Subject Areas Course Search

Data, Privacy and Cookies

What is a cookie?

Cookies are text files containing small amounts of information which are downloaded to your personal computer, mobile or other device when you visit a website. When you return to the website it uses this cookie to ‘remember’ some of the things you did on the website last time, for example if you’ve previously ordered a prospectus from us we won’t prompt you to order one again (assuming that you’re using the same computer and you haven’t deleted the cookie).

As you browse, your visit is automatically logged with information such as the browser and operating system you use, and the time of your visit. This data is collated and used to improve the service we offer but remains anonymous. Cookies are used in places on this site to store your preferences and to customise the content that is displayed based on this kind of information.

Cookies do lots of different jobs and generally improve the user experience. We don’t collect any personal information like your name, date of birth, email address or address.

Most web browsers allow you to control most cookies through browser settings. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit

This website uses the following cookies:

Cookies Purpose More information
Google Analytics

_utmz *

Collects information about how visitors use our site.

We use this information to compile reports that to help us improve the site. The cookies collect information in an anonymous form, including

  • the number of visitors to the site,
  • where they’ve come from
  • what pages they’ve visited.
  • how long they’ve stayed on the site
Google Analytics Privacy Policy

You can choose to opt out of Google Analytics


uit *

Features for sharing via social media (Facebook, Twitter etc). AddThis tracks visitors who use any of their features. AddThis Privacy and Data Practices 

Data Collection Opt-Out

VISITOR_INFO1_LIVE  Many of the videos on this site are hosted on our official YouTube channel.

Most videos have been embedded using Facebook’s privacy-enhanced mode which means YouTube can’t set a cookie unless a user clicks on the video to begin playback.

YouTube’s embedding videos information page.
Facebook Like Box 

datr *

Allows visitors to Like/Send on Facebook, shows our recent activity on Facebook. Facebook Privacy Policy 

* These cookies are provided by a third party who could change their cookies in future outside of our control. We will review this policy regularly for any such changes.

Your information – GDPR


Whether you are a student, member of staff or an organisation your privacy is important to us. Our privacy notice(s) aim to advise you on the way we look after your data at various stages, including your rights to access this data.

There are 4 stages to the student journey:

Enquirer Applicant Current Alumni


Each privacy notice should explain why we are asking you for particular data, how we will use that and how long we will keep it for. Our privacy notices will also advise you how to access your data, make changes and keep informed.

We are currently developing the Privacy Notices for all stages of staff and student journeys.

Who we are

Buxton & Leek College is part of the Univeristy of Derby. The University of Derby uses your personal data to provide you with University services, to undertake its responsibilities and to monitor its own performance.  The University is registered with the Information Commissioners Office (ICO) with the registration number Z859984X.

Our Data Protection Officer can be contacted at: Corporate Information Governance & Assurance, Legal, Governance & Assurance Services, University of Derby, Kedleston Road, Derby, DE22 1GB or email

Why we process your data

As a data controller the University of Derby can process your personal data under the General Data Protection Regulation (GDPR) 2018, Data Protection Act 2018 and subsequent/relevant enactments.

We process your data for the following purposes:

Provision of University services including the administration of your studies. This includes welfare services, such as support from the Student Union. Your data is used without your consent if the law requires it for statutory services.

All financial transactions to and from us, including payments, grants and benefits. You could lose out financially if you do not provide us with your data.

Where you have agreed for the purpose of consulting, informing and gauging your opinion about our products and services. This is consent-based. There are no consequences to you if you do not provide your data.

To ensure we meet our statutory obligations, including those related to diversity and equal opportunity. Your data is used as the law requires it for statutory services.

To carry out legal duties, providing information to others (Local Councils, Department for Education etc).

To provide other opportunities within the University’s business including developing and maintaining our alumni programme.

To conduct equal opportunities monitoring and eqaulity impact assessments using your ‘Protected Characteristic Data’.

Our legal basis for using your information

The University relies on several different legal basis depending on the processing being performed:

(Article 6(1)(a)), Consent – on specific occasions the University will only process certain data if you consent e.g. on registration you only need to provide certain “special categories” of data if you agree that.

(Article 6 (1)(b)), Necessary for the performance of your student contract – on many ocassions the University will process your data to enable it to meet its commitments to you e.g. those relating to education and assessment.

(Article 6 (1)(c)), Necessary to comply with a legal obligation – the University may have legal obligations to provide your personal data to others e.g. the Office for Students (OFS), HESA.

(Article 6 (1)(d)), For the purpose of protecting the vital interest of yourself or another – sometimes in extreme circumstances the University will have to release information to protect your interests or the interests of others e.g. in medical emergencies.

(Article 6 (1)(e)), Processing necessary for the performanace of a task carried in the public interest – the University is an educational and research establishment and in particular its educational and research activity is conducted in a public interest (including your interest and the interest of others).

(Article 6 (1)(f)), Processing is necessary for the purposes of legitimate interest of the University or a third party subject to overridden interests of the data subject – the University (and sometimes third parties) has a broad legitimate interest in activities that connect to the activities and education of students.  Subject to those interests not being overridden by the interests of fundamental rights and freedom of students, it will pursue those interests.  A good example of this legitimate interest would be its Alumni activities.

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which it is collected.

How we collect your data

Direct Collection

We collect data to operate effectively and provide you the best experience at this University. You may provide some of this data directly to us, such as when you apply for a College/University.

In-direct Collection

We also obtain data from third parties, for example schools and local authorities.

Who we share your data with

The University may share your data with the following organisations:

  • Sponsors or funding organisations (including the Education Funding Authority, Skill Funding Agency, Student Loans Company) where a contract exists in accordance with the terms of the contract (which usually relate to government funding for your courses and/or attendance and progress reports).
  • Other public authorities and public partnerships (e.g. councils, schools, NHS providers, Police, Government Departments etc) if the law requires us to do so.
  • Voluntary and non-commercial sector organisations that help us deliver services.
  • Businesses that we contract with to help us deliver services.
  • Work Placement sites or other educational partners involved in joint course provision where this is necessary for the purposes of your study.

How long we keep your data for

The University keeps personal data for as long as it is needed for the purpose for which it was originally collected.  Details of the University’s retention and disposal schedule can be found here.

Your rights

You have the following rights:

  • To ask for a copy of the data we hold on you. This is known as the right of subject access.  You can find out more about this right on the University’s Subject Access Requests webpage.
  • Rights to rectification and erasure. You have the right to correct any inaccurate personal data held by the University.  Once information the University has collected is no longer necessary for the purpose for which it was collected and processed, you sometimes have the right to have your data erased.
  • To ask us to stop processing your data temporarily if you think it is wrong until we work out what is correct
  • To ask us to let you take a copy of your data in a portable format to another organisation

You can put in a request for any of these here.

If you only gave us your data with consent, you have the right to withdraw that consent at any time. Please get in touch with us.

Making a complaint

If you are unsatisfied with the way in which we process your personal data, we ask that you let us know so that we can try and put things right.  You can complain to the University here.  If we are not able to resolve issues to your satisfaction, you can refer the matter to the Information Commissioner’s Office (ICO).  The ICO can be contacted at:


Information Commissioner’s Office

Wycliffe House

Water Lane





Telephone: 0303 123 1113