Introduction

This Notice applies to information relating to alumni (including graduates, Honorary Graduates and staff who have opted into the Alumni Association), donors, supporters, students in receipt of grants from the Fundraising and Alumni Relations department, students who are part of alumni volunteering schemes, fundraising Champions and prospective supporters.  As we hold this information in a form that identifies individuals, it is “personal data” (also referred to as “data” in this Notice). 

In this Notice, “BU” "we", "our" and "us" refers to Bournemouth University Higher Education Corporation.   We have separate Privacy Notices covering information relating to BU Students, BU Staff, individuals interested in BU services and events who are not current or past BU Students, and individuals participating in BU research projects. “BU Student” refers to an individual who has accepted an offer to study at BU or is registered on a course at BU. 

More information

The purpose of this Notice is to enable you to understand the scope of the personal data which BU holds and uses that relates to you personally, and how this data will be handled by us.  It covers use of your information within BU and the circumstances in which we will share your data with other organisations. 

We think it is important that you can understand our uses of your data.  In addition the data protection laws require us to be transparent about how we process your data, and they set legal requirements to give you specific information. 

Because of this, and because BU is a large organisation which needs to collect and use personal data for a range of purposes, this Notice is quite long and it contains some technical legal language.  We have tried to make the Notice as clear as possible and provide useful signposting so that you can find the information most relevant to you. See section (c) below for guidance on how to use the Notice. 

​

Personal data is information relating to identifiable living individuals (known as “data subjects”).  Use of personal data (including collecting data, sharing data or just holding it in files) is referred to as “data processing”.  To protect your privacy, organisations do not have complete freedom in how they use your personal data.  They have to comply with data protection laws, which apply restrictions on when and how personal data can be processed.  Processing of personal data is lawful only where it meets certain requirements or conditions which relate to the purpose of the processing and how it is carried out.

More information

Previously the data protection laws were set out in the Data Protection Act 1998, but from 25 May 2018 new data protection laws apply.  These are set out in the EU General Data Protection Regulation (called “GDPR”) and a new UK law, the Data Protection Act 2018.

Under these laws, BU is the data controller of the information it collects and processes as described in this Notice.  This means that it has the core legal responsibility to safeguard the information and ensure it is processed lawfully. 

In particular BU must:

• Take steps to ensure that the data it processes is accurate and up to date;
• Give you clear information about its processing of your data, in one or more Privacy Notices like this one;
• Only process your data for specific purposes described to you in a Privacy Notice, and only share your data with third parties as provided for in a Privacy Notice; and
• Keep your data secure.

Information about your data protection rights as a data subject is set out later in this notice.  

Sections 4 and 5 of this Notice identify and explain the data processing and data sharing carried out by BU. 

In these sections, against each description of a data processing or sharing activity you will automatically see a summary description of the processing and a colour-coded indicator of the legal basis of the processing (these are explained below).  This first level of information will also include any specific processing activities which we particularly need to highlight to you.   You can then choose whether to click through to see a more detailed layer of information about the processing and its legal basis.

BU is using colour coding to provide a quick, easily-accessible indication of the legal basis for processing.  The 'More information' boxes below explain how the colour coding in this Notice links to the conditions set out in the GDPR: references to Articles are to the relevant provisions within the GDPR.  The conditions listed here are those which BU is relying on in relation to the processing covered by this Notice and may not be a complete list of all available conditions under the data protection legislation. Further information about the basis of a specific category of processing can always be obtained by clicking through the links in sections 4 and 5 of this Notice.

• Necessary for the performance of a contract between you and BU: this will be either the core contract between us for the delivery of your course (if you are a BU student) or another contract between you and BU. The terms of the BU Student Agreement can be found here: https://www1.bournemouth.ac.uk/students/help-advice/important-information  [Art 6.1(b)]

• Necessary for compliance with a legal obligation on BU: we will provide more information about the relevant obligation [Art 6.1(c)]

• Necessary for the performance of a task carried out in the public interest: this would usually be an activity within BU’s core purpose as a statutory higher education corporation, to deliver higher education and carry out research, but might refer to a public interest task pursued by another organisation [Art 6.1(e)]

• Consent: this means that you have agreed that we can use your data for this specific purpose.  You are able to withdraw your consent at any time.  Consent can be withdrawn by contacting [email protected], tel: 01202 961083 or, where you have received a separate privacy notice specific to your consent, by using the contact details in that notice. [Art 6.1(a)]

• Necessary for legitimate interests pursued by BU or another organisation, where BU has determined that the processing represents an appropriate balance between its aims and your interests, rights and freedoms as a data subject.  Where this applies, we will identify the purpose we are pursuing [Art 6.1(f)]

• Necessary to protect your vital interests or those of another person, i.e. to prevent or manage significant risks of harm [Art 6.1(d)]

One of these must apply if we are processing any information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health or disability or your sex life or sexual orientation. These are referred to as “special categories” of data in the data protection legislation.

• Explicit consent: this means that you have explicitly agreed that we can use your personal data for this specific purpose. You are able to withdraw your consent at any time. Consent can be withdrawn by contacting [email protected] , tel: 01202 961083 [Art 9.2(a)]

• Necessary to protect the vital interests of you as the data subject or another person, where you are physically or legally incapable of giving consent [Art 9.2(c)]

• Necessary for the purposes of substantial public interest. Where this applies, we will identify the relevant public interest [Art 9.2(g)]

• Necessary for establishment, exercise or defence of legal claims [Art 9.2(f)]

• Necessary for healthcare purposes, including assessment of working capacity, medical diagnosis, provision of treatment or the management of healthcare arrangements. This only applies where the processing is the responsibility of a healthcare professional who is subject to professional obligations of confidentiality [Art 9.2(h)]

• Necessary for purposes of carrying out obligations and exercising rights in relation to employment, social security and social protection law [Art 9.2(b)]

• Necessary for research or statistical purposes, where it is considered that the use of your data will be proportionate to the aims of the research and that your interests as a data subject will be appropriately safeguarded [Art 9.2(j)]