ÌìÃÀÓ°ÊÓ

This privacy notice explains when and why we collect personal information about you which we then use for marketing and publicity purposes at BNU and how we will use this information including the ways we might share this with others.  It also explains how we keep your information secure and the rights you have in relation to the information we hold about you. 

This process concerns our arrangements to take, store and display photographs, videos, and text-based student stories for promotional and marketing purposes. 

The processing includes the promotion of BNU by way of collecting, publishing and sharing details of student experiences including photographs and videos of students, and text-based student stories. 

This publication may include online publication, production of printed materials and sharing with other organisations. The use of these materials would be without payment and Buckinghamshire New University would retain copyright of the materials collected and shared.

Names and email addresses (as identifiers) will be collected as part of the consent recording process.

We collect and use your information for the following purposes.

Purpose 1: Promotion and Marketing 

Photographs, video material and text based student stories are shared to promote and market the work of Buckinghamshire New University. This may include:

• Sharing material from events and activities on local websites and social media platforms
• Sharing photographs from learning and teaching activity to raise awareness of the college’s work on social media
• Using images in advertising or promotional materials such as leaflets, brochures, posters and banners
• Producing and sharing promotional films and videos
• Sharing student stories (in written form) on our website and advertising and promotional materials

Purpose 2: Gathering information for student stories 

We collect and use your information to: 

• gather initial material for the ‘student stories’ through an online survey tool.

We will discuss this with you and seek your approval and explicit consent for the material prior to publication.

Purpose 3: Consent management

We collect and use your information to

• Keep details of the consent you have given.

To process your personal data, the University must have a basis in data protection law. We will broadly rely on:

Consent Article 6 (1)(a). You have given consent for the use. 

As you have given consent, you have the right to withdraw your consent. However, please be aware that some of these processing purposes involve publishing your personal data and it is unlikely that we will be able to reverse publication once it has, or is in the process of, occurring.

For example, if your data is printed in a published prospectus, then Buckinghamshire New University will not be able to reverse this publication or withdraw your data from the public domain.

Similarly, if your data is published on a website, then other individuals may collect and reuse this data under the control of Buckinghamshire New University. The above examples are not exhaustive.

With this in mind, please consider the warning above carefully before giving your consent.

The personal information we collect may include (as applicable):

• Name
• Email address
• Student Number
• Course of study
• Image (Still or Video)
• Sound Recording (Opinion)

The above lists is not exhaustive but is indicative of the main types of personal information processed by the University about you which may be used to provide you with publicity and marketing information.

Most of the information above will have been provided by you and will have been collected through the medium used by BNU, 

We will ask for your consent to use your personal information via electronic media. We will also ask your affirmative consent to send you direct marketing communications via social media.

Media organisations or other organisations who will use the information for the purposes of promoting or reporting on BNU.

For example, but not limited to; local or national newspapers, media organisations, radio stations, local or national government or government bodies, tourism bodies.

Many organisations will have a journalistic reason to report on University matters, BNU may be asked for comment or to provide materials relating to the college or university, including your data, for research or journalistic purposes, including publication. The data collected may be passed to these organisations for reporting or promotional purposes, including publication.

Other organisations may have a reason to report on, or promote the University, including publication. BNU may pass promotional materials, including your data, to these organisations for their reporting or promotional purposes.

Social Media and website hosting companies

In order to publish promotional material, including your data online, BNU uses both its website and its social media accounts. We use various accounts with various companies to host and publish its promotional material online.

These social media accounts may include, but will not be limited to:

1. Facebook ()
2. X ()
3. LinkedIn ()
4. Instagram ()

We may transfer your personal data outside the UK in the following circumstances: 

Where we use a cloud-based IT system which may hold your data, and the data in the cloud is stored on servers located outside the UK in a country which is not subject to an adequacy decision.  In these circumstances we safeguard your data through undertaking appropriate checks on the levels of security offered by the cloud provider and entering into a contract with them which applies protections of the same type and level required by data protection laws within the UK.

We do not pass your data to third party e-book, e-journal or database providers. Where a third party service provider requires you to create an account, your contract is with that provider and your data is stored by them, not by BNU and we cannot guarantee where this data may be located. You are advised to read the Privacy Notice for the organisation concerned.

International data transfer - The proposed international transfer.

BNU plan to:

• Share your data with companies based outside of the UK for the purposes of publishing your data online (BNU website and social media platforms)
• Publish your data online where it can be accessed from any other country in the world
• Publish your data in hard copy, noting that these publications can be transferred to any other country or otherwise reproduced and transferred to any other country.
• Share your data with organisations that may be established outside of the UK or rely on services based outside of the UK and who may publish your data online or in hard copy.

This international transfer takes place subject to the following exceptions or safeguard being in place to allow the international transfer:

• You have given explicit consent for the international transfer.

International data transfer - The identity of the receiver, or the categories of receiver & the country or countries to which the data is to be transferred.

The ICO explains that putting personal data on to a website will often result in a restricted transfer. The restricted transfer takes place when someone outside the UK accesses that personal data via the website. In addition, BNU will be deliberately making international transfers by transferring your data to companies outside of the UK such as social media platforms (see the ‘Your data will, or may, be shared with the following recipients or categories of recipient’ section of this privacy notice for a full list of potential recipients, noting that some or all of these may publish your data themselves).

The data will be made available on a public-facing websites and published in hard-copy materials meaning any individual, in any country or territory in the world, will be able to access the data.

This means that you and Buckinghamshire New University will not know who has accessed your data on the website.

Why Buckinghamshire New University are planning to make the transfer?

The purpose of the international transfer is:

• The promotion of, and reporting on, BNU and their partner organisations (those partner organisations being listed in the ‘Purposes’ and ‘sharing’ sections of this notice).

The purposes are set out fully in the ‘Why do we collect and process your personal data? section of this privacy notice.

BNU is choosing to meet this purpose in a way that require international transfers as the world now primarily relies on the internet and, in many cases, social media platforms for communicating and promoting goods and services. We have strong evidence that potential stakeholders and the public choose to seek information about learning, research activity and projects at BNU online and through social media.

International data transfer - The type of data to be transferred:

The personal data to be transferred will be: 

• That data that is collected (a combination of case study material, evaluation quotes or photographs of you) which may include your name and details of your studies at Buckinghamshire New University under this privacy notice.

International data transfer - Your right to withdraw consent and how this may be limited once your data has been transferred:

The transfer will only take place with your explicit consent (given in the explicit consent tick box on the relevant consent form provided with this notice). You have the right to withdraw your consent at any time and the university will stop using the data collected for this purpose. However, please be aware that some of these processing purposes involve publishing your personal data and it is unlikely that we will be able to reverse publication once it has, or is in the process of, occurring. For example, if your data is printed in a published prospectus, then the university will not be able to reverse this publication or withdraw your data from the public domain. Similarly, if your data is published on a website, then other individuals may collect and reuse this data outside of the control of BNU. The above examples are not exhaustive.

To withdraw your consent please email: marketing@bnu.ac.uk  

Please note that if your data has been accessed by parties in third countries not covered by the UK GDPR you may not be able to exercise the same rights associated with consent under the UK GDPR against those third parties – including withdrawing consent for processing.

International data transfer - The possible risks involved in making a transfer to a country which does not provide adequate protection for personal data:

The UK GDPR restricts the transfer of personal data to countries outside the UK, or to certain international organisations. This restriction is in place because once data is transferred in this way it will not be subject to the UK GDPR and you will lose the ordinary UK GDPR protections (protections and rights) for your data once it has been transferred. Once the data has been transferred it may be subject to other local data protection laws in the receiving country – or no data protection law at all if no such law exists in the receiving country.

Your data will be transferred to: Your data will be transferred to, at least the USA and may be transferred to or accessed from any other country in the world (as it will have been published online).

There is a risk with international transfers of this type that you will lose control of your data if it is accessed by a party to whom the UK GDPR does not apply. This is because you will not be able to exercise your ordinary UK GDPR rights against that party, there may be no supervisory authority to appeal to, and there may be no other local data protection or privacy law on which you can rely to exercise any control over your data held by the third party. You may not be able to control who uses your data, for what purpose, with whom they share it, limit any use of the data, and you may not be informed at all that third parties are using your data.

Your data may be accessed by third parties in countries with no data protection laws and these parties may use your data in a way that would be unlawful under the UK GDPR, but which are lawful in their own country. In such circumstances you would likely have limited, or no, ability to stop or influence that processing.

There are risks involved with international transfers and you should only consent if you have read and understand the above and still wish to proceed.

Your data will be retained in accordance with the Records Retention Schedule a summary of which can be accessed at .

The following rights apply to the personal data collected in this notice. Please contact dpofficer@bnu.ac.uk  if you wish to exercise your rights: 

• Right of access to confirmation of processing and copies of your personal data 
• Right to rectification if personal data we hold about you is incorrect 
• Right to restrict processing of your personal data 
• Right to complain to the Information Commissioner’s Office about how we handle your data. 

In some circumstances you also have the following rights: 

• Right to object to our processing of your personal data 
• Right to request erasure of your personal data (deletion) 
• Right to data portability

If you have any concerns with regards to the way your personal data is being processed or have a query about this Notice, you can contact the Data Protection Officer directly by e-mail dpofficer@bnu.ac.uk  or by post. 

Data Protection Officer, Buckinghamshire New University, Queen Alexandra Road, High Wycombe, Buckinghamshire HP11 2JZ 

If you remain unhappy then you have the right to complain to the : 

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 

BNU is registered as a controller with the Information Commissioner’s Office. Our registration number is: Z772474X

This privacy notice will be reviewed on an annual basis or revised more frequently if necessary. 

This notice was last reviewed on 11 June 2024.