Enquirers, applicants and students

BCU may collect your personal data in a number of ways, for example:

• We collect the vast majority of the information directly from you;
• We may also collect additional information directly from you using information you provide to us, for example when you visit our website, or contact us by email or telephone;
• We may obtain personal data about you from third parties including referees, former schools, and government departments and agencies. You may have given other organisations permission to share your personal data.

We will collect personal details such as name, address, qualifications and information captured in your student record such as progression and attendance records. For equality monitoring purposes, we will also ask for special category data such as ethnicity, gender, sexual orientation and religious beliefs.

We will use your data to keep a record of your relationship with the University and to deliver a range of education and support services, including processing and assessing applications for study, registering and maintaining a record of academic achievement, and sending you relevant communications.

When we process your information, we rely on the following lawful bases:

• Because we have a contractual obligation to consider applications and to deliver courses and examinations to enrolled students. We will need to process your data in order to meet our obligations or exercise rights under our contract with you;

• Where we have a legal obligation. For example, to meet our duties under equality laws or when we are required by law to provide data to various Government departments through the Higher Education Statistics Agency (HESA);

• Where it is necessary to meet a task in the public interest. We may need to process your data for the purpose of teaching and related activities, such as academic assessment and supervision. Teaching is a task that we perform in the public interest in order to fulfil our responsibility as an exempt charity for promoting the advancement of learning;

• Where it is necessary to meet our legitimate interests or the legitimate interests of others. Examples included, but are not limited to, the following:

• inviting you to take part in surveys or enabling third parties to conduct surveys on our behalf;

• asking you to provide additional information; and

• notifying you of changes to course information.

• There may be situations where we ask for your consent to process your data e.g. where we ask you to confirm if you want to hear about other opportunities at BCU (you will always be able to opt out of receiving such communications).

• Where it is necessary in order to protect your or another person’s vital interests (i.e. an interest which is essential for your or their life).

If you fail to provide certain information when requested for the purposes of assessing applications, delivering courses and or examinations, we may not be able to meet our contractual obligation to consider your application, to deliver the course to your or to comply with our other legal obligations.

We will only process your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will seek your consent to use it for that new purpose.

Please note that we may process your data without your knowledge or consent where this is required or permitted by law.

Special category data and criminal conviction data require a higher level of protection. It may sometimes be necessary to process this sort of information for exceptional reasons; for example, because it is necessary to protect your vital interests or those of another person. We may also process your special category data to identify your eligibility for certain scholarships aimed at addressing underrepresentation.

We may share your data with other departments and faculties within BCU only where necessary for responding to enquiries or applications, or for the delivery of courses or educational and ancillary services.

We may share your personal data with certain third parties for the purposes of delivering educational and ancillary services, or in order to perform our contractual and other legal responsibilities.

Where information is shared with third parties, we will seek to share the minimum amount necessary.

The secure database used to store your data is kept in the UK. However, some of the personal data we process about you may be transferred to, and stored at, a destination outside the European Economic Area (EEA); for example, where it is processed by staff operating outside the EEA who work for us or for one of our suppliers, or where personal data is processed by one of our suppliers who is based outside the EEA or who uses storage facilities outside the EEA.

BCU is committed to safeguarding your personal data. Whenever you provide such information, we are legally obliged to use your information in line with all applicable laws concerning the protection of personal information, including the Data Protection Act 2018 and the General Data Protection Regulation. All of our records are held within a dedicated and secure database system hosted on a secure network with access limited on a ‘need to know’ basis. For more information, a copy of BCU’s overarching Data Protection Policy is available on the policies page of the BCU website.

We will hold your personal information within a secure dedicated database for as long as is necessary to provide educational and ancillary services to you. Where you have indicated you no longer wish to receive any services, your information will be retained or securely and permanently destroyed in accordance with the BCU retention and destruction policy.

BCU wants to ensure that we keep the details we hold about you up to date and communicate with you fully in accordance with your wishes. You should also get in touch with us if any of your personal details change. You can update your details and your communication preferences during enrolment tasks, by contacting Academic Services, or at any time using the following contact details:

By email to: informationmanagement@bcu.ac.uk

By post to: Data Protection Officer
Information Management Team
Birmingham City University
Floor 1, Joseph Priestley Building
6 Cardigan Street
Birmingham B4 7RJ

Under the Data Protection Laws, you have the right to:

• Request access to your data (commonly known as a ‘subject access request’). This enables you to receive a copy of your data and to check that we are lawfully processing it. You can submit a Subject Access Request (SAR) in accordance with the Subject Access Requests (SAR) Procedure.

• Request correction of your data. This enables you to ask us to correct any incomplete or inaccurate data we hold about you.

• Request erasure of your data. This enables you to ask us to delete or remove your data in certain circumstances; for example, if you consider that there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).

• Object to processing of your data where we are relying on our legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing for this reason. You also have the right to object where we are processing your data for direct marketing purposes.

• Request the restriction of processing of your data. This enables you to ask us to suspend the processing of your data; for example, if you want us to establish its accuracy or the reason for processing it.

• Request the transfer of your data to another party.

Depending on the circumstances and the nature of your request, it may not be possible for us to do what you have asked; for example, where there is a statutory or contractual requirement and it would not be possible to fulfil our legal obligations if we were to stop. However, where you have consented to the processing, you can withdraw your consent at any time, by emailing us at informationmanagement@bcu.ac.uk. In this event, we will stop the processing as soon as we can. Further information on your rights is available from the Information Commissioner’s Office (ICO).

If you have any questions, comments or concerns about how we use or handle your personal data, please contact the Data Protection Officer using the contact details in section 11 above.

If you are not content with how we handle your information we would ask you to contact our Data Protection Officer to help you. However, you do also have the right to complain directly to the Information Commissioner via their website or via post at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Information about the Information Commissioner is available at: www.ico.org.uk.

• Birmingham City University’s Data Protection Policy and Appropriate Policy Document
• Birmingham City University’s Privacy Notices
• The Information Commissioner’s Office (ICO) information for members of the public
• Subject Access Request Procedure

This privacy notice may be updated from time to time so you may wish to check it each time you submit personal information to BCU.

Last updated: 09 April 2023