Privacy notice for donor programme applicants and recipients

When you apply for a donation programme (for example a scholarship or other funded opportunity such as a placement or financial award) you will provide Birmingham City University with your personal data. This is likely to include, but is not limited to, the following your:

• Name
• Student number
• Application number (if you are not yet a student)
• Date of birth
• Contact details
• Reasons for applying / a personal statement
• Previous qualifications / educational experience / work experience,
• Confirmation of eligibility criteria etc. Depending on the eligibility criteria this may include information about your nationality / residency / citizenship, household income, whether are a Care Leaver or were eligible for free school meals (during your full-time education), and special category data such as your ethnicity, whether or not you have a disability etc. If providing this information is mandatory as part of the applications, this is because the donation has been made deliberately to provide opportunity to people from under-represented groups.
• At other times special category data may be requested in order to monitor equal opportunities. If this is the case providing an answer will be optional or there will be an option for ‘Prefer not to say’.

If you receive an award, you might be asked to provide a photo / be photographed for potential publicity purposes.

• The lawful basis for processing your personal data is UK GDPR Article 6(1)(f) ‘legitimate interests’, which means we need to process the personal information to fulfil our or your objectives, we believe it will not adversely affect you and we think you would expect it.
• Where the donation programme includes a form of financial donation, we process some personal data relying on the UK GDPR Article 6(1)(c) ‘legal obligation’ as we need to fulfil financial requirements.
• Processing may also be permissible under Article 89(1) for statistical and research purposes.

Special category data is processed relying on the condition of processing Data Protection Act 2018 Schedule 1 Part 2 (8)(1) the equality of opportunity or treatment and Article 89(1) and under GDPR Article 9(2)(j)) based on the duties in the Equality Act 2010.

We will use your personal information to:

• Facilitate the application process.
• Facilitate the scholarship or other award (for example a placement or financial gift).
• Communicate with the donor about the applicants or those receiving the award including about academic outcomes.
• Facilitate any BCU procedures in accordance with its policies and procedures (including those covering placements).
• Fulfil any legal requirements such as financial requirements.
• Fulfil any requirements we are contractually obliged to in connection with the donors (e.g. where funding has been provided from an external source).
• Provide placements with information to ensure they provide relevant Reasonable Adjustments in accordance with the Equality Act 2010.
• Produce internal and external publicity / press releases.
• Develop the relationship between BCU and the donor e.g. be included in case studies / success stories.
• Develop relationships between BCU and potential donors (e.g. through publicity).
• Provide confidential references as requested by you or the donor.
• Report to statutory bodies such as the Office for Students (OfS), Higher Education Statistics Authority (HESA), Student Loans Company (SLC)
• Carry out audits.
• Monitor and report on equal opportunities.
• To monitor donor programme engagement and success

Only relevant personal data would be used to fulfil each purpose.

We keep your personal information for the length of time necessary to fulfil the requirements and objectives and when this time has been reached, the personal information is securely destroyed.

We may share your personal data with any relevant staff, business areas, departments and faculties within BCU where necessary in order to provide you with provision, services and support and to enable BCU to carry its necessary functions.

For the purposes referred to in this privacy notice, we may share your personal data with certain third parties for the purposes of facilitating, reporting on and publicising the donor programmes as well as fulfilling our legal and contractual obligations. We may, where relevant and necessary, share your information with the following types of organisations:

1. The donors;
2. External organisations offering University-sponsored services including student surveys;
3. The governmental departments or agencies responsible for immigration and student loans;
4. If you have or are seeking a particular relationship with a third party, for example, providers of external training and placements;
5. Employers or prospective employers and other educational institutions;
6. The Higher Education Statistics Agency (HESA). Further information on how HESA uses this data is available from the HESA website; (Use the search term ‘collection notices’ for information about how HESA may use your personal data)
7. Any relevant professional statutory regulatory bodies for relevant courses;
8. Regulatory bodies and auditors, for example if records had to be lawfully inspected by the Information Commissioners Office;
9. Office for Students and or the Office for the Independent Adjudicator (OIA);
10. Relevant public bodies, including but not limited to the police, the UK Home Office; HM Revenue and Customs; and local authorities;
11. Organisations assisting BCU with BCU marketing activities.
12. Other educational establishments as necessary for example to verify student status, to assist with safeguarding of yourself of others, to uphold processes regarding appropriate conduct or to assist with topic regarding courses linked to regulated professions.
13. External parties for safeguarding purposes, for example the police, NHS, social services etc.
14. External parties as necessary in order to process legal claims, insurance claims or when BCU is seeking legal advice.
15. External parties as necessary to complete data rights requests, for example, if you use a third party to submit a subject access request on your behalf.
16. External parties such as the Information Commissioner’s Office (ICO) or tribunals as necessary.

Where information is shared with third parties, we will seek to share the minimum amount necessary.

If we use a third party as detailed above, we will always ensure that appropriate controls are in place to ensure data is safe, it is only used for the allowed purpose and it is permanently deleted after the task has been completed. All third-party service providers that process data on our behalf are required to take appropriate security measures to protect your data in line with our policies. We do not allow them to use your data for their own purposes. We permit them to process your data only for specified purposes and in accordance with our instructions.

We only share your personal data in appropriate circumstances, for specified purposes, by secure means, using the minimum amount necessary. In addition to the circumstances stated above we will share your personal information if we believe someone’s life is in danger or we believe we are compelled to by law. We will not sell your personal data.

Hard copies of personal information are kept in a secure location and personal data stored electronically is on secure systems within the UK or EU. If included in press releases / on the BCU website this will be accessible worldwide.

You have the right to correct or update your personal data at any time. Please get in touch with your main contact at the University related to your donor programme to update your details. You may have the right to have your personal data deleted, the right to restrict processing, the right to object and / or the right to data portability and you have the right to know about and challenge automated decision making and profiling. Follow the links to find out whether those rights apply in these circumstances. To do any of those things or if you have followed the links but would like clarification, please email informationmanagement@bcu.ac.uk.

You have the right to request to see the personal data we hold about you. You can submit a Subject Access Request (SAR) in accordance with the Subject Access Requests (SAR) Procedure.

If you have any questions, comments or concerns about how we use or handle your personal data, please contact the Data Protection Officer using the contact details in introduction to this privacy notice.

If you are not content with how we handle your information, please contact our Data Protection Officer to help you in the first instance. If you are dissatisfied with the response, you also have the right to complain directly to the Information Commissioner’s Office. You can find out more about this on their website https://ico.org.uk/make-a-complaint/.

If you are not content with how we handle your information, please contact our Data Protection Officer to help you in the first instance using the contact details in the introduction to this privacy notice. If you are dissatisfied with the response, you also have the right to complain directly to the Information Commissioner’s Office. You can find out more about this on their website https://ico.org.uk/make-a-complaint/.

• Birmingham City University’s Data Protection Policy and Appropriate Policy Document
• Birmingham City University’s Privacy Notices  
• The Information Commissioner’s Office (ICO) information for members of the public