Skip to main content

Administration, Compliance & Systems

BU Privacy Notice: Students

Finance and payments

We process your data in order to make appropriate payments to you and receive funds on your behalf, including:

To comply with legal and audit requirements we keep personal data relating to these Finance matters for a minimum period of seven years after the end of the tax year in which the relevant payment is made.

  • Course Fees

    Our Finance team will process your data in order to identify the fees which you need to pay under your contract with the University and obtain payment of those Fees.  This will include processing of information about your nationality, country of residence and immigration status, where this is relevant to determining the level of course fees that you need to pay and your funding source (if any). If you obtain funding from the Student Loans Company (SLC), we will share some of your data with them in line with the terms and conditions of their loan to you. If you obtain funding from another source (e.g. sponsor or non-UK government) we may also need to share your data with them in accordance with the terms on which they provide your support.

    For all students, we process information about your nationality, country of residence and immigration status to determine your fee status, i.e. whether you are a UK, EU/EEA or overseas student and the level of fees you are required to pay under the BU Student Agreement on the basis of this status.  We then process information about your course/progression, your fees status and your source of funding and method of payment in order to issue invoices for, and receive and process payment of, your fees.

    If you apply for funding from the SLC, we share information about your course, progression and attendance/registration, your fees status and your payment status with the SLC as necessary to enable them to enter into and monitor the agreement they have with you and make arrangement for the payment of your course fees. This includes informing SLC if you do not enrol on your course (after accepting an offer) or if you interrupt your studies or leave your course during the academic year.

    If you obtain financial support from US Federal funding, we will need to share your data with the US authorities including the US Department for Education, who also require us to retain indefinitely the supporting documentation you provide to us.

    • Necessary for the performance of the contract between us and/or the terms of an agreement you have entered into for financial support
    • Necessary for legitimate interests pursued by the Student Loans Company, i.e. applying their funding eligibility criteria and the terms of their loan agreements
  • Expenses

    If you are able to reclaim any expenses incurred, e.g. in the course of a BU research project, we will process information about the relevant activities and your banking details in order to determine whether BU can pay the expenses and to make payment as appropriate.

  • Scholarships, bursaries and BU Financial Support funding

    We process your data as necessary to make payment of any scholarships, bursaries or BU Financial Support funding you are awarded. This will include name, contact details, course and award details and payment information (e.g. banking details). This will include sharing data with Sodexo to enable payment by VISA pre-payment card to enable Sodexo to meet banking regulation requirements to “know your client/customer”.

  • Debt collection

    If you fail to meet your financial obligations to BU, we will process your data for the purposes of debt collection. If you do not respond adequately to our request to remedy any debt situation when given appropriate opportunity to do so, we may share your data with a third party contracted to provide debt collection services to BU (currently the legal firm Shakespeare Martineau). For these purposes we will process and share information about you, your fee status and fee liabilities, your payment or non-payment of fees, and your contact details.

    • Necessary for legitimate interests pursued by BU: collection of debts owed to BU
    • Necessary for the performance of the contract between you and BU

To comply with legal and audit requirements we keep personal data relating to these Finance matters for a minimum period of seven years after the end of the tax year in which the relevant payment is made.

Complaints & discipline

If you are subject to the student disciplinary process, we will process your data as required to complete this process. Further information is set out above.

Immigration compliance

If you are from the EU/EEA, your immigration status and the information we will need to process for immigration purposes will depend on when you entered the UK, but you should contact BU’s immigration advice service if you are unsure of your status.

We expect most current BU students from the EU/EEA will be eligible for EU settled status on the basis that you will have entered the UK prior to 31 December 2020. This will mean that you will not require a visa to study in the UK, but once the UK’s departure from the EU is completed on 31 December 2020 we will need to hold a copy of your passport. To ensure we have the required documentation at the relevant time, we are asking current BU students in this category to provide us with copies of their passports when they enrol at the start of the academic year 2020-21. Later we will also need to ask you for evidence that you have, or have applied to the UK government for, EU settled status.

If you require a student visa in order to study in the UK, we will need to process your data for purposes relating to immigration and visa applications. We use the term "student visa" to refer to what is currently called a "Tier 4 visa" and is likely soon to become known as a "Student Route visa".

As described in the Student Recruitment and Admissions Privacy Notice, when you accepted an offer from BU we will have processed your information to issue the Confirmation of Acceptance of Studies (CAS) that you need in order to apply for a visa and to comply with our legal obligations under our student visa sponsor licence. This may have included sharing your data with UK Visas and Immigration (UKVI) which is part of the Home Office within the UK Government

We will carry out similar processing in respect of any application you make to extend your visa. As for the initial processing to issue a CAS, we may need to share information with UKVI in order to obtain information relevant to your eligibility to extend your visa. For a visa extension we also have to process financial information including bank statements. If your reasons for seeking an extension include an illness you have suffered, we may also have to process information about your health for these purposes.

Where you are given a student visa, we are also required to report to UKVI on matters which may affect your visa status: this includes any interruption of your studies, change in course, withdrawal from the course or early completion.

We will retain any documentation you provide to us in support of a visa application (e.g. financial or medical documents) only for the period during which we are carrying out the assessment of eligibility for a CAS. Once the CAS is issued we destroy/delete this documentation.

We are required to retain some information collected for the purposes of our position as a student visa sponsor under the immigration legislation for the duration of your studies, and some information must be retained for six years after completion of your studies. We are also required to share retained information with UK Visas and Immigration on request for audit purposes. This is in accordance with the current document retention guidance for student visa sponsors which is issued by UK Visa and Immigration. We will review our processing and retention arrangements to ensure we comply with any new/revised guidance issued by UKVI.

More information

  • Necessary for compliance with a legal obligation on BU: our obligations as a student visa sponsor/licence holder under the immigration legislation and immigration law requirements with respect to holders of EU settled status
  • Consent: you have agreed to this processing


Your data which is held within our Finance or other administration teams may be viewed by BU staff carrying out internal audits or staff of external companies or organisations carrying out external audits of our operations.  They will process this data only for the purposes of auditing our compliance with BU processes and legal or regulatory requirements. They will not use your data to contact you or take any decisions relating to you as an individual.

  • Necessary for the performance of BU’s core purpose as a statutory higher education corporation, to deliver higher education and carry out research, and the public functions of other organisations such as the Charity Commission, central government and the OfS with regard to ensuring appropriate use of charitable and public funds.
  • Necessary for compliance with a legal obligation on BU: our obligations as a charity and our obligations to report to Office for Students
  • Necessary for legitimate interests pursued by BU: ensuring the appropriate and efficient financial operations and governance within BU.

IT services and systems

We process your data in the course of providing and maintaining the IT systems which we use to hold, access and create the personal data relating to you which is covered by this Notice. Some of this processing will be carried out by third parties who provide those systems to us or provide technical support services to us. These include Tribal which provides the SITS (student records) system used for student records and our provider of out of hours IT support. Your data will be processed in the course of the following activities:

  • Holding data and hosting systems

    Much of the personal data described in the rest of this privacy notice will be held in electronic form in systems provided or hosted by BU, including systems we have procured from third-party providers. Separate privacy information will be given to you about some of these systems. Some of your information may be held in cloud-based systems. We enter into agreements with IT service providers so that we have appropriate assurances in place regarding the functionality and security of their systems, to ensure that your data is processed in compliance with the data protection laws which apply in the UK.

  • System development and maintenance

    Where your personal data is held within BU IT systems it may be viewed or otherwise processed in the course of work to maintain, test or further develop the functionality or security of our systems. This processing may be done by BU staff or by third-party suppliers of the relevant system or service providers. Access to these systems is limited to specific authorised professional BU IT or third party staff as necessary for the purposes of their current responsibilities within their role at or for BU. This processing does not result in any communications with you or any decisions being taken which relate to you individually.BU is seeking to minimise the use of identifiable data for these purposes, and ensure that third parties carrying out this processing are subject to appropriate contractual requirements to maintain the confidentiality and security of your data.

  • IT support services

    BU provides an IT support service to students. During standard working hours this service is provided by BU staff. Outside standard working hours (during evenings/nights, weekends and holidays) this service is provided by staff of an external service (currently the NorMAN service provide by Northumbria University).

    Your data will be processed by IT support staff for the purposes of responding to any requests for support that you make to this service. This may include accessing your personal BU accounts (e.g. email or Brightspace), following prior notification to you that this is necessary, and collecting information from you about you/the nature of your need for IT support.

    To enable the delivery of the NorMAN out of hours IT support service, we provide Northumbria University with your name, student and user ID numbers, BU and personal email addresses, home postcode, phone number, and course title. This is to enable NorMAN to verify your identity so that you can use the service, to access your accounts/services on the BU system and to work with you to resolve your IT issue. NorMAN will share with the BU IT Support team information about you and your query if they have been unable to resolve it during the out of hours period.

    • Necessary for the performance of the contract between you and BU
    • Necessary for performance of BU’s core public task, i.e. delivery of higher education and research
    • Necessary for legitimate interests pursued by BU, i.e. operating and improving IT systems appropriate to the work of the organisation

Privacy Notice Contents:

  1. Introduction

  2. When and how we collect your data

  3. How we hold your data

  4. How and why we process your data for BU purposes

  5. Sharing your data with third parties

  6. Transfer of your data outside the European Economic Area (EEA)

  7. Retention: how long will we keep your data for?

  8. Your rights as a data subject and how to exercise them