Privacy Notice for Visitors to a BCU Campus or BCU Building

Birmingham City University (BCU) is the data controller. You can contact our Data Protection Officer by emailing informationmanagement@bcu.ac.uk or by post to:

Data Protection Officer
Information Management Team
Birmingham City University
Floor 1, Joseph Priestley Building
6 Cardigan Street
Birmingham, B4 7RJ

If you are a visitor (but not a current student or member of staff) to a BCU building, you may need to register at the relevant security / Reception area and provide us with some basic personal data such as your name, the organisation you’re representing (if any), your car registration (if any) and possibly show a piece of ID, personal data from which may be kept on record. You may need to have your photograph taken.  This information is collected for health and safety and security purposes and to provide the facilities for your visit. We will not collect the personal data of children accompanied by adults. Instead, we will add a numerical value to the register for use in the event of a building evacuation. If you refuse to register at the appropriate security / Reception area you may be required by the Security team to leave the building. By being on campus your image will also be captured on our CCTV system. More information about this is found in the CCTV Policy available on request to freedomofinformation@bcu.ac.uk.

The legal basis for using this personal information for health and safety purposes is ‘public task under A6 and Social Protection law under A9(2)(b)’ and for non-health and safety purposes is ‘legitimate interests’. Legitimate interests means we need to process the personal information to fulfil our objectives, we believe it will not adversely affect you and we think you would expect it.

The University carries out photography and filming on campus to commemorate events and for marketing purposes. As a visitor you may be photographed or filmed whilst on campus. Please read the Privacy Notice for Photography and Filming for more information about this. The lawful basis for photography and filming is legitimate interests, unless the person is to be identified by name or quoted in which case the lawful basis is consent, which would be requested before the photograph or filming was carried out.

The personal information is used to ensure that there is a safe environment for work, study and the community accessing facilities and to facilitate the visiting process.

The personal data in the visitor register and on CCTV images is kept until it reaches its retention period and then is securely destroyed. Any other photographs or filming is kept for the retention period stated in the Privacy Notice for Photography and Filming. When the retentions periods have been reached, the personal information is securely destroyed.

Your personal data will only be accessible to the Estates and Facilities team, and relevant staff unless we need to share it with other organisations such as the police. Hard copies of personal information are kept in a secure location and personal data stored electronically is on secure systems within the UK or EU. We do not share the personal data you have provided for these purposes with any other organisations outside of BCU unless we believe someone’s life is in danger or we believe we are compelled to by law. 

You have the right to be informed about the personal data we have about your visit and to correct any inaccurate information that needs to be updated. For personal information you have provided us consent to use, you have the right to withdraw your consent at any time. This right is not retrospective. You may have the right to have your personal information deleted, the right to restrict processing, the right to object and / or the right to data portability. Follow the links to find out whether those rights apply in these circumstances. To do any of those things or if you have followed the links but would like clarification, please email informationmanagement@bcu.ac.uk   

You have the right to see the personal data we hold about you. You can submit a Subject Access Request (SAR) in accordance with the Subject Access Requests (SAR) Procedure.

Data protection law also gives you rights regarding ‘automated individual decision-making and profiling’. However, BCU does not carry out any ‘automated individual decision-making and profiling’ related to visitors on campus, so these rights are not relevant in this circumstance.

You have the right to lodge a complaint with the Information Commissioners Office about the handling of your personal data and can find out more about this on the ICO website.

• Birmingham City University’s Data Protection Policy and Appropriate Policy Document
• Birmingham City University’s Privacy Notices
• The Information Commissioner’s Office (ICO) information for members of the public