Privacy Notice for Money And Childcare Advice (MACA)

We collect most personal information directly from you when you contact and or register with BCU’s Money and Childcare Advice (previously called Student Support) including online, by phone, email, or in person.

We may collect the following types of personal data about you:

• Personal details such as name, address, date of birth, phone number, your BCU ID number,
• Information about your personal circumstances

We may also process the following "special categories" of more sensitive personal data:

• Information about your health, including any disability and/or medical condition;
• Criminal convictions

We will hold your personal information within a secure dedicated database and case notes record in line with the University’s data retention schedule.

We will use your personal data to administer your support, deliver services and meet statutory obligations. Your personal information is retained and destroyed in line with the BCU Retention Schedule. When this time has been reached, the personal information is securely destroyed.

We will not share your personal information with anyone outside of the relevant departments, services and faculties within BCU unless:

• We have your explicit consent
• Required or permitted by law in which case we will only share the minimum amount necessary

Your personal data will only be accessible to relevant staff. Hard copies of personal information are kept in a secure location and personal data stored electronically is on secure systems within the UK or EU.

We do not share the personal data you have provided for these purposes with any other organisations outside of Birmingham City University unless we have explicit consent, need to prevent serious harm or are legally obliged to do so.

The University are required to offer a support service to meet our commitments to you as set out in the student contract. Maintaining records of the sessions are necessary to ensure the University is providing the appropriate support that is part of the student contract. The lawful basis for using this personal information is contract (which means the processing is necessary for the performance of a contract with you). The lawful basis of public task is also relevant for using this personal information (which means we are either carrying out a task in the exercise of official authority or in the public interest).

Where other lawful bases / special conditions of processing do not apply, we will process your data on the basis of your explicit consent. If we require your consent for any specific use of your personal data, we will collect it at the appropriate time, explaining why we are collecting the data and how we will use it, and you can withdraw this consent at any time. This usually applies for ‘special category data’ which includes information about your health (physical or mental), race, ethnic origin, religious or political beliefs, membership of a trade union and sexual orientation.

In rare circumstances the University may need to release information to protect your interests or the interests of others, e.g. in a medical emergency. This lawful basis is called ‘vital interests’. However, there are other lawful reasons for BCU to process special category data, which includes for equal opportunities purposes or to defend legal claims.

BCU is committed to safeguarding your personal data. Whenever you provide such information, we are legally obliged to use your information in line with all applicable laws concerning the protection of personal information, including the Data Protection Act 2018 and the UK General Data Protection Regulation.

In relation to all our records these are held within a dedicated and secure database system hosted on a secure network with access limited on a need-to-know basis. A range of administrative, technical, physical security controls are used to ensure a robust approach to protecting data held on University IT systems, and when approved transfers between third parties are undertaken. For more information, a copy of BCU’s overarching Data Protection Policy is available on the policies page of the BCU website.

BCU wants to ensure that we keep the details we hold about you up to date and communicate with you fully in accordance with your wishes. You should also get in touch with us if any of your personal details change. You can update your details and your communication preferences during enrolment tasks, by contacting Academic Services or at any time:

By Email to: informationmanagement@bcu.ac.uk

By Post to: Data Protection Officer, Information Management Team, Birmingham City University, Floor 1, Joseph Priestley Building, 6 Cardigan Street, Birmingham, B4 7RJ.

You have the right to correct or update your personal data at any time. Please get in touch with your main contact at the University to update your details. If you are a student, your main contact for this is your Faculty Student Centre. If you cannot contact them, please email informationmanagement@bcu.ac.uk to update your personal data. You may have the right to have your personal data deleted, the right to restrict processing, the right to object and / or the right to data portability and you have the right to know about and challenge automated decision making and profiling. Follow the links to find out whether those rights apply in these circumstances. To do any of those things or if you have followed the links but would like clarification, please email informationmanagement@bcu.ac.uk. 

You have the right to request to see the personal data we hold about you. You can submit a Subject Access Request (SAR) in accordance with the Subject Access Requests (SAR) Procedure.

Depending on the circumstances and the nature of your request it may not be possible for us to do what you have asked, for example, where there is a statutory or contractual requirement for us to process your data and it would not be possible to fulfil our legal obligations if we were to stop. However, where you have consented to the processing (for example, where you have asked us to send you certain types of communication), you can withdraw your consent at any time, by emailing us at informationmanagement@bcu.ac.uk. In this event, we will stop the processing as soon as we can. If you choose to withdraw consent, it will not invalidate past processing and it may impact our ability to provide particular additional services to you. Further information on your rights is available from the Information Commissioner’s Office (ICO).

If you wish to exercise any of your rights, please contact our Data Protection Officer using the following contact details:

By Email to: informationmanagement@bcu.ac.uk

By Post to: Data Protection Officer, Information Management Team, Birmingham City University, Floor 1, Joseph Priestley Building, 6 Cardigan Street, Birmingham, B4 7RJ.

If you have any questions, comments or concerns about how we use or handle your personal data please contact the Data Protection Officer using the contact details in the introduction to this privacy notice.

If you are not content with the how we handle your information, we would ask you to contact our Data Protection Officer to help you. If you are dissatisfied with the response, you also have the right to complain directly to the Information Commissioner’s Office. Visit the ICO website to find out more about how to make a complaint.

Birmingham City University’s Data Protection Policy and Appropriate Policy Document 

Birmingham City University’s Privacy Notices  

The Information Commissioner’s Office (ICO) information for members of the public

This privacy notice may be updated from time to time so you may wish to check it each time you submit personal information to BCU. The date of the most recent versions will appear at the end of this document (see version control). We encourage you to check our privacy notice from time to time to ensure you understand how your data will be used and to see any minor updates. If material changes are made to the privacy notice, for instance how we would like to use your personal data, we will provide a more prominent notice (including, for certain services, email notification or correspondence of privacy notice changes). We may also notify you in other ways from time to time about the processing of your personal data.