Student Data Privacy Statement
Last revised: 16th December 2019
The University of York Students’ Union (“YUSU", “we”, “us”, “our”), promises to respect any personal data you share with us, or that is received from other organisations, and keep it safe. YUSU aims to be clear when collecting your data and not do anything you wouldn’t reasonably expect.
Developing a better understanding of our members through your personal data allows YUSU to make better decisions, communicate more efficiently and, ultimately, helps YUSU to reach the goal of having a positive impact with every York student.
Where we collect information about you from
YUSU collect information in the following ways:
Each year that you enrol on a University of York accredited course you automatically become a member of the University of York Students’ Union. The University of York shares a register of members with YUSU which includes information about you and your course. When the University gives YUSU this data YUSU becomes responsible for it and will use this as a core central record of your membership.
You may give us your information in order to sign up to a student group, for one of our events, undertake research activities, take part in elections, participate in our training sessions, use our advice service, purchase our products or communicate with us. When you give us this information we take responsibility for looking after it and will only use it to provide relevant services to you during your membership.
We will also collect information from the following:
If you join an activity, we may ask you for next of kin details in case of an emergency on any trips you may participate in.
We will also collect your driving licence and potentially your car insurance details If you wish to become an authorised driver and/or drive your own car for YUSU activities.
If you join an Academic Opportunity we will collect information regarding your participation, including your feedback and feedback from relevant University and Union staff members/departments. We may also collect information regarding your levels of interaction, such as numbers of panels that have been attended or numbers of interactions you have had with members of staff relating to the opportunity.
We will collect information related to your nomination should you nominate yourself for an elected position. This may consist of your photo, manifesto and publicity material.
We will also collect information such as your election preferences and demographical data should you cast a vote in an election.
We will record your details and notes from discussion with our advisors. We may also keep documents and evidence that you submit to us to either to allow us to represent you, or to advise you, unless you inform us otherwise.
When you make a purchase online, from our Helpdesk, or at one of our venues we will collect information related to the transactions for our financial records, including items purchased, payment method, contact details for online purchases and product related information.
Once an order has been placed, we may contact you by email to confirm your order details. Should we need to contact you for any reason regarding your order, we will use the email address registered to your account.
If you attend one of our events, we will use your attendance record as a way to record accurate attendance lists, assist with the prevention and detection of crime and enable us to produce demographic reports.
As with activity memberships, we may ask for next of kin details in case of emergency. We may also use your information to facilitate third party events which we are selling tickets for in order to allow them to check you have a verified event ticket.
Your information will be used if you are involved in any incidents involving security or First Aid in order to keep a records of events. Your information will be used if you are involved with our medical team in order to maintain records, and in the case of an emergency we may share with will emergency services.
We often use surveys as a method to gather member opinion and feedback. If you are asked to complete a survey you will be provided with additional details of how we intend on using your survey data.
When you send a communication to the Students’ Union, we will collect this information in order to assist with resolving your query.
We may combine information you provide to us with information available from external sources in order to gain a better understanding of our members to improve our communication methods, products and services.
The information we get from other organisations may depend on your privacy settings or the responses you give, so you should regularly check them. This information comes from the following sources:
Third party organisations
You may have provided permission for a company or other organisation to share your data with third parties such as the Students’ Union. This could be when you buy a product or service, register for an online competition or sign up with a comparison site.
Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp or Twitter, you might give us permission to access information from those accounts or services.
Information available publicly
This may include information found in places such as Companies House and information that has been published in articles/ newspapers or on websites.
Like most websites, we use “cookies” to help us make our site, and the way you use it, better. Cookies mean that a website will remember you. They’re small text files that sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier, for example by automatically filling your name and address in text fields. There are more details in our Cookies Statement.
In addition, the type of device you’re using to access our website and the settings on that device may provide us with information about your device, including what type of device it is, what specific device you have and what operating system you’re using. Your device manufacturer or operating system provider will have more details about what information your device makes available to us.
The type and quantity of information we collect and how we use it depends on why you are providing it. We use your information in order to facilitate your membership, to provide you with relevant opportunities and services and to achieve our charitable objectives. The uses above are indicative and not a full list.
If you are one of our members, the University, in response to their obligations to you, provide us with a set of key information you provided at enrolment. When you use our services or participate in one of our activities we will use this information to provide the best possible standards of administration and communication. The information provided to the Students’ Union by the University and the data sharing agreement can be accessed here for further information.
If you attend an official Students’ Union event we will record your attendance in order to assist with the prevention and detection of crime, production of demographic reports and to enable the marketing of similar events to you, should you have provided consent.
Purchasing goods and services
When purchasing goods and services from the Students’ Union, we will use the information you provide, under our legal obligations, to maintain accurate financial records and to provide you with the purchased goods and services. We may also use anonymised transaction data in order to identify demographics and trends and ensure our services are relevant.
Elections & Student Voice
During our elections, if you choose to nominate yourself as a candidate, your name and manifesto will be published on our website and voting form in order to ensure a fair democratic voting process. If you vote in an election, we will use your information to maintain an accurate voter record and to enable the election calculation. After an election, we may contact you by email informing you of your newly elected representatives. If you are successfully elected as a student representative, we will use your contact details during the term of your appointment to keep you informed of activities relevant to your role.
If you are a student member and become a course rep, we may share your name and contact email address with your department rep to enable the facilitation of the Academic Representation System and allow them to contact you in the event of a query.
If you become an elected representative, we may ask you to upload and use your photograph in order to identify you on our website to your fellow students.
Activities & Societies
If you join an activity, we may share your name with the relevant activity committee in order to provide accurate membership lists which will allow them contact you with informative notices for the duration of your membership. We will also use your information to gather demographical information regarding the participation in our activities.
We use your information in order to facilitate development and purchase requests in order to allocate funds accordingly, as well as to facilitate any events or activity applications you submit to assist in the delivery of your activity.
We also use your information in order to monitor who is traveling when and where as part of the activity you join, in the interests of your personal safety, and we will facilitate the use of emergency contact numbers should they be required in an emergency situation.
When you come to us for advice, we may ask for additional information to help us provide the best possible service, or to enable us to refer you to the most appropriate support service. Data relating to the support you receive will be stored on our secure advice platform. If you use our Advice Centre we may share your contact details and the details of your advice case with other organisations for the purpose of providing you with further guidance and support. Should you wish at any time to access your data, or to request for it to be deleted, please contact our Data Protection Officer – [email protected].
Applications made to YUSU
If you submit an expression of interest or make an application for a student staff role with the organisation or to use any of our services, such as volunteering opportunities, we will use your personal details along with the information you submit in order to contact you and progress your application through the required processes.
You may be invited to take part in various surveys throughout your membership in order for us to improve our services and gather member insight on certain subjects. All survey submissions are anonymous, although we sometimes offer incentives for the completion of surveys. Should you choose to participate in a prize draw, then your Student ID will be used to randomly select a winner and allocate prizes as necessary.
We regularly create demographic reports across our organisation to ensure services provided are relevant to you now and in the future. Reports may be formed from information such as voting records, event attendance and the purchasing of products. If you have provided consent for marketing communications, we may create reports based on your service usage in order to provide you with personalised information and messages.
In the event of an accident or mishap in our venues, or when taking part in an official Students’ Union activity, we will use your personal details, along with information related to the incident, to maintain an accurate record in line with our legal health and safety obligation.
In the case of an emergency or adverse weather, we may use your contact details to communicate important notices to you.
The Students’ Union uses a 3rd party contractor to provide online Helpdesk services (Atlassian). A Data Processing Addendum is in place to ensure compliance with the confines of GDPR and the Data Protection Act 2018. The Privacy details of the 3rd party provider are held under the Privacy and GDPR section here:
File Transfer Software
Additional information we may ask you for
In addition, when you attend an event, join a student group or use one of our services we may ask for additional information such as:
Your date of birth to ensure compliance with age-related laws
Your bank details to facilitate payments
Information relating to your health if you are taking part in a high risk activity
Any disabilities so that we can provide assistance where needed
Information we may share with other organisations
There are times when we made need to, or would like to, share information with other organisations under strictly controlled conditions. These are listed below. We have stated where sharing is a legal requirement, when you can object to sharing and where we need your permission to share:
University of York
The University and University of York Students’ Union may also share personal information about you for the following purposes:
Employability: You would be asked for your specific consent before your information was shared for this purpose.
Health and Safety: The legal obligations of each organisation under Health and Safety legislation would justify the sharing of your information if necessary
Academic Opportunities: Your information such as name and student ID may be shared with the relevant University department to ensure the smooth delivery of the opportunity you are engaged in.
Advice Service: We collect information about you to assist in your advice case. With your consent, we may use your information to refer you to other organisations for additional specialist support.
We may also make a referral for safeguarding purposes, which could be done on the basis of the public interest, or to protect your (or another person’s) vital interests.
Representation: The University and YUSU may share personal information about elected representatives on the basis of their legitimate interests in facilitating the University & YUSU Academic Representation System.
The two organisations may also share information about candidates standing in Student Leader elections, for the purpose of confirming the good standing of candidates, including current enrolment and no outstanding tuition fees.
The Data Sharing Agreement between the University and the YUSU includes a full list of the information shared
British Universities and Colleges Sports (BUCS)
We share your information from filled in Team Sheets with BUCS In order for you to compete in BUCS Competitions
Other Students' Unions
We may share your information from filled in Team Sheets with other universities that compete BUCS in order to facilitate validation of your student status to adhere to BUCS policy
If you take part in any training activities then we will share your information with training providers in order to generate course attendance lists and certification (if applicable).
With your consent, we will share your contact information and, if applicable, work experience with volunteering organisations in order to find you opportunities.
We may share your contact information with them in order to facilitate communication between you and the organisation to enable you to discuss arrangements and participate in their volunteering activities.
Authorised Activity Providers
We may share your personal information with activity providers who facilitate activities such as Duke of Edinburgh in order for them to keep a record your involvement with them and process your overall award if applicable.
We may also share you emergency contact information for them to use in case of emergency.
Card Payment Providers
The Students’ Union does not store any digital sensitive card data on our systems following online transactions.
The Union utilises payment processors Braintree, Worldpay, YOYO & Paypoint to handle these matters. Where physical card receipts are required, they are stored securely as part of the financial regulations and in line with the financial procedures of the organisation.
We use a number of suppliers who process personal information on our behalf. These include suppliers of software services. These act strictly on our instructions and must not use the information for their own purposes.
In exceptional circumstances we may be asked to share your information with police or other investigators if it would prevent or detect crime or safeguard a person’s wellbeing. Each instance will be judged on its own merit and any sharing of information will be done within the law.
When we allow access to your information, we will always have complete control of what they see, what they are allowed to do with it and how long they can see it. We do not sell or share your personal information for other organisations to use.
We will only ever share your data in other circumstances if we have your explicit and informed consent.
Information processed abroad
Some of our suppliers may run their operations outside the European Economic Area (EEA). Although they may not be subject to the same data protection laws as companies based in the UK, we will make every effort to ensure they provide an adequate level of protection in accordance with UK data protection law. By submitting your personal information to us you agree to this transfer, storing or processing at a location outside the EEA.
Keeping your information up to date
We mostly use the record of members provided by the University of York to maintain accurate data about you as described above. We would really appreciate it if you could let us know if your contact details change.
How long we keep your information
We will keep your personal data only as long as necessary for the purpose(s) for which it was collected (unless otherwise advised) and in accordance with the Students’ Union’s records retention schedule.
Data will be kept securely and destroyed when no longer required. The Students’ Union may also decide to archive some data. For more information regarding the retention of your personal data please contact the Data Protection Officer at dataprotection.yusu.org.
If you access additional Students’ Union services these may keep a record of your contact and will provide you with details of how long they keep your information.
Marketing & communications preferences
As a member we believe you have a legitimate interest in hearing from us about the products and services we offer, what we’re doing to represent you and opportunities that might be of interest to you. Occasionally, we may include information from partner organisations, our own social enterprises or organisations who support us in these communications.
As a charity we need to fundraise to provide the services we offer to University of York students; we do this through our trading company (YUSU Commercial Services Ltd.) which is a social enterprise with a number of bar and catering venues which also support student events. We may send marketing material on behalf of our trading company to our members where you have told us that we can. We do not sell or share personal details to third parties for the purposes of marketing.
Controlling what you want to hear about
We make it easy for you to tell us how you want us to communicate, in a way that suits you. Our forms have clear marketing preference questions and we include information on how to opt out when we send you marketing material. If you don’t want to hear from us, that’s fine. Just let us know when you provide your data or contact us on 01904 323724 or [email protected].
Building profiles to make sure communications are relevant to you
We use profiling and screening techniques to ensure communications are relevant and timely, and to provide an improved experience for our members. Profiling also allows us to target our resources effectively, which members consistently tell us is a key priority for them. We do this because it allows us to understand the background of the people who study at the University and helps us to deliver appropriate services and information to members who need it.
When building a profile we may analyse geographic, demographic and other information relating to you in order to better understand your interests and preferences in order to contact you with the most relevant communications. Your data would only ever be analysed or profiled through encrypted and protected data processes, which only ever identifies broad statistics. In doing this, we may use additional information from third party sources when it is available.
Accessing your information and other rights
You have a number of rights relating to your personal information. These include:
You have the right to request a copy of any personal information we hold about you.
If you would like a copy of any of your information, please complete the Subject Access Request Form with a description of the information you want to see and the required proof of your identity and contact the Data Protection Officer on the details below. Your request will be processed within 30 days.
If you have provided information on the basis of your consent or for a contract, then you can request a digital copy, so you can send it to another organisation.
To request a copy please contact the Data Protection Officer on the details below. Your request will be processed within 30 days.
If any of the information we hold about you is incorrect or incomplete, then please let us know.
You have the right to have your information corrected so that we hold accurate records about you.
This is also known as ‘the right to be forgotten’. You can request that your personal information is erased if it is no longer necessary for the Students’ Union to keep it, or you withdraw consent that you have previously provided, or you object and there are no overriding grounds to keep it or if it is unlawful to continue to keep it.
You can request that the use of your personal information is limited to storage only and that we use it for no other purpose.
This applies where you contest the accuracy of the personal information we hold, or our use of the information is unlawful, or we no longer need the information except in relation to legal claims, or you object to the use of your data and we need to verify whether or not our purpose for keeping it overrides the grounds of your objection.
You have a right to ask us to restrict or object to the processing your personal data, and if it’s not necessary for the purpose you provided it to us for (e.g. processing your membership or registering you for an event) we will do so. You must complete the Processing Restriction/Objection Request Form and the required proof of your identity and submit them to the Data Protection Officer on the details below.
Automated Decision Making or Profiling
You have the right for your data to be safeguarded against the risk of potentially damaging decisions being taken without human intervention.
Contact us on 01904 323724 or [email protected] if you have any concerns.
How to object or withdraw consent
If you object to our use of your personal information, then we must stop unless we can demonstrate compelling legitimate grounds for continuing. Please [email protected] to explain your objection.
If you have provided your consent for the use of your personal information, then you can withdraw this consent at any time. Consent can be withdrawn by contacting the Data Protection Officer who will consider your request in accordance with data protection laws.
How to register a complaint
If you feel that we have let you down in relation to your information rights, and you wish to lodge a formal complaint, then please follow the University of York Students’ Union Complaints policy, a copy of which can be found under ‘Organisational Policies’ in the ‘About Us’ section of the yusu.com website.
Complaints should be made to the Date Protection Officer, by email on [email protected] or by post to:
Data Protection Officer
University of York Students’ Union
The Student Centre
You can also make complaints directly to the Information Commissioner’s Office (ICO). The ICO is the independent authority upholding information rights for the UK. Their website is ico.org.uk and their telephone helpline number is 0303 123 1113.
How to contact us
If you have queries about your personal information rights then please contact the Data Protection Officer by email on [email protected] or by post at:
Data Protection Officer
University of York Students’ Union
The Student Centre
Understanding the detail of our data security measures
When we process your data we will have already carefully assessed the lawful justification for doing so, the parameters in which the data is processed, the length of time the data is held for, the secure storage of your data and undertaken impact assessments to ensure your rights are delivered. An overview of the types of records held and the period for which they are retained can be accessed here.
The Students’ Union operates a Data Protection and Information Security Policy which is supported by a practical handbook for our employees and volunteers. All employees and volunteers handling data are required to undertake general data protection training, and third parties handling data are required to provide a contract which meets the requirements of the Information Commissioner's Office.
Changes to this statement
We may change this Privacy Statement from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on our website or by contacting you directly.