who we share your information with
UEA may share your information with third-party suppliers including:
software suppliers including: Shopify, Gecko Engage
shipping suppliers including: Royal Mail, DLP, DPD
We will not normally disclose your personal information to external organisations - other than those listed above - unless required to do so by law or where a lawful basis exists.
How long we keep your information
We will keep your personal information only as long as it is necessary for the purpose it was collected and in accordance with UEA’s records retention schedule.
UEA intended to retain all transaction data for six years from the end of the financial year a transaction is made.
Your rights
Under data protection law, you have rights including:
Right of access – you can ask us for copies of your personal information (this is known as a Data Subject Access Request or SAR)
Right to rectification – you can ask us to rectify personal information you think is inaccurate
Right to erasure - you can ask us to erase your personal information
Right to restrict processing – you can ask us to restrict how we use your personal information
Right to object to processing – you can object to us using your personal information
Right to data portability – you can ask that we transfer the personal information you gave us to another organisation, or to you.
Please note, these rights are not absolute and the requirement for UEA to comply with your request depends on the purpose for our processing. You don’t need to pay any charge for exercising these rights. If you make a request, we have one month to respond to you.
How to contact us
Please contact UEA’s Data Protection Officer at dataprotection@uea.ac.uk if you would like any further information; if you wish to exercise any of your data rights; if you believe your personal information has been breached; or if you have any other concerns about how your personal information is being used by UEA.
If you are still not happy after you have spoken to us, you can contact the ICO:
Online - Contact us - public | ICO or by phone - ICO Helpline number: 0303 123 1113
Changes to this privacy notice
We keep our privacy notices under regular review.
This privacy notice was last updated on 14 July 2026