Introduction

In this Notice, “BU” "we", "our" and "us" refers to Bournemouth University Higher Education Corporation.  

This Notice applies to people who:

• Apply to work at BU;
• Academic or business visitors from outside the EEA;
• Currently work at BU; and
• Former BU staff and spouses who are in receipt of pensions.

We have separate Privacy Notices covering information relating to BU Students, Student Recruitment: Enquiries, Events and Admissions, BU Alumni, people participating in BU research projects and people making enquiries or attending general public engagement events or connected to BU. 

Where we hold information in a form that identifies individuals, it is “personal data”, often referred to as “data” in this Notice. 

More information

The purpose of this Notice is to enable you to understand the scope of the personal data which BU holds and uses that relates to you personally, and how this data will be handled by us.  It covers use of your information within BU and the circumstances in which we will share your data with other organisations. 

We think it is important that you can understand our uses of your data.  In addition the data protection laws require us to be transparent about how we process your data, and they set legal requirements to give you specific information. 

Because of this, and because BU is a large organisation which needs to collect and use personal data for a range of purposes, this Notice is quite long and it contains some legal terminology.  We have tried to make the Notice as clear as possible and provide useful signposting so that you can find the information most relevant to you. See section (c) below for guidance on how to use the Notice. 

Personal data is information relating to identifiable living individuals (known as “data subjects”).  Use of personal data (including collecting data, sharing data or just holding it in files) is referred to as “data processing”.  To protect your privacy, organisations do not have complete freedom in how they use your personal data.  They have to comply with data protection laws, which apply restrictions on when and how personal data can be processed.  Processing of personal data is lawful only where it meets certain requirements or conditions which relate to the purpose of the processing and how it is carried out.

More information

Previously the data protection laws were set out in the Data Protection Act 1998, but from 25 May 2018 new data protection laws apply.  These are set out in the EU General Data Protection Regulation (called “GDPR”) and a new UK law, the Data Protection Act 2018.

Under these laws, BU is the data controller of the information it collects and processes as described in this Notice.  This means that it has the core legal responsibility to safeguard the information and ensure it is processed lawfully. 

In particular BU must:

• Take steps to ensure that the data it processes is accurate and up to date;
• Give you clear information about its processing of your data, in one or more Privacy Notices like this one;
• Only process your data for specific purposes described to you in a Privacy Notice, and only share your data with third parties as provided for in a Privacy Notice; and
• Keep your data secure.

Information about your data protection rights as a data subject is set out in section 7 of this Notice.  

Sections 4 and 5 of this Notice identify and explain the data processing and data sharing carried out by BU. 

In these sections, against each description of a data processing or sharing activity you will automatically see a summary description of the processing and a colour-coded indicator of the legal basis of the processing (these are explained below).  This first level of information will also include any specific processing activities which we particularly need to highlight to you.   In some sections, you can then choose whether to click through to see a more detailed layer of information about the processing and its legal basis.

BU is using colour coding to provide a quick, easily-accessible indication of the legal basis for processing.  This section explains how the colour coding in this Notice links to conditions set out in the GDPR: references to Articles are to the relevant provisions within the GDPR. The conditions listed here are those which BU is relying on in relation to the processing covered by this Notice and may not be a complete list of all available conditions under the data protection legislation.[MG1] 

• Necessary for the performance of a contract between you and BU or to take specific steps before entering into a contract: this will be either the core contract between us relating to your employment at BU or application for employment at BU, or an additional contract for other services, for example an additional contract between you and BU.  

• BU has a legal obligation to do so to ensure compliance.

• Necessary for the performance of a task carried out in the public interest: this would usually be an activity within BU’s core purpose as a statutory higher education corporation, to deliver higher education and carry out research, but might refer to a public interest task pursued by another organisation.

• Consent: this means that you have agreed that we can use your data for this specific purpose.  You are able to withdraw your consent at any time. 

• Necessary for legitimate interests pursued by BU or another organisation, where BU has determined that the processing represents an appropriate balance between its aims and your interests, rights and freedoms as a data subject.  

• Necessary to protect your vital interests or those of another person, i.e. to prevent or manage significant risks of harm. 

One of these must apply if we are processing any information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health or disability or your sex life or sexual orientation. These are referred to as “special categories” of data in the data protection legislation. The conditions referenced in this Notice are:

• Explicit consent: this means that you have explicitly agreed that we can use your personal data for this specific purpose.  You are able to withdraw your consent at any time.  Consent can be withdrawn at any point.

• Necessary to protect the vital interests of you as the data subject or another person, where you are physically or legally incapable of giving consent.

• Necessary for the purposes of substantial public interest.

• Necessary for establishment, exercise or defence of legal claims.

• Necessary for purposes of carrying out obligations and exercising rights in relation to employment, social security and social protection law.

• Necessary for research or statistical purposes, where it is considered that the use of your data will be proportionate to the aims of the research and that your interests as a data subject will be appropriately safeguarded.