Student Data Privacy Statement

This Privacy Statement sets out the basis on which we collect and process personal data about you including our practices regarding the collection, use, storage and disclosure of personal data that we collect from you and/or hold about you, and your rights in relation to that data.

Introduction

University of Plymouth Students’ Union is committed to protecting and respecting your privacy.

We understand that your personal data is entrusted to us and appreciates the importance of protecting and respecting your privacy. To this end we comply fully with the data protection law in force in the UK (“Data Protection Laws”).

This Privacy Statement sets out the basis on which we collect and process personal data about you including our practices regarding the collection, use, storage and disclosure of personal data that we collect from you and/or hold about you, and your rights in relation to that data.

Please read the following carefully to understand how we process your personal data. By providing your personal data to us or by using our services, website or other online or digital platform(s) you are accepting or consenting to the practices as described or referred to in this Privacy Statement.

For the purpose of Data Protection Laws, the data controller is University of Plymouth Students’ Union, with registered address at: University of Plymouth, Drake Circus, Plymouth, Devon, PL4 8AA, a Registered charity number 1172830, a company limited by guarantee in England and Wales number 10676070. UPSU is registered with the Information Commissioners Office, under the registration number: Z1253305

When we refer to ‘UPSU’, ’The SU’, we’, ‘us’ and ‘our’, we mean University of Plymouth Students’ Union.

 

What personal data we may collect on you.

When we refer to personal data in this policy, we mean information that can or has the potential to identify you as an individual. The type and quantity of information we collect and how we use it depends on why you are providing it.

If you are one of our members the University with your consent, provide us with a set of key non-sensitive information you provided at enrolment. When you use our services or participate in one of our activities, we will use this information to provide the best possible standards of administration and communication.

The information provided by the University is:

• Membership
  • Student name
  • Card / student number
  • UOP email address
  • Home address
  • Nationality
  • Gender
  • Age
  • Student type (Full-time, part-time)
  • Study Location
  • Year of study
  • Course name
  • Department
  • Faculty
  • Mode of Study

Further information can be found in the Data Sharing Agreement

In addition when you attend an event, join a student club or society, use our sports centre, advice service, or use one of our other services we may ask for additional information such as:

• Your date of birth to ensure compliance with age-related laws
• Your bank details to facilitate payments
• Information relating to your health if you are taking part in a high risk activity
• Any disabilities so that we can provide assistance where needed
• Next of kin and contact information

 

How we collect personal data

When you enrol at University become a MEMBER
Each year that you enroll on a University of Plymouth accredited course you have the option to opt in to sharing your data with us. The University of Plymouth shares a live feed of members data with us which includes information about you and your course. When the University gives us this data we become responsible for it and will use this as our core central record of your membership. Details of what is shared can be found in our Data Sharing Agreement

When you give it to us DIRECTLY
You may give us your information in order to engage in a student activities, for one of our events, undertake research activities, use our advice service, make a complaint, use our sports center, purchase our products or communicate with us. When you give us this information we take responsibility for looking after it and we may cross reference this data against our register of members.

When you give it to us INDIRECTLY
Your information may be shared with us by independent organisations – University of Plymouth, National Union of Students. These independent third parties will only do so when you have indicated that you have given consent to share this data with us. You should check their Privacy Policy when you provide your information to understand fully how they will process your data.

When you give permission to OTHER ORGANISATIONS to share
We may use information you provide to us with information available from external sources in order to gain a better understanding of our members to improve our communication methods, products and services. The information we get from other organisations may depend on your privacy settings or the responses you give, so you should regularly check them.

Information available PUBLICLY
This may include information found in places such as Companies House and information that has been published in articles/ newspapers. We may also use information found on social media, specifically Facebook, Twitter, Instagram, YouTube

When you access our venue, CCTV
Our premises are surveyed by CCTV for the purposes of security. Images and videos will be retained for 30 days.

When we collect it as you use our WEBSITES
Like most websites, we use “cookies” to help us make our site – and the way you use it – better. Cookies mean that a website will remember you. They’re small text files that sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier – for example by automatically filling your name and address in text fields. There are more details in our Cookies Statement

 

How we use your personal data

We will mainly use your data to:

• Provide you with the services, products or information you asked for
• Administer your membership(s)
• Keep a record of your relationship with us
• Ensure we know how you prefer to be contacted
• Understand how we can improve our services, products or information

 

How we keep your data safe and who has access

Personal data collected and processed by us may be shared with Students’ Union employees and student roles and under controlled conditions the following groups where necessary:

• Contractors
• Advisors
• Agents
• Service provider partners

When we allow access to your information, we will always have complete control of what they see, what they are allowed to do with it and how long they can see it. We do not sell or share your personal information for other organisations to use.

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, student roles and contractors.

We may need to legally disclose your details if required to the police, regulatory bodies or legal advisors.

We will only ever share your data in other circumstances if we have your explicit and informed consent.

 

Marketing & Communications Preferences

Membership Communications

As a member we believe you have a legitimate interest in hearing from us about the products and services we offer, what we’re doing to represent you and opportunities that might be of interest to you. As a part of the Data Sharing Agreement we will use your email as a platform of communication to keep you informed. You may opt-out of these communications at any stage by clicking the unsubscribe link contained within the email.

Direct Marketing

As a charity we need to fundraise to provide the services we offer to University of Plymouth students. We send marketing material to our members where you have told us that we can through a signup email form on upsu.com. We do not share personal details to third parties for the purposes of marketing. 

Keeping your information up to date

We mostly use the record of members provided by the University of Plymouth to maintain accurate data about you as described above. We really appreciate it if you let us know if your contact details change, keep your information up to date in the Student Portal. How to change your details

 

Understanding the detail of our data security measures

When we process your data we will have already carefully assessed the lawful justification for doing so, the parameters in which the data is processed, the length of time the data is held for, the secure storage of your data and undertaken impact assessments to ensure your rights are delivered.

The Students’ Union operates a Data Protection and Information Security Policy which is supported by a practical handbook for our employees and student roles. All employees and student roles handling data are required to undertake general data protection training and third parties handling data are required to provide a contract which meets the requirements of the Information Commissioner's Office.

UPSU does not store any sensitive card data on our systems following online transactions. UPSU utilises payment processor SAGE MSL and ecommerce experts MSL

 

Opt out of membership data sharing

If you want to opt-out of all membership communications and data processing you will be required to opt out of sharing your data with the Students’ Union, this will limit your access to activities and services. You can do this by changing your data sharing preferences in the student portal here

You have a right to ask us to stop processing your personal data, and if it’s not necessary for the purpose you provided it to us for (e.g. processing your membership or registering you for an event) we will do so. Contact us on dataprotection@upsu.com if you have any concerns.

If you have any questions please send these to dataprotection@upsu.com, and for further information see the Information Commissioner’s guidance here

 

Right of access

Right to the data we hold on you

You have the right to ask for a copy of the information we hold about you, which is called a ‘Subject Access Request’. You can write to us at any time to obtain details of the personal information. We will not accept any requests for information about other people. Please complete the Subject Access Request form and send it back to the Data Protection Officer.

Right to rectification

You are are entitled to have personal data rectified if it is inaccurate or incomplete. If you feel the data we hold on you is inaccurate and you would like to change it please download and complete the Data Rectification Form and send it back to the Data Protection Officer.

Right to erasure

The right to erasure is also known as ‘the right to be forgotten’. The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing. Please download and complete the Data Erasure Form and send it back to the Data Protection Officer.

Right to restrict processing

You have the right to restrict or suppress processing of personal data. When processing is restricted, you are permitted to store the personal data, but not further process it. An example being members opting out of receiving email communications. Please download and complete the Data Restriction and Objection Request Form and send it back to the Data Protection Officer.

 

Contact

If you have any questions, comments or suggestions, please let us know by contacting the Data Protection Officer on dataprotection@upsu.com

 

UPSU Data Protection and Information Security Policy

We are committed to the protection of the personal data of students, employees, suppliers and other individuals whom we might hold information about. Download policy

Changes to this statement: We may change this Privacy Statement from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on our Website or by contacting you directly.