How we process your data is governed by the General Data Protection Regulation and associated data protection legislation.

This information applies to the use of your personal information when you apply to the University for a place on one of our courses, and to how we process your data when you enrol as a student with us.

It explains how Bath Spa University collects, uses and shares your personal data, and your rights in relation to the personal data we hold.

How do we obtain your personal data?

We receive your data:

  • At the point of application when you provide your information, or when you register as a student with us
  • From third party sources (e.g. UCAS, other institutions involved in partner provision, or the Student Loans Company).

When your data is obtained from third parties, we ensure that these third parties have lawful authority to provide us with your personal data.

What data do we hold?

We store your personal information as part of your student record. This information consists of data such as:

  • Your contact information
  • Your prior educational and work experiences and certifications
  • Your immigration information (passport, visas, English language)
  • Your immigration history, financial information and any visa information
  • Information you have provided in your application relating to disabilities
  • Your personal information such as date of birth, age, ethnicity, and nationality.

If you register with us as a student, we'll retain and track information such as:

  • Your academic performance and assessment details
  • Your attendance and engagement with your learning and teaching including our virtual learning environment, lecture capture, resource lists, etc
  • Event registration and attendance 
  • Surveys and feedback - both internal University-run ones and external ones, such as the NSS
  • Any exceptional circumstances or specific support needs
  • (If applicable) details of any grievances, misconduct or breaches of the student code of conduct/ academic regulations
  • Information about your use of our information and communications systems.

Some of your information, such as your educational details, award and your contact details, will be retained after you're no longer a student with us.

Why do we process your personal data, and what is the legal basis for that processing?

When you apply, we'll process your data in order to assess your eligibility to join one of our programmes, including setting up interviews and auditions either in person or via Skype as part of application administration and management.

If you become a student, we process your personal data for the administration of your position as a student with us and to provide appropriate support, and to award your degree or qualification. This includes the use of our services such as accommodation services, student support, lecture capture, the Library, Careers and Employability, Student Union and Graduation and Former Student activities. We also record, monitor and analyse students' attendance and engagement in learning and teaching (sometimes known as learning analytics) and academic progress.

Transfer of data to other countries

Occasionally the University may be required to share your personal data with organisations either based in the European Union (EU), or in countries outside the EU that have equivalent levels of protection. These transfers of data are usually necessary in order to meet contractual responsibilities with you (such as arranging exchange visits or reporting to funding providers) and would only happen once we were assured that the appropriate safeguards were in place.

We will process data in accordance with the GDPR and data protection law and only for the purposes specified to you at the point of data collection, or within a reasonable period of when we receive the data from third parties. More details are available below. 

Data supplied directly by you

Purpose, legal basis and justification

Assessing your eligibility for an offer for one of our courses or programmes

Justification: We have a contractual obligation to you to process data necessary to assess your application. This includes setting up interviews and liaising with you over the course of your application. 

Legal basis: Contractual.

Ensuring that the University is able to adequately meet your needs and you are fit to study

Justification: Making reasonable adjustments for disabilities and providing relevant support to students or applicants with ill health.

Legal basis: Consent, optional data you have provided in your application.

Processing relating to the provision of student support services, both initial and ongoing

Justification: Ensuring the provision of adequate student support access is core to student services.

Legal basis: Contractual.

Processing relating to student engagement data (including attendance)

Justification: Ensuring we are able to reach students in a timely manner to proactively support students learning journey and facilitate the provision of adequate student support access, which is core to student services.

Legal basis: Contractual. There is also a legal duty for the majority of students, to monitor engage with teaching and to act on non-attendance which arises from the requirement to report attendance to UK student loan companies as well as meeting the sponsorship requirements of the UK Visa and Immigration (UKVI).

Enabling the provision of careers advice and support services

Justification: The Careers Service offer is a part of the wider student service you receive from Bath Spa University.

Legal basis: Contractual.

Provision of Library Services, such as user authentication, including loans, recalls, and renewals

Justification: The Library is a core Student service to facilitate your studies and is therefore part of the wider student service.

Legal basis: Contractual. 

For international students requiring tier 4 visa sponsorship, we must assess your eligibility for the visa type

Justification: For international students requiring tier 4 visa sponsorship we must assess your eligibility for the visa type.

Legal basis: Legal obligation

Casework for your immigration requirements if you need to access our immigration services

Justification: From time to time, we'll require elements of personal data in order to advise on specific immigration queries, including visa applications (known as casework). We use this information to enter and perform a contract with you.

Legal basis: Contractual

Using your personal data to create your record to enable provision of essential services

Justification: Providing appropriate IT and other infrastructure facilities, for example a virtual learning environment, as well as the development of new IT systems, provision for you to book rooms on campus, creating your timetable.

Legal basis: Contractual

Assessment of academic progress and performance (for Tier 4 students, attendance is monitored and tracked across your course and retained by the Compliance team)

Justification: Tracking this information is necessary to enable your progress on your course, and ensure we're able to provide the relevant support to you. We're obliged under the Home Office rules to record your attendance data as we're sponsoring your visa. 

Legal basis: Contractual necessity and legal obligation.

Administration of complaints, grievances and appeals

Justification: This processing is undertaken to investigate and address you appeals and complaints and is our contractual obligation to you. 

Legal basis: Contractual.

Regulating the University's community (including dealing with misconduct under our procedures for academic and other misconduct)

Justification: Data processed in administration for these actions is necessary for your well-being, progress and performance on your course, and safeguarding you, your peers and the University. 

Legal basis: Contract and legitimate interest.

Communicating with you via email and online chat forums, and use of online forms to process your requests

Justification: We contact you when it's necessary for the provision of your studies here or your application to study here, and to update University news, services, actions you may need to take for registration, and essential steps for your course. Communication from you is retained to follow up enquiries, help returning guests, develop FAQs, ensure quality control, and improve user experience. 

Legal basis: Contractual necessity.

Production of student identification cards, and sharing the information with third parties as required to assist with card production and the inclusion of photographic images on the University’s computerised student record systems

Justification: Your student card is necessary to enable your use of University facilities such as the Library, printing and access to some buildings. 

Legal basis: Contractual.

The operation of a lecture capture facility relating to the recording of educational activities e.g. lectures, by the University

Justification: Lecture capture is used to enhance your virtual learning environment and enable you access to the course material necessary for your modules. Ina ddition, recording of assessments and presentations are sometimes necessary to ensure quality and standards. You will always be notified in these instances and your rights as a data subject are unaffected (see the privacy home page) more information on lecture capture at Bath Spa University is available via the Minervaq Capture Policy (available iunder Academic and Student in our Policy Page) and a dedicated page has been set up to provide detailed guidance to staff and students using this provision.   

Legal basis: Contractual, legitimate interests

Data shared with third parties

Who we share your data with, what we share, and why

Local authorities

Council Tax exemption

What: Your name, student number, address, details of your study status and course dates

Purpose and legal obligation: We only share this information if you contracted us to do so as part of your registration for the purpose of assessing for exemption of Council Tax.

 

Electoral Registration

What: Your name, nationality, address of halls of residence and email address

Purpose and legal obligation: Information for students residing in student halls of residence managed by Bath Spa University will be shared with the Electoral Registration Officer for Bath & North East Somerset Council. The Electoral Registration Officer is entitled by law to collect this information to maintain an accurate and complete register of electors.

Third party government bodies, such as the Higher Education Statistics Agency, the National Student Survey, the Post Graduate Student Survey, the Office for Students and the teaching Excellence Framework.

What: Your personal data, course details and education history, along with any other information necessary to comply with the reporting requirements. This may include Special Category Data (see below).

Purpose and legal basis: Legal Obligation: Compliance with institutional returns required for third party government bodies. Some of this data will only be shared if you consent.

HESA student collection notice (.pdf).

Student Loans Company, Private Loan Providers and international equivalent (such American Federal Loans) 

What: Confirmation of your student status and attendance.

Purpose and legal basis: Contractual necessity – these organisation require this information about you in order for their administration of your funding, awards and scholarships.

University league table compilers, for example The Guardian, Financial Times and organisations compiling graduate destination data

What: Contact details, employment details or further study data.

Purpose and legal basis: Legitimate Interest of the University to ensure graduate attributes are met, to feed into strategy, for well-being of Alumni and Widening Participation targets, and publicity.

Bath Spa University Students' Union

What: Contact details and student status.

Purpose and legal basis: Following your consent given at registration, for the purposes of contact and promotion of events and activities. 

Affiliated healthcare centres

What: Your contact information, and medical information you provide.

Purpose and legal basis: We only share this if you contracted us to do so as part of your registration for the purpose of registration with the Doctors' surgery. We do not retain this data once shared.

Law Enforcement Agencies or other regulatory bodies

What: Information pertinent to request, such as contact information.

Purpose and legal basis: This data is shared only in accordance with an investigation or disclosure of a potential crime where we are compelled to do so under legal obligation or for the Public Interest.

External examiners

What: Your coursework, exams or other assessment details.

Purpose and legal basis: Processed for the purposes of moderation of assessments as part of our contractual obligation for the provision of your assessments.

The UK Home Office and other government and regulatory bodies

What: Your visa status, any changes to your circumstances or course details. 

Purpose and legal basis: Legal obligation. This is part of the University’s reporting obligations from the UK Home Office if we are sponsoring your visa.  

Partner institutions

What: Applicant information, information in your student records. 

Purpose and legal basis: Under the contractual agreement you have entered into for the delivery of a course or programme e.g. affiliated colleges and exchange institutions.

Professional bodies

What: Entry qualifications, contact information, DBS and educational background information where applicable, details of your course and dates of registration and your assessments. 

Purpose and legal basis: Processed under our contractual obligation to you where registration is a requirement of your studies e.g. the National College for Teaching and Leadership (NCTL).

Next of kin and/or the emergency services

What: Your medical condition, necessary information relating to your circumstances. 

Purpose and legal basis: Vital interests; only processed where there is an emergency situation e.g. illness, significant concerns for your wellbeing, serious injury, or bereavement.

Accommodation and housing providers

What: Contact details, course details. 

Purpose and legal basis: Necessary for the allocation of housing or provision of accommodation options to students as part of meeting contractual obligation where you request our assistance.

Data Processors contracted to process data on behalf of the University, in line with any of the purposes for which the University is permitted to process the data

What: Data necessary for purposes – for example the Careerhub services which requires you register with CV details and job sector preferences. 

Purpose and legal basis: Third parties who are contracted to process personal data on our behalf such as software providers for the administration of virtual services such as Careerhub and certain Library provisions.

Data Processers who facilitate the sharing of Library data between universities

What: Student or staff details relating to enrolment/ employee status. 

Purpose and legal basis: To enable to the use of our Library services by other students (and vice versa).

 

Data we receive from third parties

Types of data, sources, legal basis and justification

Your personal contact details, education history and academic qualifications, portfolio, and English Language Certificates (if applicable)

Source: UCAS or equivalent. 

Legal basis and justification: Contract or necessary pre-contract steps. We require these details from you via UCAS to facilitate your application to the University.

Information relating to criminal convictions

Source: Disclosure and Barring Service.

Legal basis and justification: Necessary for the provision of teaching courses and is part of our compliance with safeguarding.

Financial information, and Student Loans reference number and student details

Source: Student Loans Company.

Legal basis and justification: Contractual. To confirm your funding provision and flag your record for resulting necessary reporting obligations.

Medical, accessibility related, and similar information; occupational health medical clearing

Source: Another institution/ secondary schools.

Legal basis and justification: Information regarding "Fitness to Train to Teach" assessments as part of our safeguarding compliance duties. We only obtain this information from third parties if you give us consent to do so. Information relating to exceptional circumstances or necessary support provision.

English language level

Source: Verification services such as IELTS verification.

Legal basis and justification: We are required to verify this data as part of our record keeping legal obligation with UK Home Office rules. 

Immigration details

Source: Home Office, UKVI, Foreign and Commonwealth.

Legal basis and justification: We're required to verify this data as part of our record keeping legal obligation with UK Home Office rules.

Complaints associated with your record

Source: Office of the Independent Adjudicator.

Legal basis and justification: This is processed under our contractual obligation to you to respond to any grievances you may have raised.

Details of your performance in other educational institutions or in relevant jobs

Source: Referees you have listed in your applications.

Legal basis and justification: Contractual obligation. This forms our assessment of your eligibility for our courses.