This privacy notice outlines what you can expect when BCUC collects your information, if you are either a prospective or current employee or if you have a temporary or ongoing relationship with BCUC but are not registered as a member of staff (e.g., a contractor).

We collect and use your information for the following purposes:

Purpose 1: Employee lifecycle management.

We collect and use you information for:

• recruitment purposes
• contract management
• security clearance checks
• job changes
• end of contract purposes

Purpose 2: Leave and absence management.

We collect and use you information:

• to process leave requests
• for absence management
• for special leave administration.

Purpose 3: Training and development.

We collect and use you information:

• to maintain induction and training records
• for performance monitoring and management
• to maintain employee development records.

Purpose 4: Reporting and audit. 

We collect and use your information for statutory reporting purposes and to meet our internal and external audit obligations. This includes:

• to support internal management decision making
• responding to requests under legal obligations such as the Data Protection Act
• use of data for auditing purposes.

Purpose 5: Grievances and disciplinary procedures.

We collect and use you information:

• to investigate complaints or suspicions that any practice or conduct does not meet the standards of employment or professional expectations or requirements.

Purpose 6: Equalities monitoring and reporting.

We collect and use you information:

• to encourage, enhance and monitor equality of opportunity and treatment
• to create and assess such reports as are required for that function (such as: mainstreaming equalities report as required by the Equalities and Human Rights Commission and equalities reporting duty in the Funding Council Staffing return)
• to take steps to encourage and monitor equality.

Acceptance of the terms of this notice is a condition of your contract of employment.

The legal bases that we use in order to legally process the information you provide to us:

Contract Article 6 (1)(b). The Purpose is necessary for the performance of a contract with you or to take steps, at your request, before entering such a contract. This is the contract between BCUC and you as a member of staff or if you have a temporary or ongoing relationship with BCUC but are not registered as a member of staff (e.g., a contractor).

This legal basis will be used to achieve the following purposes:

• Purpose 1: Employee lifecycle management
• Purpose 2: Leave and absence monitoring
• Purpose 3: Training and development
• Purpose 5: Grievances and disciplinary procedures
• Purpose 7: Occupational health

Public Task Article 6 (1)(e).  BNU will process your personal data as use is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

This legal basis will be used to achieve the following purpose:

• Purpose 4: Reporting and audit

Legal Obligation Article 6 (1)(c). The processing is necessary for compliance with a legal obligation. This includes the return of statistical data and reports to satisfy various agencies that the University’s academic standards and funding arrangements are sufficient, and our obligations are being met.

This legal basis will be used to achieve the following purposes:

• Purpose 6: Equalities monitoring and reporting

Special Category Data

Some of the information we collect about you includes special category data for example racial or ethnic origin, political opinions, religious beliefs, trade union membership, health information, and data concerning sex life or sexual orientation. This data is subject to stricter data protection rules due to its sensitive nature, and processing it requires a specific legal basis.

Our legal reasons for using this special category data, where you provide it to us, are:

Purpose 1: Employee lifecycle;

Purpose 2: Leave and absence monitoring;

Purpose 4: Reporting and audit; and 

Purpose 6: Grievances and disciplinary procedures

Processing is necessary for reasons of substantial public interest, Article 9 (2)(g). The processing may be required for the purposes of employment law or assessing the work capabilities of individuals and for compliance with social protection law, in this case the Equality Act 2010.

In order to carry out its duties as an employer, BCUC must collect and process data relating to its staff. A record relating to your employment will be held by the BNU People Directorate. Information about your employment may also be kept by individual departments. Data held about you may include, but is not restricted to, the following:

• application forms
• personal details such as name, date of birth, contact details, national insurance number and next-of-kin information
• visa details and copies of passports or other forms of photographic ID
• sensitive personal data (e.g., for equality and diversity monitoring)
• data held on staff organograms
• records concerning appraisal and training
• sickness and other absence details
• proceedings relating to promotions
• contracts or terms and conditions of employment
• correspondence between the member of staff and BCUC or BNU
• correspondence between BCUC and third parties on behalf of a member of staff (e.g. employment references)
• records of grievances
• investigations into breaches of terms and conditions of employment
• records of disciplinary proceedings.

We ask you to declare your ethnic origin and any disabilities at the time of your application for a post. These fall within the definition of sensitive personal data. If you choose to provide such data, you give your consent for BCUC to use them, in an aggregated form, for statistical purposes.

Your HR file may also contain sensitive personal data in relation to health or sickness, maternity leave or paternity leave. These records will be kept in strict confidence and will not be released to third parties without your explicit consent.

Personal data about employees is normally provided to BCUC by a prospective member of staff on an application form and is added to over the course of their employment. 

BCUC may disclose certain personal data to external bodies as categorised below where we have a legitimate reason to use that data or where BCUC is under a legal requirement to do so. Information will be disclosed in accordance with the provisions and obligations of the Data Protection Act. Please note this is not an exhaustive list.

BCUC  will not release data to any unauthorised third person except where you ask us to. This means that we will not release data to banks, friends, relatives etc., without your agreement. If you wish us to provide data in these circumstances, you should provide us with written consent to release the data.

BCUC may need to make other disclosures of your personal information without your consent, but any such disclosures will be made with due consideration of your rights, in accordance with the obligations imposed on the University by the Data Protection Act and other relevant legislation.

We may transfer you personal data outside the UK in the following circumstances:

Where we use a cloud-based IT system to hold your data, and the data in the cloud is stored on servers located outside the UK in a country which is not subject to an adequacy decision. In these circumstances we safeguard your data through undertaking appropriate checks on the levels of security offered by the cloud provider and entering into a contract with them which applies protections of the same type and level required by data protection laws within the UK.

We will keep your personal data for only as long as is necessary for the purposes for which it was collected. Information about staff is retained and disposed of in accordance with BNU’s Records Retention Schedule; a summary of which can be accessed on our Policies webpage. Some information may be archived for long term historical preservation.

The following rights apply to the personal data collected in this notice. Please contact dpofficer@bnu.ac.uk  if you wish to exercise your rights:

• Right of access to confirmation of processing and copies of your personal data
• Right to rectification if personal data we hold about you is incorrect
• Right to restrict processing of your personal data
• Right to complain to the Information Commissioner’s Office about how we handle your data.

In some circumstances you also have the following rights:

• Right to object to our processing of your personal data
• Right to request erasure of your personal data (deletion)
• Right to data portability.

If you have any concerns with regards to the way your personal data is being processed or have a query about this Notice, you can contact the BNU Data Protection Officer directly by e-mail dpofficer@bnu.ac.uk or by post.

Data Protection Officer

Buckinghamshire New University
Queen Alexandra Road
High Wycombe
Buckinghamshire HP11 2JZ

If you remain unhappy with any aspect of the way your personal data is being processed then we ask that you discuss this with us first, however if you remain dissatisfied then you have the right to complain to the Information Commissioners Office:  

Information Commissioner’s Office

Wycliffe House
Water Lane
Wilmslow
Cheshire  SK9 5AF

https://ico.org.uk

BNU is registered as a controller with the Information Commissioner’s Office. Our registration number is: Z772474X 

This privacy notice will be reviewed on an annual basis or revised more frequently if necessary.  

This notice was last reviewed on 05 November 2025.