Privacy Policy

View 2U’s Cookie Policy

Last Updated: March 27, 2024

Thank you for your interest in the University of Surrey (the “School”) online graduate programs (the “Program”). This privacy policy (the “Privacy Policy”) describes how the School’s technology partner, 2U, Inc. (“2U,” “we,” or “us”) – parent company to edX – collects, uses, and discloses information from and about you when you visit and use this website, as well as associated websites and applications (together, the “Website”), as well as your ability to control certain uses of that information. It also describes certain data protection rights which apply, subject to applicable law, including a right to object to some of the processing which 2U carries out. More information about your rights, and how to exercise them, is set out in Accessing and Managing Your Personal Information below. If you live in California, please see our Notice for California Consumers for information regarding rights of California residents. If you are a resident of other US states (including Virginia, Colorado, and Connecticut) or the European Union, United Kingdom, South Africa, Brazil, the People’s Republic of China, or other locations you may have additional rights under the laws of your jurisdiction to access, delete and restrict use of your data, as described in this Privacy Policy.

2U respects your privacy and is committed to protecting it through our compliance with this Privacy Policy. By accessing or otherwise using the Website, you agree to the terms and conditions of this Privacy Policy, which is incorporated into the Terms of Use, and to 2U’s collection, use, and disclosure of your information in accordance with this Privacy Policy, where such agreement is permitted by applicable law. If you choose to apply or enroll in the Program, use of your personal information, including your education records, if applicable, will be governed by the privacy policies shown on the application website and Learning Management System, respectively. 

We regularly review our compliance with this Privacy Policy. Whenever we receive a formal complaint, we make best efforts to contact the person who made the complaint to attempt to resolve their concerns. If you have any questions about the use of your information, or the contents of this Privacy Policy, please contact us at privacy@2U.com.

The School’s online programs (the “Programs”) are as follows:

From the Faculty of Arts and Social Sciences, Surrey Business School:

  • Master of Science in International Business Management
  • Master of Science in Strategic Marketing

From the Faculty of Health and Medical Services, School of Psychology:

  • Master of Science in Psychology

From the Surrey Institute for People-Centred Artificial Intelligence:

  • Master of Science in Artificial Intelligence

From the Faculty of Engineering and Physical Sciences, Institute for Sustainability

  • Master of Science in Sustainable Development in Practice

Quick Guide to Contents

Collection of Information

Information You Provide

2U collects information from you when you choose to provide it to us. For example, we collect your information when you submit a webform requesting information about 2U-powered programs, or otherwise contact us or provide information to us through the Website. The information we collect includes personal information – such as your name, address, e-mail address, telephone number, and the content of any communications that we exchange – as well as non-personal information when you:

  • indicate an interest in the Program (you may unsubscribe from promotional emails by clicking “unsubscribe” on the emails you receive from us);
  • create an account;
  • attend a webinar; 
  • register or apply for the Program, either directly with us, through your employer, or through some other means;
  • make a payment;
  • participate in our surveys, promotions, and competitions;
  • sign up for a newsletter;
  • communicate with us, for example by submitting queries regarding the Website or the Program; and
  • use the Website. 

In some cases, we require your personal information in order to perform a contract or to comply with a legal obligation. 

Information Automatically Collected

When you visit the Website or interact with emails that we send to you, we passively collect information from you, including your internet protocol address (“IP address”), browser type, operating system, device identifier, device model, software version, or mobile or ISP carrier information. We and our third-party partners use cookies and other technologies to collect information about your visit to the Website, such as the date and time of your visit, the information you searched to find the Website, your activity on the Website, and your clicks on our ads. “Cookies” are small files which may be stored on your computer during your use of the Website and contain data about your use of the Website. We use session cookies (which expire when you close your browser) and persistent cookies (which stay on your computer until you delete them or after a specified expiry date) to understand more about your activity on the Website. 

Please see 2U’s Cookie Policy for details about how we use cookies and other tracking technologies and how you can control the cookies set on your browser. 

Tracking Options 

You may adjust your browser or operating system settings to limit tracking or to decline cookies through system settings. If you choose to limit tracking or decline cookies, however, you may be unable to access certain areas of the Website. Check the “Help” or “Settings” menu of your browser or operating system to learn how to change your tracking settings or Cookie preferences. Learn more about the use of cookies or other tracking technologies and your choices regarding the use of information collected this way by certain Service Providers (as defined below). On your mobile device, you can adjust your privacy and advertising settings to limit tracking for advertising or to control whether you receive more relevant advertising. Please see our Cookie Policy for more information or to opt out.

Information Collected from Other Sources

Where permitted by law, we collect or receive information about you from the School, your employer, companies to which you indicate that you would like to learn more about the Program, companies that are our partners, companies to which you’ve provided your information for professional or continuing education opportunities, employers or potential employers, or 2U, Inc.’s affiliated companies (collectively “Other Sources”) in order to update or supplement the information that you provide or that we collect automatically, as described above in Information Automatically Collected. We use this information to help us maintain the accuracy of the information we collect, to target our communications so that we can inform you of products, services or other offers that may be of interest to you, and for internal business analysis or other business purposes. Personal information is collected from Other Sources with consent of the data subject where such consent is required or, otherwise, for the purposes of our legitimate interests, as further described in How We Use Your Information.

Our Combination of Your Information

We combine the information we receive from and about you via the Website and from Other Sources to help us tailor our communications to you and to improve the Website.

Failure to Provide Personal Information

Failure to provide certain information may make it difficult or impossible for you to access some services through the Website. You should ensure that personal information submitted to us is accurate and up-to-date. For example, we need a current email address to communicate with you about the Program.

Children’s Privacy

We do not direct the Website to, nor do we knowingly collect any personal information via the Website from, children under the age of 16. If you learn that a child has provided us with personal information in violation of this Privacy Policy, you may notify us at privacy@2u.com.

How We Use Your Information

Purposes for Collecting and Processing Personal Information

We process personal information for the following purposes:

  • To fulfill a contract or take steps linked to a contract, including:
    • providing our services;
    • verifying your identity;
    • taking payments;
    • communicating with you.
  • To conduct 2U’s business and pursue our legitimate interests in marketing our business, ensuring that we conduct our business in line with our objectives, improving and developing our products and services, and keeping our records accurate and up to date. This includes: 
    • using your information to provide products and services you have requested and responding to any comments or complaints you may send us;
    • personalizing your experience with the Website and helping us to better respond to your individual needs;
    • targeting advertising to individuals with similar interests or characteristics through services offered by third parties; 
    • developing new products or services or conducting analyses to enhance current products and services;
    • reviewing the usage and operations of the Website and analyzing and improving the Website (we continually strive to improve the Website based on the information and feedback we receive from you);
    • contacting you for legitimate business purposes; 
    • using personal information to invite individuals to take part in market research;
    • where consent is not required by applicable law, for direct marketing purposes; 
    • protecting the security and functionality of the Website, including using personal information you provide to investigate any complaints received from you or from others about the Website or our products and services.

We conduct balancing tests for the data processing we carry out on the basis of our legitimate interests described above. For more details on the balancing tests we have carried out, please contact us at privacy@2U.com. You may also have the right to object to our use of your personal data on the basis of our legitimate interests as described at the outset of this Privacy Policy.

  • Where you give us consent. This includes: 
    • where consent is required by applicable law, sending you direct marketing in relation to our relevant products and services, or other products and services provided by 2U and its affiliates; 
    • on other occasions where we ask you for consent, using the data for the purpose which we explain at that time.
  • For purposes which are required by law. This includes: 
    • in response to requests by government or law enforcement authorities conducting an investigation;
    • using personal information in connection with legal claims, compliance, regulatory and investigative purposes as necessary, including disclosure of such information in connection with legal process or litigation.
    • For reasons not described in this Privacy Policy where the reason is compatible with the purpose for which we originally collected your information and where such use is lawful.

Processing Information at the Direction of the School

In some instances, 2U may collect and process your personal information at the direction of the School, for instance processing certain of your application materials provided to or received from the School.

Use of De-identified, Aggregate or Anonymized Information

We use de-identified, aggregate or anonymized information to help us analyze the use of the Website. Where permitted by law, this Privacy Policy does not limit our use or disclosure of de-identified, aggregate, pseudonymous or anonymous information, and we reserve the right to use and disclose such information to our partners, advertisers, and other third parties at our discretion. 

How We Disclose Your Information

2U shares your information with other entities or individuals in the following limited circumstances: 

  1. The School: We may share your information with the relevant School in order to provide the Program, track your participation in the Program, and/or fulfill our contracted responsibilities to the School. Once we share your personal information with the School, 2U does not maintain control over the School’s use of your personal information. We also share de-identified, aggregate, pseudonymous or anonymous information with the School for their own research and analytics purposes. The School’s use of your information is subject to its privacy policy.
  2. 2U, Inc. and its affiliates: Where you have expressed interest or given your consent, we share your information with 2U, Inc.’s affiliated companies to provide you with information about other educational programs.
  3. Service Providers: We share your information with third parties that provide business, professional, or technical support functions for us. In particular, we use third-party providers for website hosting, maintenance, marketing services, courier services, certification services, business operations, payment services, and identity verification services (“Service Providers”). These Service Providers are only given access to your information to the extent necessary to process your information and/or provide services to 2U, and they are prohibited from using or sharing your information for any other purposes. Where permitted by law, 2U discloses limited information about you to Service Providers to serve relevant advertising on third party platforms to you or to other audiences.
  4. Your Employer or Sponsor or their Designee: We share your information with your employer or sponsor, or someone designated by them, in the event that such third-party is paying for your Program. Information disclosed in this case shall include Program performance information, unless otherwise expressly agreed in writing with 2U.
  5. Potential Employers: Where you choose to work with our career services team, we will share your information with potential employers. Information disclosed in this case shall include your resume, employer-ready materials that you prepare (e.g., your portfolio), your LinkedIn profile, or other information that you make available to 2U. 
  6. Legal Matters; Safety: We access or share your information to satisfy any applicable law, regulation, legal process, or governmental request; in connection with an investigation on matters related to public safety; as permitted by law; or otherwise as required by law. We disclose your information to protect the security of the Program, the Website, servers, network systems, and databases. We also disclose your information, as necessary, if we believe that there has been a violation of our Terms of Use (including investigation of potential violations thereof), any other legal document or contract related to the Website, or the rights of any third party.
  7. Fraud; Security: We access and disclose your information to detect, prevent, or otherwise address fraud, security or other technical issues.
  8. Consent; Other: We share information with third parties when we have your consent or otherwise as described to you at the point of collection.
  9. Sale or Transfer of Business or Assets: 2U may sell or purchase assets during the normal course of our business. If another entity acquires us or any of our assets, information we have collected about you may be transferred to such entity. In addition, if any bankruptcy or reorganization proceeding is brought by or against us, such information may be considered an asset of ours and may be sold or transferred to third parties. Should such a sale or transfer occur, we will use reasonable efforts to try to require that the transferee use your information in a manner that is consistent with this Privacy Policy.
  10. International Transfers: We may transfer personal information from your location to other countries, including Australia, Canada, the European Economic Area, Mexico, South Africa, the United Kingdom, and the United States, where our employees and/or servers are located. Where your personal information is transferred outside of the country where you are located, such information is adequately protected by an adequacy decision by EU authorities, Standard Contractual Clauses, or a Service Provider’s Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review on request to privacy@2U.com. 

Information Security and Data Retention

We are committed to protecting the security of your information. We maintain what we believe to be appropriate physical, electronic, and managerial procedures to safeguard and secure your information and to prevent unauthorized access, maintain accuracy, and ensure appropriate use of your information. The accuracy, safety, and security of your information also depend on you. Where we have given you – or where you have chosen – a password for access to any parts of the Website, you are responsible for keeping this password confidential. We ask that you not share your password with anyone. Even though we do our best to protect your information, the transmission of information via the internet is not completely secure, and we cannot guarantee our security measures. We are not responsible for any unauthorized access to or acquisition of your information. 

We retain your personal information for as long as we have a relationship with you. We also may retain your personal information for a longer period of time which enables us to: 

  • Maintain business records for analysis and/or audit purposes; 
  • Comply with record retention requirements under the law;
  • Defend or bring any existing or potential legal claims;
  • Address any complaints regarding the services;
  • Enforce our commercial agreements; and
  • Support our legitimate interests, as described in this Privacy Policy. 

Accessing and Managing Your Personal Information

If you have created a profile or are enrolled in a Program, you may access your personal information through your user profile. 

In some instances, you may be eligible to (a) ask us for a copy of your personal information; (b) correct, delete, or restrict processing of your personal information; and/or (c) obtain the personal information you provide to us in a structured, machine readable format. In addition, you may have the right under applicable law to object to the processing of your personal information in some circumstances. 

Your rights regarding your personal information may be limited, for example, if fulfilling your request would reveal personal information about another person or would infringe the rights of a third party (including our rights), or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. We will inform you of the relevant exemption upon which we rely when responding to any request you make. 

Our use of certain personal information is necessary for us to provide information to you about the Program or to provide services to you through the Website or otherwise. If you choose not to provide this personal information or request that 2U delete or restrict the processing of this personal information, you may not be able to participate in the Program, and we may not be able to provide you with other services, including those provided through the Website or advertised about the Program. 

If you wish to access, manage, or delete your information as described in this section, please fill out 2U’s Data Request Form.  If you believe your rights regarding your personal information have been infringed upon, please contact us privacy@2U.com. Individuals with unresolved concerns who are located in certain jurisdictions — including the EU, Brazil, the People’s Republic of China, South Africa, Switzerland, or the United Kingdom —  have the right to lodge a complaint with their applicable data protection authority.

Additional Information

Education Records

You may have specific rights relating to the disclosure of any personal information that you provide to us and/or education records that we may create about you under the Family Education Rights & Privacy Act (“FERPA”). You also may have specific rights under FERPA related to accessing and/or updating your personal information. Certain information may be excluded from education records made available for inspection, within the bounds of the law and our confidentiality undertakings with third parties. You may also request amendment of education records that you believe are inaccurate, misleading or in violation of your rights. If you would like to inspect and review your education records pursuant to FERPA, you may submit a request to the School’s FERPA office. Any FERPA-protected information will be processed by 2U at the direction of the School and will not be used for targeted advertising.

NOTICE FOR CALIFORNIA CONSUMERS

Categories of Personal Information that We Collect and Disclose

As required by the California Consumer Privacy Act (“CCPA”), below are the categories of personal information about California consumers that we collect and disclose for a business purpose.   

We collect and disclose for a business purpose the following categories of personal information:

  • Contact Information and Identifiers, including real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, phone number, account name, or other similar identifiers.
  • Commercial Information, including records of products and services purchased and purchasing history.
  • Customer Records, including paper and electronic customer records containing personal information, such as name, signature, address, telephone number, education, employment, employment history, or medical information relevant to your participation in the Program.
  • Usage Data, including internet or other electronic network activity information, such as information about how you interact with our services or advertisements.
  • Audio, electronic, visual, thermal, olfactory or similar information, including voice recordings when you call us. 
  • Biometric Information, including facial recognition used for identity verification, where required by the School and remote proctoring.
  • Employment History, including professional or employment-related information.
  • Education Information, including information about education history or background.
  • Protected Classifications, characteristics of protected classifications under California or federal law such as race, color, sex, age, religion, national origin, disability and citizenship status.
  • Inferences drawn from any of the information identified above reflecting your preferences and characteristics.

Categories of Sources of Personal Information 

The categories of sources of personal information we collect are described in the section Collection of Information above.

Purposes for Collecting and Disclosing Personal Information

We collect and disclose the personal information identified above for the following purposes: 

  • To provide, maintain, improve and enhance our services;
  • To personalize your experience on our services such as by providing tailored content and recommendations; 
  • To understand and analyze how you use our services and develop new products, services, features, and functionality;
  • To communicate with you, provide you with updates and other information relating to our services, provide information that you request, respond to comments and questions, and otherwise provide customer support;
  • For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable, or otherwise of interest to you;
  • To generate anonymized, aggregate data containing only de-identified, non-personal information that we may use for purposes such as to publish reports
  • To facilitate transactions and payments;
  • To find and prevent fraud and abuse or infringing or illegal activity and respond to trust and safety issues that may arise;
  • For compliance purposes, including enforcing our Terms of Use or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or government agency; and
  • For other purposes for which we provide specific notice at the time the information is collected.

2U may also seek your consent for additional uses of information, including personal information.

Categories of Third Parties to Which Personal Information is Disclosed 

We disclose the categories of personal information identified above to the following categories of third parties:

  • The School (all categories of personal information);
  • Third-party providers that serve business, professional or technical support functions (all categories of personal information);
  • 2U’s affiliated companies (all categories of personal information);
  • Your Employer or sponsor, or their designee (Contact Information and Identifiers, Customer Records, Employment History, Education Information);
  • Potential Employers (Contact Information and Identifiers, Customer Records, Employment History, Education Information); or
  • Third parties for legal matters or safety purposes (all categories of personal information). 

In some cases, we disclose Identifiers and Usage Data with business partners in order to deliver ads that are more relevant to you and to measure and report on the effectiveness of our advertising campaigns. Under the CCPA, some of these data disclosures may be broadly considered a “sale” of information or “sharing” of information for cross-context behavioral advertising, even though these activities do not fit what most people would understand “sale” or “sharing” to mean. Except for these types of disclosures, we do not “sell” or “share” your information. To opt out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising, please visit Your Privacy Choices, also linked at the bottom of each page on the Website.

Data Retention Periods

2U will retain your Personal Information for as long as we have a relationship with you. We also may retain your personal information for a longer period of time which enables us to:

  • Maintain business records for analysis and/or audit purposes;
  • Comply with record retention requirements under the law;
  • Defend or bring any existing or potential legal claims;
  • Address any complaints regarding the services;
  • Enforce our commercial agreements; and
  • Support our legitimate interests, as described in this Privacy Policy.

Upon your request that 2U delete your personal information, we will take steps to delete the personal information we hold about you. We will notify you of any personal information we retain as a result of an applicable exemption, for example if we are legally or contractually prohibited from deleting certain information. 

California Consumer Rights

California law gives California consumers the right to make the following requests:

  • The right to opt-out of the sale or sharing of your personal information. 
  • The right to request a copy of the personal information that we have collected about you in the prior 12 months.  
  • The right to request deletion of the personal information that we have collected from you, subject to certain exemptions (for example, where the information is used by us to detect security incidents, debugging or to comply with a legal obligation).
  • The right to correct inaccurate Personal Information that we maintain about you.
  • The right to request more details about the personal information we collect and how and why we use and share it, including the categories of personal information we have collected about you, the categories of sources for personal information we collect, the business or commercial purposes for collecting personal information, and the categories of third parties with which we share personal information.

You can submit a copy, deletion, correction or right-to-know request online by filling out 2U’s Data Request Form or by contacting us at 1-888-213-3874.  To opt out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising, please visit Your Privacy Choices, also linked in the footer of the Website. If you implement browser-based opt-out preference signals, 2U will opt you out of the sale of your personal information and sharing of your personal information for cross-context behavioral advertising. You can enable these signals through your browser settings for browsers that offer them. Please refer to your browser for additional information and instructions.

You may authorize another person (your “authorized agent”) to submit a request on your behalf through the methods described above. Your authorized agent should submit proof that you gave the agent signed permission to submit the request. We may still require you to directly verify your identity and directly confirm that you have provided the authorized agent permission to submit the request.

You have the right not to receive discriminatory treatment for the exercise of your CCPA privacy rights, subject to certain limitations. We do not discriminate if you exercise your rights under the CCPA. 2U does not use or disclose your sensitive personal information for purposes other than those set forth in the CCPA.

California’s Shine the Light Law. If you are a California resident and do not want 2U to disclose your information to third parties (including to affiliates of 2U, Inc.  or 2U partner universities) for their direct marketing purposes, you may opt out here.

Public Forums; Publicly Available Content

Any information you may disclose through the Website on message boards, in chat rooms, or on other public areas, such as on webinars that you may attend about the Program, may be viewed by others, including your classmates and learning facilitators. Please exercise caution when disclosing personal information in these public areas. If you do not want 2U to store metadata associated with your content, please remove the metadata before uploading your content. 

Third-Party Content, Links, and Plug-Ins 

The Website  may also offer you the ability to interact with content provided by third parties not affiliated with 2U (“Third-Party Content”). Third-Party Content linked to or embedded on this Website is governed by the privacy policies of those third parties. Your use of Third-Party Content is subject to each site’s privacy policy, which may be different from ours. We have no control over the information that is collected, stored, or used by Third Party Content.

Questions or Concerns About this Privacy Policy 

You may direct any questions or concerns regarding this Privacy Policy to us at privacy@2U.com. You may also write to us at ATTN: Privacy, 2U, Inc. 7900 Harkins Road, Lanham, Maryland 20709 USA. We review this Privacy Policy from time to time and reserve the right to make changes to this Privacy Policy at any time. If we do make material changes, we will give notice via the Website or by otherwise notifying you.

Depending on your location, you also may have the right to file a complaint with the data protection regulatory authority in the country where you reside. A list of 2U data controllers can be found here. The relevant data controller will be charged with making decisions regarding the purposes and methods of processing of data under the terms of this Privacy Policy.

If you reside in the EU, you can contact our EU representative at DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland, privacy@2u.com.  If you reside in the UK, you can contact our UK representative at 2U Group (UK) LTD, ℅ Skadden, Arps, Slate, Meagher & Flom (UK) LLP, 22 Bishopsgate, London, United Kingdom, EC2N 4BQ, +44 20 3457 5774, privacy@2U.com. 

To make a request to delete or access personal data, or for more information about the personal data 2U has about you, use 2U’s Data Request Form.

View University of Surrey’s Privacy Policy.