Privacy notice for students
Privacy notice for students
This Privacy Notice provides essential information about how Buckinghamshire New University (BNU or the University) handles your personal data and the rights you have in relation to how we use your data.
BNU is a registered data controller and is responsible for looking after the personal data that you provide to us. We are committed to complying with the data protection principles set out in the Data Protection Act 2018 in a clear and transparent way.
If you have any concerns with regards to the way your personal data is being processed or have a query with regard to this Notice, please contact the Data Protection Officer at dpofficer@bnu.ac.uk
This privacy notice explains when and why we collect personal information about you while you are a student at BNU and how we will use this information including the ways we might share this with others. It also explains how we keep your information secure and the rights you have in relation to the information we hold about you.
We also have separate Privacy Notices relating to the admissions and the enrolment process. These along with all the BNU Privacy Notices can be accessed here.
We collect and use your information for the following purposes.
Purpose 1: Provision of academic courses and programmes.
We collect and use your information to:
- maintain student records (to ensure we have the correct data for current students)
- provide core teaching, learning and support services (e.g. enrolment, attendance, managing progression, academic misconduct investigations, assessment, certification and graduation)
- enable the provision of teaching and learning, on campus and/or using Virtual Learning Environments (VLEs), which may include the recording of teaching sessions
- monitor your attendance at classes (lectures, tutorials, supervisory meetings, lab sessions or other teaching sessions), your use of learning resources, your submission of work and your contact with academic staff, including your personal tutor and any research supervisor.
- mark and assess your work
- provide information to you about your predicted and actual grades and performance / attainment
- supervise, conduct assessments and examinations, confer BNU awards; and provide awarding bodies with assessment results and any other information required to enable them to confer awards
- produce student ID cards
- register your details with relevant professional bodies if the course of study you are enrolled on is accredited
- seek your feedback on your academic experience in order to maintain and improve the quality of our courses and teaching activities and take decisions as to the nature and content of the programmes we will provide to students in the future
- meet the requirements of our regulator, the Office for Students (OfS) we will process information about your academic progress and performance. We use this data to plan and execute activity to monitor and enhance the quality of our provision and support our Access and Participation Plan as required by the OfS
- provide you with certificates and transcripts.
- consider applications for mitigating circumstances which may be affecting your academic performance, in particular your ability to meet deadlines for submission of assignments or other course requirements.
Purpose 2: Provision of support services.
BNU provides a range of student support services and will process your data to administer these services. We collect and use your information to:
- provide general support services including personal academic support and pastoral care
- provide additional support services for those who wish to receive it, including disability services and any reasonable adjustments required under Equalities legislation
- provide support services for vulnerable and priority groups including care experienced students, estranged students and student carers
- provide counselling and other support in respect of wellbeing issues and mental health or distress
- provide advice and support to you, including careers guidance and information about educational programmes and services
- provide safeguarding services. BNU is required to safeguard the wellbeing and safety of its students, staff and stakeholders and may process you personal data where necessary in accordance with our Safeguarding Policy
- to protect your vital interests e.g., in an emergency situation
- complete occupational health checks for courses that require you to undertake a placement in a healthcare or clinical setting
- fulfil statutory obligations related to disability, protected characteristics, and other priority groups.
Purpose 3: Completing immigration checks and providing immigration advice and support.
We collect and use your information to:
- provide support and assistance to you if you are an international student and have received an offer from BNU or are an existing international student, with regard to your immigration status and visa applications
- fulfil our sponsor duties for those students studying with us on a UKVI Student Route Visa for example, we are required to report to UKVI on matters which may affect your visa status. This includes any interruption of your studies, change in course, withdrawal from the course or early completion.
Purpose 4: Administration of funding and fees.
We collect and use your information to:
- identify your fee status
- administer and collect payment of course fees from you, or your sponsor
- assist you with, and contact you about your entitlement to financial support, bursaries, scholarships and discretionary funds and make arrangements for the payment of these to you in the event you are successful. If you apply for additional financial support, you will usually do this using the Aspire Portal
- administer and collect payments for use of university resources and over payment of any student support funds.
Purpose 5: Provision of IT and Library services.
We collect and use your information in the course of providing, maintaining and protecting the IT systems and network to:
- provide access to library, IT and information services (for example, access to email, Virtual Learning Environment (VLE) and library services)
- complete a registration process so that we can use multi-factor authentication for access to systems and networks and operate a process whereby you are required to regularly re-set your IT password using an automatic password re-set service (SSPR)
- enable us to provide an IT support service to you. To do this IT Support staff may access you data to verify your identity and respond to any requests for support that you make This may include accessing your university issued email or IT account, following prior notification to you that this is necessary, and collecting information from you about you the nature of your support request
- monitor usage of IT systems which may include accessing information that is normally private. Any institutional monitoring or access will comply with UK legislation and be justifiable, fair and proportionate. Such activity will be conducted in line with the University’s policy on monitoring computer and network use
- for the purposes of security and the prevention and detection of crime we will use CCTV to monitor and collect visual images. More information on how your personal information is used in CCTV systems is available in our CCTV Privacy Notice.
Purpose 6: Completing statutory returns and statistical analysis.
We collect and use your information to:
- complete statutory returns to external bodies such as the Higher Education Statistical Agency (HESA) and the Office for Students (OfS).
- evaluate courses, outcomes and student experience
- help us maintain, develop and improve the quality of our courses, our teaching and supervision activities and related policies.
- meet our regulatory requirement to carry out surveys or evaluations
- provide overall feedback to the staff who manage and deliver a course, with a view to securing appropriate improvements to the course and its delivery
- for other administrative purposes, including carrying out internal statistical analysis for academic standards, student support, quality assurance and enhancement, business management and improvement purposes.
Purpose 7: Maintaining academic standards.
BNU has policies, procedures and guidance which set the rules concerning the delivery of learning and teaching activities and the conduct of university staff and students. We will deal with appeals, complaints, and disciplinary matters promptly and fairly, to do this we collect and use your information to:
- investigate if we have reason to think you may have acted in a fashion not in keeping with our rules, regulations, or policies
- follow our Fitness to Practice processes if your course of study is subject to additional conduct
- follow our policy on academic appeals, student complaints, academic integrity and academic misconduct.
Purpose 8: Criminal records information and disclosure and barring checks.
For courses that require you to undertake a placement in a healthcare or clinical setting or work with vulnerable individuals we collect and use your information to:
- carry out DBS checks to make sure that you are not barred from this type of work
- assess your suitability for your chosen course and professional qualification
- assess your ability to meet the course requirements to complete work placements in a regulated professional environment.
Purpose 9: To manage work placements and exchange programs.
For courses that involve undertaking a work placement is part of a student exchange programme or includes working on a project that is delivered t a third-party customer we collect and use you information to:
- arrange the placement, exchange programme or third-party project
- monitor and assess your attendance and other activities
- undertake occupational health assessments if your placement is withing a health and social care setting.
Purpose 10: Provision of accommodation service and access to other university facilities
We collect and use your information to:
- provide accommodation services to you
- investigate if we have reason to suspect that you have broken accommodation rules or if we receive a complaint about your conduct in University provided accommodation.
Purpose 11: Providing access to the BNU Alumni Network.
BNU graduates are automatically enrolled in the Alumni Network – you can opt put by emailing alumni@bnu.ac.uk . Additional information on how the Alumni team use your data is provided in the Alumni Privacy Notice. We collect and use your information to:
- keep you informed of alumni activities through the publication of the University magazine
- provide information on benefits and services available to BNU Alumni.
Purpose 12: Communicating with students.
We collect and use your information to:
- communicate with you about your academic work
- communicate with you about matters relevant to your studies, student support and graduation
- provide details on administrative arrangements such as arrangements for examinations and submission of assignments
- contact you about university activities and wider opportunities that may be of interest.
- if you have signed up to a specific service such as the gym the relevant team will send you communications as necessary for the provision and administration of the service you have signed up for
- contact you about any matters affecting the BNU campuses and information about facilities and events.
Purpose 13: To comply with auditing requirements.
The data we hold about you may be viewed by BNU staff carrying out internal audits or by staff of external companies or organisations carrying out external audit on our operations. We collect and use your information to:
- perform audit activities to ensure that we are complying with our documented processes
- perform audit activities to ensure that we comply with legal or regulatory requirements.
To process your personal data, the University must have a basis in data protection law. We will broadly rely on:
Contract Article 6 (1)(b). ThePurpose is necessary for the performance of a contract with you or to take steps, at your request, before entering into such a contract. This is the contract between the University and its students research staff and other parties to provide educational and other products and/or services and ensuring you can take part in key aspects of your course.
This legal basis will be used to achieve the following purposes:
- Purpose 10: Provision of accommodation service and access to other university facilities
- Purpose 12: Communicating with students.
Legal Obligation Article 6 (1)(c). The processing is necessary for compliance with a legal obligation. This includes the return of statistical data and reports to satisfy various agencies that the University’s academic standards and funding arrangements are sufficient, and our obligations are being met.
This legal basis will be used to achieve the following purposes:
- Purpose 3: Completing immigration checks and providing immigration advice and support
- Purpose 4: Administration of funding and fees
- Purpose 6: Completing statutory returns and statistical analysis
- Purpose 8: Criminal records information and disclosure and barring checks
Public Task Article 6 (1)(e). BNU will process your personal data to carry out a task or activity that is within our core purpose as a statutory higher education corporation, to deliver higher education and carry out research. This includes:
- Purpose 1: Provision of academic courses and programmes
- Purpose 2: Provision of support services for academic courses and programmes
- Purpose 5: Provision of IT and Library services
- Purpose 7: Maintaining academic standards
- Purpose 9: To manage work placements and exchange programs
- Purpose 13: To comply with auditing requirements
Legitimate Interest Article 6 (1)(f). The processing is necessary for legitimate interests of the University i.e. enabling access to all services and facilities available to you as a higher education student and ensuring a safe environment.
This legal basis will be used to achieve the following purposes:
- Purpose 11: Providing access to the BNU Alumni Network
Special Category Data
The data being used includes special category data. Our legal reasons for using this special category data, where you provide it to us, are:
Purpose 2: Provision of support services for academic courses and programmes.
As part of your enrolment you may disclose sensitive personal data. Processing is necessary for reasons of substantial public interest, Article 9 (2)(g). This data will be used for the purposes of support and protection as required under the university’s statutory obligations as enacted in the Further & Higher Education Act 1992, Safeguarding Vulnerable Groups Act 2006 and Equality Act 2010. The processing may also be required for the purposes of employment law or assessing the work capabilities of individuals (including working on placement or in practical elements of study).
Purpose 6: Completing statutory returns and statistical analysis.
BNU will provide special category data to the Higher Education Statistics Agency (HESA). We share data on the basis that it is necessary for reasons of substantial public interest on the basis of law, Article 9 (2)(g) as required by the Further & Higher Education Act 1992.
Purpose 7: Maintaining academic standards.
To carry out investigations in accordance with academic and misconduct regulations and to ensure that we deal with matters promptly and fairly we will consider all information available to us. This may include special category data which will be processed for reasons of substantial public interest Article 9 (2)(g).
Purpose 8: Criminal records information and disclosure and barring checks.
BNU is required to conduct a Disclosure and Barring Service (DBS) and other safeguarding checks for some of its courses to protect the public. The university is required to process special category and criminal convictions data as it has a legal obligation, Article 9 (2)(c), to undertake such checks and protect the public.
Our legal basis for processing any criminal data disclosed by on a DBS check is for reasons of substantial public interest to meet the university’s statutory requirement to fulfil its duties under the Safeguarding Vulnerable Groups Act 2006. BNU also has a requirement to ensure that students meet the regulatory standards for professional study and practice as set by the relevant professional body.
Purpose 9: To manage work placements and exchange programs.
If required to carry out occupational health assessments for placement students. if your placement is within a health and social care setting. Processing is necessary for the purposes of preventative or occupational medicine, Article 9 (2)(h).
The personal information we collect about you while you are studying at BNU:
- personal contact details including address, email, and telephone numbers and other information collected when you enquire about BNU courses and services, when you apply and when you enrol
- date of birth and National Insurance Number (or other tax identification number).
- identification documents such as copies of passports or other national identity card details
- for International students copies of passports, visas and any other documents required to ensure compliance with Home Office requirements as well as biometric data for attendance purposes
- equalities monitoring information
- photographs, and video recordings including lecture capture, student assessment and examinations
- information about academic attendance, progression and performance
- information related to the prevention and detection of crime and the safety and security of staff and students, including, but not limited to, CCTV recording and data relating to breaches of University regulations
- information relating to the provision of advice, support and welfare.
The information above may include ‘special category data’. This is personal information which is more sensitive as defined by the Data Protection Act 2018.
Most of the information above will have been provided by you and will have been collected through your original application to BNU, through the online enrolment process, when you enquire about our services in person, on the phone or by email and through the work undertaken on your course. Other information may be added to your student record when you provide it throughout your student life.
Information about you may have been collected from or via UCAS this includes information you provide in your UCAS application and other information generated through the UCAS admissions cycle.
Some information, such as references, will have been provided by named contacts that you have given to the University.
Other information may be collected from other third parties such as organisations providing funding or financing for your course e.g. the Student Loans Company or any organisations or companies providing you with individual sponsorship or other financial support, agents representing you in the admissions process, organisations which provide work placements and (where relevant) the Home Office in relation to visas and immigration.
Your data will, or may be shared with the following recipients:
| Disclosure to | Details |
| Central and Local Government Departments | We may share your data with the following public bodies to fulfil our statutory or legal obligations related to, for example, immigration, council tax and electoral registration:
|
| Police and Enforcement Agencies | We may provide data on request to the police and other enforcement agencies in emergencies or where crime detection or prevention can be aided by its release, for example, responding to information requests from individual police forces or UKVI. |
| Regulatory Bodies | The University may be required to provide data to organisations like the OfS, HESA, the University and Colleges Admissions Service (UCAS) or to other bodies acting on their behalf for regulatory, research and monitoring purposes. Examples of this include:
|
| Higher Education Statistics Agency (HESA) | It is a statutory requirement for the University to send some of the information we hold about you to HESA every year. HESA is the official source of data about UK universities and higher education colleges www.hesa.ac.uk. Some of the data we send to HESA will be passed to other statutory bodies involved with the funding of education. Further information on how your Student Record may be used by HESA can be found at www.hesa.ac.uk/collection-notices. |
| Financial Organisations | We will share your data with the Student Loans Company (SLC). If necessary we will also release data to parties involved in the recovery of debts to the University. |
| Professional Bodies | If you are enrolled on a course which is accredited by a professional body, we may share your name, email address and course information with the appropriate professional body in order to register you with that professional body. |
| Awarding Bodies | If you are enrolled on a course validated or awarded by an external body we may share your personal data with these bodies for the purposes of the awarding/validation relationship. |
| External Examiners | We may use the services of external examiners to examine or moderate your work. |
| Study Visits and Exchanges | If you are on a course that requires spending a period of time at another institution, including at an HEI abroad or if you have come to BNU as a visiting or exchange student, we may need to share information about you with the other institutions involved in the exchange. This will be done for the administration of the visit, exchange or study abroad, and so that the other institution can carry out its duties in regard to your studies. Special category personal data relating to your health or a disability will not be shared without your express consent unless required by law or in your vital interests in an emergency situation. |
| Sponsors | Where you are sponsored by, for example, your employer or embassy or the NHS, the University will provide details of attendance and attainment to the sponsor on request. |
| Third Party Software Suppliers | Limited personal data will, or may, be shared with contracted third parties to enable the provision of services for the purpose of teaching, learning and administrative support and IT provisioning. This includes:
|
| Friends, Family and Third Parties | The University will not release data to any unauthorised third-party except where you ask us to. This means that we will not release your personal data to banks, parents, guardians, relatives or friends without your agreement. If you have provided us with a nominated contact in the event of a medical problem or emergency then some personal data may be provided. We will always endeavour to obtain your consent before sharing this information unless we believe it is in your vital interests, or the vital interests of another, to do so. |
We may transfer you personal data outside the UK in the following circumstances:
Where we use a cloud-based IT system to hold your data, and the data in the cloud is stored on servers located outside the UK in a country which is not subject to an adequacy decision. In these circumstances we safeguard your data through undertaking appropriate checks on the levels of security offered by the cloud provider and entering into a contract with them which applies protections of the same type and level required by data protection laws within the UK.
Your data will be retained or six years after the end of the academic year in which you studied the course you have enrolled for. Further information on retention is available in the Records Lifecycle Management Scheme.
The following rights apply to the personal data collected in this notice. Please contact dpofficer@bnu.ac.uk if you wish to exercise your rights:
- Right of access to confirmation of processing and copies of your personal data
- Right to rectification if personal data we hold about you is incorrect
- Right to restrict processing of your personal data
- Right to complain to the Information Commissioner’s Office about how we handle your data.
In some circumstances you also have the following rights:
- Right to object to our processing of your personal data
- Right to request erasure of your personal data (deletion)
- Right to data portability
If you have any concerns with regards to the way your personal data is being processed or have a query about this Notice, you can contact the Data Protection Officer directly by e-mail dpofficer@bnu.ac.uk or by post.
Data Protection Officer
Buckinghamshire New University
Queen Alexandra Road
High Wycombe
Buckinghamshire
HP11 2JZ
If you remain unhappy with any aspect of the way your personal data is being processed then we ask that you discuss this with us first, however if you remain dissatisfied then you have the right to complain to the Information Commissioners Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
BNU is registered as a controller with the Information Commissioner’s Office. Our registration number is: Z772474X.
This privacy notice will be reviewed on an annual basis or revised more frequently if necessary.
This notice was last reviewed on 15 August 2023.