Enquirers, applicants and students
This privacy notice explains how Birmingham City University (BCU) collects, uses and shares your personal data, and your rights in relation to the personal data we hold.
This notice concerns our processing of personal data of enquirers, applicants and current students.
BCU is the data controller for your personal data and is subject to the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
Read our supplementary COVID-19 Site Testing Booking process privacy notice here.
Read the supplementary privacy notice for NHS Test & Trace here.
In order to operate as a university, BCU sometimes needs to collect information about you. BCU is committed to being transparent about how it collects and uses that data, and to meeting its data protection obligations.
1. How we collect your information
BCU may collect your personal data in a number of ways, for example:
- We collect the vast majority of the information directly from you;
- We may also collect additional information directly from you using information you provide to us, for example when you visit our website, or contact us by email or telephone;
- We may obtain personal data about you from third parties including referees, former schools, and government departments and agencies. You may have given other organisations permission to share your personal data.
2. The types of information we collect
We will collect personal details such as name, address, qualifications and information captured in your student record such as progression and attendance records. For equality monitoring purposes, we will also ask for special category data such as ethnicity, gender, sexual orientation and religious beliefs.
3. How we use your personal data
We will use your data to keep a record of your relationship with the University and to deliver a range of education and support services, including processing and assessing applications for study, registering and maintaining a record of academic achievement, and sending you relevant communications.
4. On what basis do you process my data?
When we process your information, we do this based on the following:
- We have a contractual obligation;
- We have a legal obligation;
- It is necessary to meet a task in the public interest;
- It is necessary to meet our legitimate interests or the legitimate interests of others.
There may be situations where we ask for your consent to process your data.
Please note that we may process your data without your knowledge or consent where this is required or permitted by law.
5. How we use special category data and criminal conviction data
Special category data and criminal conviction data require a higher level of protection. It may sometimes be necessary to process this sort of information for exceptional reasons; for example, because it is necessary to protect your vital interests or those of another person. We may also process your special category data to identify your eligibility for certain scholarships aimed at addressing underrepresentation.
6. Who we share personal data with
We may share your data with other departments and faculties within BCU only where necessary for responding to enquiries or applications, or for the delivery of courses or educational and ancillary services.
We may share your personal data with certain third parties for the purposes of delivering educational and ancillary services, or in order to perform our contractual and other legal responsibilities.
Where information is shared with third parties, we will seek to share the minimum amount necessary.
7. Where is my data stored?
The secure database used to store your data is kept in the UK. However, some of the personal data we process about you may be transferred to, and stored at, a destination outside the European Economic Area (EEA); for example, where it is processed by staff operating outside the EEA who work for us or for one of our suppliers, or where personal data is processed by one of our suppliers who is based outside the EEA or who uses storage facilities outside the EEA.
8. Will you be contacted for marketing purposes?
BCU will only send you marketing emails or contact you via your preferred method where you have expressly agreed to this. We may personalise the message content based on information you have provided. You can update your preferences at any time; see section 10 below.
9. How we keep your data safe
BCU is committed to safeguarding your personal data. Whenever you provide such information, we are legally obliged to use your information in line with all applicable laws concerning the protection of personal information, including the Data Protection Act 2018 and the General Data Protection Regulation. All of our records are held within a dedicated and secure database system hosted on a secure network with access limited on a ‘need to know’ basis. For more information, a copy of BCU’s overarching Data Protection Policy is available on the policies page of the BCU website.
10. How long is your information kept?
We will hold your personal information within a secure dedicated database for as long as is necessary to provide educational and ancillary services to you. Where you have indicated you no longer wish to receive any services, your information will be retained or securely and permanently destroyed in accordance with the BCU retention and destruction policy.
11. How we keep your information up to date and communication preferences
BCU wants to ensure that we keep the details we hold about you up to date and communicate with you fully in accordance with your wishes. You should also get in touch with us if any of your personal details change. You can update your details and your communication preferences during enrolment tasks, by contacting Academic Services, or at any time using the following contact details:
By email to: firstname.lastname@example.org
By post to: Data Protection Officer
Information Management Team
Birmingham City University
Floor 1, Joseph Priestley Building
6 Cardigan Street
Birmingham B4 7RJ
12. Your rights
Under the Data Protection Laws, you have the right to:
- Request access to your data (commonly known as a ‘subject access request’). This enables you to receive a copy of your data and to check that we are lawfully processing it.
- Request correction of your data. This enables you to ask us to correct any incomplete or inaccurate data we hold about you.
- Request erasure of your data. This enables you to ask us to delete or remove your data in certain circumstances; for example, if you consider that there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).
- Object to processing of your data where we are relying on our legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing for this reason. You also have the right to object where we are processing your data for direct marketing purposes.
- Request the restriction of processing of your data. This enables you to ask us to suspend the processing of your data; for example, if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your data to another party.
Depending on the circumstances and the nature of your request, it may not be possible for us to do what you have asked; for example, where there is a statutory or contractual requirement and it would not be possible to fulfil our legal obligations if we were to stop. However, where you have consented to the processing, you can withdraw your consent at any time, by emailing us at email@example.com. In this event, we will stop the processing as soon as we can. Further information on your rights is available from the Information Commissioner’s Office (ICO).
13. How to exercise your data rights
If you wish to exercise any of your rights, please contact our Data Protection Officer using the contact details in section 11.
14. How to ask or raise concerns
If you have any questions, comments or concerns about how we use or handle your personal data, please contact the Data Protection Officer using the contact details in section 11 above.
If you are not content with how we handle your information we would ask you to contact our Data Protection Officer to help you. However, you do also have the right to complain directly to the Information Commissioner via their website or via post at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Information about the Information Commissioner is available at: www.ico.org.uk.
15. Changes to this privacy notice
This privacy notice may be updated from time to time so you may wish to check it each time you submit personal information to BCU. The date of the most recent versions will appear on this page (see version control).
Document version control
Updated: 11 March 2019