Introduction

This Notice covers information about BU Students. This includes any person who has firmly accepted an offer to study at BU, as well as anyone registering / already registered on a credit-bearing course of study provided by BU. As we hold information in a form that identifies individuals, it is “personal data” [often referred to as “data” in this Notice].

In this Notice, “BU” "we", "our" and "us" refers to Bournemouth University Higher Education Corporation. We have a separate Privacy Notice covering information relating to student recruitment (including enquiries about potential study at BU and events for those considering studying at BU) and our admissions process: you can refer to this for information about how your data was processed by BU before you accepted an offer to be a BU Student.

We also have separate Privacy Notices relating to BU Alumni information, BU Staff, individuals interested in BU public events or making general enquiries and individuals participating in BU research projects. All of the Privacy Notices mentioned here can be accessed through the main Data Protection Page on our website. If you are a BU student who is also employed by BU in any capacity, the processing of your data in relation to your employment is covered by the BU Workforce and Applicants Privacy Notice.

More information

The purpose of this Notice is to enable you to understand the scope of the personal data which BU holds and uses that relates to you personally, and how this data will be handled by us. It covers use of your information within BU and the circumstances in which we will share your data with other organisations.

We think it is important that you can understand how and why we use your data. We are also required by law to give you specific information about the processing of your data.

For this reason, and because BU is a large organisation which needs to collect and use personal data for a range of purposes, this Notice is quite long. It contains some technical legal language. We have tried to make the Notice as clear as possible and provide signposting so that you can find the information most relevant to you. See section (c) below for guidance on how to use the Notice.

Personal data is information relating to identifiable living individuals (known as “data subjects”). Use of personal data (including collecting data, sharing data or just holding it in files) is referred to as “data processing”. To protect your interests and rights, organisations do not have complete freedom in how they use your personal data. They have to comply with data protection laws, which apply restrictions on when and how personal data can be processed. Processing of personal data is lawful only if it meets certain requirements or conditions. These are concerned with the purpose of the processing and how it is carried out.

More information

Current data protection laws are set out in the UK’s Data Protection Act 2018 and the UK GDPR.

Under these laws, BU is the data controller of the information it collects, and processes as described in this Notice. This means that it has the core legal responsibility to safeguard the information and ensure it is processed lawfully.

BU must:

• Take steps to ensure that the data it processes is accurate and up to date;
• Give you clear information about its processing of your data, in one or more Privacy Notices like this one;
• Only process your data for specific purposes described to you in a Privacy Notice, and only share your data with third parties as provided for in a Privacy Notice;
• Keep your data secure; and
• Respond within set timescales to certain enquiries or requests from individuals about the use of their data.

Information about your data protection rights as an individual is set out in section 8 of this Notice.

Sections 4 and 5 of this Notice identify and explain the data processing and data sharing carried out by BU.

In these sections, where we describe a particular use of your data you will see a summary description of the processing and a colour-coded indicator of the legal basis of the processing (these are explained below). This first level of information will also describe any use or sharing of your data which we particularly need to highlight to you. You can then choose whether to read the “More information” text which gives a more detailed layer of information about the processing and its legal basis.

BU is using colour coding to provide a quick, easily accessible indication of the legal basis for processing.  The following explains how the colour coding in this Notice links to the conditions set out in the UK GDPR: references to Articles are to the relevant provisions within the UK GDPR.  Further information about the basis of a specific category of processing can usually be obtained by reading the “More information” text in sections 4 and 5 of this Notice.

• Necessary for the performance of a contract between you and BU: this will be either the core contract between us for the delivery of your course or an additional contract for other services. The terms of the BU Student Agreement can be found here: https://www.bournemouth.ac.uk/students/help-advice/important-information. [Art 6.1(b)]

• Necessary for compliance with a legal obligation on BU: we will identify the relevant obligation. [Art 6.1(c)]

• Necessary for the performance of a task carried out in the public interest: this will usually refer to an activity within BU’s core purpose as a statutory higher education corporation, to deliver higher education and carry out research. [Art 6.1(e)]

• Consent: this means that you have agreed that we can use your data for this specific purpose. You are able to withdraw your consent at any time. When you are asked for consent, you will also be given details of who to contact to withdraw your consent. [Art 6.1(a)]

• Necessary for legitimate interests pursued by BU or another organisation, where BU has determined that the processing represents an appropriate balance between its aims and your interests, rights and freedoms as a data subject. Where this applies, we will identify the purpose we are pursuing. [Art 6.1(f)]

• Necessary to protect your vital interests or those of another person, i.e., to prevent or manage significant risks of harm. [Art 6.1(d)

One of these must apply if we are processing any information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health or disability or your sex life or sexual orientation. These are referred to as “special categories” of data in the data protection legislation.

• Explicit consent: this means that you have explicitly agreed that we can use your personal data for this specific purpose. You are able to withdraw your consent at any time. When you are asked for consent, you will also be given details of who to contact to withdraw your consent. [Art 9.2(a)]

• Necessary to protect the vital interests of you as the data subject or another person, where you are physically or legally incapable of giving consent. [Art 9.2(c)].

• Necessary for the purposes of substantial public interest. Where this applies, we will identify the relevant public interest. [Art 9.2(g)]

• Necessary for establishment, exercise or defence of legal claims. [Art 9.2(f)]

• Necessary for healthcare purposes, including assessment of working capacity, medical diagnosis, provision of treatment or the management of healthcare arrangements. This only applies where the processing is the responsibility of a healthcare professional who is subject to professional obligations of confidentiality. [Art 9.2(h)]

• Necessary for purposes of carrying out obligations and exercising rights in relation to employment, social security and social protection law. [Art 9.2(b)]

• Necessary for research or statistical purposes, where it is considered that that the use of your data will be proportionate to the aims of the research and that your interests as a data subject will be appropriately safeguarded. [Art 9.2(j)]

In addition, we can only process information about any criminal convictions you may have where this is in the substantial public interest and falls within a relevant description of processing set out in Schedule 1 of the Data Protection Act 2018. Further information about the basis on which we process this information is set out later in this Notice.