Privacy notice for student inclusion

We collect most personal information directly from you when you contact and or register with the University’s Student Inclusion Team including online, by phone, email, or in person.

We may collect the following types of personal data about you:

• Personal details such as name, address, date of birth, phone number, your BCU ID number
• Information about your personal circumstances and the support and assistance you have been provided such as funding you are in receipt of or may be entitled to
• Details of the interactions you have had with the Team, other areas of the University, and external agencies, where relevant
• Bookings, including for events and / or support sessions.

We may also process the following "special categories" of more sensitive personal data. For student inclusion purposes this will most often be information about your health (mental or physical), including any disability and/or medical condition.

We will use your personal data to administer your support, deliver services and meet statutory obligations.

By law BCU doesn’t always need to ask for your consent to process your personal data, but we do need to and want to keep you fully informed about how we process your personal data.

To comply with data protection laws, the University has identified that it will rely on the following lawful bases and conditions of processing for the processing of personal data.

For standard personal data BCU will usually rely on the UK General Data Protection Regulation (UK GDPR) Article 6 lawful basis of public task. This means that it’s within scope of BCU’s tasks as a public authority. For student inclusion, the public task is providing appropriate support to BCU students.

Where the above lawful basis does not apply, BCU would only share your personal data when another lawful basis applies such as vital interest (to protect someone’s life), when it’s part of the student contract, where BCU has a legal obligation, where you have provided your consent, or to fulfil legitimate interests. Legitimate interests means BCU believes it will benefit you, the University or another party, we believe it will not negatively affect you and we think you would expect it.

Special category data is personal data that needs more protection because it is sensitive. One of the topics that is special category data is health data. This includes physical health and mental health, including disabilities. 

Processing special category data requires BCU to identify not only a lawful basis (see above) but also a condition of processing. BCU must base their decision on what special category data is being processed and what the purpose for that processing is. You can read about the 10 conditions of processing on this webpage. In this privacy notice we highlight to you the most relevant ones. The three most relevant are:

• Reasons of substantial public interest: For special category data BCU will usually rely on the lawful basis of public task and the Article 9 condition of processing of Article 9(2)(g) Substantial Public Interests. Please note, the lawful basis 'public task' and the condition of processing ‘substantial public interest’ do not mean that the information is made publicly available. Instead, they mean that it is in the good of society (i.e. it’s in the public good) that organisations can use such information to support people with particular disabilities or medical conditions. The relevant condition under Part 2 of Schedule 1 of the Data Protection Act 2018 is Statutory etc and government purposes. These purposes include BCU fulfilling its duties under the Equality Act 2010 to make reasonable adjustments and to not discriminate, and BCU’s purpose of fulfilling its duty of care to its students.
• Vital interests: the processing is necessary to protect someone’s life. In rare circumstances the University may need to release information to protect your interests or the interests of others, e.g. in a medical emergency.
• Explicit Consent: In specific circumstances we may seek your consent to process your personal data.

We share limited and relevant information about you with BCU departments in order to facilitate appropriate support for you. All BCU staff have appropriate data protection and privacy clauses in their contracts and will only use personal data in appropriate ways. We only share your personal information outside of BCU if it is relevant to do so.

We store your personal data on IT systems. The companies that provide those systems only process personal data on our behalf and not for their own use.

We want you to trust us to be responsible in how we use your personal data. Therefore, we want to tell you about the kind of organisations we might liaise with about you in order to fulfil our purpose of student inclusion. BCU only shares relevant personal data with relevant organisations which can include liaising about you with the kinds of organisations in the table below. BCU relies on the condition of processing of reasons of ‘substantial public interest’ (as described in section 5) for the sharing of special category data with the following external parties unless it was to protect someone’s life, whether that’s your life or someone else’s, in which case it would rely on reasons of ‘vital interest’ (as described in section 5).

For sharing student personal data including special category personal data with parents / guardians / nominated persons, BCU will rely on the following lawful bases and conditions of processing:

BCU is committed to safeguarding your personal data. Whenever you provide such information, we are legally obliged to use your information in line with all applicable laws concerning the protection of personal information. In relation to all our records these are held within dedicated and secure IT systems hosted on a secure network with access limited on a need-to-know basis. A range of administrative, technical, physical security controls are used to ensure a robust approach to protecting data held on University IT systems, and when approved transfers between third parties are undertaken. For more information a copy of BCU’s overarching Data Protection Policy is available on the policies page of the BCU website.

Personal data is held for different lengths of time in accordance with the purpose of processing the personal data. We will hold your personal information in line with the University’s data retention schedule.

BCU wants to ensure that we keep the details we hold about you up to date and would like to know your communication preferences. You should also get in touch with us if any of your personal details change. You can update your details and your communication preferences during enrolment tasks, by contacting your Faculty Student Centre. For giving or withdrawing any consent you would need to contact the Student Inclusion team via disability@bcu.ac.uk or 0121 331 6495.

You have the right to correct or update your personal data at any time. Please get in touch with your main contact at the University to correct or update your details. If you are a student, your main contact for this is the Student Inclusion Team at disability@bcu.ac.uk or 0121 331 6495. If you cannot get it resolved via this method, please contact the Information Management team using the contact details below.

You may have the right to have your data deleted, the right to restrict processing, the right to object and / or the right to data portability and you have the right to know about and challenge automated decision making and profiling. Follow the links to find out whether those rights apply in these circumstances.

To do any of those things, or if you have followed the links but would like clarification, please email informationmanagement@bcu.ac.uk, phone 0121 202 4597 or send post to:

Data Protection Officer
Information Management Team
Birmingham City University
1st Floor, Joseph Priestley Building
6 Cardigan Street
Birmingham B4 7BD

You have the right to request to see the personal data we hold about you. You can submit a Subject Access Request (SAR) in accordance with the Subject Access Requests (SAR) Procedure.

If you have any questions, comments or concerns about how we use or handle your personal data please contact the Data Protection Officer using the contact details in section 10 above.

If you are not content with the how we handle your information we would ask you to contact our Data Protection Officer to help you. However, you do also have the right to complain directly to the Information Commissioner at: ICO website – Make a complaint or via post at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Information about the Information Commissioner is available at: Information Commissioner’s Office website.

This privacy notice may be updated from time to time so you may wish to check it each time you submit personal information to BCU. The date of the most recent versions will appear on this page (see version control). We encourage you to check our privacy notice from time to time to ensure you understand how your data will be used and to see any minor updates. If material changes are made to the privacy notice, for instance how we would like to use your personal data, we will tell you directly, for example, via email.

Document Version Control

Version: 3

Created: 20.03.2025