Personal information – Students

In conducting its operations, The University of 鶹ֱ ( “the University”, “we”, “our”, “us”) will be required to process personal data of students. For the purpose of this section, “students” may refer to prospective students, current students, applicants, apprentices and individuals who have made enquiries about studying at the University.

The University of 鶹ֱ is the data controller processing your data and registered with the Information Commissioner’s Officer (registration number: Z8974286). We are committed to ensuring your data is handled in line with UK data protection legislation.

This Privacy Notice sets out how we collect and use your personal data, and your rights regarding that information.

How we collect your information

We may collect your personal data in a number of ways, for example:

  • data provided by you, for example, when you:
    • from the information you provide to us when you interact with us before joining, for example when you express your interest in studying at the University
    • when you apply to study at the University and complete enrolment forms via the Universities and Colleges Admissions Service (UCAS), or when you apply directly to the University.
    • when you complete other admissions processes and procedures and interact with our admissions staff.
    • when you complete the University’s online registration form.
    • when you communicate with us by telephone, email or via our website, for example in order to make enquiries or raise concerns.
    • in various other ways as you interact with us during your time as a student of The University of 鶹ֱ, for the various purposes set out in the ‘How we use information about you’ section of this notice.
  • data we generate, for example:
  • images of you captured via event photography and recordings, CCTV cameras (in accordance with our CCTV Policy and Procedure) or body cameras worn by members of our Security team on our campus.
  • assessment marks.
  • data obtained from third party sources, for example:
    • the University will securely access and manage sensitive eVisa data via platforms such as the UKVI’s View and Prove Your Immigration Status system. The University may need to request updates or clarifications from UKVI regarding discrepancies in eVisa records, ensuring accurate and up-to-date information.
    • data from your previous or current school, sixth form college, university or employers who may provide a reference about you or who may sponsor your studies.

The types of information we collect

We may collect the following types of personal information about you:

  • Information to help identify you such as your name, and contact information (including your address, email address and telephone number),  your date of birth, national insurance number (or other tax identification number) and your passport number or national identity card details, country of domicile and your nationality, your University student number, and your images;
  • contact information for your parent, guardian or next of kin (please note that it is your responsibility to obtain consent from your emergency contact to share their details with us);
  • information relating to your education and employment history, the school(s), sixth form college(s) and other colleges or universities you have attended and places where you have worked, the courses you have completed, dates of study and examination results. We will also keep records relating to assessments of your work, details of examinations taken, your predicted and actual examination grades and other information in your student record;
  • information about your family or personal circumstances, and both academic and extracurricular interests, for example where this is relevant to the assessment of your suitability to receive a bursary or in order to provide you with appropriate pastoral care;
  • information relating to your Student Visa which involves collecting sensitive personal information, including financial documents, academic history, and biometric data;
  • data relating to University policies and procedures such as applicant complaints and appeals, student complaints and appeals, non-academic misconduct, fitness to study/practice etc;
  • financial information, such as bank details, tuition fee payments, and scholarship or bursary information, in order to manage and process payments; and
  • special category personal data, as defined in the UK GDPR, including:
    • information concerning your health and medical conditions (e.g. disability and dietary needs);
    • certain criminal convictions (e.g. for students on nursing programs, following completion of an annual declaration of “good character”); and
    • information about your gender, racial or ethnic origin; religion or similar beliefs; and sexual orientation.

Lawful bases

Any information collected or used by the University will be done so lawfully. The grounds for data collection and usage fall into the below categories:

  1. Data processing deemed necessary for the University to fulfil its contractual obligations to you and provide you with adequate support throughout your studies.
  2. Data processing carried out to fulfil the University’s public task to advance learning and knowledge by teaching and research, and to enable students to obtain the advantages of University education.
  3. Data processing in our legitimate interests. This is where the University can demonstrate a strong justification for data processing using a Legitimate Interest Assessment (LIA).
  4. Data processing carried out with your explicit consent.
  5. Data processing carried out in order to fulfil our statutory and legal requirements.

We will only process special category data where an appropriate Article 9 UK GDPR condition applies, including:

  1. where you have directly provided it yourself with your consent to use it for the purpose/s specified;
  2. where processed in the course of legitimate activities such as for event management purposes (e.g. for assessing access requirements arising from a disability) or for selecting a particular group of alumni who may be interested in a specific alumni function (e.g. an alumni function that is held in the country that you are a national of);
  3. where it has been sourced from information that we believe you have clearly made public (e.g it appears in your public LinkedIn profile or in your public profile on other social media); and/or
  4. where it is necessary for archiving purposes in the public interest, scientific or historical research or statistical purposes.

The University complies with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR) to store and process your data safely.  The University will never sell, licence or trade your personal data to any third party.

How we use information about you

The purposes for which we may use personal data (including special category data) that we collect during a student’s association with us include but are not limited to:

  • recruitment and admissions purposes such as contacting you with information on your course, or verifying your identity as part of registration;
  • the provision of our core teaching, learning and research services (e.g. registration, assessment, attendance, managing progress, academic misconduct investigations, certification, graduation);
  • maintaining student records;
  • administering finance (e.g. fees, scholarships and bursaries);
  • assessing your eligibility for bursaries and scholarships, etc;
  • providing library, IT and information services;
  • to provide you with educational services which may not be set out in our Student Agreement but which are nevertheless a part of our academic and educational mission;
  • providing student support services;
  • monitoring equal opportunities;
  • safeguarding and promoting the welfare of students;
  • ensuring the safety and security of the University community;
  • managing student accommodation;
  • managing the use of social media;
  • managing car parking on campus;
  • carrying out research and statistical analysis;
  • carrying out audits (e.g. to ensure compliance with our regulatory and legal obligations);
  • reporting to UKVI specific circumstances, such as:
    • non-enrolment, prolonged absences, or failure to meet academic progression requirements;
    • providing updates on changes to a student’s course, mode of study, or other conditions that may affect their visa status; and
    • confirming visa sponsorship obligations as part of the university’s role as a Student sponsor;
  • providing operational information (e.g. providing IT support, information about building closures or access restrictions on campus, or safety advice);
  • promoting our services (e.g. providing information about summer schools, student exchanges, or other events happening on and off campus);
  • monitoring and evaluating the performance and effectiveness of the University and its services. In some cases, personal information may be shared with external bodies conducting surveys such as the National Student Survey (NSS) and Graduate Outcomes Survey. If you wish to know more information about this, please contact data@buckingham.ac.uk;
  • fundraising purposes;
  • to meet reporting requirements of organisations such as the Higher Education Statistic Agency (HESA);
  • preventing and detecting crime and giving assistance with investigations (including criminal investigations) carried out by the police and other competent authorities;
  • to seek advice on our rights and obligations, such as where we require our own legal advice;
  • dealing with grievances and disciplinary actions;
  • dealing with complaints and enquiries; and
  • managing conflicts of interest where personal relationships exist between students and staff members.

Sharing information with others

All members of University staff who process or use your personal data do so in accordance with data protection legislation and the University’s Data Protection Policy and Procedure. Regular information security training is provided to all those with access to your personal data.

For the purposes referred to in this Privacy Notice and relying on the bases for processing as set out above, we may share your personal data with certain third parties where there is a legitimate reason for doing so. You are given the opportunity to opt out of some of these data sharing arrangements, for example when you register with us, but you should carefully consider the possible impact of doing this. Unless an opt-out is in place, we may disclose limited personal data to a variety of recipients including but not limited to:

  • our employees where there is a legitimate reason for their receiving the information. Examples include:
    • Student welfare teams in order to determine the reasonable adjustments that need to be made to accommodate a disability
    • The Students’ Union to administer membership which is given automatically upon enrolment with the University. The Students’ Union may also share your information with the National Union of Students (NUS). You can opt out of this by contacting studentsunion@buckingham.ac.uk.
    • The Alumni department for the purpose of coordinating alumni activities. More detail on this can be found in the Privacy Notice – Alumni. If you do not wish for your information to be used for these purposes, please contact alumni@buckingham.ac.uk.
  • third parties who work with us to provide student accommodation;
  • third parties who work with us to provide student support services (e.g. counselling);
  • third parties who are contracted to provide out-of-hours IT services for us;
  • organisations operating anti-plagiarism software on our behalf (such as Turnitin®);
  • internal and external auditors;
  • those with a legitimate interest in tracking student progress and attendance, including: student sponsors (e.g. the Student Loan Company, research sponsors, Research Councils, NHS);
  • current or potential education providers (for example, where you take part in an exchange programme as part of your course or where your teaching and/or assessment is delivered by another institution with whom the University has a formal partnership);
  • current or potential employers (to provide references and, where students are sponsored by their employer and/or where you take part in a placement, to provide details of progress/attendance);
  • professional and regulatory bodies (e.g. General Medical Council, Health Care and Professions Council, British Psychological Society, Solicitors Regulation Authority, Bar Standards Board, Association of Chartered Certified Accountants) in relation to the confirmation of qualifications, professional registration and conduct and the accreditation of courses;
  • government departments and agencies where we have a statutory obligation to provide information (e.g. the Higher Education Funding Council for England (HEFCE), the Higher Education Statistics Agency (HESA) – see , the Home Office (in connection with UK visas and immigration), Council Tax and Electoral Registration Officers at relevant local authorities (for the purpose of assessing liability for Council Tax and for electoral registration purposes));
  • NHS trusts, NHS foundation trusts and Local Authorities (for the purpose of assessing whether you are entitled to free NHS hospital treatment);
  • crime prevention or detection agencies;
  • parents, guardians, and next-of-kin (where there is a legitimate reason for disclosure);
  • third parties conducting surveys, for example the National Student Survey;
  • third parties engaged by the University to collect overdue tuition fees (debt collection) on its behalf; and
  • third parties involved in your graduation ceremonies (including our local paper, programme printers, and commemorative clothing suppliers). Your name, award, and classification may also be available to the public via the graduation programme and our website. You may withhold your consent to your name being published for these purposes when you register online to attend the award ceremony or graduate in absentia.

International data transfers

Some of the personal data we process about you may be transferred to, and stored at, a destination outside the UK, for example where it is processed by staff operating outside the UK who work for us or for one of our suppliers, or where personal data is processed by one of our suppliers who is based outside the UK or who uses storage facilities outside the UK.

In these circumstances, your personal data will be transferred in accordance with UK data protection legislation and subject to one of the following safeguards:

  • UK adequacy regulations;
  • the International Data Transfer Agreement (IDTA);
  • the UK Addendum to the EU Standard Contractual Clauses; or
  • another lawful transfer mechanism permitted under UK GDPR.

How long do we keep your data?

The University has a Data Retention Policy and Procedure and maintains a Retention Schedule on how long the University holds different types of information.

Changes to your personal data

Please tell us promptly about any changes to the information we hold about you. This is particularly important for your contact details. You can do this by emailing registry@buckingham.ac.uk

Your personal data rights

Access

You have the right to access any personal data that the University holds about you at any time. You may be able to view this information through our online systems or in paper form. Requests for specific information held should be directed to the appropriate department.

If you wish to submit a Subject Access Request, you should do so in writing to the University’s Data Protection Officer (data-protection@buckingham.ac.uk).

Rectification

You have the right to ask that the University corrects any data it holds about you which you consider to be inaccurate. See the ‘Changes to your personal data’ section of this notice above.

Erasure

In certain circumstances, you have the right to ask us to erase your personal data. This may include cases where:

  • we no longer need the personal data for the purpose it was originally collected;
  • you withdraw your consent (where consent is the lawful basis) and there is no other legal basis for the processing;
  • you object to the processing and there are no overriding legitimate grounds for the processing;
  • the personal data has been unlawfully processed; or
  • we are required to erase the data to comply with a legal obligation.

Requests should be submitted to data-protection@buckingham.ac.uk. Once we have considered your request, we will inform you of our decision.

Restrict Processing

In certain circumstances, you have the right to ask that the University restricts the processing of your personal data. This may include cases where:

  • You believe that the data is inaccurate and you want us to restrict processing until we determine whether it is indeed inaccurate
  • The processing is unlawful and you want us to restrict processing rather than erase it
  • We no longer need the data for the purpose we originally collected it, but you need it to establish, exercise or defend a legal claim
  • You have objected to the processing and you want us to restrict processing until we determine whether our legitimate interests in processing the data override your objection.

Requests should be submitted to data-protection@buckingham.ac.uk. Once we have considered your request, we will inform you of our decision.

Data Portability

You also have the right, where technically feasible, to request that we transfer this data directly to another organisation. This right only applies to personal data that you have provided to us. Requests should be submitted to data-protection@buckingham.ac.uk. Once we have considered your request, we will inform you of our decision.

Object

You have the right to object to the way the University processes your data and to opt out of certain data sharing arrangements or have the University erase certain personal data held about you. Requests should be submitted to data-protection@buckingham.ac.uk. Once we have considered your request, we will inform you of our decision.

Complaints

If you are dissatisfied with the way in which we process your personal data, we ask that you first contact data-protection@buckingham.ac.uk to try and resolve the matter.

Should you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO) about the way the University processes your personal data. Further information is available on the ICO website: .

Changes to the Privacy Notice

The University may amend the Privacy Notice from time to time where appropriate, for example to respond to changing legal and regulatory requirements. Any significant changes to the notice or to the way we treat your data will be communicated to you in writing. Any queries regarding this Privacy Notice should be sent to data-protection@buckingham.ac.uk.

Last updated: July 2026