Student Data Privacy Statement
Last revised: 22 May 2018
The University of York Students’ Union (“YUSU, “we”, “us”, “our”), promises to respect any personal data you share with us, or that is received from other organisations and keep it safe. YUSU aims to be clear when collecting your data and not do anything you wouldn’t reasonably expect.
Developing a better understanding of our members through your personal data allows YUSU to make better decisions, communicate more efficiently and, ultimately, helps YUSU to reach the goal of having a positive impact with every York student.
YUSU collect information in the following ways:
Each year that you enroll on a University of York accredited course you automatically become a member of the University of York Students’ Union. The University of York shares a register of members with YUSU which includes information about you and your course. When the University gives YUSU this data YUSU becomes responsible for it and will use this as a core central record of your membership.
You may give us your information in order to sign up to a student group, for one of our events, undertake research activities, participate in our training sessions, use our advice service, purchase our products or communicate with us. When you give us this information we take responsibility for looking after it and we will cross reference this data against our register of members.
We may combine information you provide to us with information available from external sources in order to gain a better understanding of our members to improve our communication methods, products and services.
The information we get from other organisations may depend on your privacy settings or the responses you give, so you should regularly check them. This information comes from the following sources:
Third party organisations
You may have provided permission for a company or other organisation to share your data with third parties such as the Students’ Union. This could be when you buy a product or service, register for an online competition or sign up with a comparison site.
Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp or Twitter, you might give us permission to access information from those accounts or services.
Information available publicly
This may include information found in places such as Companies House and information that has been published in articles/ newspapers or on websites.
Like most websites, we use “cookies” to help us make our site, and the way you use it, better. Cookies mean that a website will remember you. They’re small text files that sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier, for example by automatically filling your name and address in text fields. There are more details in our Cookies Statement.
In addition, the type of device you’re using to access our website and the settings on that device may provide us with information about your device, including what type of device it is, what specific device you have and what operating system you’re using. Your device manufacturer or operating system provider will have more details about what information your device makes available to us.
To place an order with us online, registration is required. At the point of registration, we request certain information including your name, billing address and email address. This information is required to enable us to process your order and notify you of its progress. Once an order has been placed, we may contact you by email to confirm your order details and again once your order has been accepted and despatched. Should we need to contact you for any reason regarding your order, we will use the email address registered to your account, or the telephone number where provided. We also ask if you will provide us with your Student ID number when you shop in store, this allows us to track the products you purchase, provide better customer service standards and develop the product range we offer to students. In store you are under no obligation to provide us with this information.
The type and quantity of information we collect and how we use it depends on why you are providing it.
If you are one of our members the University, in response to their obligations to you, provide us with a set of key information you provided at enrollment. When you use our services or participate in one of our activities we will use this information to provide the best possible standards of administration and communication. The information provided to the Students’ Union and the data sharing agreement can be accessed here for further information.
In addition when you attend an event, join a student group or use one of our services we may ask for additional information such as:
- Your date of birth to ensure compliance with age-related laws
- Your bank details to facilitate payments
- Information relating to your health if you are taking part in a high risk activity
- Any disabilities so that we can provide assistance where needed
We will mainly use your data to:
- Provide you with the services, products or information you asked for
- Administer your membership
- Keep a record of your relationship with us
- Ensure we know how you prefer to be contacted
- Understand how we can improve our services, products or information
- Register your membership with national governing bodies where relevant.
We use profiling and screening techniques to ensure communications are relevant and timely, and to provide an improved experience for our members. Profiling also allows us to target our resources effectively, which members consistently tell us is a key priority for them. We do this because it allows us to understand the background of the people who study at the University and helps us to deliver appropriate services and information to members who need it.
When building a profile we may analyse geographic, demographic and other information relating to you in order to better understand your interests and preferences in order to contact you with the most relevant communications. Your data would only ever be analysed or profiled through encrypted and protected data processes, which only ever identifies broad statistics. In doing this, we may use additional information from third party sources when it is available.
Personal data collected and processed by us may be shared with Students’ Union employees and volunteers and under strictly controlled conditions and the following groups where necessary:
- Service provider partners
When we allow access to your information, we will always have complete control of what they see, what they are allowed to do with it and how long they can see it. We do not sell or share your personal information for other organisations to us.
We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors.
Some of our suppliers may run their operations outside the European Economic Area (EEA). Although they may not be subject to the same data protection laws as companies based in the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law. By submitting your personal information to us you agree to this transfer, storing or processing at a location outside the EEA.
We may need to disclose your details if required to the police, regulatory bodies or legal advisors.
We will only ever share your data in other circumstances if we have your explicit and informed consent.
As a member we believe you have a legitimate interest in hearing from us about the products and services we offer, what we’re doing to represent you and opportunities that might be of interest to you. Occasionally, we may include information from partner organisations, our own social enterprises or organisations who support us in these communications.
As a charity we need to fundraise to provide the services we offer to University of York students we do this through our trading company (YUSU Commercial Services Ltd.) which is a social enterprise with a number of bar and catering venues which also supports student events. We may send marketing material on behalf of our trading company to our members where you have told us that we can. We do not sell or share personal details to third parties for the purposes of marketing.
We make it easy for you to tell us how you want us to communicate, in a way that suits you. Our forms have clear marketing preference questions and we include information on how to opt out when we send you marketing. If you don’t want to hear from us, that’s fine. Just let us know when you provide your data or contact us on 01904 323724 or email@example.com.
We mostly use the record of members provided by the University of York to maintain accurate data about you as described above. We really appreciate it if you let us know if your contact details change.
When we process your data we will have already carefully assessed the lawful justification for doing so, the parameters in which the data is processed, the length of time the data is held for, the secure storage of your data and undertaken impact assessments to ensure your rights are delivered. An overview of the types of records held and the period for which they are retained can be accessed here.
The Students’ Union operates a Data Protection and Information Security Policy which is supported by a practical handbook for our employees and volunteers. All employees and volunteers handling data are required to undertake general data protection training and third parties handling data are required to provide a contract which meets the requirements of the Information Commissioner's Office.
The Students’ Union does not store any digital sensitive card data on our systems following online transactions. The Union utilises payment processors Braintree, Worldpay, YOYO & Paypoint to handle these matters. Where physical card receipts are required, they are stored securely as part of the financial regulations and in line with the financial procedures of the organisation.
Accessing your data and data portability
You have the right to obtain and reuse your personal data for your own purposes across different providers. If you want to access your information, you must complete the Subject Access Request Form with a description of the information you want to see and the required proof of your identity by post or in person to the University of York Students’ Union, James College, Newton Way, Heslington, York, North, Yorkshire, YO10 5DD. We do not accept these requests by email so we can ensure that we only provide personal data to the right person.
Erasing or correcting your data
You have the right to have your personal data erased when we no longer need it for the purposes for which it is held, or when we are required to do so by law. If there are any discrepancies in the information we provide, please let us know and we will correct them. You must complete the Data Rectification/Erasure Request Form and the required proof of your identity by post or in person to the University of York Students’ Union, James College, Newton Way, Heslington, York, North, Yorkshire, YO10 5DD. We do not accept these requests by email so we can ensure that we only provide personal data to the right person.
Restricting or objecting to the processing of your data
You have a right to ask us to restrict or object to the processing your personal data, and if it’s not necessary for the purpose you provided it to us for (e.g. processing your membership or registering you for an event) we will do so. You must complete the Processing Restriction/Objection Request Form and the required proof of your identity by post or in person to the University of York Students’ Union, James College, Newton Way, Heslington, York, North, Yorkshire, YO10 5DD. We do not accept these requests by email so we can ensure that we only provide personal data to the right person.
Rights in relation to automated decision making and profiling
You have the right for your data to be safeguarded against the risk of potentially damaging decisions being taken without human intervention. Contact us on 01904 323724 or firstname.lastname@example.org if you have any concerns.
We may change this Privacy Statement from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on our Website or by contacting you directly.