Privacy Notice

Processing of BU staff, student, affiliate staff and public personal data in relation to University parking services

1.This privacy notice explains how your personal data will be collected and processed in connection with your application for a University parking permit (“Permit”) and your use of University car parks, as provided for in the BU Terms and Conditions of Parking.

2.The University is the data controller of the information it collects and processes in connection with the BU Terms and Conditions of Parking. This means that it has the core legal responsibility to safeguard the information and ensure it is processed in accordance with data protection laws. This is set out in the EU retained version of the General Data Protection Regulation (EU 2016/679) and the Data Protection Act 2018. In particular the University will:

2.1 Take steps to ensure that the data it processes is accurate and up to date: but this is subject to your responsibilities, as set out in the BU Terms and Conditions of Parking, to notify the University of any changes to your information;

2.2 Only process your data for the specific purposes set out below, and only share with third parties as provided for below; and

2.3 Keep your data secure.

How and why we process your data:

3. For the purposes set out below we collect and hold information provided by you (or your employer, where appropriate) in your permit application and information already held within our relevant record systems. Further information about you may then be generated through the processing of your permit application. This information is held by us in dedicated parking permit systems. These are accessible only to a limited number of authorised staff who need access in order to manage parking provision and the permit application process. For University staff and students some information is also processed by the relevant BU departments as described below. Where the application for your permit will be made by your employer on your behalf, we will ask your employer to provide evidence that you have given consent for them to make the application on your behalf, that you understand the terms on which a permit will be issued and held and that you consent to any processing of information under 3.4 below. For public gym members we will need to verify your membership with SportBU.

We process your data for the following purposes:

3.1 To manage University parking provision appropriately, including care and maintenance of the parking areas and ensuring health, safety and security within car parks: for these purposes we collect and hold information about your vehicle and may contact you about any problems involving your vehicle. This processing is necessary for the performance of a contract you enter into (for provision of parking/use of a Permit) and/or is necessary for the legitimate interest of managing car parking provision and protecting the interests of all car park users;

3.2 To administer the system of parking Permits: this includes dealing with permit applications and associated appeals, issuing permits, administering payments, verifying information provided in permit applications and taking any disciplinary action which relates to provision of inaccurate information. For these purposes we will process the personal information within your permit application. This processing is necessary for the performance of a contract you enter into (for provision and use of a Permit) and/or is necessary for the legitimate interest of managing car parking provision and enforcing the conditions on which the Permit is issued;

3.3 If you or your employer are applying for a Permit under an exemption (see the Parking Policy), the University will need to process information about your health/relevant medical conditions or disabilities and/or about members of your family as follows in order to determine whether an exemption applies. Where your employer is not the University, your employer will review the supporting information and confirm to us whether the exemption applies. Your employer will not share the supporting evidence with the University.

3.4 When you first apply for a permit under the Parking Policy (staff or students with children aged 12 or under or blue badge holders), you will be asked to supply a copy of your child’s full birth certificate or a copy of your blue badge (as appropriate). For University staff and students, this documentation will be reviewed by a member of the Parking Services team and then deleted. Following deletion we will retain within the BU parking permit system:

3.4.1.1 confirmation that documentation has been seen;

3.4.1.2 the expiry date (when youngest child reaches 13) for which birth certificates have been supplied; and

3.4.1.3 the expiry date of any blue badge.

3.4.2 When you apply for a permit pursuant to the Parking Policy on the grounds of a medical condition or carer responsibilities, for University staff and students your application will be referred to the appropriate department for review.

3.4.3 For students this will be the BU Additional Learning Support department (ALS) will contact you to confirm the basis of your application and may review information about you already held within the University and/or ask you to provide new supporting evidence. Any evidence reviewed for this purpose will be seen only by ALS, who will notify the Parking Services team as to whether you are within an exemption so that a permit can be issued but will not share any other information about your circumstances.

3.4.4 For University staff, the Occupational Health Department will contact you to confirm the basis of your application and may review information about you already held within the University and/or ask you to provide new supporting evidence. Any evidence reviewed for this purpose will be seen only by the Occupational Health Department, who will notify the Parking Services team as to whether you are within an exemption so that a permit can be issued but will not share any other information about your circumstances.

3.4.5 This information is retained to verify the basis on which a permit has been issued and for the purposes of any disciplinary action which relates to provision of information in support of a permit application. In addition, retaining children’s information and blue badge expiry dates will enable us to process some future permit applications without asking for supporting documentation.

3.4.6 This processing of supporting evidence is carried out on the basis of your consent. You will be asked to give your consent when you are contacted about providing supporting information as described above. Your consent can be withdrawn at any time during our processing of the relevant information.

3.4.7 Where your employer is not the University, your employer will confirm with you the basis of your application and may review information about you already held by them and/or ask you to provide new supporting evidence. Your employer will be able to provide information about this evidence is processed, including the length of time for which it is retained.

4 Processing of personal data for the purposes of parking enforcement

4.1 Parking Charge Notices (PCNs) will usually be issued by a contractor or sub – contractor of the University, as described in the Parking Policy. Currently parking enforcement services are provided by Hozah Parking Limited using their enforcement company UK Parking Administration Ltd which is contracted to provide the University with parking management and enforcement services.

4.2 Automatic Number-Plate Recognition (ANPR) systems are used in some University car parks or parking areas for the purposes of enforcement. On site signage will indicate where such systems are being used.

4.3 Permit holders (both annual and daily use) are required to complete the BU permit application process. Once completed the BU system shares only the applicants email address with Hozah Parking Limited for the purpose of their system emailing the applicant to verify identity and enable access to Hozah’s system. Once on the Hozah system the applicant is required to enter their vehicle registration number(s) and may be required make payment depending on the permit type. No other personal details are shared with Hozah Parking Limited. Pay and display users must have paid using the Hozah payment link or machine provided and entered their vehicle registration number(s) directly.

4.4 If as a contractor or affiliate your employer requests your vehicle registration number this may be shared by BU with the car park management company to enable you to park in BU controlled car parks. No other information about you will be held by BU.

4.5 If personal data is required to enforce PCNs, this is obtained by UK Parking Administration Ltd itself from the DVLA. If action is required to enforce PCNs, i.e. where PCNs are not paid within the fixed period, UK Parking Administration Ltd will obtain personal data required to enforce PCNs from the DVLA under national arrangements for such purposes. UK Parking Administration Ltd will be a data controller of such data, and further information about UK Parking Administration Ltd processing of your personal data for these purposes will be provided by UK Parking Administration Ltd, for example in signs displayed in the car parks.

4.6 The University may disclose information to Hozah Parking Limited (or any other contractor/sub-contractor with responsibility for parking enforcement) where this is necessary for the purposes of appropriate enforcement action or legal proceedings. Such disclosures would be made on the basis that they are necessary for a substantial public interest and/or for the legitimate interest of enforcing parking conditions.

5 Retention and your rights as a data subject

5.1 We will retain your personal data only for as long as necessary for administration and audit purposes, and for the purposes of any disciplinary or legal proceedings relating to your Permit application or your use of University car parks. If a permit has not been renewed after 3 years all data is deleted. Whilst a permit is active we only retain basic information regarding the vehicle registration and your contact details. Any sensitive information you may provide to the parking permit team is destroyed as soon as it is processed for the purposes it was collected.

5.2 Under the data protection legislation you have the following rights:

5.2.1 to ask for information about how we process your data and to see the data being processed [“subject access request”];

5.2.2 to ask for rectification/correction of any inaccurate personal data being processed by a data controller;

5.2.3 in certain circumstances, the right to ask for processing of your personal data to be restricted or stopped;

5.2.4 to request erasure of your data from our systems and files;

5.2.5 to object to our processing of your data;

5.2.6 to data portability: where we are processing data that you have provided to us, on the basis of consent or as necessary for the performance of a contract between us, you have the right to ask us to provide your data in an appropriate format to you or to another controller.

5.3 Most of these rights are subject to some exceptions or exemptions, depending on the purposes for which data is being processed. If you wish to exercise any of these rights, you should contact our Data Protection office on dpo@bournemouth.ac.uk.

5.4 If you have any questions or concerns about the data processing described above, again please contact our Data Protection office on dpo@bournemouth.ac.uk. We will always aim to respond clearly and fully to any concerns you have about our processing and requests to exercise the rights set out above. However, as a data subject if you have concerns about our data processing or consider that we have failed to comply with the data protection legislation then you have the right to lodge a complaint with the data protection regulator, the Information Commissioner: