This privacy notice explains when and why we collect personal information about you when you use Buckinghamshire New University Counselling and Wellbeing services and how we will use this information including the ways we might share this with others. It also explains how we keep your information secure and the rights you have in relation to the information we hold about you.

We collect and use your information for the following purposes as part of the counselling and wellbeing service. 

Counselling 

Purpose 1: to enable us to meet our commitments to you in providing a confidential counselling service.

We collect and use your information to:

• record your contact with us and keep a summary record of information shared by you, by session, in order to provide an ethical counselling service.

Purpose 2: to evaluate the service provided. 

We collect and use your information to: 

• enable us to evaluate the service provided to you when you attend for an assessment appointment and you complete an evaluation form. 

Wellbeing 

Purpose 3:  to support applications for extensions or special circumstances with respect of coursework, examinations, dissertations or theses.

We collect and use your information to:

• ensure that during episodes of poor health or wellbeing you are properly supported, either for the duration of your challenge(s) or your total study period.

Purpose 4: Protecting your (or another’s) vital interests. 

We collect and use your information:

• when we record concern expressed about yourself by a third party and 
• to provide information to protect your interests or that of another person (as necessary).

Purpose 5: To share and/or discuss your personal information with a third party.

We collect and use your information to:

• enable us to discuss your personal situation with trusted third parties i.e. parent, guardian, carer or spouse, GP or another Health Professional, etc.

To process your personal data, the University must have a basis in data protection law. We will broadly rely on:

Contract Article 6 (1)(b). The Purpose is necessary for the performance of a contract with you or to take steps, at your request, before entering into such a contract. This is the contract between the University Counselling Service and its students. This legal basis will be used to achieve the following purposes: 

• Purpose 1: To enable us to meet our commitments to you in providing a confidential counselling service.
• Purpose 3: To support applications for extensions or special circumstances with respect of coursework, examinations, dissertations or theses. 

Consent Article 6 (1)(a). The Purpose is necessary to enable us to evaluate the service provided to you about the counselling services provided by Buckinghamshire New University when you have attended a counselling session. This legal basis will be used to achieve the following purposes: 

• Purpose 2: To evaluate the service provided.
• Purpose 5: To share and/or discuss your personal information with a third party. 

Vital Interests Article 6 (1)(d). The processing is necessary to protect the vital interests of yourself or another person (or persons). This legal basis will be used to achieve the following purposes: 

• Purpose 4: Protecting your (or another’s) vital interests

Special Category Data 

The data being used includes special category data. Our legal reasons for using this special category data, where you provide it to us, is as follows: 

The nature of counselling is such that a student will reveal, and the University will process, such sensitive data as is necessary. This data usually concerns the student themselves, but it may also concern a third party such as a family member. The University will process sensitive data under the additional Lawful Basis of Substantial Public Interest (Schedule 1, Part 2, Paragraph 8 of the DPA 2018- Equality of opportunity or treatment) in that the counselling and wellbeing services provided, would not be viable without collecting, using and storing such sensitive data.

Data collected during counselling or wellbeing will be used for the purposes of recording sessions and conducting follow up activities as necessary. Personal data may also be provided by third party as necessary with the Consent of the individual.

The personal information we collect includes:

• personal contact details, including address, email, and telephone numbers
• age
• third Party contact details including address, email and telephone numbers

We also ask for some ‘special category data’. This is personal information which is more sensitive. We will ask you about:

• sexual orientation and sex life
• health which may include mental and physical health conditions, diagnoses, symptoms, and treatment
• racial or ethnic origin
• religious or philosophical beliefs

Most of the information above will have been provided by you and will have been collected through the counselling and wellbeing reporting process. Other information may be added to a report as it is provided by third parties or is ascertained during the process itself.

The above lists are not exhaustive but are indicative of the main types of personal information processed by the University about you should you attend a counselling and/or wellbeing session.

Your personal information will be shared with the organisations listed below. Any information will be disclosed in accordance with the provisions and obligations of the Data Protection Act. Please note this is not an exhaustive list and your data may also be shared in accordance with the wider university privacy notices which can be accessed at Data Protection page. 

University Staff: We may share your data with other university staff i.e. Wellbeing Advisers, Student Advisers, Student Support Officers, Personal Tutors, Senior Tutors, Student Disability & Inclusion Services, Safeguarding Officers, Student Counselling Service, the Chaplaincy, Dean of Students.

Third Party Services: We may share your data if we believe you or a third party are in serious danger, we may share information with the appropriate services e.g. your GP, Student Support teams, NHS services, Police and other emergency contacts.

Third Party Individuals : We may share your data with third party individuals such as non-emergency discussions of your support with your parent, guardian, carer or spouse, etc. (This list of third-party individuals is not exhaustive, and your data will only be shared with your consent). 

External Health Provider: We may share your data with an external health provider such as non-emergency discussions of your support with your GP or healthcare practitioner which will only take place with your consent.

External Counselling Services : We may share your data with external counselling services such as Buckinghamshire Mind.

Professional Bodies: We may share your data with professional bodies as part of their audit and regulatory process.

Third Party Software Suppliers: Limited personal data will, or may, be shared with contracted third parties to enable the provision of services for the purpose of maintaining counselling and wellbeing records. This includes: 

• Microsoft 365 software including email, Teams and other Microsoft 365 systems. 

Other systems suppliers who provide software services to and on behalf of the University. In all cases, data will only be shared in accordance with data protection legislation.

We may transfer your personal data outside the UK in the following circumstances:

Where we use a cloud-based IT system to hold your data, and the data in the cloud is stored on servers located outside the UK in a country which is not subject to an adequacy decision. In these circumstances we safeguard your data through undertaking appropriate checks on the levels of security offered by the cloud provider and entering into a contract with them which applies protections of the same type and level required by data protection laws within the UK. 

Your data will be retained in accordance with the Records Retention Schedule; a summary of which can be accessed at the Policies and Strategies page.

The following rights apply to the personal data collected in this notice. Please contact dpofficer@bnu.ac.uk if you wish to exercise your rights: 

• Right of access to confirmation of processing and copies of your personal data
• Right to rectification if personal data we hold about you is incorrect
• Right to restrict processing of your personal data
• Right to complain to the Information Commissioner’s Office about how we handle your data. 

In some circumstances you also have the following rights: 

• Right to object to our processing of your personal data
• Right to request erasure of your personal data (deletion)
• Right to data portability

If you have any concerns with regards to the way your personal data is being processed or have a query about this Notice, you can contact the Data Protection Officer directly by e-mail dpofficer@bnu.ac.uk or by post. 

Data Protection Officer 
Buckinghamshire New University 
Queen Alexandra Road
High Wycombe 
Buckinghamshire 
HP11 2JZ 

If you remain unhappy then you have the right to complain to the Information Commissioner's Office: 

Information Commissioner’s Office 
Wycliffe House 
Water Lane 
Wilmslow
Cheshire
SK9 5AF 

https://ico.org.uk/

BNU is registered as a controller with the Information Commissioner’s Office. Our registration number is: Z772474X

This privacy notice will be reviewed on an annual basis or revised more frequently if necessary. 

This notice was last reviewed on 27 January 2026.