Enquirers, applicants and students

BCU may collect your personal data in a number of ways, for example:

• We collect the vast majority of the information directly from you, through the application process (for example via UCAS) and for students during online enrolments and during your studies;
• We may also collect additional information directly from you from the information you provide to us when you interact with us, for example when you visit our website, contact us by email, telephone, post, social media or in person, register for an event, make an enquiry or respond to a questionnaire;
• We may obtain personal data about you from third parties including referees, former schools, colleges and universities, and government departments and agencies. You may have given other organisations permission to share your personal data. When appropriate we may combine third party data with data we already hold about you to fulfil the uses in section 3.

We will collect personal details such as name, address, qualifications and information captured in your student record such as progression and attendance records. For equality monitoring purposes, we will also ask for special category data such as ethnicity, gender, sexual orientation and religious beliefs.

We will use your data to keep a record of your relationship with the University and to deliver a range of education and support services, including processing and assessing applications for study, registering and maintaining a record of academic achievement, and sending you relevant communications.

When we process your information, we rely on the following lawful bases:

• Because we have a contractual obligation to consider applications and to deliver courses and examinations to enrolled students. We will need to process your data in order to meet our obligations or exercise rights under our contract with you;

• Where we have a legal obligation. For example, to meet our duties under equality laws or when we are required by law to provide data to various Government departments through the Higher Education Statistics Agency (HESA);

• Where it is necessary to meet a task in the public interest. We may need to process your data for the purpose of teaching and related activities, such as academic assessment and supervision. Teaching is a task that we perform in the public interest in order to fulfil our responsibility as an exempt charity for promoting the advancement of learning;

• Where it is necessary to meet our legitimate interests or the legitimate interests of others. Examples included, but are not limited to, the following:

• inviting you to take part in surveys or enabling third parties to conduct surveys on our behalf;

• asking you to provide additional information; and

• notifying you of changes to course information.

• There may be situations where we ask for your consent to process your data e.g. where we ask you to confirm if you want to hear about other opportunities at BCU (you will always be able to opt out of receiving such communications).

• Where it is necessary in order to protect your or another person’s vital interests (i.e. an interest which is essential for your or their life).

If you fail to provide certain information when requested for the purposes of assessing applications, delivering courses and or examinations, we may not be able to meet our contractual obligation to consider your application, to deliver the course to your or to comply with our other legal obligations.

We will only process your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will seek your consent to use it for that new purpose.

Please note that we may process your data without your knowledge or consent where this is required or permitted by law.

Special category data and criminal conviction data require a higher level of protection. It may sometimes be necessary to process this sort of information for exceptional reasons; for example, because it is necessary to protect your vital interests or those of another person. We may also process your special category data to identify your eligibility for certain scholarships aimed at addressing underrepresentation.

We may share your personal data with any relevant staff, business areas, departments and faculties within BCU where necessary in order to provide you with provision, services and support and to enable BCU to carry its necessary functions.

For the purposes referred to in the privacy notice, we may share your personal data with certain third parties for the purposes of delivering educational and ancillary services or in order to perform our contractual and other legal responsibilities. We may, where relevant and necessary, need to share your information with the following types of organisations:

1. Your funders and/or sponsors, including the Student Loan Company and research councils;
2. Your referees;
3. External organisations offering University-sponsored services including student surveys;
4. UK and overseas governmental bodies or agencies responsible for immigration, student loans, verification of identification, and security including cybersecurity, radicalisation, and counter-terrorism.
5. The Students Union;
6. If you have or are seeking a particular relationship with a third party, for example, accommodation providers, other universities, schools, health and social care providers, or providers of external training and placements;
7. Examination boards and awarding bodies;
8. Employers or prospective employers and other educational institutions;
9. The Higher Education Statistics Agency (HESA). Further information on how HESA uses this data is available from the HESA website; (Use the search term ‘collection notices’ for information about how HESA may use your personal data)
10. Any relevant professional statutory regulatory bodies for relevant courses;
11. Regulatory bodies and auditors, for example, if records had to be lawfully inspected by the Information Commissioners Office;
12. Office for Students (OfS) and/or the Office for the Independent Adjudicator (OIA);
13. Relevant public bodies, including but not limited to the police, the UK Home Office, HM Revenue and Customs, and local authorities;
14. To obtain industry-endorsed accreditation from third parties for university charter awards or university courses, including but not limited to the Advanced Higher Education (HE) Race Equality Charter Award and Creative Skillset accreditation;
15. The National Health Service or other medical practitioners;
16. Organisations assisting BCU with activities such as surveys, including the National Student Survey (NSS), Graduate Outcomes Survey (GOS), and Postgraduate Research Experience Survey (PRES);
17. Organisations assisting BCU with BCU marketing, recruitment, and assessment activities;
18. Other educational establishments as necessary, for example, affiliate and partner institutions, student status verifications, to assist with safeguarding of yourself or others, to uphold processes regarding appropriate conduct, or to assist with topics regarding courses linked to regulated professions;
19. External parties for safeguarding purposes, for example, the police, NHS, social services, Disclosure and Barring Service (DBS), etc.;
20. External parties as necessary in order to process legal claims, insurance claims, or when BCU is seeking legal advice;
21. External parties as necessary to complete data rights requests, for example, if you use a third party to submit a subject access request on your behalf;
22. External parties such as the Information Commissioner’s Office (ICO) or tribunals as necessary.

Where information is shared with third parties, we will seek to share the minimum amount necessary.

If we use a third party as detailed above, we will always ensure that appropriate controls are in place to ensure BCU shares personal data legally. If you are considering applying for a placement in the USA, please read section 7 about where your personal data is stored.

The secure databases BCU uses to store your data is kept in the UK. However, some of the personal data we process about you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"), for example where it is processed by staff operating outside the EEA who work for us or for one of our suppliers, or where personal data is processed by one of our suppliers who is based outside the EEA or who uses storage facilities outside the EEA.

In these circumstances, your personal data will only be transferred on one of the following bases:

a. a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of protection; or

b. where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission); or

c. there exists another situation where the transfer is permitted under applicable law (e.g. where we have your explicit consent).

Please note that the USA is not a country which the European Commission considers as automatically providing an adequate level of protection for personal data. Therefore, if you choose to apply for a placement in the USA, whilst BCU will ensure that the transfer of your personal data to that placement is legal according to UK data protection laws, it will not have the level of protection that it would have within the UK data protection laws.

BCU is committed to safeguarding your personal data. Whenever you provide such information, we are legally obliged to use your information in line with all applicable laws concerning the protection of personal information, including the Data Protection Act 2018 and the General Data Protection Regulation. All of our records are held within a dedicated and secure database system hosted on a secure network with access limited on a ‘need to know’ basis. For more information, a copy of BCU’s overarching Data Protection Policy is available on the policies page of the BCU website.

We will hold your personal information within a secure dedicated database for as long as is necessary to provide educational and ancillary services to you. Where you have indicated you no longer wish to receive any services, your information will be retained or securely and permanently destroyed in accordance with the BCU retention and destruction policy.

BCU wants to ensure that we keep the details we hold about you up to date and communicate with you fully in accordance with your wishes. You should also get in touch with us if any of your personal details change. You can update your details and your communication preferences during enrolment tasks, by contacting Academic Services, or at any time using the following contact details:

By email to: informationmanagement@bcu.ac.uk

By post to: Data Protection Officer
Information Management Team
Birmingham City University
Floor 1, Joseph Priestley Building
6 Cardigan Street
Birmingham B4 7RJ

Under the Data Protection Laws, you have the right to:

• Request access to your data (commonly known as a ‘subject access request’). This enables you to receive a copy of your data and to check that we are lawfully processing it. You can submit a Subject Access Request (SAR) in accordance with the Subject Access Requests (SAR) Procedure.

• Request correction of your data. This enables you to ask us to correct any incomplete or inaccurate data we hold about you.

• Request erasure of your data. This enables you to ask us to delete or remove your data in certain circumstances; for example, if you consider that there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).

• Object to processing of your data where we are relying on our legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing for this reason. You also have the right to object where we are processing your data for direct marketing purposes.

• Request the restriction of processing of your data. This enables you to ask us to suspend the processing of your data; for example, if you want us to establish its accuracy or the reason for processing it.

• Request the transfer of your data to another party.

Depending on the circumstances and the nature of your request, it may not be possible for us to do what you have asked; for example, where there is a statutory or contractual requirement and it would not be possible to fulfil our legal obligations if we were to stop. However, where you have consented to the processing, you can withdraw your consent at any time, by emailing us at informationmanagement@bcu.ac.uk. In this event, we will stop the processing as soon as we can. Further information on your rights is available from the Information Commissioner’s Office (ICO).

If you have any questions, comments or concerns about how we use or handle your personal data, please contact the Data Protection Officer using the contact details in section 11 above.

If you are not content with how we handle your information we would ask you to contact our Data Protection Officer to help you. However, you do also have the right to complain directly to the Information Commissioner via their website or via post at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Information about the Information Commissioner is available at: www.ico.org.uk.

• Birmingham City University’s Data Protection Policy and Appropriate Policy Document
• Birmingham City University’s Privacy Notices
• The Information Commissioner’s Office (ICO) information for members of the public
• Subject Access Request Procedure

This privacy notice may be updated from time to time so you may wish to check it each time you submit personal information to BCU.

Last updated: 2 June 2025.