This privacy notice explains when and why we collect personal information about you when you either make an enquiry or contact BNU and how we will use this information including the ways we might share this with others.  It also explains how we keep your information secure and the rights you have in relation to the information we hold about you. 

Data collected when you make an enquiry or contact BNU will be used to enable us to contact you in response to your enquiry or contact made with us.  We will not use your personal information to provide you with marketing information unless we have received your specific consent to do so. 

We collect and use your information for the following purposes: 

Purpose 1: Manage course or other general enquiries. 

We collect and use your information: 

• to record and progress your request 
• to correspond with you
• to seek clarification (if required)
• to locate, retrieve, and return the requested information. 

Purpose 2: Manage Data Subject Access Requests (DSAR) 

We collect and use your information:

• to record and progress your request
• to correspond with you
• to seek clarification (if required)
• to locate, retrieve, and return the requested information 
• to verify your identity (if required). Depending on the nature of our relationship with you, ID may be required to ensure that personal data is only released to the correct person. 

Purpose 3: Manage Freedom of Information Act 2000 (FOIA) and Environmental Information Regulation (EIR) requests.

We collect and use your information:

• to record and progress your request
• to correspond with you
• to seek clarification (if required)
• to locate, retrieve, and return the requested information 
• to verify your identity (if required): Depending on the nature of our relationship with you, ID may be required to ensure that personal data is only released to the correct person.   The requestor name must be provided for an FOIA request to be valid under section 8(1)(b). If we suspect that a pseudonym is being used, we may request a copy of your ID to verify that the request is valid. 

Purpose 4: Manage complaints 

We collect and use your information:

• to record and progress your request
• to correspond with you
• to seek clarification (if required)
• to locate, retrieve, and return the requested information.

The legal bases that we use in order to legally process the information you provide to us is:

Consent Article 6 (1)(a). Our legal reason for using the data is that you have given us your consent by providing your contact details. If you were to withhold the personal information, we would be unable to fulfil your enquiry or request. You have the right to withdraw your consent at any time by emailing dpo@bucks.ac.uk

• Purpose 1: Manage course or general enquiries

Legal Obligation Article 6 (1)(c). Our lawful basis for processing is to comply with a legal obligation to respond and satisfy requests received under the Data Protection Act 2018 (DPA 2018), the retained UK General Data Protection Regulations (UK GDPR), the Freedom of Information Act 2000, the Environmental Information Regulations 2004 and the Parliamentary Commissioner Act 1967, as since amended.

• Purpose 2: Manage Data Subject Requests
• Purpose 3: Manage Freedom of Information Act (FOIA) and Environmental Information Regulation (EIR) requests
• Purpose 4: Manage complaints

Special Category Data

The data being used includes special category data. Our legal reasons for using this special category data, where you provide it to us, are:

Purpose 1: Manage course or general enquiries

Our additional lawful basis for processing this information is your explicit consent, Article 9 (2)(a), if you choose to share sensitive personal data with us as part of your submitted enquiry. You have the right to withdraw your consent in relation to this processing by using the contact email address above.

If you share health data with us to request reasonable adjustments or equality of access, for example prior to visiting our campus, then our lawful basis for processing this data is for reasons of substantial public interest, Article 9 (2)(g), to promote equality of opportunity or treatment, referring to the Equalities Act 2010 as a basis in law.

Purpose 2: Manage Data Subject Requests

Purpose 3: Manage Freedom of Information Act (FOIA) and Environmental Information Regulation (EIR) requests

Purpose 4: Manage complaints

Our additional lawful basis for processing special category data is your explicit consent, Article 9 (2)(a), if you choose to share sensitive personal data with us as part of your submitted enquiry. You have the right to withdraw your consent in relation to this processing by using the contact email address above.

Withholding personal information

If you were to withhold personal information, then we would be unable to fulfil your enquiry or request. Requests received under legislation such as FOIA, UK GDPR and the DPA 2018 may not be considered valid if you withhold your name, contact details and (in certain circumstances) proof of identity.

The personal data we normally require is your name, contact information (address, email address, mobile telephone number), student ID number and date of birth.

We collect and hold information provided by you through enquiry or information request forms, email communications, telephone calls, event booking forms, event evaluation forms and your attendance at events.  Further information relating to you is then generated through our responses to your enquiries or bookings.

Your personal information will be shared with the organisations listed below. Any information will be disclosed in accordance with the provisions and obligations of the Data Protection Act. Please note this is not an exhaustive list and your data may also be shared in accordance with the wider university privacy notices which can be accessed at https://www.bucks.ac.uk/data-protection 

Your data will be retained in the university Health and Safety records system in accordance with the Records Lifecycle Management Scheme; a summary of which can be accessed at https://bnu.ac.uk/policies.

The following rights apply to the personal data collected in this notice. Please contact dpofficer@bnu.ac.uk  if you wish to exercise your rights: 

• Right of access to confirmation of processing and copies of your personal data 
• Right to rectification if personal data we hold about you is incorrect 
• Right to restrict processing of your personal data 
• Right to complain to the Information Commissioner’s Office about how we handle your data. 

In some circumstances you also have the following rights: 

• Right to object to our processing of your personal data 
• Right to request erasure of your personal data (deletion) 
• Right to data portability

If you have any concerns with regards to the way your personal data is being processed or have a query about this Notice, you can contact the Data Protection Officer directly by email dpofficer@bnu.ac.uk or by post.

Data Protection Officer

Buckinghamshire New University

Queen Alexandra Road

High Wycombe

Buckinghamshire HP11 2JZ

If you remain unhappy with any aspect of the way your personal data is being processed then we ask that you discuss this with us first, however if you remain dissatisfied then you have the right to complain to the Information Commissioners Office:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

https://ico.org.uk

BNU is registered as a controller with the Information Commissioner’s Office. Our registration number is: Z772474X

This privacy notice will be reviewed on an annual basis or revised more frequently if necessary. 

This notice was last reviewed on 05 September 2023.