This privacy notice outlines what you can expect when Buckinghamshire New University collects your information, if you are either a current employee or if you have a temporary or ongoing relationship with the University but are not registered as a member of staff or student (e.g., a visiting fellow or emeritus professor).

We collect and use your information for the following purposes:

Purpose 1: Employee lifecycle management.

We collect and use you information for:

• recruitment purposes
• contract management 
• job changes 
• end of contract purposes

Purpose 2: Leave and absence management.

We collect and use you information:

• to process leave requests 
• for absence management 
• for special leave administration.

Purpose 3: Training and development.

We collect and use you information:

• to maintain induction and training records 
• for performance monitoring and management 
• to maintain employee development records.

Purpose 4: Reporting and audit. 

We collect and use your information for statutory reporting purposes and to meet our internal and external audit obligations. This includes:

• submission of data to Office for National Statistics (ONS) and other organisations where required by law 
• to support internal management decision making 
• responding to requests under legal obligations such as FOI 
• Union facility time monitoring and reporting 
• reporting to national bodies including on the Research Excellence Framework (REF) 
• use of data for auditing purposes.

Purpose 5: Payroll and pension administration.

We collect and use you information:

• for payroll administration, including staff remuneration as dictated by their contract. 
• to decide your eligibility for a workplace pension and whether you are to be auto enrolled. 
• to enrol you on a workplace pension (auto or voluntary enrolment) 
• to process pension, opt-outs or changes 
• provide relevant data to pension providers to assist them with any queries, or instructions they receive from you 
• contribute to the determination of your eligibility, and calculation of the benefits, for various provisions in the scheme, as required.

Purpose 6: Grievances and disciplinary procedures.

We collect and use you information:

• To investigate complaints or suspicions that any practice or conduct does not meet the standards of employment or professional expectations or requirements.

Purpose 7: Occupational health.

We collect and use you information:

• To make referrals to Occupational Health service.

Purpose 8: Equalities monitoring and reporting.

We collect and use you information:

• To encourage, enhance and monitor equality of opportunity and treatment 
• To create and assess such reports as are required for that function (such as: mainstreaming equalities report as required by the Equalities and Human Rights Commission and equalities reporting duty in the Funding Council Staffing return) 
• To take steps to encourage and monitor equality.

Acceptance of the terms of this notice is a condition of your contract of employment.

The legal bases that we use in order to legally process the information you provide to us:

Contract Article 6 (1)(b). The Purpose is necessary for the performance of a contract with you or to take steps, at your request, before entering such a contract. This is the contract between the University and you as a member of its staff or if you have a temporary or ongoing relationship with the University but are not registered as a member of staff or student (e.g., a visiting fellow or emeritus professor).

• Purpose 1: Employee lifecycle management
• Purpose 2: Leave and absence monitoring
• Purpose 3: Training and development
• Purpose 5: Payroll and pension administration
• Purpose 6: Grievances and disciplinary procedures
• Purpose 7: Occupational health

Public Task Article 6 (1)(e).  BNU will process your personal data as use is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

• Purpose 4: Reporting and audit

Legal Obligation Article 6 (1)(c). The processing is necessary for compliance with a legal obligation. This includes the return of statistical data and reports to satisfy various agencies that the University’s academic standards and funding arrangements are sufficient, and our obligations are being met.

This legal basis will be used to achieve the following purposes:

• Purpose 8: Equalities monitoring and reporting

Special Category Data

The data being used includes special category data. Our legal reasons for using this special category data, where you provide it to us, are:

Purpose 1: Employee lifecycle

Purpose 2: Leave and absence monitoring

Purpose 4: Reporting and audit

Purpose 6: Grievances and disciplinary procedures

Where use is necessary for compliance with employment law.  This data will be used for compliance with social protection law, in this case the Equality Act 2010.  We produce reports based on anonymised data to demonstrate, and allow meaningful investigation of, our compliance with the Equality Act 2010.

Purpose 5: Payroll and Pensions

Where use is necessary for compliance with employment law that being the BNUs obligations under the Pensions Acts 2014 and 2017.

Purpose 7: Occupational Health

Where use is necessary for compliance with: employment law, health and safety law and other associated regulations such as RIDDOR etc.

In order to carry out its duties as an employer, the University must collect and process data relating to its staff. A record relating to your employment will be held by the Human Resources Directorate. Information about your employment may also be kept by individual departments. Data held about you may include, but is not restricted to, the following:

• application forms
• personal details such as name, date of birth, contact details, National Insurance number and next-of-kin information
• visa details and copies of passports
• bank or building society account details
• salary, grade and superannuation details
• sensitive personal data (e.g., for equality and diversity monitoring)
• data held on staff organograms
• records concerning appraisal, training and the HERA role-analysis programme
• sickness and other absence details
• proceedings relating to promotions
• contracts or terms and conditions of employment
• correspondence between the member of staff and the University
• correspondence between University and third parties on behalf of a member of staff (e.g. employment references)
• records of grievances
• investigations into breaches of terms and conditions of employment
• records of disciplinary proceedings.

We ask you to declare your ethnic origin and any disabilities at the time of your application for a post. These fall within the definition of sensitive personal data. If you choose to provide such data, you give your consent for the University to use them, in an aggregated form, for statistical purposes.

Your HR file may also contain sensitive personal data in relation to health or sickness, maternity leave or paternity leave. These records will be kept in strict confidence and will not be released to third parties without your explicit consent.

Personal data about employees is normally provided to the University by a prospective member of staff on an application form and is added to by the University over the course of their employment. Personal data may also be received by the University from partner institutions in the form of CVs and applications from partner college staff.

The University may disclose certain personal data to external bodies as categorised below where we have a legitimate reason to use that data or where the University is under a legal requirement to do so. Information will be disclosed in accordance with the provisions and obligations of the Data Protection Act. Please note this is not an exhaustive list.

The University will not release data to any unauthorised third person except where you ask us to. This means that we will not release data to banks, friends, relatives etc., without your agreement. If you wish us to provide data in these circumstances, you should provide us with written consent to release the data.

The University may need to make other disclosures of your personal information without your consent, but any such disclosures will be made with due consideration of your rights, in accordance with the obligations imposed on the University by the Data Protection Act and other relevant legislation.

We may transfer you personal data outside the UK in the following circumstances:

Where we use a cloud-based IT system to hold your data, and the data in the cloud is stored on servers located outside the UK in a country which is not subject to an adequacy decision. In these circumstances we safeguard your data through undertaking appropriate checks on the levels of security offered by the cloud provider and entering into a contract with them which applies protections of the same type and level required by data protection laws within the UK.

We will keep your personal data for only as long as is necessary for the purposes for which it was collected. Information about staff is retained and disposed of in accordance with the University’s records retention schedules, which are detailed in the Records Lifecycle Management Scheme. Some information may be archived for long term historical preservation. Data will be securely destroyed when no longer required.

The following rights apply to the personal data collected in this notice. Please contact dpofficer@bnu.ac.uk  if you wish to exercise your rights:

• Right of access to confirmation of processing and copies of your personal data
• Right to rectification if personal data we hold about you is incorrect
• Right to restrict processing of your personal data
• Right to complain to the Information Commissioner’s Office about how we handle your data.

In some circumstances you also have the following rights:

• Right to object to our processing of your personal data
• Right to request erasure of your personal data (deletion)
• Right to data portability.

If you have any concerns with regards to the way your personal data is being processed or have a query about this Notice, you can contact the Data Protection Officer directly by e-mail dpofficer@bnu.ac.uk or by post.

Data Protection Officer

Buckinghamshire New University

Queen Alexandra Road

High Wycombe

Buckinghamshire HP11 2JZ

If you remain unhappy with any aspect of the way your personal data is being processed then we ask that you discuss this with us first, however if you remain dissatisfied then you have the right to complain to the Information Commissioners Office:  

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire  SK9 5AF

https://ico.org.uk

BNU is registered as a controller with the Information Commissioner’s Office. Our registration number is: Z772474X 

This privacy notice will be reviewed on an annual basis or revised more frequently if necessary.  

This notice was last reviewed on 05 September 2023.