Privacy Notice for Students

1. Personal Information Collected?

BHE UNI is committed to protecting the privacy and security of your personal information. This privacy notice (“this Notice”) describes how we collect and use personal information about you during and after your relationship with us, in accordance with the General Data Protection Regulation (GDPR). It applies to all students.

BHE UNI is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this Notice.

This Notice applies to current and former students. This Notice does not form part of any offer made by BHE UNI to you. We may update this Notice at any time and shall inform you if we make any amendment that will significantly affect your rights.

It is important that you read this Notice, together with any other policies we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

2. Data Protection Principles

We will comply with data protection law. This says that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

3. We Hold About You

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). There are “special categories” of more sensitive personal data which require a higher level of protection.

We will collect, store, and use the following categories of personal information about you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses;
• Date of birth;
• Gender;
• Next of kin and emergency contact information;
• Parent/Guardian contact Information;
• Visa, Nationality, Police Registration and Identification Documents;
• Bank account details;
• Course Information (duration, location and Study Plans);
• Educational information (certificates, right to study);
• Information about your use of IT systems;
• Photographs;

We may also collect, store and use the following “special categories” of more sensitive personal information:

• Information about your race, ethnicity and religious beliefs;
• Information about your health, including medical conditions and health records;
• Information about criminal convictions and offences.

4. Personal Information Collected

We collect personal information about students through the application process, either directly from students or on occasions from Agents or Sponsors. We may sometimes collect additional information from third parties including former educational institutions. We will collect additional personal information in the course of your period of study with us.

ON WHAT BASIS WILL WE USE INFORMATION ABOUT YOU

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• Where we need to enter into the agreement with you to provide the study programme according to BHE UNI Terms and Conditions, and to perform such an agreement once we have entered into it with you.
• Where we need to comply with a legal obligation.
• Where it is necessary for Boost Education Service’s legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Such instances may include the prevention of fraud, error, harassment or child abuse.

5. Which Information We’ll Use

We need all the categories of information in the list above primarily to allow us to perform our contract with you and to enable us to comply with legal obligations. In some cases we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

• Making a decision about your application or appointment;
• Determining the terms on which you study with us;
• Checking you are legally entitled to study;
• Providing you with the necessary study material;
• Administering the agreement;
• Education, training and development requirements;
• Complying with health and safety obligations;
• To prevent fraud;
• To monitor IT systems use and ensure security;
• To conduct data analytics studies to review student progression;
• Equal opportunities monitoring;
• Communications and marketing purposes.

IF YOU FAIL TO PROVIDE PERSONAL INFORMATION

If you fail to provide certain information when requested, we may not be able to perform the agreement we have entered into with you (such as providing a place at an educational establishment), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our students).

CHANGE OF PURPOSE

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

6. Sensitive Personal Info Usage

"Special categories" of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal information in the following circumstances:

• In limited circumstances, with your explicit written consent.
• Where we need to carry out our legal obligations and in line with our Data Protection policy.
• Where it is needed in the public interest, such as for equal opportunities monitoring and in line with our data protection policy.
• Where it is needed to assess your studying capacity on health grounds and to act with a duty of care, subject to appropriate confidentiality safeguards.

7. Info About Criminal Convictions

We will only collect and use information about criminal convictions if it is appropriate given the nature of your place of study and where we are legally able to do so. Where appropriate, we will collect information about criminal convictions as part of the application process or we may be notified of such information directly by you in the course of you studying with us. We will use this information to provide the educational establishment you have applied to with the relevant information requested.

8. Automated Decision-Making

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We do not envisage that any decisions will be taken about you using automated means; however, we will notify you in writing if this position changes.

9. Data Sharing

We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you, or where we have another legitimate interest in doing so. This includes third-party service providers (such as UKVI, NHS, homestay families, landlords, and guardians) and other entities within our group.

10. Third-Party Service Security

All our third-party service providers and partners are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes.

11. Information Outside The EU

We may transfer the personal information we collect about you to countries outside the EU (such as Australia, Canada, New Zealand, Republic of Ireland, USA) in order to perform our contract with you. We have put in place appropriate measures to ensure that your personal information is treated in a way that is consistent with EU and UK data protection laws.

12. Data Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Access to your personal information is limited to those who have a business need to know.

13. Data Retention

We will only retain your personal information for as long as is necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements.

YOUR RIGHTS IN CONNECTION WITH PERSONAL INFORMATION

Under certain circumstances, by law you have the right to request access, request correction, request erasure, object to processing, request restriction, or request the transfer of your personal information. If you wish to exercise any of these rights, please contact the DPO.

14. What We May Need From You

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information. This is a security measure to ensure personal information is not disclosed to unauthorized persons.

RIGHT TO WITHDRAW CONSENT

In circumstances where you have provided your consent, you have the right to withdraw that consent at any time by contacting the DPO.

DATA PROTECTION OFFICER (DPO)

We have appointed an external DPO to oversee compliance with this privacy notice. If you have any questions, please contact the DPO, Aphaia Limited, at info@bheuni.io.