This privacy notice explains how your personal data, as a student enrolled on a subcontracted BU programme delivered by a partner institution, is collected, used, shared and protected.

1. Who are we?

The Partner Institution is your host institution for the delivery of the programme.
Bournemouth University Higher Education Corporation (BU) is the validating institution responsible for the academic standards and quality assurance of your programme. BU is located at Fern Barrow, Poole, Dorset, BH12 5BB, United Kingdom.

2. What data do we collect?

During your studies, the following personal data will be collected, processed, and shared between the Partner Institution and BU:

  • Personal identifiers: Title, name, date of birth, age, gender, nationality, country of domicile, passport or national insurance number, photograph and student ID numbers
  • Contact information: Email address, postal address, and telephone numbers
  • Academic records: Education history and employment information.  Application and enrolment details, attendance, coursework/exam submissions, assessment and any reassessment results, and academic transcripts, degree certifications and diploma supplement
  • Financial information: Information related to tuition fees, financial aid, or scholarships (if applicable)
  • Sensitive data: Criminal conviction information and special category data, such as disability information and health conditions (if necessary and with explicit consent)
  • Other information: Any other information required for academic administration, such as academic interests, progression and performance, personal or family circumstances, disciplinary and complaint records, academic appeals, exceptional circumstances, visa information (for international students), and other support services.

3. How we use your data

The Partner Institution and BU will process your personal data for the following purposes:

  • Admission: To manage your admission to the programme
  • Enrolment and registration: To manage your registration and academic records
  • Programme delivery: To provide the teaching, assessments, and relevant support services related to your programme
  • Quality assurance: For auditing purposes to ensure academic standards are met, including that entry requirements had been met. More detail on this processing is set out below (under Audit)
  • Communication: To send important updates related to your studies, exam notices, result letters and general student information
  • Complaints & discipline: If you are subject to a BU student disciplinary process, to process your data as required to complete this process
  • Certification: To issue certificates, degrees, and transcripts upon completion of your studies
  • Evaluating courses, outcomes and student experience: to seek your feedback on matters relating to your student experience on your programme, including both academic experiences and other matters such as your wider experience of student life at the Partner Institution. More detail on this processing is set out below (under Student experience)
  • Legal and regulatory compliance: To comply with local and international legal obligations, such as reporting to regulatory authorities.

Applications for exception/special consideration

We process information about requests from students for consideration of exceptional circumstances which may be affecting their academic performance, in particular their ability to meet deadlines for submission of assignments or other course requirements.

Where the reasons given for the request relate to health conditions or disability, we will be processing special category data. We will only process this as necessary for determining your request and implementing any special arrangements which are agreed.

Audit

Your data which is held within our administration systems may be viewed by BU staff carrying out internal audits or staff of external companies or organisations carrying out external audits of our operations, including checks that entry requirements have been met. They will process this data only for the purposes of auditing our compliance with BU processes and legal or regulatory requirements. They will not use your data to contact you or take any decisions relating to you as an individual.

Student experience

We may seek your feedback on matters relating to your student experience on your programme, including both academic experiences and other matters such as your wider experience of student life at the Partner Institution. These may be sent to you while you are still studying or after you leave. You are not required to participate in these surveys. We use your feedback to comply with our policies on programme monitoring and evaluation to maintain and improve the quality of programmes and teaching activities and take decisions as to the nature and content of the programmes offered in the future. Where relevant, your feedback is also used for other organisational development purposes e.g. to consider future approaches to providing support for students and to determine how to communicate with applicants/potential applicants and students in the future.

IT systems

We process your data in the course of providing, maintaining and protecting the IT systems and network which we use to hold, access and create the personal data relating to you which is covered by this privacy notice. Some of this processing will be carried out by third parties who provide those systems to us or provide technical support services to us. These include Tribal which provides the SITS (student records) system used for student records.

System development and maintenance

Where your personal data is held within BU IT systems it may be viewed or otherwise processed in the course of work to maintain, test or further develop the functionality or security of our systems. This processing may be done by BU staff or by third party suppliers of the relevant system or service providers. Access to these systems is limited to specific authorised professional BU IT or third-party staff as necessary for the purposes of their current responsibilities within their role at or for BU. This processing does not result in any communications with you or any decisions being taken which relate to you individually. BU is seeking to minimise the use of identifiable data for these purposes, and ensure that third parties carrying out this processing are subject to appropriate contractual requirements to maintain the confidentiality and security of your data.

Additional future reasons for processing

In addition to the original basis for processing your data as set out above, there may be situations where the basis for our processing changes over time due to developments in circumstances or in our relationship with you. We may then rely on a legal basis for processing which is not mentioned above. We may originally process your data on one basis, but then find that it is necessary to retain it and carry out further processing for other reasons even where the original basis no longer applies. For example, we may originally have collected and processed your data on the basis of consent or legitimate interests, but subsequently identify a need to process it for the purposes of managing a legal claim or process, or to protect the vital interests of you or another person. If at any point you have concerns or questions about the basis on which we are processing your data, please contact our Data Protection Officer.

4. Lawful basis for processing

The legal basis for processing your personal data includes:

  • Necessary for the performance of a task carried out in the public interest: BU’s core purpose as a statutory higher education corporation, to deliver higher education, alone or in collaboration with partner institutions
  • Performance of a contract: Processing your data is necessary to fulfil the education contract you have entered into with the Partner Institution and BU
  • Legal obligations: To comply with legal and regulatory requirements in the UK and your local jurisdiction
  • Legitimate interests: BU and the Partner Institution may process your data for legitimate interests, particularly those related to the efficient management and delivery of your academic programme and ensuring the appropriate and efficient financial operations and governance within BU
  • Consent: When processing is based on your explicit consent, where required.

Details about the nature and purpose of processing, as well as the specific lawful basis, can be found in the relevant sections of the BU Student Privacy Notice and Student Recruitment & Admissions Privacy Notice.

For example, under ‘Course Delivery & Education Services’ related to the management and delivery of your course (including core teaching and learning), the data processed for these purposes will include a range of information we collect from you and third parties, such as the Partner Institution, as well as data generated through your interactions with us. This may include, but is not limited to:

  • Contact information, education history, and employment details
  • Information regarding your course, study and learning activities, academic progression, and performance
  • Information about your engagement with your course
  • Data on your actual and expected academic progression, performance, and attainment
  • Submitted assignments, assessments, or examination papers
  • Evaluations, reviews, or assessments of your work, including marks and grades awarded
  • Arrangements for assessments and examinations
  • Details of assessments and examinations taken, including predicted and actual grades, and other information recorded in your student file
  • Any communications between you and BU academic or administrative staff, as well as internal communications between BU staff that relate to you individually. This may include information you provide regarding personal circumstances or factors affecting your academic engagement or progress.

5. Sharing your data

Your personal data will be shared between the Partner Institution and BU for the purposes outlined above. Additionally, data may be shared with:

Accreditation bodies: For external validation and accreditation of your programme
Government and regulatory bodies: As required for legal and reporting purposes
Third-party service providers: Who assist in the delivery of services such as IT support, financial processing, and data storage. These providers are subject to strict data protection obligations.

We will share personal data with emergency services and/or the person you have identified to us as being your next of kin or emergency contact, where this is necessary to safeguard your position or that of other individuals.

We will also share personal data with the police or other organisations with responsibility for investigating potential crimes such as fraud (e.g. local authority fraud investigation teams) where satisfied that this is necessary for the prevention or detection of crime.

This may include sharing special category data such as health information.

We will not share your data with any other third parties unless required or permitted by law or with your explicit consent.

6. International transfers

As BU is located in the UK, your personal data will be transferred between BU and the Partner Institution across international borders. BU and the Partner Institution will ensure that appropriate safeguards are in place to protect your data in accordance with UK GDPR requirements and other applicable data protection laws.

Data protection laws limit our ability to transfer personal data outside the countries within the UK and countries, such as the those within the European Economic Area, which are subject to an adequacy decision (Restricted Transfers) (i.e. the countries which are subject to the same or very similar data protection laws). This is to help ensure that a consistent level of data protection applies to your data at all stages of processing, and that you are not exposed to additional privacy risks through the transfer of your data. Restricted Transfers are only permitted in certain circumstances. Where such Restricted Transfers are necessary, BU ensures that we have appropriate safeguards in place.

There will be a Restricted Transfer of your personal data outside the UK in the following circumstances: 

  • Where BU transfers data to the Partner Institution and that Partner Institution is located in a country without an adequacy decision. In these circumstances, we safeguard your data by undertaking appropriate checks on the levels of security offered by the Partner Institution and enter into an appropriate agreement setting out the Partner Institution’s respective responsibilities. Such agreement will be based on the UK Information Commissioner’s International Data Transfer Agreement, the Addendum to the European Commissions’ standard contractual clauses or such other contractual agreement that is required by data protection legislation

  • Where BU uses a cloud-based IT system to hold your data, and the data in the cloud is stored on servers located outside the UK in a country which is not subject to an Adequacy Decision.  In these circumstances we safeguard your data through undertaking appropriate checks on the levels of security offered by the cloud provider and entering into a contract with them which applies protections of the same type and level required by data protection laws within the UK;

  • Where you are based outside the UK in a country which is not subject to an Adequacy Decision, and we need to send you emails or other communications which are necessary for the performance of our contract with you or for implementing pre-contractual measures which you have asked us to take (e.g. processing your application or enquiry). In these circumstances the data protection laws say that transfer is permitted; or

  • With your consent.

7. How long will we keep your data?

Your personal data will be retained for as long as is necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting obligations. Typically, this includes:

  • Academic records: Retained indefinitely for degree verification and alumni services (if applicable)
  • Other data: Retained for the duration of your programme and for a period, thereafter, as required by applicable laws or institutional policies.

In general, we apply the following principles to determine for how long we will keep your data: 

  • Much of the personal data we hold, including within your student files and in our Finance department, will be kept during the period of your programme and for several years after you finish your programme. We keep this data to enable us: 
  • to oversee the delivery of your programme by the Partner Institution efficiently and effectively and provide you with appropriate support during your programme;
  • to respond to queries or concerns you have about your experience on your programme during your time at the Partner Institution or afterwards, and to defend any legal claims brought against us; and 
  • to comply with legal and regulatory requirements as to accounting and audit
  • A small amount of data will be held indefinitely: this is the data that we need to hold so that we can confirm whether individuals attended the Partner Institution in collaboration with BU and the qualifications they obtained from BU. 

8. Your data protection rights

Under the UK General Data Protection Regulation (UK GDPR), you have the following rights regarding your personal data:

  • Right to Access: You can request a copy of the personal data we process about you and information about that processing
  • Right to Rectification: You can ask us to correct inaccurate or incomplete data
  • Right to Erasure: In certain circumstances, you can request the deletion of your personal data
  • Right to Restrict Processing: You can request that we limit the processing of your personal data
  • Right to Data Portability: You can request that your data be transferred to another institution
  • Right to Object: You have the right to object to the processing of your data in certain situations
  • Right to Withdraw Consent: If your data is being processed based on your consent, you may withdraw your consent at any time.

Most of these rights are subject to some exceptions or exemptions, depending on the purposes for which data is being processed.

To exercise any of these rights, please contact the Data Protection Officer (DPO) or equivalent at BU (contact details below) or at your Partner Institution.

BU will always aim to respond clearly and fully to any concerns you have about our processing and requests to exercise the rights set out above. However, as a data subject if you have concerns about our data processing or consider that we have failed to comply with the data protection legislation then you have the right to lodge a complaint with the data protection regulator, the Information Commissioner:

Visit the Information Commissioner’s Office Make a complaint webpage

Email: [email protected]

Tel: 0303 123 1113

Post: Information Commissioner’s Office, Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

9. Data protection contact information

Bournemouth University
Data Protection Officer
Email: [email protected]

Address: Bournemouth University, Fern Barrow, Poole, Dorset, BH12 5BB, United Kingdom

10. Changes to this privacy notice

We will update this privacy notice from time to time to reflect any changes in data protection laws or the way we process your data. You will be given access to the updated privacy notice when you complete the annual Online Registration process with the Partner Institution. Significant changes during the year will be notified to you using your email address. We encourage you to review this notice periodically.