Student Financial Processes

When you engage with Birmingham City University in relation to financial matters (for example, when you enrol as a student, make tuition fee payments, apply for a payment plan, receive financial support, or when the University manages outstanding or unidentified payments), we may collect and process personal data including:

• Your Name
• Bank or payment reference details
• Contact details (such as postal address, email address and telephone number)
• Correspondence relating to payments, arrears, or financial queries
• Course and enrolment details
• Date of birth
• Fee liability and payment information
• Student Finance England (or other funding body) status / funding entitlement
• Student Finance details such as SSN (Student Support Number) and Customer Reference Number
• Student or applicant ID number (where applicable)

For the purposes of payment verification, fraud prevention, audit, and regulatory compliance (including Know Your Payer checks), we may also request and process:

• Proof of identity (such as a passport or driving licence)
• Proof of payment or source of funds
• Bank statements or transaction evidence (limited to relevant information only)
• Confirmation of the relationship between the payer and the student, where the payer is a third party.

This information is provided by you and a combination of people or organisations such as the Student Loans Company (SLC), Student Finance England/Wales/ Student Universal Support Ireland (SUS), Student Awards Agency Scotland (SAAS), debt collection agencies, parents/sponsors, and applicant and student agents / representatives including international recruitment agents.

The legal basis for using this personal information is

• Public task – where processing is necessary for BCU to carry out its functions as a higher education provider
• Contract – where processing is necessary for the performance of a contract (for example, to administer tuition fee payments)
• Legal obligation – where processing is required to comply with financial controls, audit requirements, anti-fraud measures, or other regulatory obligations
• Legitimate interests – where processing is necessary to protect the University from fraud, financial loss, misapplied payments, or error, and does not override your rights.

BCU may process special category data for the purposes within scope of this privacy notice. Where it does, it will identify a relevant condition of processing. For example, for equal opportunities purposes, to prevent the loss of life, to provide support for an individual with a particular disability or medical condition (including administrating the Disabled Students’ Allowance), to prevent fraud or money laundering, to administrate the financial assistance fund (hardship fund), or awards / donations / scholarship that have criteria related to special category data (such as ethnicity or disability) or to defend legal claims. Where no other lawful bases / special conditions of processing apply, we will process your data on the basis of your explicit consent.

We will use your personal information to

• Administrate bursaries, donations, financial assistance fund (hardship fund), scholarships, Disabled Students’ Allowance (DSA) etc.
• Assess and administer tuition fee liability
• Communicate with you regarding financial matters
• Liaise with funding bodies such as Student Finance England and the Student Loans Company including confirming attendance, reporting changes (withdrawals, suspensions, transfers) and managing funding entitlement
• Manage payment plans and debt recovery activity
• Prevent and mitigate fraud, error, or misallocation of funds
• Produce financial reports and meet audit and regulatory requirements
• Process and reconcile payments and refunds
• Verify the identity of payers and the source of payments.

Personal data relating to financial processes is retained in line with Birmingham City University’s Records Retention Schedule. Retention periods vary depending on the type of data and legal requirements. For example:

• Financial transaction and payment verification records are typically retained for six years after the end of the relevant financial year
• Records required for audit, regulatory, or legal purposes may be retained for longer where necessary.

Once the relevant retention period has expired, personal data is securely destroyed.

BCU may use artificial intelligence (AI) where it may bring benefits to the university and / or people and organisations who interact with BCU. Please be assured that BCU will only use AI where it has been assessed as safe and appropriate. BCU makes every effort to ensure that it meets its’ legal obligations under data protection laws when using AI tools in order to protect your personal data.

Access to your personal data is restricted to authorised staff within Birmingham City University who require it to perform their duties. This may include staff within:

• Academic Schools (where relevant to fee status)
• Finance and Financial Operations (including Accounts Receivable, Collections and Treasury)
• Legal Services and Internal Audit team
• Student Services and Registry

Where personal data is processed outside the EEA, appropriate legal safeguards are in place to ensure adequate protection.

We share the personal data with a third parties, such as Student Finance England / Student Finance Wales (SFW), Student Awards Agency Scotland (SAAS), Student Universal Support Ireland (SUSI) and third party collection agencies, as:

• Required to meet a legal or regulatory obligation
• Necessary for audit or fraud prevention purposes

In addition to the circumstances stated above we will share your personal information if we believe someone’s life is in danger or we believe we are compelled to by law. Any data sharing is limited to what is necessary and appropriate.

You have the right to correct or update your personal data at any time. If you are a BCU student, your main contact for this is the Student Support Centre. If you’re not a student, please contact your main University contact or email informationmanagement@bcu.ac.uk. You may have the right to have your data deleted, the right to restrict processing, the right to object and / or the right to data portability and you have the right to know about and challenge automated decision making and profiling. Follow the links to find out whether those rights apply in these circumstances. To do any of those things or if you have followed the links but would like clarification, please email informationmanagement@bcu.ac.uk.

You have the right to request to see the personal data we hold about you. You can submit a Subject Access Request (SAR) in accordance with the Subject Access Requests (SAR) Procedure.

If you have read this privacy notice and would like further information, you’re welcome to contact our Data Protection Officer by emailing informationmanagement@bcu.ac.uk or by post to: Data Protection Officer, Information Management Team, Legal Services, Birmingham City University, Floor 1, Joseph Priestley Building, 6 Cardigan Street, Birmingham, B4 7BD, or by phoning 0121 202 4597.

If you are not content with how we handle your information, please follow our Data Protection Complaints Procedure. If you have used that procedure and are unsatisfied with the response you have received, you then have the right to complain directly to the Information Commission (IC). You can find out more about this on the IC’s complaints website.

Birmingham City University’s Data Protection Policy and Appropriate Policy Document

Birmingham City University’s Privacy Notices

The Information Commission’s (IC) information for members of the public

BCU Tuition Fee Payment Policy